From 8bcf6fa5468a5f06225bb20248f31f6f29c6a9ea Mon Sep 17 00:00:00 2001
From: Anand Kumria <akumria@acm.org>
Date: Sun, 24 Nov 2013 16:06:03 +0000
Subject: [PATCH 2/4] Escape the returned placeholder value.

We were not doing this before but this is good hygene anyway.
---
 bp-xprofile/bp-xprofile-template.php |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bp-xprofile/bp-xprofile-template.php b/bp-xprofile/bp-xprofile-template.php
index 99d4a43..b16f608 100644
--- a/bp-xprofile/bp-xprofile-template.php
+++ b/bp-xprofile/bp-xprofile-template.php
@@ -473,7 +473,7 @@ function bp_get_placeholder_text_for_field( $field ) {
 		switch ( $field->type ) {
 			case 'selectbox':
 
-				$html .= '<option value="">' . bp_get_placeholder_text_for_field($field) . '</option>';
+				$html .= '<option value="">' . esc_html( bp_get_placeholder_text_for_field($field) ) . '</option>';
 
 				$original_option_values = '';
 				$original_option_values = maybe_unserialize( BP_XProfile_ProfileData::get_value_byid( $field->id ) );
-- 
1.7.9.5