From 0f3e87ffb195519867eb5b130182580d7749858c Mon Sep 17 00:00:00 2001
From: denisbaranov <dbaranov.work@gmail.com>
Date: Tue, 16 Jul 2019 18:40:07 +0300
Subject: [PATCH] use esc_attr() in templates

---
 templates/account.php                 | 42 +++++++++++++--------------
 templates/gdpr-register.php           |  8 ++---
 templates/login.php                   |  2 +-
 templates/logout.php                  |  6 ++--
 templates/members-grid.php            | 16 +++++-----
 templates/members.php                 |  2 +-
 templates/message.php                 |  2 +-
 templates/password-change.php         |  2 +-
 templates/password-reset.php          |  2 +-
 templates/profile.php                 |  4 +--
 templates/profile/comments-single.php |  4 +--
 templates/profile/comments.php        |  2 +-
 templates/profile/posts-single.php    |  8 ++---
 templates/profile/posts.php           |  2 +-
 templates/register.php                |  2 +-
 templates/searchform.php              |  4 +--
 16 files changed, 54 insertions(+), 54 deletions(-)

diff --git a/templates/account.php b/templates/account.php
index 362367d4..aa58d6c5 100644
--- a/templates/account.php
+++ b/templates/account.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-form">
 	
@@ -26,16 +26,16 @@
 			 */
 			do_action( 'um_account_page_hidden_fields', $args ); ?>
 
-			<div class="um-account-meta radius-<?php echo UM()->options()->get( 'profile_photocorner' ); ?> uimob340-show uimob500-show">
+			<div class="um-account-meta radius-<?php echo esc_attr( UM()->options()->get( 'profile_photocorner' ) ); ?> uimob340-show uimob500-show">
 
 				<div class="um-account-meta-img">
-					<a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a>
+					<a href="<?php echo esc_url( um_user_profile_url() ); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a>
 				</div>
 
 				<div class="um-account-name">
-					<a href="<?php echo um_user_profile_url(); ?>"><?php echo um_user( 'display_name' ); ?></a>
+					<a href="<?php echo esc_url( um_user_profile_url() ); ?>"><?php esc_html_e( um_user( 'display_name' ) ); ?></a>
 					<div class="um-account-profile-link">
-						<a href="<?php echo um_user_profile_url(); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a>
+						<a href="<?php echo esc_url( um_user_profile_url() ); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a>
 					</div>
 				</div>
 
@@ -43,23 +43,23 @@
 			
 			<div class="um-account-side uimob340-hide uimob500-hide">
 
-				<div class="um-account-meta radius-<?php echo UM()->options()->get('profile_photocorner'); ?>">
+				<div class="um-account-meta radius-<?php echo esc_attr( UM()->options()->get('profile_photocorner') ); ?>">
 
-					<div class="um-account-meta-img uimob800-hide"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
+					<div class="um-account-meta-img uimob800-hide"><a href="<?php echo esc_url( um_user_profile_url() ); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
 
 					<?php if ( UM()->mobile()->isMobile() ) { ?>
 
-						<div class="um-account-meta-img-b uimob800-show" title="<?php echo um_user( 'display_name' ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
+						<div class="um-account-meta-img-b uimob800-show" title="<?php echo esc_attr( um_user( 'display_name' ) ); ?>"><a href="<?php echo esc_url( um_user_profile_url() ); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
 
 					<?php } else { ?>
 
-						<div class="um-account-meta-img-b uimob800-show um-tip-w" title="<?php echo um_user( 'display_name' ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
+						<div class="um-account-meta-img-b uimob800-show um-tip-w" title="<?php echo esc_attr( um_user( 'display_name' ) ); ?>"><a href="<?php echo um_user_profile_url(); ?>"><?php echo get_avatar( um_user('ID'), 120 ); ?></a></div>
 
 					<?php } ?>
 
 					<div class="um-account-name uimob800-hide">
-						<a href="<?php echo um_user_profile_url(); ?>"><?php echo um_user( 'display_name', 'html' ); ?></a>
-						<div class="um-account-profile-link"><a href="<?php echo um_user_profile_url(); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a></div>
+						<a href="<?php echo esc_url( um_user_profile_url() ); ?>"><?php esc_html_e( um_user( 'display_name', 'html' ) ); ?></a>
+						<div class="um-account-profile-link"><a href="<?php echo esc_url( um_user_profile_url() ); ?>" class="um-link"><?php _e( 'View profile', 'ultimate-member' ); ?></a></div>
 					</div>
 
 				</div>
@@ -69,15 +69,15 @@
 						if ( isset( $info['custom'] ) || UM()->options()->get( "account_tab_{$id}" ) == 1 || $id == 'general' ) { ?>
 
 							<li>
-								<a data-tab="<?php echo $id ?>" href="<?php echo UM()->account()->tab_link( $id ); ?>" class="um-account-link <?php if ( $id == UM()->account()->current_tab ) echo 'current'; ?>">
+								<a data-tab="<?php echo esc_attr( $id  )?>" href="<?php echo esc_url( UM()->account()->tab_link( $id ) ); ?>" class="um-account-link <?php if ( $id == UM()->account()->current_tab ) echo 'current'; ?>">
 									<?php if ( UM()->mobile()->isMobile() ) { ?>
-										<span class="um-account-icontip uimob800-show" title="<?php echo $info['title']; ?>"><i class="<?php echo $info['icon']; ?>"></i></span>
+										<span class="um-account-icontip uimob800-show" title="<?php echo esc_attr( $info['title'] ); ?>"><i class="<?php echo esc_attr( $info['icon'] ); ?>"></i></span>
 									<?php } else { ?>
-										<span class="um-account-icontip uimob800-show um-tip-w" title="<?php echo $info['title']; ?>"><i class="<?php echo $info['icon']; ?>"></i></span>
+										<span class="um-account-icontip uimob800-show um-tip-w" title="<?php echo esc_attr( $info['title'] ); ?>"><i class="<?php echo esc_attr( $info['icon'] ); ?>"></i></span>
 									<?php } ?>
 
-									<span class="um-account-icon uimob800-hide"><i class="<?php echo $info['icon']; ?>"></i></span>
-									<span class="um-account-title uimob800-hide"><?php echo $info['title']; ?></span>
+									<span class="um-account-icon uimob800-hide"><i class="<?php echo esc_attr( $info['icon'] ); ?>"></i></span>
+									<span class="um-account-title uimob800-hide"><?php esc_html_e( $info['title'] ); ?></span>
 									<span class="um-account-arrow uimob800-hide">
 										<i class="<?php if ( is_rtl() ) { ?>um-faicon-angle-left<?php } else { ?>um-faicon-angle-right<?php } ?>"></i>
 									</span>
@@ -89,7 +89,7 @@
 				</ul>
 			</div>
 			
-			<div class="um-account-main" data-current_tab="<?php echo UM()->account()->current_tab; ?>">
+			<div class="um-account-main" data-current_tab="<?php echo esc_attr( UM()->account()->current_tab ); ?>">
 			
 				<?php
 				/**
@@ -120,14 +120,14 @@
 					if ( isset( $info['custom'] ) || UM()->options()->get( 'account_tab_' . $id ) == 1 || $id == 'general' ) { ?>
 
 						<div class="um-account-nav uimob340-show uimob500-show">
-							<a href="#" data-tab="<?php echo $id; ?>" class="<?php if ( $id == $current_tab ) echo 'current'; ?>">
-								<?php echo $info['title']; ?>
-								<span class="ico"><i class="<?php echo $info['icon']; ?>"></i></span>
+							<a href="#" data-tab="<?php echo esc_attr( $id ); ?>" class="<?php if ( $id == $current_tab ) echo 'current'; ?>">
+								<?php esc_html_e( $info['title'] ); ?>
+								<span class="ico"><i class="<?php echo esc_attr( $info['icon'] ); ?>"></i></span>
 								<span class="arr"><i class="um-faicon-angle-down"></i></span>
 							</a>
 						</div>
 
-						<div class="um-account-tab um-account-tab-<?php echo $id ?>" data-tab="<?php echo $id ?>">
+						<div class="um-account-tab um-account-tab-<?php echo esc_attr( $id ); ?>" data-tab="<?php echo esc_attr( $id  )?>">
 							<?php $info['with_header'] = true;
 							UM()->account()->render_account_tab( $id, $info, $args ); ?>
 						</div>
diff --git a/templates/gdpr-register.php b/templates/gdpr-register.php
index 714c6e84..44789c5e 100644
--- a/templates/gdpr-register.php
+++ b/templates/gdpr-register.php
@@ -12,9 +12,9 @@
 			} ?>
 		</div>
 		<a href="javascript:;" class="um-toggle-gdpr" data-toggle-state="hidden"
-		   data-toggle-show="<?php echo ! empty( $args['use_gdpr_toggle_show'] ) ? $args['use_gdpr_toggle_show'] : __( 'Show privacy policy', 'ultimate-member' ); ?>"
-		   data-toggle-hide="<?php echo ! empty( $args['use_gdpr_toggle_hide'] ) ? $args['use_gdpr_toggle_hide'] : __( 'Hide privacy policy', 'ultimate-member' ); ?>">
-			<?php echo ! empty( $args['use_gdpr_toggle_show'] ) ? $args['use_gdpr_toggle_show'] : __( 'Show privacy policy', 'ultimate-member' ); ?>
+		   data-toggle-show="<?php echo esc_attr( ! empty( $args['use_gdpr_toggle_show'] ) ? $args['use_gdpr_toggle_show'] : __( 'Show privacy policy', 'ultimate-member' ) ); ?>"
+		   data-toggle-hide="<?php echo esc_attr( ! empty( $args['use_gdpr_toggle_hide'] ) ? $args['use_gdpr_toggle_hide'] : __( 'Hide privacy policy', 'ultimate-member' ) ); ?>">
+			<?php esc_html_e( ! empty( $args['use_gdpr_toggle_show'] ) ? $args['use_gdpr_toggle_show'] : __( 'Show privacy policy', 'ultimate-member' ) ); ?>
 		</a>
 	</div>
 	<div class="um-field-area">
@@ -25,7 +25,7 @@
 				<i class="um-icon-android-checkbox-outline-blank"></i>
 			</span>
 			<span class="um-field-checkbox-option">
-				<?php echo ! empty( $args['use_gdpr_agreement'] ) ? $args['use_gdpr_agreement'] :  __( 'Please confirm that you agree to our privacy policy', 'ultimate-member' ); ?>
+				<?php esc_html_e( ! empty( $args['use_gdpr_agreement'] ) ? $args['use_gdpr_agreement'] :  __( 'Please confirm that you agree to our privacy policy', 'ultimate-member' ) ); ?>
 			</span>
 		</label>
 		<div class="um-clear"></div>
diff --git a/templates/login.php b/templates/login.php
index b36de01b..97bc1530 100644
--- a/templates/login.php
+++ b/templates/login.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-form">
 	
diff --git a/templates/logout.php b/templates/logout.php
index 9843bd7c..d4e5bd5b 100644
--- a/templates/logout.php
+++ b/templates/logout.php
@@ -1,14 +1,14 @@
-<div class="um <?php echo $this->get_class( $mode, $args ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode, $args ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-form">
 	
 		<div class="um-misc-with-img">
 			
 			<div class="um-misc-img">
-				<a href="<?php echo um_get_core_page( 'user' ); ?>"><?php echo um_user( 'profile_photo', 80 ); ?></a>
+				<a href="<?php echo esc_url( um_get_core_page( 'user' ) ); ?>"><?php echo um_user( 'profile_photo', 80 ); ?></a>
 			</div>
 			
-			<div><strong><?php echo um_user( 'display_name' ); ?></strong></div>
+			<div><strong><?php esc_html_e( um_user( 'display_name' ) ); ?></strong></div>
 			
 			<?php
 			/**
diff --git a/templates/members-grid.php b/templates/members-grid.php
index 91467dab..03e21e63 100644
--- a/templates/members-grid.php
+++ b/templates/members-grid.php
@@ -4,9 +4,9 @@
 	
 	<?php $i = 0; foreach( um_members('users_per_page') as $member) { $i++; um_fetch_user( $member ); ?>
 			
-	<div class="um-member um-role-<?php echo um_user( 'role' ); ?> <?php echo um_user('account_status'); ?> <?php if ($cover_photos) { echo 'with-cover'; } ?>">
+	<div class="um-member um-role-<?php echo esc_attr( um_user( 'role' ) ); ?> <?php esc_html_e( um_user('account_status') ); ?> <?php if ($cover_photos) { echo 'with-cover'; } ?>">
 				
-		<span class="um-member-status <?php echo um_user('account_status'); ?>"><?php echo um_user('account_status_name'); ?></span>
+		<span class="um-member-status <?php echo esc_attr( um_user('account_status') ); ?>"><?php esc_html_e( um_user('account_status_name') ); ?></span>
 					
 		<?php
 		if ($cover_photos) {
@@ -18,8 +18,8 @@
 			}
 		?>
 
-		<div class="um-member-cover" data-ratio="<?php echo UM()->options()->get('profile_cover_ratio'); ?>">
-			<div class="um-member-cover-e"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo esc_attr(um_user('display_name')); ?>"><?php echo um_user('cover_photo', $cover_size); ?></a></div>
+		<div class="um-member-cover" data-ratio="<?php echo esc_attr( UM()->options()->get('profile_cover_ratio') ); ?>">
+			<div class="um-member-cover-e"><a href="<?php echo esc_url( um_user_profile_url() ); ?>" title="<?php echo esc_attr( um_user('display_name') ); ?>"><?php echo um_user('cover_photo', $cover_size); ?></a></div>
 		</div>
 
 		<?php } ?>
@@ -28,13 +28,13 @@
 			$default_size = str_replace( 'px', '', UM()->options()->get('profile_photosize') );
 			$corner = UM()->options()->get('profile_photocorner');
 		?>
-		<div class="um-member-photo radius-<?php echo $corner; ?>"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo esc_attr(um_user('display_name')); ?>"><?php echo get_avatar( um_user('ID'), $default_size ); ?></a></div>
+		<div class="um-member-photo radius-<?php echo esc_attr( $corner ); ?>"><a href="<?php echo esc_url( um_user_profile_url() ); ?>" title="<?php echo esc_attr( um_user('display_name') ); ?>"><?php echo get_avatar( um_user('ID'), $default_size ); ?></a></div>
 		<?php } ?>
 					
 					<div class="um-member-card <?php if (!$profile_photo) { echo 'no-photo'; } ?>">
 						
 						<?php if ( $show_name ) { ?>
-						<div class="um-member-name"><a href="<?php echo um_user_profile_url(); ?>" title="<?php echo esc_attr(um_user('display_name')); ?>"><?php echo um_user('display_name', 'html'); ?></a></div>
+						<div class="um-member-name"><a href="<?php echo esc_url( um_user_profile_url() ); ?>" title="<?php echo esc_attr( um_user('display_name') ); ?>"><?php esc_html_e( um_user('display_name', 'html') ); ?></a></div>
 						<?php } ?>
 						
 						<?php
@@ -62,7 +62,7 @@
 
 						<?php if ( UM()->roles()->um_current_user_can( 'edit', um_user('ID') ) ) { ?>
 							<div class="um-members-edit-btn">
-								<a href="<?php echo um_edit_profile_url() ?>" class="um-edit-profile-btn um-button um-alt">
+								<a href="<?php echo esc_url( esc_attr( um_edit_profile_url() ) ); ?>" class="um-edit-profile-btn um-button um-alt">
 									<?php _e( 'Edit profile','ultimate-member' ) ?>
 								</a>
 							</div>
@@ -127,7 +127,7 @@
 											if ( ! $value )
 												continue; ?>
 
-											<div class="um-member-metaline um-member-metaline-<?php echo esc_attr( $key ); ?>"><span><strong><?php echo UM()->fields()->get_label( $key ); ?>:</strong> <?php _e( $value, 'ultimate-member'); ?></span></div>
+								<div class="um-member-metaline um-member-metaline-<?php echo esc_attr( $key ); ?>"><span><strong><?php esc_html_e( UM()->fields()->get_label( $key ) ); ?>:</strong> <?php _e( $value, 'ultimate-member'); ?></span></div>
 
 										<?php }
 									}
diff --git a/templates/members.php b/templates/members.php
index 45caf78d..71b84f50 100644
--- a/templates/members.php
+++ b/templates/members.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-form">
 
diff --git a/templates/message.php b/templates/message.php
index 2b9bb7bd..144ad682 100644
--- a/templates/message.php
+++ b/templates/message.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-postmessage">
 		
diff --git a/templates/password-change.php b/templates/password-change.php
index c8d2a75d..4d273184 100644
--- a/templates/password-change.php
+++ b/templates/password-change.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-form">
 	
diff --git a/templates/password-reset.php b/templates/password-reset.php
index bd18f47b..e5531bef 100644
--- a/templates/password-reset.php
+++ b/templates/password-reset.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 	<div class="um-form">
 		<form method="post" action="">
 			<?php if ( isset( $_GET['updated'] ) && 'checkemail' == $_GET['updated'] ) { ?>
diff --git a/templates/profile.php b/templates/profile.php
index 04c2c483..cfe24506 100644
--- a/templates/profile.php
+++ b/templates/profile.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?> um-role-<?php echo um_user( 'role' ); ?> ">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?> um-role-<?php echo esc_attr( um_user( 'role' ) ); ?> ">
 
 	<div class="um-form">
 	
@@ -93,7 +93,7 @@
 		 */
 		$classes = apply_filters( 'um_profile_navbar_classes', '' ); ?>
 
-		<div class="um-profile-navbar <?php echo $classes ?>">
+		<div class="um-profile-navbar <?php echo esc_attr( $classes ); ?>">
 			<?php
 			/**
 			 * UM hook
diff --git a/templates/profile/comments-single.php b/templates/profile/comments-single.php
index f626bfb2..fca59a8a 100644
--- a/templates/profile/comments-single.php
+++ b/templates/profile/comments-single.php
@@ -16,7 +16,7 @@ foreach ( UM()->shortcodes()->loop as $comment ) {
 	<div class="um-item">
 		<div class="um-item-link">
 			<i class="um-icon-chatboxes"></i>
-			<a href="<?php echo get_comment_link( $comment->comment_ID ); ?>">
+			<a href="<?php echo esc_url( get_comment_link( $comment->comment_ID ) ); ?>">
 				<?php echo get_comment_excerpt( $comment->comment_ID ); ?>
 			</a>
 		</div>
@@ -30,7 +30,7 @@ foreach ( UM()->shortcodes()->loop as $comment ) {
 if ( isset( UM()->shortcodes()->modified_args ) && count(UM()->shortcodes()->loop ) >= 10 ) { ?>
 
 	<div class="um-load-items">
-		<a href="#" class="um-ajax-paginate um-button" data-hook="um_load_comments" data-args="<?php echo UM()->shortcodes()->modified_args; ?>">
+		<a href="#" class="um-ajax-paginate um-button" data-hook="um_load_comments" data-args="<?php echo esc_attr( UM()->shortcodes()->modified_args ); ?>">
 			<?php _e('load more comments','ultimate-member'); ?>
 		</a>
 	</div>
diff --git a/templates/profile/comments.php b/templates/profile/comments.php
index f6663c08..069343c6 100644
--- a/templates/profile/comments.php
+++ b/templates/profile/comments.php
@@ -11,7 +11,7 @@
 		<?php if ( count( UM()->shortcodes()->loop) >= 10 ) { ?>
 		
 		<div class="um-load-items">
-			<a href="#" class="um-ajax-paginate um-button" data-hook="um_load_comments" data-args="comment,10,10,<?php echo um_user('ID'); ?>"><?php _e('load more comments','ultimate-member'); ?></a>
+			<a href="#" class="um-ajax-paginate um-button" data-hook="um_load_comments" data-args="comment,10,10,<?php echo esc_attr( um_user('ID') ); ?>"><?php _e('load more comments','ultimate-member'); ?></a>
 		</div>
 		
 		<?php } ?>
diff --git a/templates/profile/posts-single.php b/templates/profile/posts-single.php
index e7b31c75..3e353b84 100644
--- a/templates/profile/posts-single.php
+++ b/templates/profile/posts-single.php
@@ -1,7 +1,7 @@
 <div class="um-item">
 	<div class="um-item-link">
 		<i class="um-icon-ios-paper"></i>
-		<a href="<?php echo get_permalink( $post ) ?>"><?php echo $post->post_title; ?></a>
+		<a href="<?php echo esc_url( get_permalink( $post ) ); ?>"><?php esc_html_e( $post->post_title ); ?></a>
 	</div>
 
 	<?php if ( has_post_thumbnail( $post->ID ) ) {
@@ -9,7 +9,7 @@
 		$image_url = wp_get_attachment_image_src( $image_id, 'full', true ); ?>
 
 		<div class="um-item-img">
-			<a href="<?php echo get_permalink( $post ) ?>">
+			<a href="<?php echo esc_url( get_permalink( $post ) ); ?>">
 				<?php echo get_the_post_thumbnail( $post->ID, 'medium' ); ?>
 			</a>
 		</div>
@@ -21,7 +21,7 @@
 			<?php printf( __( '%s ago', 'ultimate-member' ), human_time_diff( get_the_time( 'U', $post->ID ), current_time( 'timestamp' ) ) ); ?>
 		</span>
 		<span>
-			<?php echo __( 'in', 'ultimate-member' ); ?>: <?php the_category( ', ', '', $post->ID ); ?>
+			<?php _e( 'in', 'ultimate-member' ); ?>: <?php the_category( ', ', '', $post->ID ); ?>
 		</span>
 		<span>
 			<?php $num_comments = get_comments_number( $post->ID );
@@ -34,7 +34,7 @@
 				$comments = __( '1 comment', 'ultimate-member' );
 			} ?>
 
-			<a href="<?php echo get_comments_link( $post->ID ) ?>"><?php echo $comments ?></a>
+			<a href="<?php echo esc_url( get_comments_link( $post->ID ) ); ?>"><?php echo $comments; ?></a>
 		</span>
 	</div>
 </div>
\ No newline at end of file
diff --git a/templates/profile/posts.php b/templates/profile/posts.php
index 6b13e9fb..82e5b64a 100644
--- a/templates/profile/posts.php
+++ b/templates/profile/posts.php
@@ -17,7 +17,7 @@
 
 			if ( $count_posts > 10 ) { ?>
 				<div class="um-load-items">
-					<a href="javascript:void(0);" class="um-ajax-paginate um-button" data-hook="um_load_posts" data-author="<?php echo um_get_requested_user(); ?>" data-page="1" data-pages="<?php echo ceil( $count_posts / 10 ) ?>">
+					<a href="javascript:void(0);" class="um-ajax-paginate um-button" data-hook="um_load_posts" data-author="<?php echo esc_attr( um_get_requested_user() ); ?>" data-page="1" data-pages="<?php echo esc_attr( ceil( $count_posts / 10 ) ); ?>">
 						<?php _e( 'load more posts', 'ultimate-member' ); ?>
 					</a>
 				</div>
diff --git a/templates/register.php b/templates/register.php
index f049489a..9e19524b 100644
--- a/templates/register.php
+++ b/templates/register.php
@@ -1,4 +1,4 @@
-<div class="um <?php echo $this->get_class( $mode ); ?> um-<?php echo esc_attr( $form_id ); ?>">
+<div class="um <?php echo esc_attr( $this->get_class( $mode ) ); ?> um-<?php echo esc_attr( $form_id ); ?>">
 
 	<div class="um-form">
 	
diff --git a/templates/searchform.php b/templates/searchform.php
index 3f1b538a..f039c851 100644
--- a/templates/searchform.php
+++ b/templates/searchform.php
@@ -1,8 +1,8 @@
-<form role="search" method="get" class="search-form um-search-form" action="<?php echo  esc_url( um_get_core_page( 'members' ) ); ?>">
+<form role="search" method="get" class="search-form um-search-form" action="<?php echo esc_url( um_get_core_page( 'members' ) ); ?>">
 	<input type="hidden" name="um_search" value="1">
 	<div class="um-search-area">
 		<span class="screen-reader-text"><?php echo _x( 'Search for:', 'label' ); ?></span>
-		<input type="search" class="um-search-field search-field" placeholder="<?php echo esc_attr_x( 'Search &hellip;', 'placeholder' ); ?>" value="<?php echo um_get_search_query(); ?>" name="search" title="<?php echo esc_attr_x( 'Search for:', 'label' ); ?>" />
+		<input type="search" class="um-search-field search-field" placeholder="<?php echo esc_attr_x( 'Search &hellip;', 'placeholder' ); ?>" value="<?php echo esc_attr( um_get_search_query() ); ?>" name="search" title="<?php echo esc_attr_x( 'Search for:', 'label' ); ?>" />
 		<a href="javascript: void(0);" id="um-search-button" class="um-search-icon um-faicon um-faicon-search"></a>
 	</div>
 </form>