Added data conversion to avoid XSS

App/Controllers/Posts.php

@@ -94,6 +94,11 @@ class Posts
             $posts[] = $post;
         }
 
+        // Replace \n or \r with <br />
+        for ($i=0; $i < count($posts); $i++) {
+            $posts[$i]['content'] = preg_replace('/\r\n/', '<br />', $posts[$i]['content']);
+        }
+
         View::render($url, [
             'posts' => $posts,
             'status' => $status
@@ -138,6 +143,8 @@ class Posts
                 $creator = $post['creator'];
                 $editor = $post['editor'];
 
+                $post['content'] = htmlspecialchars_decode($post['content']);
+
                 $table = 'users';
 
                 $creator = $this->model->showAll([
@@ -204,6 +211,8 @@ class Posts
             }
         }
 
+        $args['content'] = htmlspecialchars($args['content']);
+
         if (isset($table)) {
             if ($this->model->entry($args, $table)) {
                 Session::flash('info', 'Data berhasil diunggah.');