Merge pull request #107 from AuditeMarlow/prevent-html-injection

Prevent HTML injection

Author: freekmurze

src/Tinker.php

@@ -35,7 +35,7 @@ public function __construct(OutputModifier $outputModifier)
     public function execute(string $phpCode): string
     {
         $phpCode = $this->removeComments($phpCode);
-        
+
         $this->shell->addInput($phpCode);
 
         $closure = new ExecutionLoopClosure($this->shell);
@@ -116,6 +116,6 @@ protected function cleanOutput(string $output): string
 
         $output = preg_replace('/(?s)(<whisper.*?<\/whisper>)|INFO  Ctrl\+D\./ms', '$2', $output);
 
-        return trim($output);
+        return htmlentities(trim($output));
     }
 }