html encode mailbox names

src/folders.php

@@ -263,9 +263,9 @@ if ($count_special_folders < count($boxes)) {
             ($boxes[$i]["unformatted"] != $trash_folder) &&
             ($boxes[$i]["unformatted"] != $sent_folder) &&
             ($boxes[$i]["unformatted"] != $draft_folder)) {
-            $box = $boxes[$i]["unformatted-dm"];
+            $box = htmlspecialchars($boxes[$i]["unformatted-dm"]);
             $box2 = str_replace(' ', '&nbsp;',
-                                imap_utf7_decode_local($boxes[$i]["unformatted-disp"]));
+                                htmlentities(imap_utf7_decode_local($boxes[$i]["unformatted-disp"])));
             echo "         <OPTION VALUE=\"$box\">$box2\n";
         }
     }
@@ -297,8 +297,8 @@ if(!$no_list_for_subscribe) {
         }
     }
     if ($use_folder == true) {
-        $box[$q] = $boxes_all[$i]['unformatted-dm'];
-        $box2[$q] = imap_utf7_decode_local($boxes_all[$i]['unformatted-disp']);
+        $box[$q] = htmlspecialchars($boxes_all[$i]['unformatted-dm']);
+        $box2[$q] = htmlentities(imap_utf7_decode_local($boxes_all[$i]['unformatted-disp']));
         $q++;
     }
   }

src/folders_delete.php

@@ -63,7 +63,7 @@ if( !sqgetGlobalVar('confirmed', $tmp, SQ_POST) ) {
         sprintf(_("Are you sure you want to delete %s?"), imap_utf7_decode_local($mailbox)).
         '<FORM ACTION="folders_delete.php" METHOD="POST"><p>'.
 
-        '<INPUT TYPE=HIDDEN NAME="mailbox" VALUE="'.$mailbox."\">\n" .
+        '<INPUT TYPE=HIDDEN NAME="mailbox" VALUE="' . htmlspecialchars($mailbox) . "\">\n" .
         '<INPUT TYPE=SUBMIT NAME="confirmed" VALUE="'._("Yes")."\">\n".
         '<INPUT TYPE=SUBMIT NAME="backingout" VALUE="'._("No")."\">\n".
         '</p></FORM><BR></td></tr></table>';