Merge pull request #3960 from protich/issue/xss-forms

xss: Cached forms data

include/ajax.forms.php

@@ -21,7 +21,8 @@ class DynamicFormsAjaxAPI extends AjaxController {
         if ($_GET || isset($_SESSION[':form-data'])) {
             if (!is_array($_SESSION[':form-data']))
                 $_SESSION[':form-data'] = array();
-            $_SESSION[':form-data'] = array_merge($_SESSION[':form-data'], $_GET);
+            $_SESSION[':form-data'] = array_merge($_SESSION[':form-data'],
+                    Format::htmlchars($_GET));
         }
 
         foreach ($topic->getForms() as $form) {