// W3C

modules/cashondelivery/views/templates/front/validation.tpl

@@ -33,7 +33,7 @@
 
 <h3>{l s='Cash on delivery (COD) payment' mod='cashondelivery'}</h3>
 
-<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" method="post">
 	<input type="hidden" name="confirm" value="1" />
 	<p>
 		<img src="{$this_path_cod}cashondelivery.jpg" alt="{l s='Cash on delivery (COD) payment' mod='cashondelivery'}" style="float:left; margin: 0px 10px 5px 0px;" />

modules/cashondelivery/views/templates/hook/confirmation.tpl

@@ -27,5 +27,5 @@
 	<br /><br />
 	{l s='You have chosen the cash on delivery method.' mod='cashondelivery'}
 	<br /><br /><span class="bold">{l s='Your order will be sent very soon.' mod='cashondelivery'}</span>
-	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)}">{l s='customer support' mod='cashondelivery'}</a>.
+	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)|escape:'html'}">{l s='customer support' mod='cashondelivery'}</a>.
 </p>

modules/cashondelivery/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
+	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
 		<img src="{$this_path_cod}cashondelivery.gif" alt="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" style="float:left;" />
 		<br />{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}
 		<br />{l s='You pay for the merchandise upon delivery' mod='cashondelivery'}