I am checking website for XSS and Cross Site scripting issues and i found that in account form fields or user registration page form fields for First name and Last name A user can enter html/js code. For testing when i place the following JS code :
It is saved and is run on page load. This is very strange, because i checked the template files and values are escaped as below:
<?php echo $this->escapeHtml($this->getObject()->getFirstname()) ?>
I have also confirmed if i am in correct template file by changing the label of field. I have read the following questions and tried to used them but did not worked for me.
Regarding to the observer method, it works, but when i try to login to magento admin, i cant, but when iremove the observer, i can login again.
Update: Check the two attached screenshots.
Kindly help me with this issue.