Prepopulating Input not being Escaped « Gravity Support Forums

We have a user registration field for our members to update their bio on the front end. We noticed recently that quote's weren't being properly escaped causing an error.

Turns out this issue is in userregistration.php in the prepopulate_input function (lines 3225 - 32310.

Replacing:

public function prepopulate_input($input_id, $value) {
        $filter_name = 'gfur_field_' . str_replace('.', '_', $input_id);
        add_filter("gform_field_value_{$filter_name}", create_function("", "return '$value';"));

        return $filter_name;
    }

with:

public function prepopulate_input($input_id, $value) {
        $value = str_replace("'", "\'", str_replace("\\", "\\\\", $value));
        $filter_name = 'gfur_field_' . str_replace('.', '_', $input_id);
        add_filter("gform_field_value_{$filter_name}", create_function("", "return '$value';"));

        return $filter_name;
    }

Fixes the issue on our end. Please consider using this or a better solution!