Foreign keys, bugfixes and output sanitation

webgui/task.php

@@ -127,7 +127,6 @@ page_caption_search($pagetitle);
 
 // load filter from db
 $flt = db_get_filter($user->id, 206, ['txt', 'prio', 'stat', 'proj']);
-
 $w = array('(t.vid=:vid OR t.vid IS NULL)');
 $p = array(':vid' => $user->vid);
 if (strlen($flt->txt) > 1) {
@@ -215,7 +214,7 @@ filter_create_select('flt_prio', _('Priority'), $g_opt_all + $g_opt_none + $opt_
 </div>
 <?php
 $opt_status = db_load_enum('task', 'taskstate', true, true, false);
-filter_create_checks('flt_stat', _('Status'), $opt_status, $flt->stat);
+filter_create_checks('flt_stat', _('Status'), $opt_status, $flt->stat ?? []);
 ?>
 </div>
 <div class="card-footer">
@@ -367,7 +366,7 @@ echo '<h2>', _('Edit Task'), "</h2>\n";
 <input type="hidden" name="id" value="<?=$id?>">
 <div class="mb-3">
   <label for="taskname" class="form-label"><?=_('Name')?></label>
-  <input type="text" class="form-control" id="taskname" name="taskname" value="<?=$task->taskname ?>">
+  <input type="text" class="form-control" id="taskname" name="taskname" value="<?=h($task->taskname)?>">
 </div>
 <?php
 $opt_none = [-1 => '&horbar; none &horbar;'];