From 53e1bb2fd35829c422eae37aeb5d3880e8db727c Mon Sep 17 00:00:00 2001
From: Nikola Petrov <nikola@petrovv.com>
Date: Tue, 5 May 2026 23:42:14 +0200
Subject: [PATCH] t

---
 go-form-plugin/go-form-plugin.php           | 1 +
 go-form-plugin/templates/form-shortcode.php | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/go-form-plugin/go-form-plugin.php b/go-form-plugin/go-form-plugin.php
index bc21dd1..359d151 100644
--- a/go-form-plugin/go-form-plugin.php
+++ b/go-form-plugin/go-form-plugin.php
@@ -155,6 +155,7 @@ add_action('admin_post_nopriv_go_form_submit', 'go_form_handle_submission');
 
 // ========== Shortcode ==========
 function go_form_shortcode($atts) {
+    global $ranks;
     $form_id = intval(shortcode_atts(['id' => 1], $atts)['id']);
 
     $msg = '';
diff --git a/go-form-plugin/templates/form-shortcode.php b/go-form-plugin/templates/form-shortcode.php
index e3eb666..18ff8d1 100644
--- a/go-form-plugin/templates/form-shortcode.php
+++ b/go-form-plugin/templates/form-shortcode.php
@@ -60,9 +60,8 @@
             <select name="rank" id="rank">
             
             <?php 
-                global $ranks;
                 foreach ($ranks as $value => $label) {
-                    echo "<option value='{$value}'>{$label}</option>\n";
+                    echo "<option value='" . esc_attr($value) . "'>" . esc_html($label) . "</option>\n";
                 }
             ?>
             </select>