Frontend does not filter user input

[nlsvgtr]

When a user enters data the input is not filtered. It is possible, for example, to enter "><img src="x:x" onerror="alert('LBVD')"> in the user account First Name field.

This is not a big issue because the backend does filter the data, and the text above is not added to the database. It does however leave a theoretical possibility for reflected cross-site scripting.

Possible Solution
Filter the data that a user enters

Steps to Reproduce

1. Login to a Plannen site
2. Goto My Account
3. Enter "><img src="x:x" onerror="alert('LBVD')"> as your first name
4. Click Opslaan
5. Reload the page and see an alert.