Index: branches/version-2_13_3/data/Smarty/templates/admin/basis/payment_input.tpl
===================================================================
--- branches/version-2_13_3/data/Smarty/templates/admin/basis/payment_input.tpl	(revision 23546)
+++ branches/version-2_13_3/data/Smarty/templates/admin/basis/payment_input.tpl	(revision 23668)
@@ -26,11 +26,11 @@
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="edit" />
-    <input type="hidden" name="payment_id" value="<!--{$tpl_payment_id}-->" />
+    <input type="hidden" name="payment_id" value="<!--{$tpl_payment_id|h}-->" />
     <input type="hidden" name="image_key" value="" />
-    <input type="hidden" name="fix" value="<!--{$arrForm.fix.value}-->" />
+    <input type="hidden" name="fix" value="<!--{$arrForm.fix.value|h}-->" />
     <!--{foreach key=key item=item from=$arrHidden}-->
     <input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
     <!--{/foreach}-->
-    <input type="hidden" name="charge_flg" value="<!--{$charge_flg}-->" />
+    <input type="hidden" name="charge_flg" value="<!--{$charge_flg|h}-->" />
     <div id="basis" class="contents-main">
         <h2>支払方法登録・編集</h2>
Index: branches/version-2_13_3/data/Smarty/templates/admin/order/status.tpl
===================================================================
--- branches/version-2_13_3/data/Smarty/templates/admin/order/status.tpl	(revision 23546)
+++ branches/version-2_13_3/data/Smarty/templates/admin/order/status.tpl	(revision 23668)
@@ -26,6 +26,6 @@
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="" />
-    <input type="hidden" name="status" value="<!--{if $arrForm.status == ""}-->1<!--{else}--><!--{$arrForm.status}--><!--{/if}-->" />
-    <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno}-->" />
+    <input type="hidden" name="status" value="<!--{if $arrForm.status == ""}-->1<!--{else}--><!--{$arrForm.status|h}--><!--{/if}-->" />
+    <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno|h}-->" />
     <input type="hidden" name="order_id" value="" />
     <div id="order" class="contents-main">