diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index d70e9c32c0b..9b52fd0e497 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -3932,11 +3932,12 @@ class Form
/**
* Return a HTML select string, built from an array of key+value.
+ * Note: Do not use returned string into a langs->trans function, content may be entity encoded twice.
*
* @param string $htmlname Name of html select area
* @param array $array Array with key+value
* @param string $id Preselected key
- * @param int $show_empty 1 si il faut ajouter une valeur vide dans la liste, 0 sinon
+ * @param int $show_empty 0 no empty value allowed, 1 to add an empty value into list (value is '' or ' ').
* @param int $key_in_label 1 pour afficher la key dans la valeur "[key] value"
* @param int $value_as_key 1 to use value as key
* @param string $moreparam Add more parameters onto the select tag
@@ -3945,7 +3946,7 @@ class Form
* @param int $disabled Html select box is disabled
* @param int $sort 'ASC' or 'DESC' =Sort on label, '' or 'NONE'=Do not sort
* @param string $morecss Add more class to css styles
- * @return string HTML select string
+ * @return string HTML select string.
*/
static function selectarray($htmlname, $array, $id='', $show_empty=0, $key_in_label=0, $value_as_key=0, $moreparam='', $translate=0, $maxlen=0, $disabled=0, $sort='', $morecss='')
{
@@ -3982,11 +3983,11 @@ class Form
if ($key_in_label)
{
- $selectOptionValue = dol_htmlentitiesbr($key.' - '.($maxlen?dol_trunc($value,$maxlen):$value));
+ $selectOptionValue = dol_escape_htmltag($key.' - '.($maxlen?dol_trunc($value,$maxlen):$value));
}
else
{
- $selectOptionValue = dol_htmlentitiesbr($maxlen?dol_trunc($value,$maxlen):$value);
+ $selectOptionValue = dol_escape_htmltag($maxlen?dol_trunc($value,$maxlen):$value);
if ($value == '' || $value == '-') $selectOptionValue=' ';
}
$out.=$selectOptionValue;
diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php
index f91ec3d188d..673f64e6261 100644
--- a/htdocs/core/lib/ajax.lib.php
+++ b/htdocs/core/lib/ajax.lib.php
@@ -337,7 +337,7 @@ function ajax_combobox($htmlname, $events=array(), $minLengthToAutocomplete=0)
width: "500px" */
$msg = '