Cross site scripting / Unsantized output in hidden fields

In better_exposed_filters.theme.

Please note my addition of htmlspecialchars() calls.

  $output = '<div class="bef-select-as-links">';
  $output .= theme('form_element', array('element' => $properties));
  if (!empty($element['#value'])) {
    if (is_array($element['#value'])) {
      foreach ($element['#value'] as $value) {
        $output .= '<input type="hidden" name="' . $name . '[]" value="' . htmlspecialchars($value) . '" />';
      }
    }
    else {
      $output .= '<input type="hidden" name="' . $name . '" value="' . htmlspecialchars($element['#value']) . '" />';
    }
  }
  $output .= '</div>';

Sorry I dont know how to create a patch.