Security fix : f_id is a number

include/lib/html_input.class.php

@@ -826,6 +826,7 @@ class HtmlInput
     static function title_box($p_name, $p_div, $p_mod="close", $p_js="",
             $p_draggable="n")
     {
+        $p_div=strip_tags($p_div);
         $r='<div class="bxbutton">';
 
         // If draggable : display a icon to unpin and move the dialog box