Cross-site Scripting Attack Security Issue: Sanitize Input

A client of mine has reviewed multiples of theirs that I have done and came back with a few security concerns of theirs. One relating to a calendar and the other to a search. Both websites are on version 2.53.

The 'title_keyword=' parameter on the affected page does not properly sanitize input before returning it back into the clients browser, resulting in a non-persistent Cross-Site Scripting attack.

Change this website such that all input is validated and escaped before rendering it in an HTML page. To prevent this attack, transform HTML metacharacters (such as "<" and ">") into entities (such as "&lt;" and "$gt;").

There is also a calendar on their website that they are saying has some issues with the year parameter.

The 'year' URL parameter on the affected page does not properly sanitize input before returning it back into the clients browser, resulting in a non-persistent Cross-Site Scripting attack.

Change this website such that all input is validated and escaped before rendering it in an HTML page. To prevent this attack, transform HTML metacharacters (such as "<" and ">") into entities (such as "&lt;" and "$gt;").

Any help and/or direction is greatly appreciated and I can provide code for anyone that would need it.

Thank you.