Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.
**Describe the bug**
Storage type xss exists in Custom Field Editor in /admin/modules/system/custom_field.php file. There is no effective defense against the NOTE field, leading to cross-site script attacks.

**To Reproduce**
Steps to reproduce the behavior:
Storage type xss exists in Custom Field Editor in /admin/modules/system/custom_field.php file. There is no effective defense against the NOTE field, leading to cross-site scripting attacks.
Administrator login "system" add new "field> fill in cross-site scripting in the NOTE field `(example:'"><svg/onload=alert(document.domain)>)`
It will take effect after saving.

**Expected behavior**
You can insert js scripts to attack.

**Screenshots**
<img width="1071" alt="3" src="https://user-images.githubusercontent.com/18564938/147060823-4a8328b5-9ea5-400a-80d2-48c4a8828895.png">
<img width="1087" alt="4" src="https://user-images.githubusercontent.com/18564938/147060883-f5af4b94-3587-4dee-9e94-45415050b3eb.png">


**Desktop :**
 - OS: [MacBook M1]
 - Browser [Chrome]
 - Version [96.0.4664.110]


[Security Bug]Stored cross-site script attacks（xss）
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bug]Stored cross-site script attacks（xss）
Issue date:

--- start body ---
**Describe the bug**
Storage type xss exists in Custom Field Editor in /admin/modules/system/custom_field.php file. There is no effective defense against the NOTE field, leading to cross-site script attacks.

**To Reproduce**
Steps to reproduce the behavior:
Storage type xss exists in Custom Field Editor in /admin/modules/system/custom_field.php file. There is no effective defense against the NOTE field, leading to cross-site scripting attacks.
Administrator login "system" add new "field> fill in cross-site scripting in the NOTE field `(example:'"><svg/onload=alert(document.domain)>)`
It will take effect after saving.

**Expected behavior**
You can insert js scripts to attack.

**Screenshots**
<img width="1071" alt="3" src="https://user-images.githubusercontent.com/18564938/147060823-4a8328b5-9ea5-400a-80d2-48c4a8828895.png">
<img width="1087" alt="4" src="https://user-images.githubusercontent.com/18564938/147060883-f5af4b94-3587-4dee-9e94-45415050b3eb.png">


**Desktop :**
 - OS: [MacBook M1]
 - Browser [Chrome]
 - Version [96.0.4664.110]


--- end body ---

Stored cross-site scripting (XSS) vulnerability in the Custom Field Editor of the application allows attackers to inject malicious scripts via the NOTE field. This occurs because there is no effective input validation or sanitization for user input, enabling the execution of arbitrary JavaScript when the stored data is rendered in the browser.