My site is failing a PCI compliance test

https://hazmatuniversity.com

This is what they said was the problem
Here is the request I used to execute this
curl 'http://hazmatuniversity.com/store/index.php?function=add_kom&no="><script>alert(123)</script>' >> kate5.html
The characters are not getting sanitized.
The specific plugins are flagging because we are getting our request back unsanitized on those specific checks. So even if you are not using those programs you still would need to correct the core issue of those characters not getting sanitized. If you ensure all special characters on user supplied info are sanitized, these should clear up with a new scan.

This is from SecurityMetrics. If this is fixed in 1.5.5f, please let me know. If not, can you provide a quick patch, or tell me where to make the change, so I can pass the test.

Thanks

This is NOT a bug in Zen Cart.

This is a problem in your template, and thus will exist regardless which version of Zen Cart you are using.

Your template is blindly taking whatever the current page URL is, and immediately outputting it back to your page, without any sanitization.
It seems as though someone was attempting to cleverly link to the #mainPageColumnsHeadlineRow position on your page, but implemented it poorly.

You will need to find the part of your template which outputs the HTML and text in this section of the page, and change how you produce the intended link:

<br/><a href="/store/index.php#mainPageColumnsHeadlineRow"><p><span style="font-size:16px;">Learn about the benefits of Hazmat University Online Training below</span></p></a></div></div></div></div><div class="row">