All escaping functions replace HTML reserved characters.

This commit is contained in:
Chad Weider 2012-01-14 14:46:15 -08:00
parent 30da7357e5
commit 6e36b59a59
4 changed files with 20 additions and 5 deletions

View file

@ -429,14 +429,15 @@ exports.getPadHTMLDocument = function (padId, revNum, noDocType, callback)
function _escapeHTML(s)
{
var re = /[&<>]/g;
var re = /[&"<>]/g;
if (!re.MAP)
{
// persisted across function calls!
re.MAP = {
'&': '&amp;',
'"': '&quot;',
'<': '&lt;',
'>': '&gt;',
'>': '&gt;'
};
}