All escaping functions replace HTML reserved characters.

2025-04-20 15:36:16 -04:00 · 2012-01-14 14:46:15 -08:00 · 2012-01-14 14:46:15 -08:00 · 6e36b59a59
commit 6e36b59a59
parent 30da7357e5
4 changed files with 20 additions and 5 deletions
--- a/static/js/pad_utils.js
+++ b/static/js/pad_utils.js
@ -23,7 +23,14 @@
 var padutils = {
  escapeHtml: function(x)
  {
-    return String(x).replace(/\</g, '&lt;').replace(/\>/g, '&gt;');
+    return String(x).replace(/[&"<>]/g, function (c) {
+      return {
+        '&': '&amp;',
+        '"': '&quot;',
+        '<': '&lt;',
+        '>': '&gt;'
+      }[c] || c;
+    });
  },
  uniqueId: function()
  {