Add escaping of dynamic content

2025-09-18 09:01:31 +02:00
parent 9ddb744fdd
commit dff078537e
3 changed files with 4 additions and 5 deletions
@@ -55,10 +55,10 @@ let main =

            <div class="item">
                <div>
-                    <a href=\'"'\link\'"'>\post.title</a>
+                    <a href=\'"'\link\'"'>\escape(post.title)</a>
                </div>
                <div>
-                    <span>\post.date</span> | <span>\post.num_comments comments</span>
+                    <span>\escape(post.date)</span> | <span>\escape(post.num_comments) comments</span>
                </div>
            </div>
        }
@@ -3,7 +3,7 @@ procedure page(title, login_user_id, style, main)
    <html>
    <head>
        <meta charset="UTF-8" />
-        <title>CN - \title</title>
+        <title>CN - \escape(title)</title>
        <style>
            body {
                line-height: 200%;