Add escaping of dynamic content

2025-09-18 09:01:31 +02:00
parent 9ddb744fdd
commit dff078537e
3 changed files with 4 additions and 5 deletions
@@ -55,10 +55,10 @@ let main =

            <div class="item">
                <div>
-                    <a href=\'"'\link\'"'>\post.title</a>
+                    <a href=\'"'\link\'"'>\escape(post.title)</a>
                </div>
                <div>
-                    <span>\post.date</span> | <span>\post.num_comments comments</span>
+                    <span>\escape(post.date)</span> | <span>\escape(post.num_comments) comments</span>
                </div>
            </div>
        }