summaryrefslogtreecommitdiffabout
path: root/html.c
authorLars Hjemli <hjemli@gmail.com>2009-01-29 21:21:15 (UTC)
committer Lars Hjemli <hjemli@gmail.com>2009-01-29 21:21:15 (UTC)
commit7efcef00b5aadf22f5be80ecd7b736398cf7f6b4 (patch) (unidiff)
tree6bfdb7c5499ba43eb9b302394adc7bfa7e517436 /html.c
parentba75f6613ebce2d716334d912932f1bd78ef124f (diff)
downloadcgit-7efcef00b5aadf22f5be80ecd7b736398cf7f6b4.zip
cgit-7efcef00b5aadf22f5be80ecd7b736398cf7f6b4.tar.gz
cgit-7efcef00b5aadf22f5be80ecd7b736398cf7f6b4.tar.bz2
html.c: use correct escaping in html attributes
First, an apostrophe is not a quote. Second, we also need to escape quotes. And finally, quotes are encoded as '&quot;', not '&quote;'. Sighned-off-by: Lars Hjemli <hjemli@gmail.com>
Diffstat (limited to 'html.c') (more/less context) (ignore whitespace changes)
-rw-r--r--html.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/html.c b/html.c
index d7d9fd7..66ba65d 100644
--- a/html.c
+++ b/html.c
@@ -109,20 +109,22 @@ void html_ntxt(int len, char *txt)
109 109
110void html_attr(char *txt) 110void html_attr(char *txt)
111{ 111{
112 char *t = txt; 112 char *t = txt;
113 while(t && *t){ 113 while(t && *t){
114 int c = *t; 114 int c = *t;
115 if (c=='<' || c=='>' || c=='\'') { 115 if (c=='<' || c=='>' || c=='\'' || c=='\"') {
116 write(htmlfd, txt, t - txt); 116 write(htmlfd, txt, t - txt);
117 if (c=='>') 117 if (c=='>')
118 html("&gt;"); 118 html("&gt;");
119 else if (c=='<') 119 else if (c=='<')
120 html("&lt;"); 120 html("&lt;");
121 else if (c=='\'') 121 else if (c=='\'')
122 html("&quote;"); 122 html("&#x27;");
123 else if (c=='"')
124 html("&quot;");
123 txt = t+1; 125 txt = t+1;
124 } 126 }
125 t++; 127 t++;
126 } 128 }
127 if (t!=txt) 129 if (t!=txt)
128 html(txt); 130 html(txt);