From acf63a3753d9a078498cd6472971eb7b65a2b396 Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Sat, 27 Jun 2026 01:44:32 +0200
Subject: [PATCH] Escape < and > in escHtml to prevent stored XSS

---
 src/main.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main.cpp b/src/main.cpp
index c49747d..69eebce 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -391,6 +391,8 @@ static String escHtml(const String& s) {
     char c = s.charAt(i);
     switch (c) {
       case '&':  out += "&amp;";  break;
+      case '<':  out += "&lt;";   break;
+      case '>':  out += "&gt;";   break;
       case '\'': out += "&#39;";  break;
       case '"':  out += "&quot;"; break;
       default:   out += c;