browser: quote html entities

Title and description contain special characters literally.
Other fields are usually to be inserted as HTML, but are not always valid
(stand-alone chars, invisible linebreaks) so apply some smart escaping.

diff --git a/browser.plp b/browser.plp
index 741868ba148a12bc3b9eea1261953aec88011148..c2a5d256dcb75b1e611bb8807b270beb7a4aa216 100644 (file)
--- a/browser.plp
+++ b/browser.plp
@@ -181,15 +181,15 @@ sub saytitlecol {
                        sprintf("try { %s; return false } catch(err) { return true }",
                                "document.getElementById('$id').classList.toggle('target')",
                        ),
                        sprintf("try { %s; return false } catch(err) { return true }",
                                "document.getElementById('$id').classList.toggle('target')",
                        ),

-                       $_,
+                       Entity($_),

                );
        } $row->{title};
        print '<div class=aside>';
        s/\.?$/./, print "<p>$_</p>" for map { ref $_ ? @$_ : $_ || () }
                );
        } $row->{title};
        print '<div class=aside>';
        s/\.?$/./, print "<p>$_</p>" for map { ref $_ ? @$_ : $_ || () }

-               $row->{description}, $row->{notes};
-       printf 'Resources: %s.', join(', ',
-               map { qq(<a href="$_->{url}">$_->{title}</a>) } @$_
-       ) for grep { @$_ } $row->{links} // ();
+               Entity($row->{description}), formathtml($row->{notes});  # sic
+       printf 'Resources: %s.', join(', ', map {
+               sprintf '<a href="%s">%s</a>', EscapeHTML($_->{url}), $_->{title}
+       } @$_) for grep { @$_ } $row->{links} // ();

        print '</div>';
 }
 
        print '</div>';
 }
 


@@ -257,6 +257,16 @@ for my $id (sort {
 print '<tfoot>', $header;
 print '</table>';
 
 print '<tfoot>', $header;
 print '</table>';
 

+sub formathtml {
+       my $ref = defined wantarray ? [@_] : \@_;
+       for (@$ref) {
+               s/& (?!\w)/&amp;/gx;
+               s/< \s/&lt;/gx;
+               s/\n\K\n/<br>/g;
+       }
+       return @$ref;
+}
+

 sub paddedver {
        # normalised version number comparable as string (cmp)
        shift =~ /^(\d*)(.*)/;
 sub paddedver {
        # normalised version number comparable as string (cmp)
        shift =~ /^(\d*)(.*)/;