From 63f52703b7f6043b8830b511ac94acb34426f683 Mon Sep 17 00:00:00 2001
From: mic <m@micz.it>
Date: Thu, 26 Mar 2026 23:41:13 +0100
Subject: [PATCH] escaping html code also in chatgpt web integration. see #711

---
 js/mzta-utils.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/js/mzta-utils.js b/js/mzta-utils.js
index c5dbc59e..b3048c30 100644
--- a/js/mzta-utils.js
+++ b/js/mzta-utils.js
@@ -285,10 +285,19 @@ function convertBrToNewlines(html) {
 export function convertNewlinesToParagraphs(input) {
   return input
     .split('\n')
-    .map(line => `<p>${line}</p>`)
+    .map(line => `<p>${escapeHtml(line)}</p>`)
     .join('');
 }
 
+function escapeHtml(text) {
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
 
 // This method is used to convert the model string id used in the URL
 // to the model string used in the webpage