Fixed escapeHTML function

to skip not only &***;, but also &#***; and &x***;
This commit is contained in:
Dmitry Baranovskiy
2011-03-02 08:12:24 +11:00
parent 7216d99350
commit 0cdc525961

View File

@@ -1079,7 +1079,7 @@
// Helper function to escape a string for HTML rendering.
var escapeHTML = function(string) {
return string.replace(/&(?!\w+;)/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
return string.replace(/&(?!\w+;|#\d+;|#x[\da-f]+;)/gi, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
};
}).call(this);