xml escaping, fixes #207

3 files changed, 11 insertions, 7 deletions

diff --git a/js/globals.js b/js/globals.js
index 29f62c5..46c7699 100644
--- a/js/globals.js
+++ b/js/globals.js
@@ -53,6 +53,10 @@ var SQL = {
 	unsubscribe: function(message, subscriber) {
 		var index = this._subscribers[message].indexOf(subscriber);
 		if (index > -1) { this._subscribers[message].splice(index, 1); }
+	},
+
+	escape: function(str) {
+		return str.replace(/&/g, "&amp;").replace(/>/g, "&gt;").replace(/</g, "&lt;");
 	}
 }
 
diff --git a/js/row.js b/js/row.js
index ac1c94b..a9abf86 100644
--- a/js/row.js
+++ b/js/row.js
@@ -143,7 +143,8 @@ SQL.Row.prototype.buildEdit = function() {
 	elms.push(["null",this.dom.nll]);
 	
 	this.dom.comment = OZ.DOM.elm("span",{className:"comment"});
-	this.dom.comment.innerHTML = this.data.comment;
+	this.dom.comment.innerHTML = "";
+	this.dom.comment.appendChild(document.createTextNode(this.data.comment));
 
 	this.dom.commentbtn = OZ.DOM.elm("input");
 	this.dom.commentbtn.type = "button";
@@ -180,7 +181,8 @@ SQL.Row.prototype.changeComment = function(e) {
 	var c = prompt(_("commenttext"),this.data.comment);
 	if (c === null) { return; }
 	this.data.comment = c;
-	this.dom.comment.innerHTML = this.data.comment;
+	this.dom.comment.innerHTML = "";
+	this.dom.comment.appendChild(document.createTextNode(this.data.comment));
 }
 
 SQL.Row.prototype.expand = function() {
@@ -336,7 +338,7 @@ SQL.Row.prototype.toXML = function() {
 		} else if (d != "CURRENT_TIMESTAMP") { 
 			d = q+d+q; 
 		}
-		xml += "<default>"+d+"</default>";
+		xml += "<default>"+SQL.escape(d)+"</default>";
 	}
 
 	for (var i=0;i<this.relations.length;i++) {
@@ -346,8 +348,7 @@ SQL.Row.prototype.toXML = function() {
 	}
 	
 	if (this.data.comment) { 
-		var escaped = this.data.comment.replace(/&/g, "&amp;").replace(/>/g, "&gt;").replace(/</g, "&lt;");
-		xml += "<comment>"+escaped+"</comment>\n"; 
+		xml += "<comment>"+SQL.escape(this.data.comment)+"</comment>\n"; 
 	}
 	
 	xml += "</row>\n";
diff --git a/js/table.js b/js/table.js
index b72ce11..1b20f20 100644
--- a/js/table.js
+++ b/js/table.js
@@ -245,8 +245,7 @@ SQL.Table.prototype.toXML = function() {
 	}
 	var c = this.getComment();
 	if (c) { 
-		c = c.replace(/&/g, "&amp;").replace(/>/g, "&gt;").replace(/</g, "&lt;");
-		xml += "<comment>"+c+"</comment>\n"; 
+		xml += "<comment>"+SQL.escape(c)+"</comment>\n"; 
 	}
 	xml += "</table>\n";
 	return xml;