Escape &, <, >

2 files changed, 23 insertions, 8 deletions

diff --git a/README.html b/README.html
index a96b35c..2dea2c7 100644
--- a/README.html
+++ b/README.html
@@ -104,7 +104,7 @@ You can download the file here [1].
 Preformatted blocks start with a single tab:
 </p>
 <pre>
-#include <stdio.h>
+	#include &lt;stdio.h&gt;
 	main() { puts("Hello world!\n"); }
 </pre>
 <h4>Paragraphs</h4>
@@ -157,8 +157,8 @@ It is available for download [1].
 translates into the following HTML:
 </p>
 <pre>
-<p>It is available for download (<a href="v1.tgz">link</a>).
-</p>
+&lt;p&gt;It is available for download (&lt;a href="v1.tgz"&gt;link&lt;/a&gt;).
+&lt;/p&gt;
 </pre>
 <p>
 The default link text ("link") can be changed by setting
diff --git a/aux/emparse b/aux/emparse
index 65644e9..38bec54 100755
--- a/aux/emparse
+++ b/aux/emparse
@@ -2,6 +2,18 @@
 
 # aux/emparse -- parse em source
 
+function escape(s) {
+	if (s == "") {
+		gsub("&", "\\&amp;")
+		gsub("<", "\\&lt;")
+		gsub(">", "\\&gt;")
+	} else {
+		gsub("&", "\\&amp;", s)
+		gsub("<", "\\&lt;", s)
+		gsub(">", "\\&gt;", s)
+	}
+}
+
 function beginblock(name) {
 	if (name == "nl") printf "<ol>\n"
 	else printf "<%s>\n", name
@@ -37,6 +49,7 @@ function breakblock() {
 function heading(level, line) {
 	sub("^=* ", "", line)
 	sub(" =*$", "", line)
+	escape(line)
 	printf "<h%d>%s</h%d>\n", level, line, level
 	# should inline formatting be supported in headings?
 }
@@ -68,10 +81,11 @@ function item(level, type, line) {
 function term(line, t) { # t is a local variable
 	if (opendef) printf "</dd>"
 	opendef = 1
-	t = $0; d  = $0
+	t = $0
 	sub("^ ", "", t)
 	sub(": .*$", "", t)
 	sub("^ [^:]+: ", "")
+	escape(t)
 	printf "<dt>%s</dt><dd>", t
 }
 
@@ -83,6 +97,7 @@ function ref(v) {
 }
 
 function format(line) {
+	escape(line)
 	n = split(line, w, "[ 	]")
 	for (i = 0; i <= n; i++) {
 		if (w[i] == "") continue;
@@ -146,16 +161,18 @@ expectblock && /^ - /			{ newblock("ul") }
 expectblock && /^ [0-9a-z]+\. /		{ newblock("ol") }
 expectblock && /^ \[[0-9a-z]\]+ /	{ newblock("nl") }
 expectblock && /^ .*: /			{ newblock("dl") }
-expectblock && /^	/			{ newblock("pre"); sub("^	", "") }
+expectblock && /^	/			{ newblock("pre") }
 expectblock && /^---$/			{ expectblock = 0; printf "<hr/>\n"; next }
 expectblock && /^= .* =$/			{ heading(1, $0); next }
-expectblock && /^== .* ==$/			{ heading(3, $0); next }
+expectblock && /^== .* ==$/			{ heading(2, $0); next }
 expectblock && /^=== .* ===$/		{ heading(3, $0); next }
 expectblock && /^==== .* ====$/		{ heading(4, $0); next }
 expectblock && /^===== .* =====$/	{ heading(5, $0); next }
 expectblock && /^====== .* ======$/	{ heading(6, $0); next }
 expectblock { newblock("p") }
 
+block = "pre" { sub("^	", ""); escape(); printf "%s\n", $0; next }
+
 block = "ul" && /^ - /				{ item(1, "ul", line) }
 block = "ol" && /^ [0-9a-z]+\. /		{ item(1, "ol", line) }
 block = "nl" && /^ \[[0-9a-z]\]+ [^ 	]+$/	{ next }			# hyperlink reference
@@ -173,6 +190,4 @@ block = "ol" && /^     [0-9a-z]+\./	{ item(5, "ol", line) }
 block = "ul" && /^      -/			{ item(6, "ul", line) }
 block = "ol" && /^      [0-9a-z]+\./	{ item(6, "ol", line) }
 
-block = "pre"  && /^	/	{ sub("^	", ""); printf "%s\n", $0; next }
-
 { format($0) }