Escape HTML

config.js

@@ -15,6 +15,11 @@ function tabulate(list) {
 }
 
 
+String.prototype.escapeHtml = function () {
+  return this.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+}
+
+
 function template(tmpl, data) {
   var brag = tmpl.replace(/\$([_A-Za-z.]+)/g, function (str, p1) {
     var dict = data;
@@ -24,6 +29,8 @@ function template(tmpl, data) {
         dict = tabulate(dict);
       } else {
         dict = dict[v.replace("_"," ")];
+        if (typeof dict == typeof "")
+          dict = dict.escapeHtml();
       }
       return null;
     });

main.js

@@ -974,7 +974,7 @@ function quit() {
 
 function LoadCharacter() {
   var result = true;
-  var name = window.location.href.split('#')[1];
+  var name = unescape(window.location.href.split('#')[1]);
   var sheet = loadSheet(name);
 
   if (!sheet) {

newguy.js

@@ -207,7 +207,7 @@ function sold() {
 
   addToRoster(newguy);
 
-  window.location.href = "main.html#" + newguy.Traits.Name;
+  window.location.href = "main.html#" + escape(newguy.Traits.Name);
 }
 
 function cancel() {

roster.js

@@ -18,7 +18,7 @@ function load() {
     
     var br = brag(c);
     roster.append(br);
-    br.find("a.go").attr("href", "main.html#" + name);
+    br.find("a.go").attr("href", "main.html#" + escape(name));
     
     br.find("a.x").click(function () {
       if (confirm("Terminate " + Pick(["faithful","noble","loyal","brave"])+