From ed1b784ee219853afbfc3bc7880d901948581b6a Mon Sep 17 00:00:00 2001
From: Anhgelus Morhtuuzh <william@herges.fr>
Date: Fri, 17 Apr 2026 17:33:09 +0200
Subject: feat(dom): escape html

---
 src/dom/Element.zig | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/dom/Element.zig')

diff --git a/src/dom/Element.zig b/src/dom/Element.zig
index ed7611c..1922a41 100644
--- a/src/dom/Element.zig
+++ b/src/dom/Element.zig
@@ -1,6 +1,7 @@
 const std = @import("std");
 const Allocator = std.mem.Allocator;
 const eql = std.mem.eql;
+const html = @import("html.zig");
 
 pub const Kind = enum {
     void,
@@ -92,8 +93,9 @@ fn renderAttribute(self: *Self, alloc: Allocator) !std.ArrayList(u8) {
     while (iter.next()) |it| : (i += 1) {
         try acc.appendSlice(alloc, it.key_ptr.*);
         try acc.appendSlice(alloc, "=\"");
-        // MISSING ESCAPING!!!
-        try acc.appendSlice(alloc, it.value_ptr.*);
+        const escape = try html.escape(alloc, it.value_ptr.*);
+        defer alloc.free(escape);
+        try acc.appendSlice(alloc, escape);
         try acc.append(alloc, '"');
         if (i < iter.len - 1) try acc.append(alloc, ' ');
     }
-- 
cgit v1.2.3