From 7f2ed60a89764adf543cdf86ec0d3550f932662c Mon Sep 17 00:00:00 2001
From: interlope <spleenftw@gmail.com>
Date: Mon, 1 Jun 2026 21:02:27 +0200
Subject: [PATCH] Sanitize output by applying htmlspecialchars to site titles,
 slogans, and social network labels across multiple templates

---
 php/home.php    | 18 +++++++++---------
 php/navbar.php  | 10 +++++-----
 php/page.php    |  6 +++---
 php/sidebar.php |  6 +++---
 4 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/php/home.php b/php/home.php
index 68db363..4ef0493 100644
--- a/php/home.php
+++ b/php/home.php
@@ -7,20 +7,20 @@
 ?>
 <?php if ($showProfile) : ?>
   <header class="profile text-center">
-    <img class="profile-avatar" src="<?php echo $profileImage; ?>" alt="<?php echo $site->title(); ?>" />
-    <h1 class="profile-name"><?php echo $site->title(); ?></h1>
+    <img class="profile-avatar" src="<?php echo $profileImage; ?>" alt="<?php echo htmlspecialchars($site->title(), ENT_QUOTES, 'UTF-8'); ?>" />
+    <h1 class="profile-name"><?php echo htmlspecialchars($site->title(), ENT_QUOTES, 'UTF-8'); ?></h1>
     <?php if ($site->slogan()) : ?>
-      <p class="profile-bio"><?php echo $site->slogan(); ?></p>
+      <p class="profile-bio"><?php echo htmlspecialchars($site->slogan(), ENT_QUOTES, 'UTF-8'); ?></p>
     <?php elseif ($site->description()) : ?>
-      <p class="profile-bio"><?php echo $site->description(); ?></p>
+      <p class="profile-bio"><?php echo htmlspecialchars($site->description(), ENT_QUOTES, 'UTF-8'); ?></p>
     <?php endif ?>
 
     <?php $networks = Theme::socialNetworks(); ?>
     <?php if (!empty($networks)) : ?>
       <div class="profile-social">
         <?php foreach ($networks as $key => $label) : ?>
-          <a href="<?php echo $site->{$key}(); ?>" target="_blank" rel="noopener" title="<?php echo $label ?>">
-            <img class="profile-social-icon" src="<?php echo DOMAIN_THEME . 'img/' . $key . '.svg' ?>" alt="<?php echo $label ?>" />
+          <a href="<?php echo $site->{$key}(); ?>" target="_blank" rel="noopener" title="<?php echo htmlspecialchars($label, ENT_QUOTES, 'UTF-8') ?>">
+            <img class="profile-social-icon" src="<?php echo DOMAIN_THEME . 'img/' . $key . '.svg' ?>" alt="<?php echo htmlspecialchars($label, ENT_QUOTES, 'UTF-8') ?>" />
           </a>
         <?php endforeach ?>
       </div>
@@ -51,7 +51,7 @@
 
       <div class="post-list-head">
         <a href="<?php echo $page->permalink(); ?>">
-          <h2 class="post-list-title"><?php echo $page->title(); ?></h2>
+          <h2 class="post-list-title"><?php echo htmlspecialchars($page->title(), ENT_QUOTES, 'UTF-8'); ?></h2>
         </a>
         <div class="post-list-meta">
           <span><i class="bi bi-calendar3"></i><?php echo $page->date(); ?></span>
@@ -67,11 +67,11 @@
         <div class="post-taxonomy">
           <?php if ($categoryKey) : ?>
             <a class="taxonomy-badge" href="<?php echo $page->categoryPermalink(); ?>">
-              <i class="bi bi-folder2"></i><?php echo $page->category(); ?>
+              <i class="bi bi-folder2"></i><?php echo htmlspecialchars($page->category(), ENT_QUOTES, 'UTF-8'); ?>
             </a>
           <?php endif ?>
           <?php foreach ($tagsList as $tagKey => $tagName) : ?>
-            <a class="taxonomy-badge" href="<?php echo DOMAIN_TAGS . $tagKey; ?>"><i class="bi bi-tag"></i><?php echo $tagName; ?></a>
+            <a class="taxonomy-badge" href="<?php echo DOMAIN_TAGS . $tagKey; ?>"><i class="bi bi-tag"></i><?php echo htmlspecialchars($tagName, ENT_QUOTES, 'UTF-8'); ?></a>
           <?php endforeach ?>
         </div>
       <?php endif ?>
diff --git a/php/navbar.php b/php/navbar.php
index d4925bf..fd5239d 100644
--- a/php/navbar.php
+++ b/php/navbar.php
@@ -1,7 +1,7 @@
 <nav class="navbar navbar-expand-md navbar-dark fixed-top navbar-modern">
 	<div class="container">
 		<a class="navbar-brand" href="<?php echo Theme::siteUrl() ?>">
-			<span class="text-white"><?php echo $site->title() ?></span>
+			<span class="text-white"><?php echo htmlspecialchars($site->title(), ENT_QUOTES, 'UTF-8') ?></span>
 		</a>
 		<button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation">
 			<span class="navbar-toggler-icon"></span>
@@ -19,16 +19,16 @@
 				<!-- Static pages -->
 				<?php foreach ($staticContent as $staticPage) : ?>
 					<li class="nav-item">
-						<a class="nav-link<?php echo ($url->slug() == $staticPage->slug()) ? ' active' : '' ?>" href="<?php echo $staticPage->permalink() ?>"><?php echo $staticPage->title() ?></a>
+						<a class="nav-link<?php echo ($url->slug() == $staticPage->slug()) ? ' active' : '' ?>" href="<?php echo $staticPage->permalink() ?>"><?php echo htmlspecialchars($staticPage->title(), ENT_QUOTES, 'UTF-8') ?></a>
 					</li>
 				<?php endforeach ?>
 
 				<!-- Social Networks (SVG icons live in img/<network>.svg) -->
 				<?php foreach (Theme::socialNetworks() as $key => $label) : ?>
 					<li class="nav-item">
-						<a class="nav-link" href="<?php echo $site->{$key}(); ?>" target="_blank" rel="noopener" title="<?php echo $label ?>">
-							<img class="d-none d-md-block nav-svg-icon" src="<?php echo DOMAIN_THEME . 'img/' . $key . '.svg' ?>" alt="<?php echo $label ?>" />
-							<span class="d-inline d-md-none"><?php echo $label; ?></span>
+						<a class="nav-link" href="<?php echo $site->{$key}(); ?>" target="_blank" rel="noopener" title="<?php echo htmlspecialchars($label, ENT_QUOTES, 'UTF-8') ?>">
+							<img class="d-none d-md-block nav-svg-icon" src="<?php echo DOMAIN_THEME . 'img/' . $key . '.svg' ?>" alt="<?php echo htmlspecialchars($label, ENT_QUOTES, 'UTF-8') ?>" />
+							<span class="d-inline d-md-none"><?php echo htmlspecialchars($label, ENT_QUOTES, 'UTF-8'); ?></span>
 						</a>
 					</li>
 				<?php endforeach; ?>
diff --git a/php/page.php b/php/page.php
index 147ed62..7ee0599 100644
--- a/php/page.php
+++ b/php/page.php
@@ -13,7 +13,7 @@
 
 	<div class="card-body">
 		<!-- Title -->
-		<h1 class="title"><?php echo $page->title(); ?></h1>
+		<h1 class="title"><?php echo htmlspecialchars($page->title(), ENT_QUOTES, 'UTF-8'); ?></h1>
 
 		<?php if (!$page->isStatic() && !$url->notFound()): ?>
 		<!-- Creation date, reading time and author -->
@@ -35,11 +35,11 @@
 		<div class="post-taxonomy mt-4">
 			<?php if ($categoryKey) : ?>
 				<a class="taxonomy-badge" href="<?php echo $page->categoryPermalink(); ?>">
-					<i class="bi bi-folder2"></i><?php echo $page->category(); ?>
+					<i class="bi bi-folder2"></i><?php echo htmlspecialchars($page->category(), ENT_QUOTES, 'UTF-8'); ?>
 				</a>
 			<?php endif ?>
 			<?php foreach ($tagsList as $tagKey => $tagName) : ?>
-				<a class="taxonomy-badge" href="<?php echo DOMAIN_TAGS . $tagKey; ?>"><i class="bi bi-tag"></i><?php echo $tagName; ?></a>
+				<a class="taxonomy-badge" href="<?php echo DOMAIN_TAGS . $tagKey; ?>"><i class="bi bi-tag"></i><?php echo htmlspecialchars($tagName, ENT_QUOTES, 'UTF-8'); ?></a>
 			<?php endforeach ?>
 		</div>
 		<?php endif ?>
diff --git a/php/sidebar.php b/php/sidebar.php
index a101614..382fa4e 100644
--- a/php/sidebar.php
+++ b/php/sidebar.php
@@ -8,11 +8,11 @@
 	<?php if ($isArticle) : ?>
 		<div class="sidebar-profile text-center">
 			<a href="<?php echo Theme::siteUrl() ?>">
-				<img class="sidebar-profile-avatar" src="<?php echo DOMAIN_THEME . 'img/spleenftw.jpeg' ?>" alt="<?php echo $site->title() ?>" />
+				<img class="sidebar-profile-avatar" src="<?php echo DOMAIN_THEME . 'img/spleenftw.jpeg' ?>" alt="<?php echo htmlspecialchars($site->title(), ENT_QUOTES, 'UTF-8') ?>" />
 			</a>
-			<div class="sidebar-profile-name"><?php echo $site->title() ?></div>
+			<div class="sidebar-profile-name"><?php echo htmlspecialchars($site->title(), ENT_QUOTES, 'UTF-8') ?></div>
 			<?php if ($site->slogan()) : ?>
-				<p class="sidebar-profile-bio"><?php echo $site->slogan() ?></p>
+				<p class="sidebar-profile-bio"><?php echo htmlspecialchars($site->slogan(), ENT_QUOTES, 'UTF-8') ?></p>
 			<?php endif ?>
 		</div>
 	<?php endif ?>