e375b6261547192b9aebef00662d48fb7256c032
chmalee
  Mon May 4 09:00:02 2026 -0700
Fix a comment typo and some potential XSS vectors pointed out in code review email

diff --git src/hg/hgTrackUi/hgTrackUi.c src/hg/hgTrackUi/hgTrackUi.c
index 3feb32b6d2d..c6c9dceaf55 100644
--- src/hg/hgTrackUi/hgTrackUi.c
+++ src/hg/hgTrackUi/hgTrackUi.c
@@ -3306,31 +3306,31 @@
     printf("<p>Please <a href=\"./hgSession\">log in</a> to manage shares.</p>\n");
     return;
     }
 
 printf("<h3>Share this track</h3>\n");
 printf("<div id=\"shareCreateSection\">\n");
 printf("<h4 style=\"margin-top:0\">Create share link</h4>\n");
 printf("<table style=\"border-spacing:4px\"><tbody>\n");
 
 /* Project dropdown */
 printf("<tr><td>Project:</td><td><select id=\"shareProject\">\n");
 printf("<option value=\"*\">All projects</option>\n");
 struct slName *projects = myVariantsGetProjects(userName);
 struct slName *p;
 for (p = projects; p != NULL; p = p->next)
-    printf("<option value=\"%s\">%s</option>\n", p->name, p->name);
+    printf("<option value=\"%s\">%s</option>\n", htmlEncode(p->name), htmlEncode(p->name));
 slFreeList(&projects);
 printf("</select></td></tr>\n");
 
 /* Permission radios */
 printf("<tr><td>Permission:</td><td>"
     "<label><input type=\"radio\" name=\"sharePerm\" value=\"0\" checked> Can view</label> "
     "<label><input type=\"radio\" name=\"sharePerm\" value=\"1\"> Can edit</label>"
     "</td></tr>\n");
 printf("<tr><td>Share with:</td>"
     "<td><input type=\"text\" id=\"shareTargetUser\""
     " placeholder=\"Username (blank = anyone with link)\" style=\"width:250px\"></td></tr>\n");
 printf("<tr><td>Label:</td>"
     "<td><input type=\"text\" id=\"shareLabel\" placeholder=\"Optional label\""
     " style=\"width:250px\"></td></tr>\n");
 printf("</tbody></table>\n");