a1d7c07c50f1d895337de121680ea672b261c058
max
  Mon Aug 17 02:26:36 2026 -0700
escape reflected/echoed user input across several CGIs (XSS), refs #38057

Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text),
cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string
literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer.
Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene,
hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui,
hgPhyloPlace, hgMirror, hgCustom and hgSearch.

diff --git src/hg/hgBlat/hgBlat.c src/hg/hgBlat/hgBlat.c
index 846a2e42cfd..5fae564a6b7 100644
--- src/hg/hgBlat/hgBlat.c
+++ src/hg/hgBlat/hgBlat.c
@@ -2533,38 +2533,39 @@
 }
 
 void fakeAskForSeqForm(char *organism, char *db)
 /* Put up a hidden form that asks for sequence.
  * Call self.... */
 {
 char *userSeq = NULL;
 char *type = NULL;
 char *sort = NULL;
 char *output = NULL;
 
 printf("<FORM ACTION=\"../cgi-bin/hgBlat\" METHOD=\"POST\" ENCTYPE=\"multipart/form-data\" NAME=\"mainForm\">\n");
 cartSaveSession(cart);
 printf("<INPUT TYPE=HIDDEN NAME=org VALUE=\"%s\">\n", organism);
 printf("<INPUT TYPE=HIDDEN NAME=db VALUE=\"%s\">\n", db);
+// all four come from the cart (user input) and go into value="" attributes; escape (XSS)
 type = cartUsualString(cart, "type", "");
-printf("<INPUT TYPE=HIDDEN NAME=type VALUE=\"%s\">\n", type);
+printf("<INPUT TYPE=HIDDEN NAME=type VALUE=\"%s\">\n", htmlEncode(type));
 sort = cartUsualString(cart, "sort", "");
-printf("<INPUT TYPE=HIDDEN NAME=sort VALUE=\"%s\">\n", sort);
+printf("<INPUT TYPE=HIDDEN NAME=sort VALUE=\"%s\">\n", htmlEncode(sort));
 output = cartUsualString(cart, "output", "");
-printf("<INPUT TYPE=HIDDEN NAME=output VALUE=\"%s\">\n", output);
+printf("<INPUT TYPE=HIDDEN NAME=output VALUE=\"%s\">\n", htmlEncode(output));
 userSeq = cartUsualString(cart, "userSeq", "");
-printf("<INPUT TYPE=HIDDEN NAME=userSeq VALUE=\"%s\">\n", userSeq);
+printf("<INPUT TYPE=HIDDEN NAME=userSeq VALUE=\"%s\">\n", htmlEncode(userSeq));
 printf("<INPUT TYPE=HIDDEN NAME=Submit VALUE=submit>\n"); 
 printf("</FORM>\n");
 }
 
 static void blatFormJsonList(struct jsonWrite *jw, char *name, char *list[], int count)
 /* Write a JSON array of the strings in list, for a dropdown in the JS-built form. */
 {
 jsonWriteListStart(jw, name);
 int i;
 for (i = 0;  i < count;  ++i)
     jsonWriteString(jw, NULL, list[i]);
 jsonWriteListEnd(jw);
 }
 
 void askForSeqJs(char *organism, char *db)