52cee2eff9e953d4584a415b8a9b84bd2326d3cd
braney
  Tue Aug 18 11:14:37 2026 -0700
hgTables: encode track menu and schema text consistently, refs #38123

diff --git src/hg/hgTables/mainPage.c src/hg/hgTables/mainPage.c
index 840f1925b7d..d281ec61132 100644
--- src/hg/hgTables/mainPage.c
+++ src/hg/hgTables/mainPage.c
@@ -80,33 +80,34 @@
 /* If the saved selection is a QuickLift group, fall back to a visible default
  * since QuickLift groups are filtered from the dropdown below. */
 if (selGroup != NULL && startsWith("QuickLift", selGroup->label))
     {
     cartRemove(cart, groupVar);
     selGroup = findSelectedGroup(groupList, groupVar);
     }
 hPrintf("<label for='%s'><B>Group:</B></label>\n", groupVar);
 hPrintf("<SELECT NAME=%s id='%s'>\n", groupVar, groupVar);
 jsOnEventById(event,groupVar,groupScript);
 for (group = groupList; group != NULL; group = group->next)
     {
     if (startsWith("QuickLift", group->label))
         continue;
     if (allTablesOk || differentString(group->name, "allTables"))
+        // a hub group's label is built from the hub's shortLabel and its groups.txt label
         hPrintf(" <OPTION VALUE=%s%s>%s</OPTION>\n", group->name,
                 (group == selGroup ? " SELECTED" : ""),
-                group->label);
+                htmlEncode(group->label));
     }
 hPrintf("</SELECT>\n");
 return selGroup;
 }
 
 static void addIfExists(struct hash *hash, struct slName **pList, char *name)
 /* Add name to tail of list if it exists in hash. */
 {
 if (hashLookup(hash, name))
     slNameAddTail(pList, name);
 }
 
 struct slName *getDbListForGenome()
 /* Get list of selectable databases. */
 {
@@ -175,31 +176,32 @@
     for (track = fullTrackList; track != NULL; track = track->next)
 	{
 	if (allTracks || sameString(selGroup->name, track->grp))
 	    {
 	    hPrintf(" <OPTION VALUE=\"%s\"", track->track);
             if (disableNoGenome && isNoGenomeDisabled(database, track->table))
                 {
                 hPrintf(" DISABLED");
                 if (track == selTrack)
                     selTrackIsDisabled = TRUE;
                 }
             else if (firstEnabled == NULL)
                 firstEnabled = track;
             if (track == selTrack && !selTrackIsDisabled)
                 hPrintf(" SELECTED");
-            hPrintf(">%s</OPTION>", track->shortLabel);
+            // shortLabel comes from trackDb, which a track hub controls
+            hPrintf(">%s</OPTION>", htmlEncode(track->shortLabel));
 	    }
 	}
     if (selTrackIsDisabled)
         selTrack = firstEnabled;
     hPrintf("</SELECT>\n");
     }
 hPrintf("\n");
 return selTrack;
 }
 
 char *unsplitTableName(char *table)
 /* Convert chr*_name to name */
 {
 if (startsWith("chr", table))
     {