52cee2eff9e953d4584a415b8a9b84bd2326d3cd
braney
  Tue Aug 18 11:14:37 2026 -0700
hgTables: encode track menu and schema text consistently, refs #38123

diff --git src/hg/hgTables/schema.c src/hg/hgTables/schema.c
index 9746bad24bb..53225f8cd0a 100644
--- src/hg/hgTables/schema.c
+++ src/hg/hgTables/schema.c
@@ -331,31 +331,32 @@
 		    break;
 		    }
 	}
     if (gotRetVal)
         break;
     }
 slFreeList(&chain);
 return retVal;
 }
 
 void printTrackHtml(struct trackDb *tdb)
 /* If trackDb has html for table, print it out in a new section. */
 {
 if (tdb != NULL && isNotEmpty(tdb->html))
     {
-    webNewSection("%s (%s) Track Description", tdb->shortLabel, tdb->track);
+    // shortLabel comes from trackDb, which a track hub controls
+    webNewSection("%s (%s) Track Description", htmlEncode(tdb->shortLabel), tdb->track);
     char *browserVersion;
     if (btIE == cgiClientBrowser(&browserVersion, NULL, NULL) && *browserVersion < '8')
         puts(tdb->html);
     else
 	{
 	// H2 (as in "<H2>Description</H2>") has a big top margin, which adds to
 	// the 10px start-of-web-section <tr> (except for IE < 8, above).
 	// Tim's trick for moving the text back up in this case, to look like more
 	// like details pages in which HR's bottom margin melts into H2's top margin:
 	char *s = skipLeadingSpaces(tdb->html);
 	if (startsWith("<H2>", s) || startsWith("<h2>", s))
 	    printf("<div style='position:relative; top:-1.2em; margin-bottom:0em;'>%s\n</div>",
 		   tdb->html);
 	else
 	    puts(tdb->html);