e6b0dc7877ae4b24f56682885e03263fd2da3582
braney
  Tue Aug 18 11:37:04 2026 -0700
lib, hgc: encode barChart, BAM and VCF detail text consistently, refs #38123

diff --git src/hg/hgc/barChartClick.c src/hg/hgc/barChartClick.c
index 7cb1d54f446..721f1cf9717 100644
--- src/hg/hgc/barChartClick.c
+++ src/hg/hgc/barChartClick.c
@@ -521,48 +521,51 @@
 // get name and name2 from trackDb, .as file, or use defaults
 struct asColumn *nameCol = NULL, *name2Col = NULL;
 //struct asColumn *name2Col;
 char *nameLabel = NULL, *name2Label = NULL;
 if (as != NULL)
     {
     numColumns = slCount(as->columnList);
     nameCol = asFindColByIx(as, BARCHART_NAME_COLUMN_IX);
     name2Col = asFindColByIx(as, BARCHART_NAME2_COLUMN_IX);
     }
 nameLabel = trackDbSettingClosestToHomeOrDefault(tdb, "bedNameLabel", nameCol ? nameCol->comment : "Item");
 struct slPair *fields = getFields(tdb, row);
 if (trackDbSettingClosestToHomeOrDefault(tdb, "url", NULL) != NULL)
     printCustomUrlWithFields(tdb, item, item, TRUE, fields);
 else
-    printf("<b>%s: </b>%s ", nameLabel, chartItem->name);
+    // the label comes from trackDb or the autoSql, the name from the bigBed
+    printf("<b>%s: </b>%s ", hubEncode(tdb, nameLabel), hubEncode(tdb, chartItem->name));
 name2Label = name2Col ? name2Col->comment : "Alternative name";
 if (differentString(chartItem->name2, ""))
     {
     if (trackDbSettingClosestToHomeOrDefault(tdb, "url2", NULL) != NULL)
         printOtherCustomUrl(tdb, chartItem->name2, "url2", TRUE);
     else
-        printf("(%s: %s)<br>\n", name2Label, chartItem->name2);
+        printf("(%s: %s)<br>\n", hubEncode(tdb, name2Label), hubEncode(tdb, chartItem->name2));
     }
 else
     printf("<br>\n");
 
 int categId;
 float highLevel = barChartMaxValue(chartItem, &categId);
 char *units = trackDbSettingClosestToHomeOrDefault(tdb, BAR_CHART_UNIT, "units");
 char *metric = trackDbSettingClosestToHomeOrDefault(tdb, BAR_CHART_METRIC, "");
+// barChartMetric, barChartUnit and the bar labels all come from trackDb
 printf("<b>Maximum %s value: </b> %0.2f %s in %s<br>\n",
-	    metric, highLevel, units, barChartUiGetCategoryLabelById(categId, database, tdb, NULL));
+	    hubEncode(tdb, metric), highLevel, hubEncode(tdb, units),
+	    hubEncode(tdb, barChartUiGetCategoryLabelById(categId, database, tdb, NULL)));
 printf("<b>Gene position: "
                 "</b>%s <a href='%s&db=%s&position=%s%%3A%d-%d'>%s:%d-%d</a>\n",
                     database, hgTracksPathAndSettings(), database,
                     chartItem->chrom, chartItem->chromStart+1, chartItem->chromEnd,
                     chartItem->chrom, chartItem->chromStart+1, chartItem->chromEnd);
 printf("&nbsp;&nbsp;<b>Strand: </b> %s\n", chartItem->strand);
 
 // print any remaining extra fields
 if (numColumns > 0)
     {
     extraFieldsPrint(tdb, NULL, extraFields, extraFieldCount);
     }
 
 char *matrixUrl = NULL, *sampleUrl = NULL;
 struct barChartItemData *vals = getSampleVals(tdb, chartItem, &matrixUrl, &sampleUrl);