f2d3014a3cc95116346eab4675817cf0c65f6d62
braney
  Tue Aug 18 11:12:35 2026 -0700
hgc: encode item detail text consistently, refs #38123

diff --git src/hg/hgc/hgc.h src/hg/hgc/hgc.h
index abda4b2f4a1..a4c0bd16077 100644
--- src/hg/hgc/hgc.h
+++ src/hg/hgc/hgc.h
@@ -540,30 +540,33 @@
  */
 
 void printIframe(struct trackDb *tdb, char *itemName);
 /* print an iframe with the URL specified in trackDb (iframeUrl), can have
  * the standard codes in it (like $$ for itemName, etc) */
 
 char *getIdInUrl(struct trackDb *tdb, char *itemName);
 /* If we have an idInUrlSql tag, look up itemName in that, else just
  * return itemName. */
 
 // trackDb setting prefix for JS visualization scripts on details pages.
 // Format: detailsScript.<plotType>.<fieldName> <jsonConfig>
 // Parsed in both bigBedClick.c (to build JSON + load JS) and hgc.c (to skip fields from table).
 #define DETAILS_SCRIPT_PREFIX "detailsScript.*"
 
+char *hubEncode(struct trackDb *tdb, char *text);
+/* Return text escaped for HTML if it belongs to a track hub, otherwise return it unchanged. */
+
 void printFieldLabel(char *entry);
 /* print the field label, the first column in the table, as a <td>. Allow a
  * longer description after a |-char, as some fields are not easy to
  * understand. */
 
 void printFieldLabelWithId(char *entry, char *fieldName);
 /* Like printFieldLabel but adds id="bfld_<fieldName>" to the <tr> element,
  * so JavaScript can find the row by field name. */
 
 struct slPair* getExtraFields(struct trackDb *tdb, char **fields, int fieldCount);
 /* return the extra field names and their values as a list of slPairs */
 
 struct slPair *getFields(struct trackDb *tdb, char **fields);
 /* return field names and their values as a list of slPairs.  */