1c7ec830118f006d5fde9d8cdb36596edcf6e055
braney
  Tue Aug 18 12:03:17 2026 -0700
cheapcgi, hui: encode a bigBed-derived form control name, refs #38123

diff --git src/lib/cheapcgi.c src/lib/cheapcgi.c
index 7a6dfaad854..9b061eeddb7 100644
--- src/lib/cheapcgi.c
+++ src/lib/cheapcgi.c
@@ -1846,32 +1846,34 @@
         (msg ? " TITLE=\"" : ""), (msg ? msg : ""), (msg ? "\"" : "" ),
         text);
 }
 
 void cgiParagraph(char *text)
 /* Make text paragraph */
 {
 printf("<P> %s\n", text);
 }
 
 void cgiMakeRadioButton(char *name, char *value, boolean checked)
 /* Make radio type button.  A group of radio buttons should have the
  * same name but different values.   The default selection should be
  * sent with checked on. */
 {
+// name and value can carry a hub-supplied string (a bigBed field name from filterValues),
+// so encode them
 printf("<input type=radio name='%s' id='%s' value='%s'",
-        name, name, value);
+        htmlEncode(name), htmlEncode(name), htmlEncode(value));
 if (checked)
    printf(" CHECKED");
 printf(">");
 }
 
 void cgiMakeOnEventRadioButtonWithClass(char *name, char *value, boolean checked,
     char *class, char *event, char *command)
 /* Make radio type button with an event and an optional class attribute.
  *  A group of radio buttons should have the
  * same name but different values.   The default selection should be
  * sent with checked on. If class is non-null it is included. */
 {
 char temp[256];
 safef(temp, sizeof temp, "%s_%s", name, value);
 char *valNoSpc = replaceChars(temp, " ", "_"); // replace spaces with underscore