From da5aa094213df5490c5bd95a57e60058cda72bc6 Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Sun, 12 Jul 2026 13:09:10 +0800
Subject: [PATCH] fix: escape single quotes in U.esc to prevent onclick
 attribute injection

---
 public/js/utils.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/js/utils.js b/public/js/utils.js
index e14a3b7..ec7c6b3 100644
--- a/public/js/utils.js
+++ b/public/js/utils.js
@@ -22,7 +22,7 @@ const U = {
 
   esc(s) {
     if (!s) return '';
-    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
   },
 
   showAlert(containerId, type, msg) {