From c1371eb0a2f18e2df0398b266b405b4871c070c4 Mon Sep 17 00:00:00 2001
From: Toks <tttoksss@gmail.com>
Date: Sun, 5 May 2013 20:31:07 -0400
Subject: [PATCH] escape html for related tags form

---
 app/assets/javascripts/blacklists.js  | 2 +-
 app/assets/javascripts/related_tag.js | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/blacklists.js b/app/assets/javascripts/blacklists.js
index ac8f2cafc..af2320f1b 100644
--- a/app/assets/javascripts/blacklists.js
+++ b/app/assets/javascripts/blacklists.js
@@ -57,7 +57,7 @@
       var link = $("<a/>");
       var count = $("<span/>");
 
-      link.html(entry.tags);
+      link.text(entry.tags);
       link.click(Danbooru.Blacklist.toggle_entry);
       count.html(entry.hits);
       item.append(link);
diff --git a/app/assets/javascripts/related_tag.js b/app/assets/javascripts/related_tag.js
index 39cd2d7de..b4586cc34 100644
--- a/app/assets/javascripts/related_tag.js
+++ b/app/assets/javascripts/related_tag.js
@@ -164,7 +164,7 @@
     var $ul = $("<ul/>");
     $ul.append(
       $("<li/>").append(
-        $("<em/>").html(
+        $("<em/>").text(
           query.replace(/_/g, " ")
         )
       )
@@ -173,7 +173,7 @@
     $.each(related_tags, function(i, tag) {
       if (tag[0][0] !== " ") {
         var $link = $("<a/>");
-        $link.html(tag[0].replace(/_/g, " "));
+        $link.text(tag[0].replace(/_/g, " "));
         $link.addClass("tag-type-" + tag[1]);
         $link.attr("href", "/posts?tags=" + encodeURIComponent(tag[0]));
         $link.click(Danbooru.RelatedTag.toggle_tag);
@@ -184,7 +184,7 @@
           $("<li/>").append($link)
         );
       } else {
-        $ul.append($("<li/>").html(tag[0]));
+        $ul.append($("<li/>").text(tag[0]));
       }
     });