[PR #1413] [MERGED] Escape single quotes in htmlEntities() #1753

New issue

Closed

opened 2026-02-28 02:12:53 +03:00 by kerem · 0 comments

kerem commented

2026-02-28 02:12:53 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/tzapu/WiFiManager/pull/1413
Author: @abryant
Created: 5/7/2022
Status: ✅ Merged
Merged: 5/8/2022
Merged by: @tablatronix

Base: master ← Head: patch-1

📝 Commits (1)

6ae3268 Escape single quotes in htmlEntities()

📊 Changes

1 file changed (+1 additions, -0 deletions)

View changed files

📝 WiFiManager.cpp (+1 -0)

📄 Description

This should allow SSIDs that contain single quotes to populate data-ssid correctly. Without this patch, clicking on an SSID containing a single quote will either:

Not use the whole SSID, in cases where there's text before the quote:
foo'bar will appear in the SSID box as just foo
Fall back to innerText, in cases where the quote is the first character in the SSID:
'); DROP TABLE WIFI; -- will appear in the SSID box as a version that has spaces converted to non-breaking spaces, causing the connection to eventually fail with WL_NO_SSID_AVAIL.

Fixes #1412

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/tzapu/WiFiManager/pull/1413 **Author:** [@abryant](https://github.com/abryant) **Created:** 5/7/2022 **Status:** ✅ Merged **Merged:** 5/8/2022 **Merged by:** [@tablatronix](https://github.com/tablatronix) **Base:** `master` ← **Head:** `patch-1` --- ### 📝 Commits (1) - [`6ae3268`](https://github.com/tzapu/WiFiManager/commit/6ae3268a07639380b25b6b5efbdb61f03c6bf312) Escape single quotes in htmlEntities() ### 📊 Changes **1 file changed** (+1 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `WiFiManager.cpp` (+1 -0) </details> ### 📄 Description This should allow SSIDs that contain single quotes to populate data-ssid correctly. Without this patch, clicking on an SSID containing a single quote will either: * Not use the whole SSID, in cases where there's text before the quote: `foo'bar` will appear in the SSID box as just `foo` * Fall back to innerText, in cases where the quote is the first character in the SSID: `'); DROP TABLE WIFI; --` will appear in the SSID box as a version that has spaces converted to non-breaking spaces, causing the connection to eventually fail with WL_NO_SSID_AVAIL. Fixes #1412 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>