Escaping content

handlers/default-types.xsl

@@ -86,7 +86,7 @@
 						<xsl:text>this.setAttribute("value", "</xsl:text><xsl:call-template name="get-duration-info"><xsl:with-param name="type">prefix</xsl:with-param><xsl:with-param name="pattern" select="$pattern" /></xsl:call-template>".concat(this.value).concat("<xsl:call-template name="get-duration-info"><xsl:with-param name="type">abbreviation</xsl:with-param><xsl:with-param name="pattern" select="$pattern" /></xsl:call-template><xsl:text>")); this.previousElementSibling.textContent = this.value;</xsl:text>
 					</xsl:when>
 					<xsl:otherwise> <!-- Use value if otherwise -->
-						<xsl:text>if (this.value) { this.setAttribute("value", this.value</xsl:text><xsl:if test="$whitespace = 'replace'">.replace(/\s/g, " ")</xsl:if><xsl:if test="$whitespace = 'collapse'">.replace(/\s+/g, " ").trim()</xsl:if><xsl:text>); } else { this.removeAttribute("value"); };</xsl:text>
+						<xsl:text>if (this.value) { this.setAttribute("value", escapeContent(this.value)</xsl:text><xsl:if test="$whitespace = 'replace'">.replace(/\s/g, " ")</xsl:if><xsl:if test="$whitespace = 'collapse'">.replace(/\s+/g, " ").trim()</xsl:if><xsl:text>); } else { this.removeAttribute("value"); };</xsl:text>
 					</xsl:otherwise>
 				</xsl:choose>
 			</xsl:attribute>

js/html-populators.xsl

@@ -36,7 +36,7 @@
 								//check for input elements existing to handle empty elements
 								&& o.previousElementSibling.previousElementSibling.querySelector("input, textarea, select")
 								//check if element has been populated with data from an xml document
-								&& !o.previousElementSibling.previousElementSibling.querySelector("input, textarea, select").hasAttribute("data-xsd2html2xml-filled")) {
+								&& Array.from(o.previousElementSibling.previousElementSibling.querySelectorAll("input, textarea, select")).filter(function(el) {return el.hasAttribute("data-xsd2html2xml-filled")}).length == 0) {
 								clickRemoveButton(
 									o.parentElement.children[0].querySelector("legend > button.remove, span > button.remove")
 								);

js/xml-generators.xsl

@@ -116,7 +116,7 @@
 						            case "gyearmonth":
 						            	return node.getElementsByTagName("input")[0].getAttribute("value");
 						            default:
-						            	return node.getElementsByTagName("input")[0].value;
+						            	return escapeContent(node.getElementsByTagName("input")[0].value);
 				            	}
 				        }
 				    } else if (node.getElementsByTagName("select").length != 0) {
@@ -132,6 +132,22 @@
 				    } else if (node.getElementsByTagName("textarea").length != 0) {
 				    	return node.getElementsByTagName("textarea")[0].value;
 				    }
+				};
+
+				var characterToXmlSafe = {
+					"<": "<",
+					">": ">",
+					"&": "&",
+					"\"": """,
+					"'": "'" /* This doesn't seem to work, so turned off in escapeContent function */
+				};
+
+				var escapeContent = function(content)
+				{
+					return content.replace(/[<>&"]/g, function(character)
+					{
+						return characterToXmlSafe[character];
+					});
 				}
 			</xsl:text>
 		</xsl:element>