From 0098fa87469f918f2c4a84f5ef49031e8e63c4f0 Mon Sep 17 00:00:00 2001
From: Lan Hui <1348141770@qq.com>
Date: Fri, 29 Jul 2022 15:26:19 +0800
Subject: [PATCH] Prevent attribute injection

---
 app/templates/userpage_post.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/templates/userpage_post.html b/app/templates/userpage_post.html
index ba3b38d..725ee09 100644
--- a/app/templates/userpage_post.html
+++ b/app/templates/userpage_post.html
@@ -30,7 +30,7 @@
             :
             <a href='http://youdao.com/w/eng/{{word}}/#keyfrom=dict2.index' title={{word}}>{{word}}</a>
             ({{x[1]}})
-            <input type="checkbox" name="marked" value={{word}}>
+            <input type="checkbox" name="marked" value="{{word}}">
         </p>
 
        {% endfor %}
@@ -42,4 +42,4 @@
         {% endfor %}
     {% endif %}
 </body>
-</html>
\ No newline at end of file
+</html>