diff --git a/core/lib/utils/string_convert.dart b/core/lib/utils/string_convert.dart index a959aeacb..8e1b7b75a 100644 --- a/core/lib/utils/string_convert.dart +++ b/core/lib/utils/string_convert.dart @@ -216,7 +216,15 @@ class StringConvert { } static String convertTextContentToHtmlContent(String textContent) { - final htmlContent = textContent.replaceAll('\n', '
'); + // Escape HTML entities first to prevent interpretation as HTML + final escapedContent = textContent + .replaceAll('&', '&') + .replaceAll('<', '<') + .replaceAll('>', '>') + .replaceAll('"', '"') + .replaceAll("'", '''); + + final htmlContent = escapedContent.replaceAll('\n', '
'); return '
$htmlContent
'; }