Need to escape id3 tags

[GoogleCodeExporter]

A malicious id3 tag may cause security risk if displayed directly
1. id3 tag containing html markup might adversely affect display
2. an intentionally constructed id3 tag might embed an undesired javascript
into a page.

The solution is to either not display tags, or escape them before displaying.

Original issue reported on code.google.com by mico.dr...@gmail.com on 20 Sep 2009 at 6:55

[GoogleCodeExporter]

OPEN:
AnOggPlayer.hx

FIND:
comments = comments +"=\""+StringTools.replace(comment[1],"\"","\"\"")+"\";";

REPLACE WITH:
comments = comments +"=\""+StringTools. htmlEscape 
(StringTools.replace(comment[1],"\"","\"\""))+"\";";

Original comment by Yahav.Sh...@gmail.com on 18 Aug 2010 at 3:20

[GoogleCodeExporter]

REPLACE WITH:
comments = comments 
+"=\""+StringTools.htmlEscape(StringTools.replace(comment[1],"\"","\"\""))+"\";"
;


(REMOVED THE SPACES)

Original comment by Yahav.Sh...@gmail.com on 18 Aug 2010 at 3:21