Fix HTML escaping

1 files changed, 3 insertions, 0 deletions

diff --git a/src/main/java/com/juick/util/MessageUtils.java b/src/main/java/com/juick/util/MessageUtils.java
index 5669a454..84c29807 100644
--- a/src/main/java/com/juick/util/MessageUtils.java
+++ b/src/main/java/com/juick/util/MessageUtils.java
@@ -144,6 +144,9 @@ public class MessageUtils {
     }
 
     public static String formatMessage(String msg) {
+        msg = msg.replaceAll("&", "&");
+        msg = msg.replaceAll("<", "&lt;");
+        msg = msg.replaceAll(">", "&gt;");
         // --
         // &mdash;
         msg = msg.replaceAll("((?<=\\s)|(?<=\\A))\\-\\-?((?=\\s)|(?=\\Z))", "$1&mdash;$2");