[michaelJustin]

Closes #562.

djGlobal.HTMLEncode escaped only <, >, & and ". Application code that used it for a single-quoted attribute value could be broken out of:

Response.ContentText := '<input value=''' + HTMLEncode(Name) + '''>';
// Name = "' autofocus onfocus='alert(1)" used to close the attribute and add an event handler

The framework's own uses (the 404 page and the development-mode 500 page) put the value in element text and were not affected.

Changes

• ' is now escaped as '. This only adds escaping, so existing output stays valid HTML.
• The result is sized exactly in a first pass, instead of SetLength(Result, Length(AData) * 6). When nothing needs escaping, the input is returned as-is, with no new allocation.
• A doc comment on the declaration states where the output is safe: element text and quoted attribute values (single or double). It is not safe for unquoted attributes, JavaScript, CSS or URLs.
• SECURITY.md "Output encoding" is updated to match.
• CHANGELOG: entry under Security.

Tests

djGlobalTests adds:

• ' on its own;
• the attribute break-out from the issue;
• text with nothing to escape, including a non-ASCII character.

The consecutive-characters test now includes ', and the widest-escape test's comment now describes the exact sizing.

• FPC (run-fpc.cmd): 215 tests, 0 errors, 0 failures; heap trace at the clean baseline (6 blocks / 744 bytes).
• Delphi 2009 (run-delphi.cmd): OK, 215 tests.

Both were run before the rebase onto the merged #568, which touches none of these files.

🤖 Generated with Claude Code