From 65692d67a852c0c0bb819f00a113da72e5f8000c Mon Sep 17 00:00:00 2001
From: x <admin@f0ck.it>
Date: Sat, 24 Jan 2026 19:18:56 +0100
Subject: [PATCH] refactor: Migrate template variable output to use escaped
 syntax

---
 views/index.html        | 36 ++++++++++++++++++------------------
 views/item-partial.html |  2 +-
 views/search.html       | 19 +++++++++++--------
 views/settings.html     |  2 +-
 4 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/views/index.html b/views/index.html
index 684016b..e09480f 100644
--- a/views/index.html
+++ b/views/index.html
@@ -1,18 +1,18 @@
-@include(snippets/header)
-<div class="pagewrapper">
-  <div id="main">
-    <div class="index-container">
-      @if(tmp.user)<h2>user: <a href="/user/{{ tmp.user.toLowerCase() }}">{!! tmp.user.toLowerCase() !!}</a>@if(tmp.mime) ({{ tmp.mime }}s)@else (all)@endif</h2>@endif
-      @if(tmp.tag)<h2>tag: @if(session)<a href="/search?tag={!! tmp.tag.toLowerCase() !!}" target="_blank">{!! tmp.tag.toLowerCase() !!}</a>@else{!! tmp.tag.toLowerCase() !!}@endif@if(tmp.mime) ({{ tmp.mime }}s)@else (all)@endif</h2>@endif
-      <div class="posts">
-        @each(items as item)
-        <a href="{{ link.main }}{{ item.id }}" data-mime="{{ item.mime }}" data-mode="{{ item.tag_id ? ['','sfw','nsfw'][item.tag_id] : 'null' }}" style="background-image: url('/t/{{ item.id }}.webp')"><p></p></a>
-        @endeach
-      </div>
-      <div id="footbar">
-        &#9660;
-      </div>
-    </div>
-  </div>
-</div>
-@include(snippets/footer)
+@include(snippets/header)
+<div class="pagewrapper">
+  <div id="main">
+    <div class="index-container">
+      @if(tmp.user)<h2>user: <a href="/user/{{ tmp.user.toLowerCase() }}">{{ tmp.user.toLowerCase() }}</a>@if(tmp.mime) ({{ tmp.mime }}s)@else (all)@endif</h2>@endif
+      @if(tmp.tag)<h2>tag: @if(session)<a href="/search?tag={{ tmp.tag.toLowerCase() }}" target="_blank">{{ tmp.tag.toLowerCase() }}</a>@else{{ tmp.tag.toLowerCase() }}@endif@if(tmp.mime) ({{ tmp.mime }}s)@else (all)@endif</h2>@endif
+      <div class="posts">
+        @each(items as item)
+        <a href="{{ link.main }}{{ item.id }}" data-mime="{{ item.mime }}" data-mode="{{ item.tag_id ? ['','sfw','nsfw'][item.tag_id] : 'null' }}" style="background-image: url('/t/{{ item.id }}.webp')"><p></p></a>
+        @endeach
+      </div>
+      <div id="footbar">
+        &#9660;
+      </div>
+    </div>
+  </div>
+</div>
+@include(snippets/footer)
diff --git a/views/item-partial.html b/views/item-partial.html
index 8f96e73..da880ee 100644
--- a/views/item-partial.html
+++ b/views/item-partial.html
@@ -103,7 +103,7 @@
             @if(typeof item.tags !== "undefined")
             @each(item.tags as tag)
             <span @if(session)tooltip="{{ tag.user }}" @endif class="badge {{ tag.badge }} mr-2">
-                <a href="/tag/{{ tag.normalized }}">{!! tag.tag !!}</a>@if(session.admin)&nbsp;<a class="removetag"
+                <a href="/tag/{{ tag.normalized }}">{{ tag.tag }}</a>@if(session.admin)&nbsp;<a class="removetag"
                     href="#">&#215;</a>@endif
             </span>
             @endeach
diff --git a/views/search.html b/views/search.html
index 2c0543a..705ee53 100644
--- a/views/search.html
+++ b/views/search.html
@@ -5,7 +5,7 @@
       <span>search</span>
     </div>
     <form action="/search" class="admin-search">
-      <input type="text" name="tag" value="{!! searchstring || '' !!}" /><button type="submit">🔍</button>
+      <input type="text" name="tag" value="{{ searchstring || '' }}" /><button type="submit">🔍</button>
     </form>
     <div class="results">
       @if(result)
@@ -22,20 +22,23 @@
           </tr>
         </thead>
         <tbody>
-      @each(result as line)
+          @each(result as line)
           <tr>
-            <td style="width: 128px;"><a href="/tag/{!! line.tag !!}/{{ line.id }}" target="_blank"><img src="/t/{{ line.id }}.webp" /></a></td>
-            <td><span class="mview_desc">ID:</span><a href="/tag/{!! line.tag !!}/{{ line.id }}" target="_blank">{{ line.id }}</a></td>
-            <td><span class="mview_desc">Tag:</span><a href="/tag/{!! line.tag !!}">{!! line.tag !!}</a></td>
+            <td style="width: 128px;"><a href="/tag/{{ line.tag }}/{{ line.id }}" target="_blank"><img
+                  src="/t/{{ line.id }}.webp" /></a></td>
+            <td><span class="mview_desc">ID:</span><a href="/tag/{{ line.tag }}/{{ line.id }}" target="_blank">{{
+                line.id }}</a></td>
+            <td><span class="mview_desc">Tag:</span><a href="/tag/{{ line.tag }}">{{ line.tag }}</a></td>
             <td><span class="mview_desc">Mime:</span>{{ line.mime }}</td>
-            <td><span class="mview_desc">User:</span><a href="/user/{!! line.username !!}/f0cks/{{ line.id }}">{!! line.username !!}</a></td>
+            <td><span class="mview_desc">User:</span><a href="/user/{{ line.username }}/f0cks/{{ line.id }}">{{
+                line.username }}</a></td>
             <td><span class="mview_desc">Score:</span>{{ line.score?.toFixed(2) }}</td>
           </tr>
-      @endeach
+          @endeach
         </tbody>
       </table>
       @endif
     </div>
   </div>
 </div>
-@include(snippets/footer)
+@include(snippets/footer)
\ No newline at end of file
diff --git a/views/settings.html b/views/settings.html
index 1c19b43..9bf20c9 100644
--- a/views/settings.html
+++ b/views/settings.html
@@ -24,7 +24,7 @@
       </tr>
       <tr>
         <td>username</td>
-        <td>{!! session.user !!}</td>
+        <td>{{ session.user }}</td>
       </tr>
       <tr>
         <td>@if(session.avatar)<a href="/{{ session.avatar }}"><img id="img_avatar"