// escapeHtml escapes characters that are significant in HTML so that // user-controlled values (client names, emails, notes, ...) cannot be used to // inject markup or scripts when interpolated into the DOM. function escapeHtml(value) { if (value === null || value === undefined) { return ''; } return String(value) .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } function renderClientList(data) { $.each(data, function(index, obj) { const clientName = escapeHtml(obj.Client.name); // render telegram button let telegramButton = '' if (obj.Client.telegram_userid) { telegramButton = `