From 71099bb0ac170a4020190e9ed530d459dcea5771 Mon Sep 17 00:00:00 2001
From: Stephan Yelle <syelle@noreply.localhost>
Date: Sat, 20 Dec 2025 20:45:22 -0500
Subject: [PATCH] Update samy.ps1

---
 samy.ps1 | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/samy.ps1 b/samy.ps1
index 81263f6..abf7f7e 100644
--- a/samy.ps1
+++ b/samy.ps1
@@ -801,21 +801,30 @@ if (-not $Global:SamyTasks) {
 
             $labelText = Escape-HtmlText ([string]$_.Label)
 
-            $html = "<label$tooltipAttr><input type='checkbox' id='$taskId' name='$($_.Name)' data-column='$Column'> $labelText</label>"
+            $taskIdAttr = Escape-HtmlAttr ([string]$taskId)
+            $nameAttr   = Escape-HtmlAttr ([string]$_.Name)
+            $colAttr    = Escape-HtmlAttr ([string]$Column)
+
+            $html = "<label$tooltipAttr><input type=""checkbox"" id=""$taskIdAttr"" name=""$nameAttr"" data-column=""$colAttr""> $labelText</label>"
 
             if ($_.SubOptions) {
             $subHtml = (
                 $_.SubOptions |
                 ForEach-Object {
-                     $subLabel = Escape-HtmlText ([string]$_.Label)
-                    "<label style='margin-left:20px; display:block;'>
-                    <input type='checkbox' class='sub-option-$taskId' name='$($_.Value)' value='$($_.Value)'> $subLabel
+                    $subLabel = Escape-HtmlText ([string]$_.Label)
+
+                    $subTaskIdClass = Escape-HtmlAttr ([string]$taskId)
+                    $subValueAttr   = Escape-HtmlAttr ([string]$_.Value)
+
+                    "<label style=""margin-left:20px; display:block;"">
+                    <input type=""checkbox"" class=""sub-option-$subTaskIdClass"" name=""$subValueAttr"" value=""$subValueAttr""> $subLabel
                     </label>"
+
                 }
             ) -join "`n"
 
             $html += @"
-    <div id='${taskId}OptionsContainer' style='display:none; margin-top:4px;'>
+    <div id="$(Escape-HtmlAttr ([string]$taskId))OptionsContainer" style="display:none; margin-top:4px;">
     $subHtml
     </div>
 "@