From a5ece0f5c3c2196c2b86a757aba240c807078d6f Mon Sep 17 00:00:00 2001
From: Stephan Yelle <syelle@noreply.localhost>
Date: Sat, 20 Dec 2025 20:12:41 -0500
Subject: [PATCH] Update samy.ps1

---
 samy.ps1 | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/samy.ps1 b/samy.ps1
index fab10b3..a3e19e7 100644
--- a/samy.ps1
+++ b/samy.ps1
@@ -751,7 +751,7 @@ if (-not $Global:SamyTasks) {
     throw "SAMY cannot continue: failed to load tasks from $Script:SamyTasksUrl"
 }
 
-  #endregion building the Menus
+  #endregion building the Menu
 
     #region Publish-Checkboxes
     function Publish-Checkboxes {
@@ -760,6 +760,26 @@ if (-not $Global:SamyTasks) {
         [string]$Column
     )
 
+    function Escape-HtmlAttr {
+    param([string]$s)
+    if ([string]::IsNullOrEmpty($s)) { return '' }
+    $s = $s -replace '&','&amp;'
+    $s = $s -replace '"','&quot;'
+    $s = $s -replace '<','&lt;'
+    $s = $s -replace '>','&gt;'
+    return $s
+    }
+
+    function Escape-HtmlText {
+        param([string]$s)
+        if ([string]::IsNullOrEmpty($s)) { return '' }
+        $s = $s -replace '&','&amp;'
+        $s = $s -replace '<','&lt;'
+        $s = $s -replace '>','&gt;'
+        return $s
+    }
+
+
     # Start with all tasks on the given page
     $tasks = $Global:SamyTasks | Where-Object Page -EQ $Page
 
@@ -772,9 +792,18 @@ if (-not $Global:SamyTasks) {
         $tasks |
         ForEach-Object {
             $taskId   = $_.Id
-            $tooltip = " title='$($_.Tooltip)'"
+            $rawTooltip = if ($_.PSObject.Properties.Name -contains 'Tooltip' -and $_.Tooltip) {
+                [string]$_.Tooltip
+            } else {
+                [string]$_.Label
+            }
 
-            $html = "<label$tooltip><input type='checkbox' id='$taskId' name='$($_.Name)' data-column='$Column'> $($_.Label)</label>"
+            $tooltipText = Escape-HtmlAttr $rawTooltip
+            $tooltipAttr = if ([string]::IsNullOrWhiteSpace($tooltipText)) { '' } else { " title=""$tooltipText""" }
+
+            $labelText = Escape-HtmlText ([string]$_.Label)
+
+            $html = "<label$tooltipAttr><input type='checkbox' id='$taskId' name='$($_.Name)' data-column='$Column'> $labelText</label>"
 
             if ($_.SubOptions) {
             $subHtml = (