Escape special characters (e.g. '<', '>') in title text

diff --git a/xkcd_keyboard_nav.user.js b/xkcd_keyboard_nav.user.js
index b35c7ca..0cfdcef 100644 (file)
--- a/xkcd_keyboard_nav.user.js
+++ b/xkcd_keyboard_nav.user.js
@@ -1,6 +1,6 @@
 /* xkcd keyboard nav - Navigate xkcd with your keyboard
  * 
- * Copyright (c) 2015 Adrian Iain Lam <adrianiainlam@gmail.com>
+ * Copyright (c) 2015-2018 Adrian Iain Lam <me@adrianiainlam.tk>
  * 
  * This program is free software. It comes without any warranty, to
  * the extent permitted by applicable law. You can redistribute it
@@ -27,7 +27,7 @@
 // @name        xkcd keyboard nav
 // @namespace   https://github.com/adrianiainlam
 // @description Navigate xkcd with your keyboard
-// @version     1.0.3
+// @version     1.0.4
 // @downloadURL https://gist.github.com/adrianiainlam/542dd0794a874ca31321/raw/xkcd_keyboard_nav.user.js
 // @updateURL   https://gist.github.com/adrianiainlam/542dd0794a874ca31321/raw/xkcd_keyboard_nav.user.js
 // @include     /^https?://xkcd\.com(/[0-9]+)?/?$/
@@ -39,9 +39,9 @@ function showTitleText() {
   var child   = elem.children[0];
   var newnode = document.createElement("p");
   if(child instanceof HTMLImageElement) {
-      newnode.innerHTML = child.title;
+      newnode.appendChild(document.createTextNode(child.title));
   } else if(child instanceof HTMLAnchorElement && child.children[0] instanceof HTMLImageElement) {
-      newnode.innerHTML = child.children[0].title;
+      newnode.appendChild(document.createTextNode(child.children[0].title));
   } else {
       console.log("Title text not found by this script. Please file a bug report with URL");
   }