Defensive programming: more urlencode/htmlentities

Make build_url return an URL, not HTML. This separates presentation
from data.

plugin_header's return value is unused, remove the unnecessary return.

At places where `printf("<tag att='%s'>", $x);` is used, it is now
converted to `printf("<tag att=\"%s\">", htmlentities($x));` since
the single quote is not escaped by default by htmlentities.

In case the canvas style is used, JS should use `textContent` instead
of `innerHTML` to avoid reading `&quot;` instead of `"`. Nobody (should)
use(s) IE6 anymore, so it is a safe change.

While at it, use the standard charset attribute of meta to specify
the character set (UTF-8).

1 files changed, 1 insertions, 1 deletions

diff --git a/js/CGP.js b/js/CGP.js
index bbfd1b5..c30cfd2 100644
--- a/js/CGP.js
+++ b/js/CGP.js
@@ -66,7 +66,7 @@ function prepare_draw(id) {
         RrdGraph.prototype.mousex = 0;
         RrdGraph.prototype.mousedown = false;
 
-        var cmdline = document.getElementById(id).innerHTML;
+        var cmdline = document.getElementById(id).textContent;
         var gfx = new RrdGfxCanvas(id);
         var fetch = new RrdDataFile();
         var rrdcmdline = null;