Bug: setAsWho fails when surname contains a single quote

Question

How to reproduce:

1. Go to any profile. Click any of "add parent/spouse/child"

2. Input "First Name at Birth" = Jacques Bonaventure

3. Input "Last Name at Birth" = L'Italien

4. Enter "Birth Date" = 1718-11-17

The system will suggest a profile (L'Italien-3) but the link [set as father] will not work.

The HTML generated:

<span class="pseudolink" onclick="setAsWho(&quot;L" italien-3");'="">set as father]</span>

Comments

That looks like the classic SQL gotcha with unescaped single quotes, and I'm amazed that the WikiTree software doesn't catch it. It's a potential security bug.

Answer 1

Thanks for reporting this, PB.