escape

src/state/fsm/priceiswrong/events.go

@@ -36,7 +36,7 @@ func (p *PriceIsWrong) apply(e priceiswrong.Event) error {
 	case *priceiswrong.Guess:
 		for i := range p.Contestants {
 			if p.Contestants[i].ID == e.ID {
-				p.Contestants[i].Guess = e.Guess
+				p.Contestants[i].Guess = html.EscapeString(e.Guess)
 			}
 		}
 	}