tree b8cef7b05e90bb7e07fcb493759b4fb4cb784134
parent e64837957394de67900bc92386376c9b58609773
author Jonathan Amsterdam <jba@google.com> 1592439759 -0400
committer Jonathan Amsterdam <jba@google.com> 1592919395 +0000

internal/{source,frontend}: escape HTML

Escape any strings that may come from outside the program and will
be rendered as HTML.

Also, fix some typos.

Also, put args to a cmp.Diff call in the right order.

Change-Id: I1fc6013e200326af8719b14c28a607fc7936e20a
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/239478
Reviewed-by: Julie Qiu <julie@golang.org>