From f0314bb1129efc13de4ccb0682ab303bfdd028e3 Mon Sep 17 00:00:00 2001
From: John MacFarlane <jgm@berkeley.edu>
Date: Mon, 7 Sep 2026 09:29:18 -0700
Subject: [PATCH] htmlAttrs: escape id and class attributes, like the others.

---
 src/Text/Pandoc/Writers/Shared.hs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/Text/Pandoc/Writers/Shared.hs b/src/Text/Pandoc/Writers/Shared.hs
index 2e8001b90..3f172d0ef 100644
--- a/src/Text/Pandoc/Writers/Shared.hs
+++ b/src/Text/Pandoc/Writers/Shared.hs
@@ -204,10 +204,11 @@ htmlAttrs :: HasChars a => Attr -> Doc a
 htmlAttrs (ident, classes, kvs) = addSpaceIfNotEmpty (hsep [
   if T.null ident
       then empty
-      else "id=" <> doubleQuotes (text $ T.unpack ident)
+      else "id=" <> doubleQuotes (text $ T.unpack (escapeStringForXML ident))
   ,if null classes
       then empty
-      else "class=" <> doubleQuotes (text $ T.unpack (T.unwords classes))
+      else "class=" <> doubleQuotes
+             (text $ T.unpack . escapeStringForXML $ T.unwords classes)
   ,hsep (map (\(k,v) -> formatKey k <> "=" <>
                 doubleQuotes (text $ T.unpack (escapeStringForXML v))) kvs)
   ])