Describe the bug
Stored malicious HTML/JS payloads (e.g. <script>alert('XSS')</script>) are accepted and saved in player/game names without any validation or sanitization.
Phoenix auto-escapes output so no XSS executes now, but raw dangerous content stays in the database.
Expected behavior
Player and game names should be validated/sanitized on save reject or strip HTML/JS tags and other unsafe characters.
Screenshot
Desktop (please complete the following information):
- OS: Windows / macOS / Linux
- Browser: Chrome / Firefox / Edge
- Version: Latest
Additional context
- No content validation in changesets (only length/required checks).
- Raw HTML/JS stored in DB → big risk if someone later uses raw() in templates, adds exports (CSV/JSON), emails, or admin views.
- Current Phoenix escaping protects against immediate XSS, but this is a future-proofing / data integrity issue.
Describe the bug
Stored malicious HTML/JS payloads (e.g. <script>alert('XSS')</script>) are accepted and saved in player/game names without any validation or sanitization.
Phoenix auto-escapes output so no XSS executes now, but raw dangerous content stays in the database.
Expected behavior
Player and game names should be validated/sanitized on save reject or strip HTML/JS tags and other unsafe characters.
Screenshot
Desktop (please complete the following information):
Additional context