Special characters may break `onclick`

[LuisHeinzlmeier]

If I render this question, it does not respond to my clicks. The multiple-choice question may not work correctly if the explanation text contains quotes or special characters (').

multiple_choice_question(
    question_id="q4",
    question="How would you access RNA data in a MuData object `mdata`?",
    options=[
        "mdata.rna",
        "mdata.obs['rna']",
        "mdata.mod['rna']",
        "mdata.uns['rna']",
    ],
    correct_answer="mdata.mod['rna']",
    explanations={
        "mdata.rna": "MuData does not provide direct attributes for modalities. They are stored in `mod`.",
        "mdata.obs['rna']": "`obs` stores cell-level metadata, not modality data.",
        "mdata.uns['rna']": "`uns` stores unstructured metadata, not the modality matrix.",
    },
)

LLM suggested sth like this:

import html
explanation_text_escaped = html.escape(explanation_text)

[flying-sheep]

What does “special” mean? Non-ASCII?

[LuisHeinzlmeier]

I didn't follow up on this. But when I asked LLM about it, I got the answer that it might be the character '. This question works fine, for example:

multiple_choice_question(
    question_id="q3a",
    question="In an AnnData object, which slot stores the main count matrix for scRNA-seq data?",
    options=["X", "obs", "var", "uns"],
    correct_answer="X",
    explanations={
        "obs": "`.obs` stores cell-level metadata (observations), not the main count matrix.",
        "var": "`.var` stores gene-level metadata (variables), not the expression matrix itself.",
        "uns": "`.uns` stores unstructured metadata.",
    },
)

[flying-sheep]

This is basically an injection vulnerability, and why that might not mean anything in this context, it should be the absolute baseline standard of anyone writing code to not write it like this.

To generate HTML, you should use a template language like Jinja or specially designed APIs accepting the new Python 3.14 template strings, not manually interpolated strings.