Potential fix for code scanning alert no. 6: DOM text reinterpreted as HTML

[vannu07]

Potential fix for https://github.com/vannu07/jarvis/security/code-scanning/6

To fix the issue, all text coming from the DOM (via t.text()) should be escaped before being added as HTML content using string concatenation and .append(). The best way is to properly encode the item variable before concatenation in line 18, so HTML metacharacters are converted to entities (e.g., < becomes <). In jQuery, a common approach is to use document.createTextNode to escape text, but since we are building HTML as a string, we need an explicit escaping function.

• Add an escape function to convert metacharacters to their HTML entity forms.
• Use this function to escape item before concatenating.
• All edits must be inside the relevant code you have been shown.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Message that will be displayed on users' first pull request