fixes and refactor

tests/test_search_highlight_utils.py

@@ -184,3 +184,26 @@ def test_create_qdro_highlight_requires_full_query_in_single_field():
     out = create_qdro_highlight(qdro, 'plan 123')
     assert out == ''
 
+
+def test_highlight_text_escapes_html_in_source_and_tokens():
+    # Source contains HTML, should be escaped, not interpreted
+    out = highlight_text('<script>alert(1)</script> Alpha & Beta', ['alpha', 'beta'])
+    # Tags are escaped; only <strong> wrappers exist
+    assert '&lt;script&gt;alert(1)&lt;/script&gt;' in out
+    assert '<strong>Alpha</strong>' in out
+    assert '<strong>Beta</strong>' in out
+    assert '<script>' not in out and '</script>' not in out
+
+
+def test_highlight_text_handles_quotes_and_apostrophes_safely():
+    out = highlight_text('He said "Hello" & it\'s fine', ['hello'])
+    # Quotes and ampersand should be escaped
+    assert '&quot;<strong>Hello</strong>&quot;' in out
+    assert '&#39;s' in out
+    assert '&amp;' in out
+
+
+def test_highlight_text_no_tokens_returns_escaped_source():
+    out = highlight_text('<b>bold</b>', [])
+    assert out == '&lt;b&gt;bold&lt;/b&gt;'
+