From 2855622d7fe235c6c805716edff943b5945d1eea Mon Sep 17 00:00:00 2001
From: Hsiaoming Yang <me@lepture.com>
Date: Mon, 6 Apr 2026 21:11:33 +0900
Subject: [PATCH] fix: escape id of headings

---
 src/mistune/renderers/html.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mistune/renderers/html.py b/src/mistune/renderers/html.py
index 41e2c19..dabc009 100644
--- a/src/mistune/renderers/html.py
+++ b/src/mistune/renderers/html.py
@@ -108,7 +108,7 @@ def heading(self, text: str, level: int, **attrs: Any) -> str:
         html = "<" + tag
         _id = attrs.get("id")
         if _id:
-            html += ' id="' + _id + '"'
+            html += ' id="' + escape_text(_id) + '"'
         return html + ">" + text + "</" + tag + ">\n"
 
     def blank_line(self) -> str: