Fixed escaping HTML entities in HTML formatter

Fixes #83

Signed-off-by: Michal Čihař <michal@cihar.com>

Author: nijel

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## [Unreleased]
 
 * Fix parsing of DEFINER without backquotes
+* Fixed escaping HTML entities in HTML formatter
 
 ## [3.4.6] - 2016-09-13
 

src/Utils/Formatter.php

@@ -453,7 +453,7 @@ public function toString($token)
 
                 // Formatting HTML.
                 if ($this->options['type'] === 'html') {
-                    return '<span ' . $format['html'] . '>' . $text . '</span>';
+                    return '<span ' . $format['html'] . '>' . htmlspecialchars($text, ENT_NOQUOTES) . '</span>';
                 } elseif ($this->options['type'] === 'cli') {
                     return $format['cli'] . $text;
                 }
@@ -464,8 +464,9 @@ public function toString($token)
 
         if ($this->options['type'] === 'cli') {
             return "\x1b[39m" . $text;
+        } elseif ($this->options['type'] === 'html') {
+            return htmlspecialchars($text, ENT_NOQUOTES);
         }
-        return $text;
     }
 
     /**