Fix HTML injection in email templates and harden server-side validation

[Copilot]

User input is interpolated directly into HTML email bodies without escaping, enabling HTML/script injection in both notification and auto-reply emails. Server endpoints also lack input validation and leak internal error details to clients.

Changes

• HTML escaping — Added escapeHtml() to sanitize name, email, subject, message before embedding in HTML email templates across server/index.js, netlify/functions/contact.js, and project/server/index.js

function escapeHtml(str) {
  return String(str)
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#39;');
}

• Input validation — Added required-field checks with .trim() and email format validation via regex on all server-side handlers
• Error leakage — Replaced res.status(500).json({ error: error.message }) with a generic message to avoid exposing SMTP internals to clients

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[netlify]

✅ Deploy Preview for harshitkulkarnisportfolio ready!

Name	Link
🔨 Latest commit	bbee637
🔍 Latest deploy log	https://app.netlify.com/projects/harshitkulkarnisportfolio/deploys/699968d32fc8f800085ffc4e
😎 Deploy Preview	https://deploy-preview-1--harshitkulkarnisportfolio.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
harshit-kulkarni-portfolio	Ready	Preview, Comment	Feb 21, 2026 8:12am