--- rat/client/parameter.html	2007/06/13 01:01:33	1.45
+++ rat/client/parameter.html	2007/08/30 00:02:20	1.46
@@ -3,7 +3,7 @@
 The LearningOnline Network with CAPA
 Parameter Input Window
 //
-// $Id: parameter.html,v 1.45 2007/06/13 01:01:33 albertel Exp $
+// $Id: parameter.html,v 1.46 2007/08/30 00:02:20 albertel Exp $
 //
 // Copyright Michigan State University Board of Trustees
 //
@@ -32,7 +32,7 @@ Parameter Input Window
 <title>LON-CAPA</title>
 </head>
 
-<script>
+<script type="text/javascript">
 
 var ptype='';
 var pvalue='';
@@ -92,6 +92,14 @@ function valline(text,id1,id2) {
               id2+'></td></tr>');
 }
 
+function escapeHTML(text) {
+  text = text.replace(/&/g, '&amp;');
+  text = text.replace(/"/g, '&quot;');
+  text = text.replace(/</g, '&lt;');
+  text = text.replace(/>/g, '&gt;');
+  return text;
+}
+
 function datecalc() {
     var sform=choices.document.forms.sch;
 
@@ -500,7 +508,7 @@ function draw() {
            tablestart('Integer');
         }
         choicewrite('<tr bgcolor="#AAFFAA"><td>Value:</td><td colspan=2>');
-        choicewrite('<input name=intval size=10 value="'+svalue+
+        choicewrite('<input name=intval size=10 value="'+escapeHTML(svalue)+
                     '" name=intval onChange="parent.integereval()">');
         choicewrite('</td></table>');
       }
@@ -522,7 +530,7 @@ function draw() {
            tablestart('Floating point number');
         }
         choicewrite('<tr bgcolor="#AAFFAA"><td>Value:</td><td colspan=2>');
-        choicewrite('<input name=floatval size=10 value="'+svalue+
+        choicewrite('<input name=floatval size=10 value="'+escapeHTML(svalue)+
                     '" name=floatval onChange="parent.floateval()">');
         choicewrite('</td></table>');
       }
@@ -533,7 +541,7 @@ function draw() {
             (typeof(pscat)=='undefined')) {
            tablestart('Text');
 	   choicewrite('<tr bgcolor="#AAFFAA"><td>Value:</td><td colspan=2>');
-           choicewrite('<input name="stringval" size="20" value="'+svalue+
+           choicewrite('<input name="stringval" size="20" value="'+escapeHTML(svalue)+
                     '" type="text" onChange="parent.stringeval()">');
         }
         if (pscat=='yesno') {
@@ -599,7 +607,7 @@ function draw() {
         if (pscat=='ip') {
            tablestart('IP Number/Name');
 	   choicewrite('<tr bgcolor="#AAFFAA"><td>Value:</td><td colspan=2>');
-           choicewrite('<input name="stringval" size="20" value="'+svalue+
+           choicewrite('<input name="stringval" size="20" value="'+escapeHTML(svalue)+
                     '" onChange="parent.stringeval()">');
         }
         if (pscat=='fileext') {
@@ -617,7 +625,7 @@ function draw() {
                ' type="radio" '+callradiostringeval('doc,xls,ppt'));
            if (svalue=='doc,xls,ppt') { choicewrite(' checked'); }
            choicewrite('> Office Document</label><br />');
-           choicewrite('<input name="stringval" size="20" value="'+svalue+
+           choicewrite('<input name="stringval" size="20" value="'+escapeHTML(svalue)+
                     '" onChange="parent.stringeval()">');
        }
        if (pscat=='useslots') {
@@ -648,7 +656,7 @@ function draw() {
       choicewrite('<table>');
       if (svalue) {
          choicewrite('<tr><td colspan="9">Current choice:</td><td bgcolor="'+
-                     svalue+'" colspan="2">&nbsp;</td></tr>');
+                     escapeHTML(svalue)+'" colspan="2">&nbsp;</td></tr>');
       }
       for (var ir=0; ir<=10; ir++) {
           for (var ig=0; ig<=10; ig++) {