quixote/form form_templates.ptl,1.17,1.18

Update of /home/cvs/quixote/form
In directory hewson:/tmp/cvs-serv12573

Modified Files:
	form_templates.ptl 
Log Message:
HTML-escape both the widget title and the hint

Index: form_templates.ptl
===================================================================
RCS file: /home/cvs/quixote/form/form_templates.ptl,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -d -r1.17 -r1.18
--- form_templates.ptl	18 Oct 2002 18:27:35 -0000	1.17
+++ form_templates.ptl	18 Oct 2002 19:24:24 -0000	1.18
@@ -4,7 +4,7 @@
 #"""
 
 from types import StringType
-from quixote.html import htmltag, htmltext
+from quixote.html import htmlescape, htmltag, htmltext
  
 def _render_start [html] (self, request, action, method='post', name=None):
     htmltag('form', method=method, action=action, name=name)
@@ -26,12 +26,12 @@
     
 def _render_hint [html] (self, hint):
     if hint:
-        '<em>' + hint + '</em>\n'
+        '<em>' + htmlescape(hint) + '</em>\n'
 
 def _render_widget_row [html] (self, request, widget):
     if widget.widget_type == 'hidden':
         return
-    title = htmltext(self.title[widget.name] or '')
+    title = htmlescape(self.title[widget.name] or '')
     if self.required.get(widget.name):
         title = title + '&nbsp;*'
     '<tr>'