--- loncom/interface/lonhtmlcommon.pm	2010/01/19 19:00:02	1.261
+++ loncom/interface/lonhtmlcommon.pm	2010/01/24 03:56:09	1.262
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common html routines
 #
-# $Id: lonhtmlcommon.pm,v 1.261 2010/01/19 19:00:02 droeschl Exp $
+# $Id: lonhtmlcommon.pm,v 1.262 2010/01/24 03:56:09 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -66,7 +66,7 @@ use LONCAPA;
 sub coursepreflink {
    my ($text,$category)=@_;
    if (&Apache::lonnet::allowed('opa',$env{'request.course.id'})) {
-      return '<a href="/adm/courseprefs?phase=display&actions='.$category.'">'.$text.'</a>';
+      return '<a href="'.&HTML::Entities::encode("/adm/courseprefs?phase=display&actions=$category",'<>&"').'">'.$text.'</a>';
    } else {
       return '';
    }
@@ -1285,7 +1285,7 @@ sub htmlareaselectactive {
     my @fields=@_;
     unless (&htmlareabrowser()) { return ''; }
     #if (&htmlareablocked()) { return '<br />'.&enablelink(@fields); }
-    my $output='<script type="text/javascript" defer="1">'."\n"
+    my $output='<script type="text/javascript" defer="defer">'."\n"
               .'// <![CDATA['."\n";
     my $lang = &htmlarea_lang();
     $output.='