--- rat/lonsequence.pm	2006/11/02 21:15:22	1.28
+++ rat/lonsequence.pm	2007/01/16 21:19:11	1.30
@@ -2,7 +2,7 @@
 #
 # Sequence Handler
 #
-# $Id: lonsequence.pm,v 1.28 2006/11/02 21:15:22 albertel Exp $
+# $Id: lonsequence.pm,v 1.30 2007/01/16 21:19:11 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -34,10 +34,10 @@ use Apache::lonnet;
 use Apache::Constants qw(:common :http REDIRECT);
 use GDBM_File;
 use LONCAPA::map();
-use Apache::lonratsrv();
 use Apache::lonpageflip();
 use Apache::loncommon();
 use Apache::lonlocal;
+use HTML::Entities();
 
 my %selhash;
 my $successtied;
@@ -170,10 +170,15 @@ ENDSELECT
 		$r->print('<form name="form'.$idx.'">');
             }
 	    my ($title,$url)=split(/\:/,$_);
-            $title=~s/\&colon\;/\:/g;
-            $url=~s/\&colon\;/\:/g;
-            unless ($title) { $title=(split(/\//,$url))[-1] };
-            unless ($title) { $title='<i>'.&mt('Empty').'</i>'; }
+	    $title = &LONCAPA::map::qtescape($title);
+	    unless ($title) { $title=(split(/\//,$url))[-1] };
+            my $enc_title = &HTML::Entities::encode($title,'\'"<>&');
+	    unless ($title) {
+		$title='<i>'.&mt('Empty').'</i>';
+		$enc_title = &mt('Empty');
+	    }
+	    $url  = &LONCAPA::map::qtescape($url);
+            my $enc_url = &HTML::Entities::encode($url,'\'"<>&');
             if ($url) {
 		if ($successtied) {
 		    my $checked='';
@@ -182,16 +187,17 @@ ENDSELECT
 	           }
 	           $selhash{"pre_${idx}_link"}=$url;
 	           $selhash{"pre_${idx}_title"}=$title;
-
+		    
+		    $url  = &HTML::Entities::encode($url, '\'"<>&');
 		    $r->print(<<ENDCHECKBOX);
 <input type='checkbox' name='filelink' 
-value='$url' onClick='javascript:queue("form$idx")'$checked>
-<input type='hidden' name='title' value='$title'>
+value='$enc_url' onClick='javascript:queue("form$idx")'$checked />
+<input type='hidden' name='title' value='$enc_title' />
 ENDCHECKBOX
                 }
-		$r->print('<a href="'.&Apache::lonratsrv::qtescape($url).'">');
+		$r->print('<a href="'.$enc_url.'">');
             }
-            $r->print(&Apache::lonratsrv::qtescape($title));
+            $r->print($enc_title);
             if ($url) { $r->print('</a>'); }
             if ($successtied) {
 		$r->print('</form>');