--- loncom/auth/lonroles.pm	2022/01/16 17:32:44	1.269.2.39.2.2
+++ loncom/auth/lonroles.pm	2022/02/24 16:28:46	1.269.2.39.2.3
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # User Roles Screen
 #
-# $Id: lonroles.pm,v 1.269.2.39.2.2 2022/01/16 17:32:44 raeburn Exp $
+# $Id: lonroles.pm,v 1.269.2.39.2.3 2022/02/24 16:28:46 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -177,7 +177,8 @@ ENDREDIR
 
 sub finish_loading_course {
     my ($r,$msg,$url) = @_;
-    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.$url.'">'.&mt('Continue').'</a></div>';
+    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.
+               &HTML::Entities::encode($url,'"<>&').'">'.&mt('Continue').'</a></div>';
     my $end_page = &Apache::loncommon::end_page();
     my $js_url = &js_escape($url);
     my $remote_js;
@@ -212,6 +213,7 @@ $msg
     var url = "$js_url";
     \$(location).attr('href',url);
 });
+// ]]>
 </script>
 $link
 $end_page