--- loncom/interface/createaccount.pm	2015/01/09 15:41:49	1.69
+++ loncom/interface/createaccount.pm	2015/06/09 21:22:55	1.70
@@ -4,7 +4,7 @@
 # kerberos, or SSO) or an e-mail address. Requests to use an e-mail address as
 # username may be processed automatically, or may be queued for approval.
 #
-# $Id: createaccount.pm,v 1.69 2015/01/09 15:41:49 raeburn Exp $
+# $Id: createaccount.pm,v 1.70 2015/06/09 21:22:55 damieng Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -389,6 +389,7 @@ sub javascript_setforms {
     }
     if (@required) {
         my $missprompt = &mt('One or more required fields are currently blank.');
+        &js_escape(\$missprompt);
         my $reqstr = join("','",@required);
         $requiredchk = <<"ENDCHK";
                 var requiredfields = new Array('$reqstr');
@@ -452,8 +453,10 @@ ENDSCRIPT
 sub javascript_checkpass {
     my ($now,$context) = @_;
     my $nopass = &mt('You must enter a password.');
-    my $mismatchpass = &mt('The passwords you entered did not match.').'\\n'.
+    my $mismatchpass = &mt('The passwords you entered did not match.')."\n".
                        &mt('Please try again.'); 
+    &js_escape(\$nopass);
+    &js_escape(\$mismatchpass);
     my $js = <<"ENDSCRIPT";
 <script type="text/javascript">
 // <![CDATA[
@@ -487,18 +490,19 @@ ENDSCRIPT
 }
 
 sub javascript_validmail {
-    my %lt = &Apache::lonlocal::texthash (
+    my %js_lt = &Apache::lonlocal::texthash (
                email => 'The e-mail address you entered',
                notv  => 'is not a valid e-mail address',
     );
     my $output =  "\n".'<script type="text/javascript">'."\n".
                   '// <![CDATA['."\n".
                   &Apache::lonhtmlcommon::javascript_valid_email()."\n";
+    &js_escape(\%js_lt);
     $output .= <<"ENDSCRIPT";
 function validate_email(client) {
     field = client.uname;
     if (validmail(field) == false) {
-        alert("$lt{'email'}: "+field.value+" $lt{'notv'}.");
+        alert("$js_lt{'email'}: "+field.value+" $js_lt{'notv'}.");
         return false;
     }
     return true;