--- loncom/interface/groupsort.pm	2007/07/25 23:10:23	1.60
+++ loncom/interface/groupsort.pm	2007/11/02 21:08:45	1.61
@@ -2,7 +2,7 @@
 # The LON-CAPA group sort handler
 # Allows for sorting prior to import into RAT.
 #
-# $Id: groupsort.pm,v 1.60 2007/07/25 23:10:23 banghart Exp $
+# $Id: groupsort.pm,v 1.61 2007/11/02 21:08:45 albertel Exp $
 # 
 # Copyright Michigan State University Board of Trustees
 #
@@ -37,7 +37,7 @@ use GDBM_File;
 use Apache::loncommon;
 use Apache::lonlocal;
 use Apache::lonnet;
-use LONCAPA();
+use LONCAPA;
 
 my $iconpath; # variable to be accessible to multiple subroutines
 my %hash; # variable to tie to user specific database
@@ -229,9 +229,9 @@ function finish_import() {
     for (var num=0; num<document.forms.groupsort.fnum.value; num++) {
 	$begincondition
 	opener.document.forms.simpleedit.importdetail.value+='&'+
-              escape(eval("document.forms.groupsort.title"+num+".value"))+'='+
-	      escape(eval("document.forms.groupsort.filelink"+num+".value"))+'='+
-	      escape(eval("document.forms.groupsort.id"+num+".value"));
+              eval("document.forms.groupsort.title"+num+".value")+'='+
+	      eval("document.forms.groupsort.filelink"+num+".value")+'='+
+	      eval("document.forms.groupsort.id"+num+".value");
 	$endcondition
     }
     opener.document.forms.simpleedit.submit();
@@ -431,12 +431,12 @@ END
 # --------------------------------------- Hidden values (returns scalar string)
 sub hidden {
     my ($sel,$title,$filelink,$id) = @_;
-    my $string = '<input type="hidden" name="title'.$sel.'" value="'.$title.
-	'" />';
+    my $string = '<input type="hidden" name="title'.$sel.'" value="'.
+	&escape($title).'" />';
     $filelink=~s|^/ext/|http://|;
     $string .= '<input type="hidden" name="filelink'.$sel.'" value="'.
-	$filelink.'" />';
-    $string .= '<input type="hidden" name="id'.$sel.'" value="'.$id.'" />';
+	&escape($filelink).'" />';
+    $string .= '<input type="hidden" name="id'.$sel.'" value="'.&escape($id).'" />';
     return $string;
 }