--- loncom/interface/lonhtmlcommon.pm	2004/10/05 20:35:02	1.91
+++ loncom/interface/lonhtmlcommon.pm	2004/10/12 23:26:48	1.93
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common html routines
 #
-# $Id: lonhtmlcommon.pm,v 1.91 2004/10/05 20:35:02 albertel Exp $
+# $Id: lonhtmlcommon.pm,v 1.93 2004/10/12 23:26:48 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -904,7 +904,7 @@ sub spellheader {
     my $nothing = &javascript_nothing();
     return (<<ENDCHECK);
 <script type="text/javascript"> 
-// BEGIN LON-CAPA Internal
+//<!-- BEGIN LON-CAPA Internal
 var checkwin;
 
 function spellcheckerwindow() {
@@ -912,7 +912,7 @@ function spellcheckerwindow() {
     checkwin.document.writeln('<html><body bgcolor="#DDDDDD"><form name="spellcheckform" action="/adm/spellcheck" method="post"><input type="hidden" name="text" value="" /></form></body></html>');
     checkwin.document.close();
 }
-// END LON-CAPA Internal
+// END LON-CAPA Internal -->
 </script>
 ENDCHECK
 }
@@ -976,7 +976,7 @@ sub disablelink {
     if (defined($#fields)) {
 	unless ($#fields>=0) { return ''; }
     }
-    return '<a href="/adm/preferences?action=set_wysiwyg&wysiwyg=off&returnurl='.&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Disable WYSIWYG Editor').'</a>';
+    return '<a href="'.&HTML::Entities::encode('/adm/preferences?action=set_wysiwyg&wysiwyg=off&returnurl=','<>&"').&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Disable WYSIWYG Editor').'</a>';
 }
 
 sub enablelink {
@@ -984,7 +984,7 @@ sub enablelink {
     if (defined($#fields)) {
 	unless ($#fields>=0) { return ''; }
     }
-    return '<a href="/adm/preferences?action=set_wysiwyg&wysiwyg=on&returnurl='.&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Enable WYSIWYG Editor').'</a>';
+    return '<a href="'.&HTML::Entities::encode('/adm/preferences?action=set_wysiwyg&wysiwyg=on&returnurl=','<>&"').&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Enable WYSIWYG Editor').'</a>';
 }
 
 # ----------------------------------------- Script to activate only some fields
