--- loncom/interface/lonhtmlcommon.pm	2015/05/28 12:20:16	1.365
+++ loncom/interface/lonhtmlcommon.pm	2015/06/09 21:22:56	1.366
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common html routines
 #
-# $Id: lonhtmlcommon.pm,v 1.365 2015/05/28 12:20:16 raeburn Exp $
+# $Id: lonhtmlcommon.pm,v 1.366 2015/06/09 21:22:56 damieng Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -2478,7 +2478,7 @@ sub course_selection {
     if ($totcodes > 0) {
         my $numtitles = @$codetitles;
         if ($numtitles > 0) {
-            $output .= '<label><input type="radio" name="coursepick" value="category" onclick="coursePick(this.form);alert('."'".&mt('Choose categories, from left to right')."'".')" />'.&mt('Pick courses by category:').'</label><br />';
+            $output .= '<label><input type="radio" name="coursepick" value="category" onclick="coursePick(this.form);alert('."'".&html_escape(&mt('Choose categories, from left to right'))."'".')" />'.&mt('Pick courses by category:').'</label><br />';
             $output .= '<table><tr><td>'.$$codetitles[0].'<br />'."\n".
                '<select name="'.$standardnames->[0].
                '" onchange="setPick(this.form);courseSet('."'$$codetitles[0]'".')">'."\n".
@@ -2935,10 +2935,12 @@ sub set_form_elements {
 
 sub file_submissionchk_js {
     my ($turninpaths,$multiples) = @_;
-    my $overwritewarn = &mt('File(s) you uploaded for your submission will overwrite existing file(s) submitted for this item').'\\n'.
+    my $overwritewarn = &mt('File(s) you uploaded for your submission will overwrite existing file(s) submitted for this item')."\n".
                       &mt('Continue submission and overwrite the file(s)?');
-    my $delfilewarn = &mt('You have indicated you wish to remove some files previously included in your submission.').'\\n'.
+    &js_escape(\$overwritewarn);
+    my $delfilewarn = &mt('You have indicated you wish to remove some files previously included in your submission.')."\n".
                       &mt('Continue submission with these files removed?');
+    &js_escape(\$delfilewarn);
     my ($turninpathtext,$multtext,$arrayindexofjs);
     if (ref($turninpaths) eq 'HASH') {
         foreach my $key (sort(keys(%{$turninpaths}))) {
@@ -3443,8 +3445,9 @@ THIRD
 ##############################################
 
 sub javascript_jumpto_resource {
-    my $confirm_switch = &mt("Editing requires switching to the resource's home server.").'\n'.
+    my $confirm_switch = &mt("Editing requires switching to the resource's home server.")."\n".
                          &mt('Switch server?');
+    &js_escape(\$confirm_switch);
     return (<<ENDUTILITY)
 
 function go(url) {