--- loncom/interface/lonhtmlcommon.pm	2004/10/12 22:55:21	1.92
+++ loncom/interface/lonhtmlcommon.pm	2004/10/12 23:26:48	1.93
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common html routines
 #
-# $Id: lonhtmlcommon.pm,v 1.92 2004/10/12 22:55:21 albertel Exp $
+# $Id: lonhtmlcommon.pm,v 1.93 2004/10/12 23:26:48 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -976,7 +976,7 @@ sub disablelink {
     if (defined($#fields)) {
 	unless ($#fields>=0) { return ''; }
     }
-    return '<a href="/adm/preferences?action=set_wysiwyg&wysiwyg=off&returnurl='.&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Disable WYSIWYG Editor').'</a>';
+    return '<a href="'.&HTML::Entities::encode('/adm/preferences?action=set_wysiwyg&wysiwyg=off&returnurl=','<>&"').&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Disable WYSIWYG Editor').'</a>';
 }
 
 sub enablelink {
@@ -984,7 +984,7 @@ sub enablelink {
     if (defined($#fields)) {
 	unless ($#fields>=0) { return ''; }
     }
-    return '<a href="/adm/preferences?action=set_wysiwyg&wysiwyg=on&returnurl='.&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Enable WYSIWYG Editor').'</a>';
+    return '<a href="'.&HTML::Entities::encode('/adm/preferences?action=set_wysiwyg&wysiwyg=on&returnurl=','<>&"').&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Enable WYSIWYG Editor').'</a>';
 }
 
 # ----------------------------------------- Script to activate only some fields