--- loncom/interface/lonhtmlcommon.pm	2004/10/12 23:26:48	1.93
+++ loncom/interface/lonhtmlcommon.pm	2004/10/21 11:18:06	1.94
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common html routines
 #
-# $Id: lonhtmlcommon.pm,v 1.93 2004/10/12 23:26:48 albertel Exp $
+# $Id: lonhtmlcommon.pm,v 1.94 2004/10/21 11:18:06 foxr Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -131,7 +131,8 @@ sub select_recent {
 	">\n<option value=''>--- ".&mt('Recent')." ---</option>";
     foreach (sort keys %recent) {
 	unless ($_=~/^error\:/) {
-	    $return.="\n<option value='$_'>".
+	    my $escaped = &Apache::loncommon::escape_url($_);
+	    $return.="\n<option value='$escaped'>".
 		&Apache::lonnet::unescape((split(/\&/,$recent{$_}))[1]).
 		'</option>';
 	}
@@ -887,9 +888,12 @@ sub crumbs {
 	    unless ($path eq $uri) { $path.='/'; }
 	    my $linkpath=$path;
 	    if ($form) {
-		$linkpath="javascript:$form.action='$path';$form.submit();";
+		my $escaped_path = &Apache::loncommon::escape_single($path);
+		$linkpath="javascript:$form.action='$escaped_path';$form.submit();";
 	    }
-	    $output.='<a href="'.$linkpath.'"'.($target?' target="'.$target.'"':'').'>'.$_.'</a>/';
+	    my $escaped_linkpath = &Apache::loncommon::escape_single($linkpath);
+	    my $escaped_target   = &Apache::loncommon::escape_single($target);
+	    $output.='<a href="'.$escaped_linkpath.'"'.($target?' target="'.$escaped_target.'"':'').'>'.$_.'</a>/';
 	}
     } else {
 	$output.=$uri;