--- loncom/interface/lonmenu.pm	2009/08/23 13:22:16	1.244.2.7
+++ loncom/interface/lonmenu.pm	2010/01/18 20:28:20	1.244.2.8
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Routines to control the menu
 #
-# $Id: lonmenu.pm,v 1.244.2.7 2009/08/23 13:22:16 raeburn Exp $
+# $Id: lonmenu.pm,v 1.244.2.8 2010/01/18 20:28:20 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -144,6 +144,7 @@ use Apache::loncommon();
 use Apache::lonenc();
 use Apache::lonlocal;
 use LONCAPA qw(:DEFAULT :match);
+use HTML::Entities();
 
 use vars qw(@desklines %category_names %category_members %category_positions $readdesk);
 
@@ -1729,7 +1730,7 @@ sub roles_selector {
         }
         $role_selector .= '</select>'."\n".
                '<input type="hidden" name="destinationurl" value="'.
-               $ENV{'REQUEST_URI'}.'" />'."\n".
+               &HTML::Entities::encode($ENV{'REQUEST_URI'},'"<>&').'" />'."\n".
                '<input type="hidden" name="gotorole" value="1" />'."\n".
                '<input type="hidden" name="selectrole" value="" />'."\n".
                '<input type="hidden" name="switch" value="1" />'."\n".