Index: lams_tool_gmap/web/includes/jsp/mapFunctions.jsp
===================================================================
diff -u -r6a57078ba37aa7459ac8b400e717e33a350c9cfd -rcf00c458d8f6d4cef59b8280c3ecfc45db474bee
--- lams_tool_gmap/web/includes/jsp/mapFunctions.jsp	(.../mapFunctions.jsp)	(revision 6a57078ba37aa7459ac8b400e717e33a350c9cfd)
+++ lams_tool_gmap/web/includes/jsp/mapFunctions.jsp	(.../mapFunctions.jsp)	(revision cf00c458d8f6d4cef59b8280c3ecfc45db474bee)
@@ -7,8 +7,6 @@
 --%>	
 
 <%@ include file="/common/taglibs.jsp"%>
-<%@ page import="org.lamsfoundation.lams.util.Configuration" %>
-<%@ page import="org.lamsfoundation.lams.util.ConfigurationKeys" %>
 
 <c:set var="tool">
 	<lams:WebAppURL />
@@ -80,7 +78,7 @@
     // set the marker's info message
     if (infoMessage!=null)
     {
-    	marker.infoMessage = unescape(infoMessage);
+    	marker.infoMessage = decode_utf8(infoMessage);
     }
     else
     {
@@ -384,7 +382,35 @@
 	}	
 }
 
+// hack to ensure that the saved strings are safe to send in xml
+function encode_utf8( s )
+{
+	// "'&<>\
+	var re = new RegExp("[<>\\\\]", "g");
+	var re1 = new RegExp('"', "g");
+	var re2 = new RegExp("'", "g");
+	var re3 = new RegExp("&", "g");
+	s = s.replace(re, "_");
+	s = s.replace(re1, "&quot;");
+	s = s.replace(re2, "&apos;");
+	s = s.replace(re3, "&amp;");
+	return s;
+}
 
+// hack to ensure that the saved strings are safe to send in xml
+function decode_utf8( s )
+{
+  	var re1 = new RegExp("&quot;", "g");
+	var re2 = new RegExp("&apos;", "g");
+	var re3 = new RegExp("&amp;", "g");
+	s = s.replace(re1, '"');
+	s = s.replace(re2, "'");
+	s = s.replace(re3, "&");
+	
+  	return s;
+}
+
+
 function confirmLeavePage()
 {
 	var i =0;
@@ -428,9 +454,9 @@
 			var markerString = '<marker'+
 			' latitude="'+ markers[i].getPoint().lat()+ '"'+
 			' longitude="'+ markers[i].getPoint().lng()+ '"'+
-			' infoMessage="'+ escape(markers[i].infoMessage)+ '"' +
+			' infoMessage="'+ encode_utf8(markers[i].infoMessage)+ '"' +
 			' markerUID="'+ markers[i].uid + '"' +
-			' title="'+ escape(markers[i].title) + '"' +
+			' title="'+ encode_utf8(markers[i].title) + '"' +
 			' state="'+ markers[i].state + '"' +
 			' />';
 			xmlString += markerString;