Index: lams_central/web/emailuser.jsp
===================================================================
diff -u -red3e9985492484a14131be21420a269b5b03694e -r738c1ec90176394b826038af57ed7afeab3c76d5
--- lams_central/web/emailuser.jsp	(.../emailuser.jsp)	(revision ed3e9985492484a14131be21420a269b5b03694e)
+++ lams_central/web/emailuser.jsp	(.../emailuser.jsp)	(revision 738c1ec90176394b826038af57ed7afeab3c76d5)
@@ -83,7 +83,7 @@
 					<tr>
 						<td><fmt:message key="email.to" /></td>
 						 <c:if test="${not empty user}">
-							<td><c:out value="${user.firstName} ${user.lastName} &lt;${user.email}&gt;"/></td>
+							<td><c:out value="${user.firstName} ${user.lastName}"/> &lt;<c:out value="${user.email}"/>&gt;</td>
 						 </c:if>
 					</tr>
 
Index: lams_central/web/findUserLessons.jsp
===================================================================
diff -u -red3e9985492484a14131be21420a269b5b03694e -r738c1ec90176394b826038af57ed7afeab3c76d5
--- lams_central/web/findUserLessons.jsp	(.../findUserLessons.jsp)	(revision ed3e9985492484a14131be21420a269b5b03694e)
+++ lams_central/web/findUserLessons.jsp	(.../findUserLessons.jsp)	(revision 738c1ec90176394b826038af57ed7afeab3c76d5)
@@ -4,6 +4,7 @@
 <%@ taglib uri="tags-fmt" prefix="fmt"%>
 <%@ taglib uri="tags-core" prefix="c"%>
 <%@ taglib uri="tags-html" prefix="html"%>
+<%@ taglib uri="tags-function" prefix="fn"%>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
 		"http://www.w3.org/TR/html4/loose.dtd">
@@ -78,7 +79,7 @@
 
 	<c:otherwise>
 		<h1><fmt:message key="lessonsearch.results">
-			<fmt:param value="${originalQuery}" />
+			<fmt:param value="${fn:escapeXml(originalQuery)}" />
 		</fmt:message></h1>
 
 		<c:forEach var="user" items="${userLessonsMap}">
Index: lams_central/web/indexLessonConditions.jsp
===================================================================
diff -u -r35a0e719d061c08b52e705135bb2f2126079ed21 -r738c1ec90176394b826038af57ed7afeab3c76d5
--- lams_central/web/indexLessonConditions.jsp	(.../indexLessonConditions.jsp)	(revision 35a0e719d061c08b52e705135bb2f2126079ed21)
+++ lams_central/web/indexLessonConditions.jsp	(.../indexLessonConditions.jsp)	(revision 738c1ec90176394b826038af57ed7afeab3c76d5)
@@ -4,6 +4,7 @@
 <%@ taglib uri="tags-lams" prefix="lams"%>
 <%@ taglib uri="tags-logic" prefix="logic" %>
 <%@ taglib uri="tags-html" prefix="html" %>
+<%@ taglib uri="tags-function" prefix="fn"%>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <lams:html>
@@ -65,7 +66,7 @@
 		<td colspan="2">
 			<h4>
 				<fmt:message key="label.conditions.box.title">
-					<fmt:param>${title}</fmt:param>
+					<fmt:param>${fn:escapeXml(title)}</fmt:param>
 				</fmt:message>
 			</h4>
 		</td>
@@ -121,7 +122,7 @@
 					<td class="lessonList" style="width: 70%">
 						<select name="precedingLessonId">
 							<c:forEach var="availableLesson" items="${availableLessons}">
-								<option value="${availableLesson.id}">${availableLesson.name}</option>
+								<option value="${availableLesson.id}">${fn:escapeXml(availableLesson.name)}</option>
 							</c:forEach>
 						</select>
 					</td>
Index: lams_central/web/lessonIntro.jsp
===================================================================
diff -u -r606581007abbdaee5483777096f32ffac1c3e3eb -r738c1ec90176394b826038af57ed7afeab3c76d5
--- lams_central/web/lessonIntro.jsp	(.../lessonIntro.jsp)	(revision 606581007abbdaee5483777096f32ffac1c3e3eb)
+++ lams_central/web/lessonIntro.jsp	(.../lessonIntro.jsp)	(revision 738c1ec90176394b826038af57ed7afeab3c76d5)
@@ -6,6 +6,7 @@
 <%@ taglib uri="tags-fmt" prefix="fmt" %>
 <%@ taglib uri="tags-core" prefix="c" %>
 <%@ taglib uri="tags-html" prefix="html" %>
+<%@ taglib uri="tags-function" prefix="fn"%>
 <c:set var="lams" ><lams:LAMSURL/></c:set>
 <c:set var="pngImageSrc" value="${lams}www/secure/learning-design-images/${learningDesignID}.png" />
 <c:set var="svgImageSrc" value="${lams}www/secure/learning-design-images/${learningDesignID}.svg" />
@@ -44,9 +45,9 @@
 			</div>
 		</c:if>
 	
-		<h1>${lesson.lessonName}</h1>
+		<h1><c:out value="${lesson.lessonName}" escapeXml="true"/></h1>
 	
-		<p>${lesson.lessonDescription}</p>	
+		<p><c:out value="${lesson.lessonDescription}" escapeXml="false"/></p>	
 	
 		<c:if test="${displayDesignImage}">
 			<div id="sequence-preview">
@@ -60,11 +61,11 @@
 		</c:if>
 			
 		<div class="space-bottom-top align-right">
-			<html:link href="${learnerURL}" styleClass="button">
+			<html:link href="${fn:escapeXml(learnerURL)}" styleClass="button">
 				<span class="nextActivity"><fmt:message key="label.start.lesson" /></span>
 			</html:link>
 		</div>
-			
+
 	</div>
 	   
 	<div id="footer"></div>
Index: lams_central/web/main.jsp
===================================================================
diff -u -r8b8718bcc6700cd1e896ef1dd0d97b9198fd3c4e -r738c1ec90176394b826038af57ed7afeab3c76d5
--- lams_central/web/main.jsp	(.../main.jsp)	(revision 8b8718bcc6700cd1e896ef1dd0d97b9198fd3c4e)
+++ lams_central/web/main.jsp	(.../main.jsp)	(revision 738c1ec90176394b826038af57ed7afeab3c76d5)
@@ -155,7 +155,10 @@
 				</c:if>
 				<td>
 					<fmt:message key="index.welcome" />
-					<lams:user property="firstName" />
+					<c:set var="firstName">
+						<lams:user property="firstName" />
+					</c:set>
+					<c:out value="${firstName}" escapeXml="true"/>
 				</td>
 				
 				<td id="messageCell">
