Index: lams_tool_forum/web/WEB-INF/tags/AuthoringButton.tag
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/WEB-INF/tags/AuthoringButton.tag	(.../AuthoringButton.tag)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/WEB-INF/tags/AuthoringButton.tag	(.../AuthoringButton.tag)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -33,6 +33,7 @@
 <%@ taglib uri="tags-core" prefix="c" %>
 <%@ taglib uri="tags-fmt" prefix="fmt" %>
 <%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %> 
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
 <%@ taglib uri="tags-lams" prefix="lams"%>
 
 <%@ attribute name="formID" required="true" rtexprvalue="true" %>
@@ -90,7 +91,7 @@
     	}
     }
     function doCancel() {
-    	if(confirm("<fmt:message key='${cancelConfirmMsgKey}'/>")){
+    	if(confirm("<spring:escapeBody javaScriptEscape='true'><fmt:message key='${cancelConfirmMsgKey}'/></spring:escapeBody>")){
     		closeWindow("cancel");
     	}
     }
Index: lams_tool_forum/web/WEB-INF/tags/AuthoringRatingAllStyleCriteria.tag
===================================================================
diff -u -rfa2b057ec9dda91bbe9fa54337c32c443f561cd1 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/WEB-INF/tags/AuthoringRatingAllStyleCriteria.tag	(.../AuthoringRatingAllStyleCriteria.tag)	(revision fa2b057ec9dda91bbe9fa54337c32c443f561cd1)
+++ lams_tool_forum/web/WEB-INF/tags/AuthoringRatingAllStyleCriteria.tag	(.../AuthoringRatingAllStyleCriteria.tag)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -9,6 +9,7 @@
 <%@ taglib uri="tags-core" prefix="c" %>
 <%@ taglib uri="tags-fmt" prefix="fmt" %>
 <%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %> 
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
 <%@ taglib uri="tags-lams" prefix="lams"%>
 <%@ taglib uri="tags-function" prefix="fn" %>
 <c:set var="lams"><lams:LAMSURL/></c:set>
@@ -148,8 +149,8 @@
 <script type="text/javascript">
 	var minimumWordsSpinnerArray  = new Array();
 	var maxOrderId;
-	var criteriaArrows = '<div class="arrow-up" title="<fmt:message key="${upLabel}"/>" />' + 
-	 					 '<div class="arrow-down" title="<fmt:message key="${downLabel}"/>" />';
+	var criteriaArrows = '<div class="arrow-up" title="<spring:escapeBody javaScriptEscape="true"><fmt:message key="${upLabel}"/></spring:escapeBody>" />' + 
+	 					 '<div class="arrow-down" title="<spring:escapeBody javaScriptEscape="true"><fmt:message key="${downLabel}"/></spring:escapeBody>" />';
 	  
 	var newGroupId = -1; // groups existing in DB have ID > 0; new, unsaved ones have ID < 0
 	const MAX_RUBRICS_COLUMNS = 5;
@@ -255,7 +256,7 @@
 		if ( validate ) {
 			str += ' onchange="validateRatingLimits('+validate+','+orderId+');" '
 		} 
-		str	+= '> <option value="-1" '+ ( -1 == currentValue ? ' selected="selected"' : '' ) + '><fmt:message key="${allLabel}"/></option>';
+		str	+= '> <option value="-1" '+ ( -1 == currentValue ? ' selected="selected"' : '' ) + '><spring:escapeBody javaScriptEscape="true"><fmt:message key="${allLabel}"/></spring:escapeBody></option>';
 		if ( zeroDescription ) {
 			str += '<option value="0" '+ ( 0 == currentValue ? ' selected="selected"' : '' ) + '>'+zeroDescription+'</option>';
 		}
@@ -320,52 +321,52 @@
 		if ( style == 0 ) {
 			var ratingLimitsStr = '';
 			if ( '${hasRatingLimits}' == 'true' ) {
-				ratingLimitsStr = '<div class="voffset5"><label for="minimumRates"><fmt:message key="${minimumLabel}" /></label>&nbsp;'
-				+ generateSelect('minimumRates' + orderId, 'true', '<fmt:message key="${noMinimumLabel}"/>', orderId, minimumRates)
-	  			+ '<label for="maximumRates" class="loffset10"><fmt:message key="${maximumLabel}" /></label>&nbsp;'
-				+ generateSelect('maximumRates' + orderId, 'false', '<fmt:message key="${noMaximumLabel}"/>', orderId, maximumRates)
+				ratingLimitsStr = '<div class="voffset5"><label for="minimumRates"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${minimumLabel}" /></spring:escapeBody></label>&nbsp;'
+				+ generateSelect('minimumRates' + orderId, 'true', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${noMinimumLabel}"/></spring:escapeBody>', orderId, minimumRates)
+	  			+ '<label for="maximumRates" class="loffset10"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${maximumLabel}" /></spring:escapeBody></label>&nbsp;'
+				+ generateSelect('maximumRates' + orderId, 'false', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${noMaximumLabel}"/></spring:escapeBody>', orderId, maximumRates)
 				+ '<BR/>'
-			 	+ generateManadatorySpinner(orderId, '<fmt:message key="${minNumberWordsLabel}"><fmt:param> </fmt:param></fmt:message>', commentMinWordsLimit);
+			 	+ generateManadatorySpinner(orderId, '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${minNumberWordsLabel}"><fmt:param> </fmt:param></fmt:message></spring:escapeBody>', commentMinWordsLimit);
 			}
 			row.append(jQuery('<td/>', {
 				'class': 'criteria-info',
-			    html: '<div class="voffset5"><fmt:message key="${styleComment}" />:&nbsp;</div>'+ inputField + hiddenInputs + ratingLimitsStr
+			    html: '<div class="voffset5"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${styleComment}" /></spring:escapeBody>:&nbsp;</div>'+ inputField + hiddenInputs + ratingLimitsStr
 			})).appendTo('#criterias-table-body');	
 			
 			activateSpinner(orderId, true);
 			
 		} else if ( style == 1 ) {
 			var ratingLimitsStr = '';
 			if ( '${hasRatingLimits}' == 'true' ) {
-				ratingLimitsStr = '<div class="voffset5"><label for="minimumRates"><fmt:message key="${minimumLabel}" /></label>&nbsp;'
-				+ generateSelect('minimumRates' + orderId, 'true', '<fmt:message key="${noMinimumLabel}"/>', orderId, minimumRates)
-	  			+ '<label for="maximumRates" class="loffset10"><fmt:message key="${maximumLabel}" /></label>&nbsp;'
-				+ generateSelect('maximumRates' + orderId, 'false', '<fmt:message key="${noMaximumLabel}"/>', orderId, maximumRates)
+				ratingLimitsStr = '<div class="voffset5"><label for="minimumRates"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${minimumLabel}" /></spring:escapeBody></label>&nbsp;'
+				+ generateSelect('minimumRates' + orderId, 'true', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${noMinimumLabel}"/></spring:escapeBody>', orderId, minimumRates)
+	  			+ '<label for="maximumRates" class="loffset10"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${maximumLabel}" /></spring:escapeBody></label>&nbsp;'
+				+ generateSelect('maximumRates' + orderId, 'false', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${noMaximumLabel}"/></spring:escapeBody>', orderId, maximumRates)
 				+ '<BR/>'
-			 	+ generateSpinner(orderId, justifyOrComment, '<fmt:message key="${allowCommentsLabel}" />', '<fmt:message key="${minNumberWordsLabel}"><fmt:param> </fmt:param></fmt:message>', commentMinWordsLimit);
+			 	+ generateSpinner(orderId, justifyOrComment, '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${allowCommentsLabel}" /></spring:escapeBody>', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${minNumberWordsLabel}"><fmt:param> </fmt:param></fmt:message></spring:escapeBody>', commentMinWordsLimit);
 			}
 			row.append(jQuery('<td/>', {
 				'class': 'criteria-info',
-			    html: '<div class="voffset5"><fmt:message key="${styleStar}" />:&nbsp;</div>'+inputField + hiddenInputs + ratingLimitsStr
+			    html: '<div class="voffset5"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${styleStar}" /></spring:escapeBody>:&nbsp;</div>'+inputField + hiddenInputs + ratingLimitsStr
 			})).appendTo('#criterias-table-body');
 				
 			activateSpinner(orderId, justifyOrComment);
 			
 		} else if ( style == 2 ) { 
-			var rankingStr = '<div class="voffset5"><label for="maxRating' + orderId + '"><fmt:message key="${rankLabel}"/></label>&nbsp;'
+			var rankingStr = '<div class="voffset5"><label for="maxRating' + orderId + '"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${rankLabel}"/></spring:escapeBody></label>&nbsp;'
 			  + generateSelect('maxRating' + orderId, null, null, orderId, maxRating);
 			row.append(jQuery('<td/>', {
 				'class': 'criteria-info',
-			    html: '<div class="voffset5"><fmt:message key="${styleRanking}" />:&nbsp;</div>'+ inputField + hiddenInputs + rankingStr 
+			    html: '<div class="voffset5"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${styleRanking}" /></spring:escapeBody>:&nbsp;</div>'+ inputField + hiddenInputs + rankingStr 
 			})).appendTo('#criterias-table-body');
 	
 		} else if ( style == 3) {
 			row.append(jQuery('<td/>', {
 				'class': 'criteria-info',
-			    html: '<div class="voffset5"><fmt:message key="${styleHedging}" />:&nbsp;</div>' + inputField + hiddenInputs
-				 + '<div class="voffset5"><label for="maxRating'+ orderId + '"><fmt:message key="${hedgeRankLabel}"/>&nbsp;</label>'
+			    html: '<div class="voffset5"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${styleHedging}" /></spring:escapeBody>:&nbsp;</div>' + inputField + hiddenInputs
+				 + '<div class="voffset5"><label for="maxRating'+ orderId + '"><spring:escapeBody javaScriptEscape="true"><fmt:message key="${hedgeRankLabel}"/></spring:escapeBody>&nbsp;</label>'
 			     + '<input type="text" name="maxRating' + orderId + '" id="maxRating' + orderId + '" value="'+maxRating+'" size="4">&nbsp;'
-				 + generateSpinner(orderId, justifyOrComment, '<fmt:message key="${justifyLabel}"/>', '<fmt:message key="${minNumberWordsLabel}"><fmt:param> </fmt:param></fmt:message>', commentMinWordsLimit)
+				 + generateSpinner(orderId, justifyOrComment, '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${justifyLabel}"/></spring:escapeBody>', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${minNumberWordsLabel}"><fmt:param> </fmt:param></fmt:message></spring:escapeBody>', commentMinWordsLimit)
 			})).appendTo('#criterias-table-body');	
 			
 			activateSpinner(orderId, justifyOrComment);
@@ -417,7 +418,7 @@
 		// it deletes either whole criterion or a rubrics row (which is also a criterion)
 		row.append($('<td/>', {
 			width: '20px',
-			html: '<i class="fa fa-times delete-criteria" title="<fmt:message key="${deleteLabel}"/>"></i>'
+			html: '<i class="fa fa-times delete-criteria" title="<spring:escapeBody javaScriptEscape="true"><fmt:message key="${deleteLabel}"/></spring:escapeBody>"></i>'
 		}));
 	}
 
@@ -433,7 +434,7 @@
 		var cell = $('<td />', {
 			'class': 'criteria-info',
 			// arrows to move whole rubrics table
-		    html: '<div class="voffset5"><fmt:message key="label.rating.style.rubrics" />:<div class="pull-right">' + criteriaArrows + '</div></div>'
+		    html: '<div class="voffset5"><spring:escapeBody javaScriptEscape="true"><fmt:message key="label.rating.style.rubrics" /></spring:escapeBody>:<div class="pull-right">' + criteriaArrows + '</div></div>'
 		}).attr('colspan', '3').appendTo(row);
 
 		var rubricsTable = $("<table />").addClass('table-striped table-condensed rubrics-table').attr('groupId', groupId).appendTo(cell)
@@ -443,7 +444,7 @@
 				$(this).closest('tr').find('textarea').height(height);
 			}),
 			addColumnButton = $('<button />').attr('type', 'button').addClass('btn btn-default pull-right voffset20 rubrics-add-column-button')
-										   	 .text('<fmt:message key="label.rating.rubrics.column.add" />').click(function(){
+										   	 .text('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.rating.rubrics.column.add" /></spring:escapeBody>').click(function(){
 						var columns = $('.rubrics-columns-part .rubrics-column', rubricsTable);
 						// no more than X columns allowed
 						if (columns.length >= MAX_RUBRICS_COLUMNS) {
@@ -457,7 +458,7 @@
 
 						// add delete button
 						$('<i />').addClass('fa fa-times rubrics-delete-column-button')
-								  .attr('title', '<fmt:message key="${deleteLabel}"/>').appendTo(cell).click(function(){
+								  .attr('title', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${deleteLabel}"/></spring:escapeBody>').appendTo(cell).click(function(){
 							deleteRubricsColumn($(this));
 						});
 
@@ -489,7 +490,7 @@
 		}
 		
 		$('<button />').attr('type', 'button').addClass('btn btn-default pull-right voffset20 roffset10')
-					   .text('<fmt:message key="label.rating.rubrics.row.add" />').click(function(){
+					   .text('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.rating.rubrics.row.add" /></spring:escapeBody>').click(function(){
 			// this will add a row to the existing rubrics table with the given group ID
 			maxOrderId++;
 			$("#criteria-max-order-id").val(maxOrderId);
@@ -503,7 +504,7 @@
 		row.append('<th />');
 
 		$('<th />').attr('colspan', rubricsColumnsLength)
-				   .text('<fmt:message key="label.rating.rubrics.column.headers" />')
+				   .text('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.rating.rubrics.column.headers" /></spring:escapeBody>')
 				   .appendTo(row);
 		// empty cell for action buttons
 		$('<th />').attr('colspan', 2).appendTo(row);
@@ -516,7 +517,7 @@
 		for (var i = 0; i < rubricsColumnsLength; i++) {
 			cell = $('<td />').appendTo(row);
 			$('<i />').addClass('fa fa-times rubrics-delete-column-button')
-					  .attr('title', '<fmt:message key="${deleteLabel}"/>').appendTo(cell).click(function(){
+					  .attr('title', '<spring:escapeBody javaScriptEscape="true"><fmt:message key="${deleteLabel}"/></spring:escapeBody>').appendTo(cell).click(function(){
 				deleteRubricsColumn($(this));
 			});
 			
@@ -528,9 +529,9 @@
 
 		// description of the rows part
 		row = $('<tr />').addClass('rubrics-rows-part').appendTo(rubricsTable);
-		$('<th />').addClass('rubrics-row-title').text('<fmt:message key="label.rating.rubrics.row.headers" />').appendTo(row);
+		$('<th />').addClass('rubrics-row-title').text('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.rating.rubrics.row.headers" /></spring:escapeBody>').appendTo(row);
 		$('<th />').attr('colspan', rubricsColumnsLength)
-				   .text('<fmt:message key="label.rating.rubrics.column.content" />')
+				   .text('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.rating.rubrics.column.content" /></spring:escapeBody>')
 				   .appendTo(row);
 		$('<td />').attr('colspan', 2).appendTo(row);
 
@@ -624,7 +625,7 @@
 				maxRateDropDown.selectedIndex = minRateDropDown.selectedIndex;
 			}
 
-			alert('<fmt:message key="js.warning.max.min.limit"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="js.warning.max.min.limit"/></spring:escapeBody>');
 		}
 	}
 </script>
Index: lams_tool_forum/web/WEB-INF/tags/AuthoringRatingCriteria.tag
===================================================================
diff -u -r500f37cffc230632ac8b906e91bcddd44836a814 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/WEB-INF/tags/AuthoringRatingCriteria.tag	(.../AuthoringRatingCriteria.tag)	(revision 500f37cffc230632ac8b906e91bcddd44836a814)
+++ lams_tool_forum/web/WEB-INF/tags/AuthoringRatingCriteria.tag	(.../AuthoringRatingCriteria.tag)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -9,6 +9,7 @@
 <%@ taglib uri="tags-core" prefix="c" %>
 <%@ taglib uri="tags-fmt" prefix="fmt" %>
 <%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %> 
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
 <%@ taglib uri="tags-lams" prefix="lams"%>
 <%@ taglib uri="tags-function" prefix="fn" %>
 <c:set var="lams"><lams:LAMSURL/></c:set>
@@ -132,12 +133,12 @@
 		    		
 		})).append(jQuery('<td/>', {
 			width: '40px',
-			html: '<div class="arrow-up fa fa-long-arrow-up fa-pull-left" title="<fmt:message key="${upLabel}"/>" />' + 
-		    		'<div class="arrow-down fa fa-long-arrow-down fa-pull-right" title="<fmt:message key="${downLabel}"/>" />'
+			html: '<div class="arrow-up fa fa-long-arrow-up fa-pull-left" title="<spring:escapeBody javaScriptEscape="true"><fmt:message key="${upLabel}"/></spring:escapeBody>" />' + 
+		    		'<div class="arrow-down fa fa-long-arrow-down fa-pull-right" title="<spring:escapeBody javaScriptEscape="true"><fmt:message key="${downLabel}"/></spring:escapeBody>" />'
 		    		
 		})).append(jQuery('<td/>', {
 			width: '20px',
-			html: '<i class="fa fa-times" title="<fmt:message key="${deleteLabel}"/>"></i>'
+			html: '<i class="fa fa-times" title="<spring:escapeBody javaScriptEscape="true"><fmt:message key="${deleteLabel}"/></spring:escapeBody>"></i>'
 		})).appendTo('#criterias-table');
 		
 		reactivateArrows();
@@ -257,7 +258,7 @@
 				maxRateDropDown.selectedIndex = minRateDropDown.selectedIndex;
 			}
 
-			alert('<fmt:message key="js.warning.max.min.limit"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="js.warning.max.min.limit"/></spring:escapeBody>');
 		}
 	}
 </script>
Index: lams_tool_forum/web/WEB-INF/tags/OutcomeAuthor.tag
===================================================================
diff -u -r006c6b1060de8f84a95f80940553251f22e7a60a -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/WEB-INF/tags/OutcomeAuthor.tag	(.../OutcomeAuthor.tag)	(revision 006c6b1060de8f84a95f80940553251f22e7a60a)
+++ lams_tool_forum/web/WEB-INF/tags/OutcomeAuthor.tag	(.../OutcomeAuthor.tag)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -11,6 +11,7 @@
 <%@ taglib uri="tags-lams" prefix="lams"%>
 <%@ taglib uri="tags-function" prefix="fn" %>
 <%@ taglib uri="csrfguard" prefix="csrf" %>
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
 <c:set var="lams"><lams:LAMSURL/></c:set>
 
 <%-- Optional attributes. Must provide at either lessonId or toolContentId --%>
@@ -53,10 +54,10 @@
 		outcomeMappingIds${outcomeTagId} = [],
 		outcomeAddEnabled = true,
 		
-		outcomeExistingNoneLabel = '<fmt:message key="outcome.authoring.existing.none" />',
-		outcomeCreateNewLabel = '<fmt:message key="outcome.authoring.create.new" />',
+		outcomeExistingNoneLabel = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="outcome.authoring.existing.none" /></spring:escapeBody>',
+		outcomeCreateNewLabel = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="outcome.authoring.create.new" /></spring:escapeBody>',
 		outcomeMappingRemoveButton = '<i class="fa fa-remove loffset5"></i>',
-		outcomeMappingRemoveConfirm = '<fmt:message key="outcome.authoring.remove.confirm" />';
+		outcomeMappingRemoveConfirm = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="outcome.authoring.remove.confirm" /></spring:escapeBody>';
 	
 	$(document).ready(function(){
 		$('#outcomeSearchInput${outcomeTagId}').autocomplete({
Index: lams_tool_forum/web/WEB-INF/tags/Page.tag
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/WEB-INF/tags/Page.tag	(.../Page.tag)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/WEB-INF/tags/Page.tag	(.../Page.tag)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -2,6 +2,7 @@
 <%@ taglib uri="tags-core" prefix="c"%>
 <%@ taglib uri="tags-fmt" prefix="fmt"%>
 <%@ taglib uri="tags-lams" prefix="lams"%>
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
 
 <%@ attribute name="type" required="true" rtexprvalue="true"%>
 <%@ attribute name="formID" required="false" rtexprvalue="true"%>
@@ -186,7 +187,7 @@
 				// check if autosave does not happen too often
 				if (autosaveInterval > 0 && lamsAutosaveTimestamp && lamsAutosaveTimestamp + autosaveInterval/2 > currentTime) {
 					// this label is required only in tool which implement autosave
-					alert('<fmt:message key="label.prevent.learner.autosave.mutliple.tabs" />');
+					alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.prevent.learner.autosave.mutliple.tabs" /></spring:escapeBody>');
 					return false;
 				}
 				localStorage.setItem('lamsAutosaveTimestamp', currentTime);
Index: lams_tool_forum/web/WEB-INF/tags/Page5.tag
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/WEB-INF/tags/Page5.tag	(.../Page5.tag)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/WEB-INF/tags/Page5.tag	(.../Page5.tag)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -3,6 +3,7 @@
 <%@ taglib uri="tags-fmt" prefix="fmt"%>
 <%@ taglib uri="tags-lams" prefix="lams"%>
 <%@ taglib uri="tags-function" prefix="fn" %>
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
 
 <%@ attribute name="type" required="true" rtexprvalue="true"%>
 <%@ attribute name="formID" required="false" rtexprvalue="true"%>
@@ -188,7 +189,7 @@
 				// check if autosave does not happen too often
 				if (autosaveInterval > 0 && lamsAutosaveTimestamp && lamsAutosaveTimestamp + autosaveInterval/2 > currentTime) {
 					// this label is required only in tool which implement autosave
-					alert('<fmt:message key="label.prevent.learner.autosave.mutliple.tabs" />');
+					alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.prevent.learner.autosave.mutliple.tabs" /></spring:escapeBody>');
 					return false;
 				}
 				localStorage.setItem('lamsAutosaveTimestamp', currentTime);
Index: lams_tool_forum/web/common/taglibs.jsp
===================================================================
diff -u -r9cbba0026b9584b2e4bcba57f0d5a8510bdb5846 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/common/taglibs.jsp	(.../taglibs.jsp)	(revision 9cbba0026b9584b2e4bcba57f0d5a8510bdb5846)
+++ lams_tool_forum/web/common/taglibs.jsp	(.../taglibs.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -7,3 +7,4 @@
 
 <%@ taglib uri="csrfguard" prefix="csrf" %> 
 <%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %> 
+<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
Index: lams_tool_forum/web/jsps/authoring/advance.jsp
===================================================================
diff -u -r62aaf160878735888d077bf28fac3c1989bb8fbd -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/authoring/advance.jsp	(.../advance.jsp)	(revision 62aaf160878735888d077bf28fac3c1989bb8fbd)
+++ lams_tool_forum/web/jsps/authoring/advance.jsp	(.../advance.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -220,13 +220,13 @@
 		var errors = '';
 		var num = parseFloat(this.value);
 		if (isNaN(num)) {
-			errors = "<fmt:message key="js.error.invalid.number"/>\n";
+			errors = "<spring:escapeBody javaScriptEscape='true'><fmt:message key='js.error.invalid.number'/></spring:escapeBody>\n";
 		} else if (num <= min) {
-			errors = "<fmt:message key="js.error.min.number"/>";
+			errors = "<spring:escapeBody javaScriptEscape='true'><fmt:message key='js.error.min.number'/></spring:escapeBody>";
 		}
 
 		if (errors) {
-			alert("<fmt:message key="js.error.title"/>\n" + errors);
+			alert("<spring:escapeBody javaScriptEscape='true'><fmt:message key='js.error.title'/></spring:escapeBody>\n" + errors);
 		}
 	}
 
@@ -275,7 +275,7 @@
 				maxCharacters.value = minCharacters.value;
 			}
 
-			alert('<fmt:message key="js.error.validate.posting.number"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="js.error.validate.posting.number"/></spring:escapeBody>');
 		}
 	}
 
@@ -291,7 +291,7 @@
 				maxReplyDropDown.value = minReplyDropDown.value;
 			}
 
-			alert('<fmt:message key="js.error.validate.reply.number"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="js.error.validate.reply.number"/></spring:escapeBody>');
 		}
 	}
 
@@ -307,7 +307,7 @@
 				maxRateDropDown.value = minRateDropDown.value;
 			}
 
-			alert('<fmt:message key="js.error.validate.number"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="js.error.validate.number"/></spring:escapeBody>');
 		}
 	}
 
Index: lams_tool_forum/web/jsps/authoring/authoring.jsp
===================================================================
diff -u -rca136be52df70bbdd506d2383d4d4bd2201a3b3f -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/authoring/authoring.jsp	(.../authoring.jsp)	(revision ca136be52df70bbdd506d2383d4d4bd2201a3b3f)
+++ lams_tool_forum/web/jsps/authoring/authoring.jsp	(.../authoring.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -36,10 +36,8 @@
    		 		UPLOAD_FILE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_MAX_SIZE}"/>',
    		 		UPLOAD_FILE_LARGE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_LARGE_MAX_SIZE}"/>',
    				// convert Java syntax to JSON
-   		       EXE_FILE_TYPES = JSON.parse("[" + "${EXE_FILE_TYPES}".replace(/\.\w+/g, '"$&"') + "]"),
-   			   decoderDiv = $('<div />'),
-   		       <fmt:message key="error.attachment.executable" var="EXE_FILE_ERROR_VAR" />
-   		       EXE_FILE_ERROR = decoderDiv.html('<c:out value="${EXE_FILE_ERROR_VAR}" />').text();
+   		       EXE_FILE_TYPES = JSON.parse("[" + "${EXE_FILE_TYPES}".replace(/\.\w+/g, '"$&"') + "]"),   		       
+   		       EXE_FILE_ERROR = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';
    				
 			function init(){
 				var tag = document.getElementById("currentTab");
Index: lams_tool_forum/web/jsps/authoring/basic.jsp
===================================================================
diff -u -r6132d98ee813109713fda3579007d4359596fc1e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/authoring/basic.jsp	(.../basic.jsp)	(revision 6132d98ee813109713fda3579007d4359596fc1e)
+++ lams_tool_forum/web/jsps/authoring/basic.jsp	(.../basic.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -53,7 +53,7 @@
 	var topicListTargetDiv = "messageListArea";
 	function deleteTopic(topicIndex, sessionMapID){
 
-		var	deletionConfirmed = confirm("<fmt:message key='label.authoring.basic.do.you.want.to.delete'></fmt:message>");
+		var	deletionConfirmed = confirm("<spring:escapeBody javaScriptEscape='true'><fmt:message key='label.authoring.basic.do.you.want.to.delete'/></spring:escapeBody>");
 		
 		if (deletionConfirmed) {
 			var url = "<c:url value="/authoring/deleteTopic.do"/>?<csrf:token/>";
Index: lams_tool_forum/web/jsps/learning/create.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/create.jsp	(.../create.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/create.jsp	(.../create.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -52,18 +52,17 @@
 		
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 				
    			var LAMS_URL = '${lams}',
    		 		UPLOAD_FILE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_MAX_SIZE}"/>',
    		 		UPLOAD_FILE_LARGE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_LARGE_MAX_SIZE}"/>';
    				// convert Java syntax to JSON
-   		       EXE_FILE_TYPES = JSON.parse("[" + "${EXE_FILE_TYPES}".replace(/\.\w+/g, '"$&"') + "]"),
-   			   decoderDiv = $('<div />'),
-   		       <fmt:message key="error.attachment.executable" var="EXE_FILE_ERROR_VAR" />
-   		       EXE_FILE_ERROR = decoderDiv.html('<c:out value="${EXE_FILE_ERROR_VAR}" />').text();
+   		       EXE_FILE_TYPES = JSON.parse("[" + "${EXE_FILE_TYPES}".replace(/\.\w+/g, '"$&"') + "]"),   		       
+   		       EXE_FILE_ERROR = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';
+			   
 		</script>
 		<script type="text/javascript" src="${tool}includes/javascript/learner.js"></script>
 		<script type="text/javascript" src="${tool}includes/javascript/message.js"></script>	
Index: lams_tool_forum/web/jsps/learning/definelater.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/definelater.jsp	(.../definelater.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/definelater.jsp	(.../definelater.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -34,9 +34,9 @@
 		
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 			var EXE_FILE_TYPES = '${EXE_FILE_TYPES}';
 			var UPLOAD_FILE_MAX_SIZE = '${UPLOAD_FILE_MAX_SIZE}';
 		</script>
Index: lams_tool_forum/web/jsps/learning/edit.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/edit.jsp	(.../edit.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/edit.jsp	(.../edit.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -51,18 +51,16 @@
 		
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 			
    			var LAMS_URL = '${lams}',
    		 		UPLOAD_FILE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_MAX_SIZE}"/>',
    		 		UPLOAD_FILE_LARGE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_LARGE_MAX_SIZE}"/>';
    				// convert Java syntax to JSON
    		       EXE_FILE_TYPES = JSON.parse("[" + "${EXE_FILE_TYPES}".replace(/\.\w+/g, '"$&"') + "]"),
-   			   decoderDiv = $('<div />'),
-   		       <fmt:message key="error.attachment.executable" var="EXE_FILE_ERROR_VAR" />
-   		       EXE_FILE_ERROR = decoderDiv.html('<c:out value="${EXE_FILE_ERROR_VAR}" />').text();
+   		       EXE_FILE_ERROR = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';
 
 		</script>
 		<script type="text/javascript" src="${tool}includes/javascript/learner.js"></script>	
@@ -106,7 +104,7 @@
 			        			var rootUid = response.rootUid;
 			        			var messDiv = document.getElementById('outermsg'+messageUid);
 			        			if ( ! messDiv) {
-			        				alert('<fmt:message key="error.cannot.redisplay.please.refresh"/>');
+			        				alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.cannot.redisplay.please.refresh"/></spring:escapeBody>');
 		        				} else {
 		        					// make sure the old edit form is gone, so if something goes wrong 
 		        					// the user won't try to submit it again
Index: lams_tool_forum/web/jsps/learning/message/bodyarea.jsp
===================================================================
diff -u -rb7aaf1918d51259a93067809b0d1627c2017be33 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/message/bodyarea.jsp	(.../bodyarea.jsp)	(revision b7aaf1918d51259a93067809b0d1627c2017be33)
+++ lams_tool_forum/web/jsps/learning/message/bodyarea.jsp	(.../bodyarea.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -152,11 +152,10 @@
 		</div>&nbsp;<a tabindex="0" role="button" data-toggle="popover"><i class="fa fa-info-circle"></i></a>
 	
 		<%-- Use c:out to escape any quotes in the I18N string. Then use html: true converts any escaped quotes back --%>
-		<%-- into real quotes. Should be safe from XSS attack as the string is coming from a translation file. --%>	
-		<fmt:message key="label.anonymous.tooltip" var="ANONYMOUS_TOOLTIP_VAR"></fmt:message>		
+		<%-- into real quotes. Should be safe from XSS attack as the string is coming from a translation file. --%>			
  		<script type="text/javascript">
 		$(document).ready(function() {
-			var ANONYMOUS_TOOLTIP = '<c:out value="${ANONYMOUS_TOOLTIP_VAR}" />';
+			var ANONYMOUS_TOOLTIP = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.anonymous.tooltip"/></spring:escapeBody>';
 	    		$('[data-toggle="popover"]').popover({title: "", content: ANONYMOUS_TOOLTIP, placement:"auto left", delay: 50, trigger:"hover focus", html: true});
 		});
 		</script>
Index: lams_tool_forum/web/jsps/learning/message/topicview.jsp
===================================================================
diff -u -rb71c9cb2f96eb891545d32aaca8904051d1e00d5 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/message/topicview.jsp	(.../topicview.jsp)	(revision b71c9cb2f96eb891545d32aaca8904051d1e00d5)
+++ lams_tool_forum/web/jsps/learning/message/topicview.jsp	(.../topicview.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -10,13 +10,13 @@
 <c:set var="indent" value="10" />
 
 <c:set var="show">
-	<fmt:message key="label.show.replies" />
+	<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.show.replies" /></spring:escapeBody>
 </c:set>
 <c:set var="hide">
-	<fmt:message key="label.hide.replies" />
+	<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.hide.replies" /></spring:escapeBody>
 </c:set>
 <c:set var="prompt">
-	<fmt:message key="label.showhide.prompt" />
+	<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.showhide.prompt" /></spring:escapeBody>
 </c:set>
 <c:set var="tableCommand">expandable:true,initialState:'expanded',
 	expanderTemplate:'<a href=\"#\"><span style="margin-left:20px">${prompt}</span></a>',
@@ -45,7 +45,7 @@
 
 	function createReply(messageUid, url, level) {
 		if ( document.getElementById('reply') ) {
-			alert('<fmt:message key="message.complete.or.cancel.reply"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="message.complete.or.cancel.reply"/></spring:escapeBody>');
 		} else {
 			// set up the new reply area
 			var replyDiv = document.createElement("div");
@@ -58,7 +58,7 @@
 
 	function createEdit(messageUid, url, level) {
 		if ( document.getElementById('edit') ) {
-			alert('<fmt:message key="message.complete.or.cancel.edit"/>');
+			alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="message.complete.or.cancel.edit"/></spring:escapeBody>');
 		} else {
 			// set up the new edit area
 			var editDiv = document.createElement("div");
Index: lams_tool_forum/web/jsps/learning/notebook.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/notebook.jsp	(.../notebook.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/notebook.jsp	(.../notebook.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -37,9 +37,9 @@
 	
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 			var EXE_FILE_TYPES = '${EXE_FILE_TYPES}';
 			var UPLOAD_FILE_MAX_SIZE = '${UPLOAD_FILE_MAX_SIZE}';
 
Index: lams_tool_forum/web/jsps/learning/reply.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/reply.jsp	(.../reply.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/reply.jsp	(.../reply.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -52,18 +52,16 @@
 		
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 			
    			var LAMS_URL = '${lams}',
    		 		UPLOAD_FILE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_MAX_SIZE}"/>',
    		 		UPLOAD_FILE_LARGE_MAX_SIZE = '<c:out value="${UPLOAD_FILE_LARGE_MAX_SIZE}"/>';
    				// convert Java syntax to JSON
    		       EXE_FILE_TYPES = JSON.parse("[" + "${EXE_FILE_TYPES}".replace(/\.\w+/g, '"$&"') + "]"),
-   			   decoderDiv = $('<div />'),
-   		       <fmt:message key="error.attachment.executable" var="EXE_FILE_ERROR_VAR" />
-   		       EXE_FILE_ERROR = decoderDiv.html('<c:out value="${EXE_FILE_ERROR_VAR}" />').text();
+   		       EXE_FILE_ERROR = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';
 
 		</script>
 		<script type="text/javascript" src="${tool}includes/javascript/learner.js"></script>	
@@ -118,7 +116,7 @@
 								$('#reply').remove();
 		        			
 			        			if ( ! threadDiv) {
-			        				alert('<fmt:message key="error.cannot.redisplay.please.refresh"/>');
+			        				alert('<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.cannot.redisplay.please.refresh"/></spring:escapeBody>');
 		        				} else {
 			        				var loadString = "<lams:WebAppURL />learning/viewTopicThread.do?topicID=" + rootUid + "&sessionMapID=" + response.sessionMapID + "&threadUid=" + threadUid+"&messageUid="+messageUid;
 			        				$.ajaxSetup({ cache: true });
Index: lams_tool_forum/web/jsps/learning/submissionDeadline.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/submissionDeadline.jsp	(.../submissionDeadline.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/submissionDeadline.jsp	(.../submissionDeadline.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -34,9 +34,9 @@
 		
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 			var EXE_FILE_TYPES = '${EXE_FILE_TYPES}';
 			var UPLOAD_FILE_MAX_SIZE = '${UPLOAD_FILE_MAX_SIZE}';
 		</script>
Index: lams_tool_forum/web/jsps/learning/viewforum.jsp
===================================================================
diff -u -rfe19797ec82718905555353176ed719bec11043e -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/learning/viewforum.jsp	(.../viewforum.jsp)	(revision fe19797ec82718905555353176ed719bec11043e)
+++ lams_tool_forum/web/jsps/learning/viewforum.jsp	(.../viewforum.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -48,9 +48,9 @@
 		
 		<script type="text/javascript">
 			var removeItemAttachmentUrl = "<lams:WebAppURL />learning/deleteAttachment.do";
-			var warning = '<fmt:message key="warn.minimum.number.characters" />';
-			var LABEL_MAX_FILE_SIZE = '<fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message>';
-			var LABEL_NOT_ALLOWED_FORMAT = '<fmt:message key="error.attachment.executable"/>';	
+			var warning = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="warn.minimum.number.characters" /></spring:escapeBody>';
+			var LABEL_MAX_FILE_SIZE = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="errors.maxfilesize"><param>{0}</param></fmt:message></spring:escapeBody>';
+			var LABEL_NOT_ALLOWED_FORMAT = '<spring:escapeBody javaScriptEscape="true"><fmt:message key="error.attachment.executable"/></spring:escapeBody>';	
 			var EXE_FILE_TYPES = '${EXE_FILE_TYPES}';
 			var UPLOAD_FILE_MAX_SIZE = '${UPLOAD_FILE_MAX_SIZE}';
 
Index: lams_tool_forum/web/jsps/monitoring/parts/advanceOptions.jsp
===================================================================
diff -u -r7475d08afc280b5e2e5ddf04e8bf35e3166aaf80 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/monitoring/parts/advanceOptions.jsp	(.../advanceOptions.jsp)	(revision 7475d08afc280b5e2e5ddf04e8bf35e3166aaf80)
+++ lams_tool_forum/web/jsps/monitoring/parts/advanceOptions.jsp	(.../advanceOptions.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -1,4 +1,4 @@
-<c:set var="adTitle"><fmt:message key="monitor.summary.th.advancedSettings" /></c:set>
+<c:set var="adTitle"><spring:escapeBody javaScriptEscape="true"><fmt:message key="monitor.summary.th.advancedSettings" /></spring:escapeBody></c:set>
 <lams:AdvancedAccordian title="${adTitle}">
              
 <table class="table table-striped table-condensed">
Index: lams_tool_forum/web/jsps/monitoring/parts/daterestriction.jsp
===================================================================
diff -u -rc1d637e4d2786f97672dd38f6e3278d5c4f7b79c -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/monitoring/parts/daterestriction.jsp	(.../daterestriction.jsp)	(revision c1d637e4d2786f97672dd38f6e3278d5c4f7b79c)
+++ lams_tool_forum/web/jsps/monitoring/parts/daterestriction.jsp	(.../daterestriction.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -1,6 +1,6 @@
 <%@include file="/common/taglibs.jsp"%>
 
-<c:set var="ddTitle"><fmt:message key="monitor.summary.date.restriction" /></c:set>
+<c:set var="ddTitle"><spring:escapeBody javaScriptEscape="true"><fmt:message key="monitor.summary.date.restriction" /></spring:escapeBody></c:set>
 <lams:RestrictedUsageAccordian title="${ddTitle}">
 
 	<p><fmt:message key="monitor.summary.when.date.restriction.is.set" /></p>
Index: lams_tool_forum/web/jsps/monitoring/summary.jsp
===================================================================
diff -u -r47dddf6db4afaba99d8f3f88fc50b16df9251a76 -rabf11f48c3a772c5715c3e5caa1ecc86d62056a8
--- lams_tool_forum/web/jsps/monitoring/summary.jsp	(.../summary.jsp)	(revision 47dddf6db4afaba99d8f3f88fc50b16df9251a76)
+++ lams_tool_forum/web/jsps/monitoring/summary.jsp	(.../summary.jsp)	(revision abf11f48c3a772c5715c3e5caa1ecc86d62056a8)
@@ -28,9 +28,9 @@
 		submissionDateString: '${submissionDateString}',
 		setSubmissionDeadlineUrl: '<c:url value="/monitoring/setSubmissionDeadline.do"/>?<csrf:token/>',
 		toolContentID: '<c:out value="${param.toolContentID}" />',
-		messageNotification: '<fmt:message key="monitor.summary.notification" />',
-		messageRestrictionSet: '<fmt:message key="monitor.summary.date.restriction.set" />',
-		messageRestrictionRemoved: '<fmt:message key="monitor.summary.date.restriction.removed" />'
+		messageNotification: '<spring:escapeBody javaScriptEscape="true"><fmt:message key="monitor.summary.notification" /></spring:escapeBody>',
+		messageRestrictionSet: '<spring:escapeBody javaScriptEscape="true"><fmt:message key="monitor.summary.date.restriction.set" /></spring:escapeBody>',
+		messageRestrictionRemoved: '<spring:escapeBody javaScriptEscape="true"><fmt:message key="monitor.summary.date.restriction.removed" /></spring:escapeBody>'
 	};
 </script>
 <script type="text/javascript" src="${lams}/includes/javascript/monitorToolSummaryAdvanced.js" ></script>
@@ -70,7 +70,7 @@
             	resizable: true,
             	// include column filters 
                 filter_columnFilters: true, 
-                filter_placeholder: { search : '<fmt:message key="label.search"/>' }, 
+                filter_placeholder: { search : '<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.search"/></spring:escapeBody>' }, 
                 filter_searchDelay: 700 
             }
 		});
@@ -118,12 +118,12 @@
 								rows += "-";
 								
 							} else {
-								var anyPostsMarked = (userData["anyPostsMarked"]) ? '<fmt:message key="label.yes"/>' : '<fmt:message key="label.no"/>';
+								var anyPostsMarked = (userData["anyPostsMarked"]) ? '<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.yes"/></spring:escapeBody>' : '<spring:escapeBody javaScriptEscape="true"><fmt:message key="label.no"/></spring:escapeBody>';
 								rows += anyPostsMarked;	
 								
 								var viewUserMarkUrl = '<c:url value="/monitoring/viewUserMark.do"/>?sessionMapID=${sessionMapID}&userUid=' + userData["userUid"] + "&toolSessionID=" + $(table).attr('data-session-id');
 								rows += 	'<a href="javascript:launchPopup(\'' + viewUserMarkUrl + '\')" style="margin-left: 7px;" styleClass="button">';
-								rows += 		'<fmt:message key="lable.topic.title.mark" />';
+								rows += 		'<spring:escapeBody javaScriptEscape="true"><fmt:message key="lable.topic.title.mark" /></spring:escapeBody>';
 								rows += 	'</a>';
 							}
 							rows += '</td>';