Index: lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/service/GradebookService.java
===================================================================
diff -u -rcf77c0915cbb991b869756e0a53436e651040dd0 -rcda0a3d272f76d413f458d02ebeb068b937a026c
--- lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/service/GradebookService.java	(.../GradebookService.java)	(revision cf77c0915cbb991b869756e0a53436e651040dd0)
+++ lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/service/GradebookService.java	(.../GradebookService.java)	(revision cda0a3d272f76d413f458d02ebeb068b937a026c)
@@ -41,6 +41,7 @@
 import java.util.TimeZone;
 import java.util.TreeSet;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.lamsfoundation.lams.dao.IBaseDAO;
@@ -1285,7 +1286,7 @@
 	    } else if (learnerProgress.getAttemptedActivities() != null
 		    && learnerProgress.getAttemptedActivities().size() > 0) {
 		status = "<img src='" + IMAGES_DIR + "/cog.png' title='"
-			+ learnerProgress.getCurrentActivity().getTitle() + "' />";
+			+ StringEscapeUtils.escapeHtml(learnerProgress.getCurrentActivity().getTitle()) + "' />";
 	    }
 	}
 	return status;
@@ -1305,7 +1306,7 @@
 	    byte statusByte = learnerProgress.getProgressState(activity);
 	    if (statusByte == LearnerProgress.ACTIVITY_ATTEMPTED) {
 		return "<img src='" + IMAGES_DIR + "/cog.png' title='"
-			+ learnerProgress.getCurrentActivity().getTitle() + "' />";
+			+ StringEscapeUtils.escapeHtml(learnerProgress.getCurrentActivity().getTitle()) + "' />";
 	    } else if (statusByte == LearnerProgress.ACTIVITY_COMPLETED) {
 		return "<img src='" + IMAGES_DIR + "/tick.png' />";
 	    }