Index: lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBActivityGridRowDTO.java
===================================================================
RCS file: /usr/local/cvsroot/lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBActivityGridRowDTO.java,v
diff -u -r1.8 -r1.9
--- lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBActivityGridRowDTO.java	6 Jun 2013 19:25:58 -0000	1.8
+++ lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBActivityGridRowDTO.java	5 Apr 2014 18:46:03 -0000	1.9
@@ -27,6 +27,7 @@
 import java.util.Date;
 import java.util.Set;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.lamsfoundation.lams.gradebook.util.GBGridView;
 import org.lamsfoundation.lams.gradebook.util.GradebookUtil;
 import org.lamsfoundation.lams.learningdesign.CompetenceMapping;
@@ -64,11 +65,11 @@
 	    
 	    this.groupId = groupId;
 	    // If grouped acitivty, append group name
-	    this.rowName = activity.getTitle() + " (" + groupName + ")";
+	    this.rowName = StringEscapeUtils.escapeHtml(activity.getTitle()) + " (" + groupName + ")";
 	} else {
 	    this.id = activity.getActivityId().toString();
 
-	    this.rowName = activity.getTitle();
+	    this.rowName = StringEscapeUtils.escapeHtml(activity.getTitle());
 	}
 	
 	//Constructs the competences for this activity.
Index: lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBLessonGridRowDTO.java
===================================================================
RCS file: /usr/local/cvsroot/lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBLessonGridRowDTO.java,v
diff -u -r1.4 -r1.5
--- lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBLessonGridRowDTO.java	6 Jun 2013 19:25:58 -0000	1.4
+++ lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBLessonGridRowDTO.java	5 Apr 2014 18:46:04 -0000	1.5
@@ -25,6 +25,8 @@
 
 import java.util.ArrayList;
 
+import org.apache.commons.lang.StringEscapeUtils;
+
 import org.lamsfoundation.lams.gradebook.util.GBGridView;
 import org.lamsfoundation.lams.gradebook.util.GradebookUtil;
 
@@ -52,6 +54,8 @@
 	
 	ret.add(id.toString());
 	
+	rowName = StringEscapeUtils.escapeHtml(rowName);
+	
 	if (view == GBGridView.MON_COURSE) {
 	    if (gradebookMonitorURL != null && gradebookMonitorURL.length() != 0) {
 		ret.add("<a href='javascript:launchPopup(\"" + gradebookMonitorURL + "\",\"" + rowName + "\",1220,600)'>" + rowName
Index: lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBUserGridRowDTO.java
===================================================================
RCS file: /usr/local/cvsroot/lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBUserGridRowDTO.java,v
diff -u -r1.10 -r1.11
--- lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBUserGridRowDTO.java	6 Jun 2013 19:25:58 -0000	1.10
+++ lams_gradebook/src/java/org/lamsfoundation/lams/gradebook/dto/GBUserGridRowDTO.java	5 Apr 2014 18:46:04 -0000	1.11
@@ -26,6 +26,8 @@
 import java.util.ArrayList;
 import java.util.Date;
 
+import org.apache.commons.lang.StringEscapeUtils;
+
 import org.lamsfoundation.lams.gradebook.util.GBGridView;
 import org.lamsfoundation.lams.gradebook.util.GradebookUtil;
 import org.lamsfoundation.lams.usermanagement.User;
@@ -47,7 +49,7 @@
     
     public GBUserGridRowDTO(User user) {
 	this.id = user.getUserId().toString();
-	this.rowName = user.getLastName() + " " + user.getFirstName();
+	this.rowName = StringEscapeUtils.escapeHtml(user.getLastName() + " " + user.getFirstName());
 	this.firstName = user.getFirstName();
 	this.lastName = user.getLastName();
     }
Index: lams_gradebook/web/gradebookCourseLearner.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_gradebook/web/gradebookCourseLearner.jsp,v
diff -u -r1.8 -r1.9
--- lams_gradebook/web/gradebookCourseLearner.jsp	29 Sep 2012 13:56:58 -0000	1.8
+++ lams_gradebook/web/gradebookCourseLearner.jsp	5 Apr 2014 18:48:09 -0000	1.9
@@ -156,7 +156,7 @@
 			<h1 class="no-tabs-below">
 				<fmt:message key="gradebook.title.myGradebook">
 					<fmt:param>
-						${fullName}
+						<c:out value="${fullName}" escapeXml="true"/>
 					</fmt:param>
 				</fmt:message>
 			</h1>
Index: lams_gradebook/web/gradebookCourseMonitor.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_gradebook/web/gradebookCourseMonitor.jsp,v
diff -u -r1.15 -r1.16
--- lams_gradebook/web/gradebookCourseMonitor.jsp	5 Dec 2013 19:39:55 -0000	1.15
+++ lams_gradebook/web/gradebookCourseMonitor.jsp	5 Apr 2014 18:48:09 -0000	1.16
@@ -430,7 +430,7 @@
 			<h1 class="no-tabs-below">
 				<fmt:message key="gradebook.title.courseMonitor">
 					<fmt:param>
-						${organisationName}
+						<c:out value="${organisationName}" escapeXml="true"/>
 					</fmt:param>
 				</fmt:message>
 			</h1>
Index: lams_gradebook/web/gradebookMonitor.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_gradebook/web/gradebookMonitor.jsp,v
diff -u -r1.11 -r1.12
--- lams_gradebook/web/gradebookMonitor.jsp	28 Oct 2013 14:28:02 -0000	1.11
+++ lams_gradebook/web/gradebookMonitor.jsp	5 Apr 2014 18:46:04 -0000	1.12
@@ -88,7 +88,7 @@
 			    ],
 			    colModel:[
 			      {name:'id', index:'id', sortable:false, editable:false, hidden:true, search:false, hidedlg:true},
-			      {name:'rowName',index:'rowName', sortable:true, editable:false},
+			      {name:'rowNamer',index:'rowName', sortable:true, editable:false, autoencode:true},
 			      {name:'status',index:'status', sortable:false, editable:false, search:false, width:50, align:"center"},
 			      {name:'timeTaken',index:'timeTaken', sortable:true, editable:false, search:false, width:80, align:"center"},
 			      {name:'feedback',index:'feedback', sortable:false, editable:true, edittype:'textarea', editoptions:{rows:'4',cols:'20'}, search:false },
@@ -461,7 +461,7 @@
 			<h1 class="no-tabs-below">
 				<fmt:message key="gradebook.title.lessonGradebook">
 					<fmt:param>
-						${lessonDetails.lessonName}
+						<c:out value="${lessonDetails.lessonName}" escapeXml="true"/>
 					</fmt:param>
 				</fmt:message>
 			</h1>