Index: lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/EmailNotificationsAction.java
===================================================================
RCS file: /usr/local/cvsroot/lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/EmailNotificationsAction.java,v
diff -u -r1.9 -r1.10
--- lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/EmailNotificationsAction.java	4 Jul 2013 11:35:01 -0000	1.9
+++ lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/EmailNotificationsAction.java	6 Apr 2014 22:43:53 -0000	1.10
@@ -39,6 +39,8 @@
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
+import org.apache.commons.lang.StringEscapeUtils;
+
 import org.apache.struts.action.ActionForm;
 import org.apache.struts.action.ActionForward;
 import org.apache.struts.action.ActionMapping;
@@ -306,10 +308,10 @@
 	responcedata.put("total", "" + users.size());
 	responcedata.put("page", "" + 1);
 	responcedata.put("records", "" + users.size());
-
+	
 	for (User user : users) {
 	    JSONArray cell=new JSONArray();
-	    cell.put(user.getFirstName() + " " + user.getLastName() + " [" + user.getLogin() + "]");
+	    cell.put(StringEscapeUtils.escapeHtml(user.getFirstName()) + " " + StringEscapeUtils.escapeHtml(user.getLastName()) + " [" + StringEscapeUtils.escapeHtml(user.getLogin()) + "]");
 	    
 	    JSONObject cellobj = new JSONObject();
 	    cellobj.put("id", "" + user.getUserId());
Index: lams_monitoring/web/monitor.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_monitoring/web/monitor.jsp,v
diff -u -r1.24 -r1.25
--- lams_monitoring/web/monitor.jsp	2 Feb 2014 17:18:46 -0000	1.24
+++ lams_monitoring/web/monitor.jsp	6 Apr 2014 22:42:41 -0000	1.25
@@ -138,7 +138,7 @@
 					<fmt:message key="lesson.description"/>
 				</td>
 				<td>
-					${lesson.lessonDescription}
+					<c:out value="${lesson.lessonDescription}" escapeXml="false"/>
 				</td>
 			</tr>
 			<tr>
@@ -173,7 +173,7 @@
 					<fmt:message key="lesson.class"/>
 				</td>
 				<td>
-					${lesson.organisationName}
+					<c:out value="${lesson.organisationName}" escapeXml="true"/>
 				</td>
 			</tr>
 			<tr>