Index: lams_central/web/emailuser.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/emailuser.jsp,v
diff -u -r1.2 -r1.3
--- lams_central/web/emailuser.jsp	6 Apr 2014 20:15:35 -0000	1.2
+++ lams_central/web/emailuser.jsp	6 Apr 2014 22:56:46 -0000	1.3
@@ -83,7 +83,7 @@
 					<tr>
 						<td><fmt:message key="email.to" /></td>
 						 <c:if test="${not empty user}">
-							<td><c:out value="${user.firstName} ${user.lastName} &lt;${user.email}&gt;"/></td>
+							<td><c:out value="${user.firstName} ${user.lastName}"/> &lt;<c:out value="${user.email}"/>&gt;</td>
 						 </c:if>
 					</tr>
 
Index: lams_central/web/findUserLessons.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/findUserLessons.jsp,v
diff -u -r1.10 -r1.11
--- lams_central/web/findUserLessons.jsp	6 Apr 2014 20:15:35 -0000	1.10
+++ lams_central/web/findUserLessons.jsp	6 Apr 2014 22:54:08 -0000	1.11
@@ -4,6 +4,7 @@
 <%@ taglib uri="tags-fmt" prefix="fmt"%>
 <%@ taglib uri="tags-core" prefix="c"%>
 <%@ taglib uri="tags-html" prefix="html"%>
+<%@ taglib uri="tags-function" prefix="fn"%>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
 		"http://www.w3.org/TR/html4/loose.dtd">
@@ -78,7 +79,7 @@
 
 	<c:otherwise>
 		<h1><fmt:message key="lessonsearch.results">
-			<fmt:param value="${originalQuery}" />
+			<fmt:param value="${fn:escapeXml(originalQuery)}" />
 		</fmt:message></h1>
 
 		<c:forEach var="user" items="${userLessonsMap}">
Index: lams_central/web/indexLessonConditions.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/indexLessonConditions.jsp,v
diff -u -r1.7 -r1.8
--- lams_central/web/indexLessonConditions.jsp	29 Sep 2012 13:56:32 -0000	1.7
+++ lams_central/web/indexLessonConditions.jsp	6 Apr 2014 22:57:35 -0000	1.8
@@ -4,6 +4,7 @@
 <%@ taglib uri="tags-lams" prefix="lams"%>
 <%@ taglib uri="tags-logic" prefix="logic" %>
 <%@ taglib uri="tags-html" prefix="html" %>
+<%@ taglib uri="tags-function" prefix="fn"%>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <lams:html>
@@ -65,7 +66,7 @@
 		<td colspan="2">
 			<h4>
 				<fmt:message key="label.conditions.box.title">
-					<fmt:param>${title}</fmt:param>
+					<fmt:param>${fn:escapeXml(title)}</fmt:param>
 				</fmt:message>
 			</h4>
 		</td>
@@ -121,7 +122,7 @@
 					<td class="lessonList" style="width: 70%">
 						<select name="precedingLessonId">
 							<c:forEach var="availableLesson" items="${availableLessons}">
-								<option value="${availableLesson.id}">${availableLesson.name}</option>
+								<option value="${availableLesson.id}">${fn:escapeXml(availableLesson.name)}</option>
 							</c:forEach>
 						</select>
 					</td>
Index: lams_central/web/lessonIntro.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/lessonIntro.jsp,v
diff -u -r1.7 -r1.8
--- lams_central/web/lessonIntro.jsp	3 Sep 2013 10:55:33 -0000	1.7
+++ lams_central/web/lessonIntro.jsp	6 Apr 2014 22:58:12 -0000	1.8
@@ -6,6 +6,7 @@
 <%@ taglib uri="tags-fmt" prefix="fmt" %>
 <%@ taglib uri="tags-core" prefix="c" %>
 <%@ taglib uri="tags-html" prefix="html" %>
+<%@ taglib uri="tags-function" prefix="fn"%>
 <c:set var="lams" ><lams:LAMSURL/></c:set>
 <c:set var="pngImageSrc" value="${lams}www/secure/learning-design-images/${learningDesignID}.png" />
 <c:set var="svgImageSrc" value="${lams}www/secure/learning-design-images/${learningDesignID}.svg" />
@@ -44,9 +45,9 @@
 			</div>
 		</c:if>
 	
-		<h1>${lesson.lessonName}</h1>
+		<h1><c:out value="${lesson.lessonName}" escapeXml="true"/></h1>
 	
-		<p>${lesson.lessonDescription}</p>	
+		<p><c:out value="${lesson.lessonDescription}" escapeXml="false"/></p>	
 	
 		<c:if test="${displayDesignImage}">
 			<div id="sequence-preview">
@@ -60,11 +61,11 @@
 		</c:if>
 			
 		<div class="space-bottom-top align-right">
-			<html:link href="${learnerURL}" styleClass="button">
+			<html:link href="${fn:escapeXml(learnerURL)}" styleClass="button">
 				<span class="nextActivity"><fmt:message key="label.start.lesson" /></span>
 			</html:link>
 		</div>
-			
+
 	</div>
 	   
 	<div id="footer"></div>
Index: lams_central/web/main.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/main.jsp,v
diff -u -r1.73 -r1.74
--- lams_central/web/main.jsp	14 Jan 2014 15:10:31 -0000	1.73
+++ lams_central/web/main.jsp	6 Apr 2014 22:58:59 -0000	1.74
@@ -155,7 +155,10 @@
 				</c:if>
 				<td>
 					<fmt:message key="index.welcome" />
-					<lams:user property="firstName" />
+					<c:set var="firstName">
+						<lams:user property="firstName" />
+					</c:set>
+					<c:out value="${firstName}" escapeXml="true"/>
 				</td>
 				
 				<td id="messageCell">
