Index: lams_tool_wiki/web/includes/css/wiki_style.css
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/includes/css/wiki_style.css,v
diff -u -r1.1 -r1.2
--- lams_tool_wiki/web/includes/css/wiki_style.css	8 Oct 2008 05:33:01 -0000	1.1
+++ lams_tool_wiki/web/includes/css/wiki_style.css	14 Apr 2014 12:57:18 -0000	1.2
@@ -33,4 +33,9 @@
 	margin: 0px;
 }
 
+.error {
+	color: red;
+
+}
+
 	
\ No newline at end of file
Index: lams_tool_wiki/web/includes/javascript/validation.js
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/includes/javascript/validation.js,v
diff -u
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ lams_tool_wiki/web/includes/javascript/validation.js	14 Apr 2014 12:57:18 -0000	1.1
@@ -0,0 +1,31 @@
+		$(function(){
+						
+			$('form input[name="title"]').blur(function () {
+			    var title = $(this).val();
+				var re = /^[^<>^#()/\\|'\",{}`]*$/;
+				if (re.test(title)) {			    
+				    $('.title').hide();
+				} else {
+				    $('.title').show();
+				    $(this).focus();
+				    $(this).select();
+				}
+		
+			});
+
+
+			$('form input[name="newPageTitle"]').blur(function () {
+			    var newPageTitle = $(this).val();
+				var re = /^[^<>^#()/\\|'\",{}`]*$/;
+				if (re.test(newPageTitle)) {			    
+				    $('.newPageTitle').hide();
+				} else {
+				    $('.newPageTitle').show();
+				    $(this).focus();
+				    $(this).select();
+				}
+		
+			});
+
+			
+		});
Index: lams_tool_wiki/web/pages/authoring/authoring.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/authoring/authoring.jsp,v
diff -u -r1.4 -r1.5
--- lams_tool_wiki/web/pages/authoring/authoring.jsp	17 Jan 2014 22:18:21 -0000	1.4
+++ lams_tool_wiki/web/pages/authoring/authoring.jsp	14 Apr 2014 12:57:18 -0000	1.5
@@ -2,6 +2,10 @@
 
 <%@ page import="org.lamsfoundation.lams.tool.wiki.util.WikiConstants"%>
 
+	<script language="JavaScript" type="text/javascript" src="<lams:LAMSURL/>includes/javascript/jquery.js"></script>
+	<script language="JavaScript" type="text/javascript" src="<lams:LAMSURL/>includes/javascript/jquery-ui.js"></script>
+	<link href="includes/css/wiki_style.css" rel="stylesheet" type="text/css">
+	
 <html:form action="/authoring" styleId="authoringForm" method="post" enctype="multipart/form-data">
 
 	<c:set var="formBean" value="<%=request.getAttribute(org.apache.struts.taglib.html.Constants.BEAN_KEY)%>" />
Index: lams_tool_wiki/web/pages/authoring/basic.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/authoring/basic.jsp,v
diff -u -r1.14 -r1.15
--- lams_tool_wiki/web/pages/authoring/basic.jsp	19 Mar 2012 19:36:00 -0000	1.14
+++ lams_tool_wiki/web/pages/authoring/basic.jsp	14 Apr 2014 12:57:18 -0000	1.15
@@ -1,5 +1,9 @@
 <%@ include file="/common/taglibs.jsp"%>
 
+<script language="JavaScript" type="text/javascript" src="includes/javascript/validation.js"></script>
+
+
+
 <c:set var="formBean" value="<%=request.getAttribute(org.apache.struts.taglib.html.Constants.BEAN_KEY)%>" />
 
 <!-- ========== Basic Tab ========== -->
@@ -8,9 +12,9 @@
 
 	<div id="breadcrumb" style="float: left; width: 50%;">
 		<c:if test="${currentWikiPage.title != mainWikiPage.title}">
-			<a href='javascript:changeWikiPage("${mainWikiPage.javaScriptTitle}")'>${mainWikiPage.title}</a> :
+			<a href='javascript:changeWikiPage("${fn:escapeXml(mainWikiPage.javaScriptTitle)}")'>${fn:escapeXml(mainWikiPage.title)}</a> :
 		</c:if> 
-		<a href='javascript:changeWikiPage("${currentWikiPage.javaScriptTitle}")'>${currentWikiPage.title}</a>
+		<a href='javascript:changeWikiPage("${fn:escapeXml(currentWikiPage.javaScriptTitle)}")'>${fn:escapeXml(mainWikiPage.title)}</a>
 	</div>
 	
 	<div id="buttons" style="float: right; width: 50%; text-align:right; " >
@@ -65,7 +69,7 @@
 
 <div id="view" style="margin-right:75px;">
 	<h1>
-		${currentWikiPage.title}
+		<c:out value="${currentWikiPage.title}" escapeXml="true"/>
 	</h1>
 	
 	<br />
@@ -78,7 +82,7 @@
 						<fmt:message key="label.wiki.history.editor.author"></fmt:message>
 					</c:when>
 					<c:otherwise>
-						${currentWikiPage.currentWikiContentDTO.editorDTO.firstName} ${currentWikiPage.currentWikiContentDTO.editorDTO.lastName}
+						<c:out value="${currentWikiPage.currentWikiContentDTO.editorDTO.firstName} ${currentWikiPage.currentWikiContentDTO.editorDTO.lastName}" />
 					</c:otherwise>
 				</c:choose>
 			</fmt:param>
@@ -92,14 +96,14 @@
 	<br />
 	
 	<div id="viewBody">
-		${currentWikiPage.currentWikiContentDTO.body}
+		<c:out value="${currentWikiPage.currentWikiContentDTO.body}" escapeXml="false"/>
 	</div>
 </div>
 
 <div id="history" style="display: none;">
 
 	<h1>
-	<fmt:message key="label.wiki.history" /> - ${currentWikiPage.title}
+	<fmt:message key="label.wiki.history" /> - <c:out value="${currentWikiPage.title}" />
 	</h1>
 	
 	<br />
@@ -134,7 +138,7 @@
 							<td>
 								<c:choose>
 									<c:when test="${wikiContentPageVersion.editorDTO != null}">
-										${wikiContentPageVersion.editorDTO.firstName} ${wikiContentPageVersion.editorDTO.firstName}
+										<c:out value="${wikiContentPageVersion.editorDTO.firstName} ${wikiContentPageVersion.editorDTO.firstName}" escapeXml="true"/>
 									</c:when>
 									<c:otherwise>
 										<fmt:message key="label.wiki.history.editor.author"></fmt:message>
@@ -168,14 +172,14 @@
 
 <div id="edit" style="display: none;">
 	<h1>
-		<fmt:message key="label.wiki.edit"></fmt:message> - ${currentWikiPage.title}
+		<fmt:message key="label.wiki.edit"></fmt:message> - <c:out value="${currentWikiPage.title}" escapeXml="true"/>
 	</h1>
 	
 	<table cellpadding="0">
 		<tr>
 			<td>
 				<div class="field-name"><fmt:message key="label.authoring.basic.title"></fmt:message></div>
-				<html:text property="title" styleId="title" style="width: 99%;" value="${currentWikiPage.title}"></html:text>
+				<html:text property="title" styleId="title" style="width: 99%;" value="${currentWikiPage.title}"></html:text><span style="display: none;'" class="title error"><fmt:message key="error.title.invalid.characters"/>
 			</td>
 		</tr>
 		<tr>
@@ -217,7 +221,7 @@
 				<div class="field-name">
 					<fmt:message key="label.authoring.basic.title"></fmt:message>
 				</div>
-				<html:text property="newPageTitle" styleId="newPageTitle" style="width: 99%;" value=""></html:text>
+				<html:text property="newPageTitle" styleId="newPageTitle" style="width: 99%;" value=""></html:text><span style="display: none;'" class="newPageTitle error"><fmt:message key="error.title.invalid.characters"/>
 			</td>
 		</tr>
 		<tr>
@@ -258,12 +262,12 @@
 <img src="<lams:WebAppURL />/images/tree_closed.gif" id="wikiListImage" 
 	onclick="javascript:toggleWikiList('<lams:WebAppURL />')" />
 &nbsp;
-<a href="javascript:changeWikiPage('${mainWikiPage.javaScriptTitle}')">${mainWikiPage.title}</a>
+<a href="javascript:changeWikiPage('${fn:escapeXml(mainWikiPage.javaScriptTitle)}')">${fn:escapeXml(mainWikiPage.title)}</a>
 <div id="wikiList" style="display:none;">
 	<c:forEach var="wikiPage" items="${wikiPages}">
 		<c:if test="${wikiPage.title != mainWikiPage.title}">
 			&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-			<a href="javascript:changeWikiPage('${wikiPage.javaScriptTitle}')">${wikiPage.title}</a>
+			<a href="javascript:changeWikiPage('${fn:escapeXml(wikiPage.javaScriptTitle)}')">${fn:escapeXml(wikiPage.title)}</a>
 			<br />
 		</c:if> 
 	</c:forEach>
@@ -278,7 +282,7 @@
 	function populateWikiLinkArray()
 	{
 		<c:forEach var="wikiPage" items="${wikiPages}">
-			wikiLinkArray[wikiLinkArray.length] = '${wikiPage.javaScriptTitle}';
+			wikiLinkArray[wikiLinkArray.length] = '${fn:escapeXml(wikiPage.javaScriptTitle)}';
 		</c:forEach>
 		
 		
@@ -317,7 +321,7 @@
 		
 		for (i=0; i<wikiLinkArray.length; i++)
 		{
-			if(dispatch == "editPage" && wikiLinkArray[i] == '${currentWikiPage.javaScriptTitle}')
+			if(dispatch == "editPage" && wikiLinkArray[i] == '${fn:escapeXml(currentWikiPage.javaScriptTitle)}')
 			{
 				continue;
 			}
Index: lams_tool_wiki/web/pages/learning/notebook.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/learning/notebook.jsp,v
diff -u -r1.5 -r1.6
--- lams_tool_wiki/web/pages/learning/notebook.jsp	9 Apr 2013 12:45:26 -0000	1.5
+++ lams_tool_wiki/web/pages/learning/notebook.jsp	14 Apr 2014 12:57:18 -0000	1.6
@@ -12,15 +12,15 @@
 
 <div id="content">
 	<h1>
-		${wikiDTO.title}
+		<c:out value="${wikiDTO.title}" escapeXml="true"/>
 	</h1>
 
 	<html:form action="/learning" method="post" onsubmit="disableFinishButton();" styleId="messageForm">
 		<html:hidden property="toolSessionID" styleId="toolSessionID"/>
 		<html:hidden property="mode" value="${mode}" />
 		
 		<p class="small-space-top">
-			<lams:out value="${wikiDTO.reflectInstructions}" />
+			<lams:out value="${wikiDTO.reflectInstructions}"  escapeHtml="true"/>
 		</p>
 
 		<html:textarea cols="60" rows="8" property="entryText"
Index: lams_tool_wiki/web/pages/learning/wiki.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/learning/wiki.jsp,v
diff -u -r1.24 -r1.25
--- lams_tool_wiki/web/pages/learning/wiki.jsp	22 Jan 2014 14:11:02 -0000	1.24
+++ lams_tool_wiki/web/pages/learning/wiki.jsp	14 Apr 2014 12:57:18 -0000	1.25
@@ -1,5 +1,9 @@
 <%@ include file="/common/taglibs.jsp"%>
 <%@ page import="org.lamsfoundation.lams.tool.wiki.util.WikiConstants"%>
+<link href="includes/css/wiki_style.css" rel="stylesheet" type="text/css">
+<script language="JavaScript" type="text/javascript" src="<lams:LAMSURL/>includes/javascript/jquery.js"></script>
+<script language="JavaScript" type="text/javascript" src="<lams:LAMSURL/>includes/javascript/jquery-ui.js"></script>
+<script language="JavaScript" type="text/javascript" src="includes/javascript/validation.js"></script>
 <script type="text/javascript">
 <!--
 	var mode = "${mode}";
@@ -13,7 +17,7 @@
 	
 		// Validates that there's input from the user. 
 		
-		// disables the Finish button to avoid double submittion 
+		// disables the Finish button to avoid double submission 
 		disableFinishButton();
 
  		if (mode == "learner") {
@@ -124,9 +128,9 @@
 		<div id="wikimenu">
 			<div id="breadcrumb" style="float: left; width: 50%;">
 				<c:if test="${currentWikiPage.title != mainWikiPage.title}">
-					<a href="javascript:changeWikiPage('${mainWikiPage.javaScriptTitle}')">${mainWikiPage.title}</a> :
+					<a href="javascript:changeWikiPage('${fn:escapeXml(mainWikiPage.javaScriptTitle)}')">${fn:escapeXml(mainWikiPage.title)}</a> :
 				</c:if> 
-				<a href="javascript:changeWikiPage('${currentWikiPage.javaScriptTitle}')">${currentWikiPage.title}</a>
+				<a href="javascript:changeWikiPage('${fn:escapeXml(currentWikiPage.javaScriptTitle)}')">${fn:escapeXml(currentWikiPage.title)}</a>
 			</div>
 	
 			<div id="buttons" style="float: right; width: 50%; text-align:right;">
@@ -191,7 +195,7 @@
 		<br />
 	
 		<div id="view">
-			<h1>${currentWikiPage.title}</h1>
+			<h1>${fn:escapeXml(currentWikiPage.title)}</h1>
 			<i> 
 				<fmt:message key="label.wiki.last.edit">
 					<fmt:param>
@@ -200,7 +204,7 @@
 								<fmt:message key="label.wiki.history.editor.author"></fmt:message>
 							</c:when>
 							<c:otherwise>
-								${currentWikiPage.currentWikiContentDTO.editorDTO.firstName} ${currentWikiPage.currentWikiContentDTO.editorDTO.lastName}
+								<c:out value="${currentWikiPage.currentWikiContentDTO.editorDTO.firstName} ${currentWikiPage.currentWikiContentDTO.editorDTO.lastName}" escapeXml="true"/>
 							</c:otherwise>
 						</c:choose>
 					</fmt:param>
@@ -230,13 +234,13 @@
 			<br />
 			<br />
 			<div id="viewBody">
-				${currentWikiPage.currentWikiContentDTO.body}
+				<c:out value="${currentWikiPage.currentWikiContentDTO.body}" escapeXml="false"/>
 			</div>
 		</div>
 	
 		<div id="history" style="display: none;">
 			<h1>
-				<fmt:message key="label.wiki.history" /> - ${currentWikiPage.title}
+				<fmt:message key="label.wiki.history" /> - ${fn:escapeXml(currentWikiPage.title)}
 			</h1>
 			<br />
 			<c:choose>
@@ -268,7 +272,7 @@
 									<td>
 										<c:choose>
 											<c:when test="${wikiContentPageVersion.editorDTO != null}">
-												${wikiContentPageVersion.editorDTO.firstName} ${wikiContentPageVersion.editorDTO.lastName}
+												<c:out value="${wikiContentPageVersion.editorDTO.firstName} ${wikiContentPageVersion.editorDTO.lastName}" escapeXml="true"/>
 											</c:when>
 											<c:otherwise>
 												<fmt:message key="label.wiki.history.editor.author"></fmt:message>
@@ -305,7 +309,7 @@
 	
 		<div id="edit" style="display: none;">
 			<h1>
-				<fmt:message key="label.wiki.edit"></fmt:message> - ${currentWikiPage.title}
+				<fmt:message key="label.wiki.edit"></fmt:message> - ${fn:escapeXml(currentWikiPage.title)}
 			</h1>
 			
 			<table cellpadding="0">
@@ -315,7 +319,7 @@
 							<fmt:message key="label.authoring.basic.title"></fmt:message>
 						</div>
 						
-						<html:text property="title" styleId="title" style="width: 99%;" value="${currentWikiPage.title}"></html:text>
+						<html:text property="title" styleId="title" style="width: 99%;" value="${currentWikiPage.title}"></html:text><span style="display: none;'" class="title error"><fmt:message key="error.title.invalid.characters"/>
 					</td>
 				</tr>
 				<tr>
@@ -351,7 +355,7 @@
 						<div class="field-name">
 							<fmt:message key="label.authoring.basic.title"></fmt:message>
 						</div>
-						<html:text property="newPageTitle" styleId="newPageTitle" style="width: 99%;" value=""></html:text>
+						<html:text property="newPageTitle" styleId="newPageTitle" style="width: 99%;" value=""></html:text><span style="display: none;'" class="newPageTitle error"><fmt:message key="error.title.invalid.characters"/>
 					</td>
 				</tr>
 				<tr>
@@ -387,12 +391,12 @@
 		<img src="<lams:WebAppURL />/images/tree_closed.gif" id="wikiListImage" 
 			onclick="javascript:toggleWikiList('<lams:WebAppURL />')" />
 		&nbsp;
-		<a href="javascript:changeWikiPage('${mainWikiPage.javaScriptTitle}')">${mainWikiPage.title}</a>
+		<a href="javascript:changeWikiPage('${fn:escapeXml(mainWikiPage.javaScriptTitle)}')">${fn:escapeXml(mainWikiPage.title)}</a>
 		<div id="wikiList" style="display:none;">
 			<c:forEach var="wikiPage" items="${wikiPages}">
 				<c:if test="${wikiPage.title != mainWikiPage.title}">
 					&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-					<a href="javascript:changeWikiPage('${wikiPage.javaScriptTitle}')">${wikiPage.title}</a>
+					<a href="javascript:changeWikiPage('${fn:escapeXml(wikiPage.javaScriptTitle)}')">${fn:escapeXml(wikiPage.title)}</a>
 					<br />
 				</c:if> 
 			</c:forEach>
@@ -414,7 +418,7 @@
 	function populateWikiLinkArray()
 	{
 		<c:forEach var="wikiPage" items="${wikiPages}">
-			wikiLinkArray[wikiLinkArray.length] = '${wikiPage.javaScriptTitle}';
+			wikiLinkArray[wikiLinkArray.length] = '${fn:escapeXml(wikiPage.javaScriptTitle)}';
 		</c:forEach>
 		document.getElementById("wikiLinks").value = wikiLinkArray.toString();
 	}
@@ -453,7 +457,7 @@
 		
 		for (i=0; i<wikiLinkArray.length; i++)
 		{
-			if(dispatch == "editPage" && wikiLinkArray[i] == '${currentWikiPage.javaScriptTitle}')
+			if(dispatch == "editPage" && wikiLinkArray[i] == '${fn:escapeXml(currentWikiPage.javaScriptTitle)}')
 			{
 				continue;
 			}
Index: lams_tool_wiki/web/pages/learning/parts/finishButton.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/learning/parts/finishButton.jsp,v
diff -u -r1.9 -r1.10
--- lams_tool_wiki/web/pages/learning/parts/finishButton.jsp	22 Jan 2014 14:11:02 -0000	1.9
+++ lams_tool_wiki/web/pages/learning/parts/finishButton.jsp	14 Apr 2014 12:57:18 -0000	1.10
@@ -20,7 +20,7 @@
 	<html:hidden property="toolSessionID" styleId="toolSessionID"/>
 		<div class="space-top">
 			<h2>
-				${wikiDTO.reflectInstructions}
+				<lams:out value="${wikiDTO.reflectInstructions}" escapeHtml="true"/>
 			</h2>
 
 			<p>
Index: lams_tool_wiki/web/pages/monitoring/editActivity.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/monitoring/editActivity.jsp,v
diff -u -r1.1 -r1.2
--- lams_tool_wiki/web/pages/monitoring/editActivity.jsp	8 Oct 2008 05:33:00 -0000	1.1
+++ lams_tool_wiki/web/pages/monitoring/editActivity.jsp	14 Apr 2014 12:57:18 -0000	1.2
@@ -15,7 +15,7 @@
 				<fmt:message key="label.authoring.basic.title" />
 			</td>
 			<td>
-				<c:out value="${dto.title}" escapeXml="false" />
+				<c:out value="${dto.title}" escapeXml="true" />
 			</td>
 		</tr>
 		<tr>
Index: lams_tool_wiki/web/pages/monitoring/summary.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_tool_wiki/web/pages/monitoring/summary.jsp,v
diff -u -r1.4 -r1.5
--- lams_tool_wiki/web/pages/monitoring/summary.jsp	14 Nov 2008 07:29:52 -0000	1.4
+++ lams_tool_wiki/web/pages/monitoring/summary.jsp	14 Apr 2014 12:57:18 -0000	1.5
@@ -30,6 +30,45 @@
 <c:set var="dto" value="${wikiDTO}" />
 
 <h1>
+	<c:out value="${dto.title}" escapeXml="true" />
+</h1>
+
+<div class="instructions space-top">
+	<c:out value="${dto.instructions}" escapeXml="false" />
+</div>
+<br/>
+
+<c:choose>
+	<c:when test="${not empty dto.sessionDTOs}">
+		<table class="alternative-color">
+			<tr>
+				<th>
+					<fmt:message key="monitor.th.sessions"></fmt:message>
+				</th>	
+				<th>
+					<fmt:message key="monitor.th.numlearners"></fmt:message>
+				</th>
+			</tr>
+			<c:forEach var="session" items="${dto.sessionDTOs}">
+			<tr>
+				<td>
+					<a href='javascript:openViewWindow("./monitoring.do?dispatch=showWiki&amp;toolSessionID=${session.sessionID}&contentFolderID=${contentFolderID}");'>${session.sessionName}</a>
+				</td>	
+				<td>
+					${session.numberOfLearners}
+				</td>	
+			</tr>
+			</c:forEach>
+		</table>
+
+	</c:when>
+	<c:otherwise>
+		<fmt:message key="monitor.nosessions"></fmt:message> 
+	</c:otherwise>
+</c:choose>
+
+
+<h1>
 	<img src="<lams:LAMSURL/>/images/tree_closed.gif" id="treeIcon" onclick="javascript:toggleAdvancedOptionsVisibility(document.getElementById('advancedDiv'), document.getElementById('treeIcon'), '<lams:LAMSURL/>');" />
 
 	<a href="javascript:toggleAdvancedOptionsVisibility(document.getElementById('advancedDiv'), document.getElementById('treeIcon'),'<lams:LAMSURL/>');" >
@@ -150,7 +189,7 @@
 					<fmt:message key="monitor.summary.td.notebookInstructions" />
 				</td>
 				<td>
-					${dto.reflectInstructions}	
+					<lams:out value="${dto.reflectInstructions}" escapeHtml="true"/>	
 				</td>
 			</tr>
 		</c:when>
@@ -187,33 +226,4 @@
 	</tr>
 	
 </table>
-</div>
-
-<c:choose>
-	<c:when test="${not empty dto.sessionDTOs}">
-		<table class="alternative-color">
-			<tr>
-				<th>
-					<fmt:message key="monitor.th.sessions"></fmt:message>
-				</th>	
-				<th>
-					<fmt:message key="monitor.th.numlearners"></fmt:message>
-				</th>
-			</tr>
-			<c:forEach var="session" items="${dto.sessionDTOs}">
-			<tr>
-				<td>
-					<a href='javascript:openViewWindow("./monitoring.do?dispatch=showWiki&amp;toolSessionID=${session.sessionID}&contentFolderID=${contentFolderID}");'>${session.sessionName}</a>
-				</td>	
-				<td>
-					${session.numberOfLearners}
-				</td>	
-			</tr>
-			</c:forEach>
-		</table>
-
-	</c:when>
-	<c:otherwise>
-		<fmt:message key="monitor.nosessions"></fmt:message> 
-	</c:otherwise>
-</c:choose>
+</div>
\ No newline at end of file