Index: lams_central/conf/language/lams/ApplicationResources.properties
===================================================================
RCS file: /usr/local/cvsroot/lams_central/conf/language/lams/ApplicationResources.properties,v
diff -u -r1.135 -r1.136
--- lams_central/conf/language/lams/ApplicationResources.properties	6 Apr 2014 18:27:23 -0000	1.135
+++ lams_central/conf/language/lams/ApplicationResources.properties	15 Apr 2014 11:42:01 -0000	1.136
@@ -442,6 +442,6 @@
 error.firstname.invalid.characters  =First name contains invalid characters
 error.lastname.invalid.characters  =Last name contains invalid characters
 error.username.invalid.characters  =Username can only contain alphanumeric characters and no spaces.
+error.lessonname.invalid.characters  =Lesson name contains invalid characters
 
-
 #======= End labels: Exported 436 labels for en AU =====
Index: lams_central/web/addLesson.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/addLesson.jsp,v
diff -u -r1.15 -r1.16
--- lams_central/web/addLesson.jsp	20 Feb 2014 09:42:16 -0000	1.15
+++ lams_central/web/addLesson.jsp	15 Apr 2014 11:42:01 -0000	1.16
@@ -23,24 +23,25 @@
 	<script type="text/javascript" src="includes/javascript/yui/treeview-min.js" ></script>
 	<script type="text/javascript" src="includes/javascript/addLesson.js"></script>
 	<script type="text/javascript">
-		var userId = '<lams:user property="userID"/>';
-		var folderContents = ${folderContents};
-		var users = ${users};
-		
-		var LAMS_URL = '<lams:LAMSURL/>';
-		var LD_THUMBNAIL_URL_BASE = LAMS_URL + 'home.do?method=createLearningDesignThumbnail&ldId=';
+		var userId = '<lams:user property="userID"/>',
+			folderContents = ${folderContents},
+			users = ${users},
+			
+			LAMS_URL = '<lams:LAMSURL/>',
+			LD_THUMBNAIL_URL_BASE = LAMS_URL + 'home.do?method=createLearningDesignThumbnail&ldId=',
+			
+			CANVAS_RESIZE_OPTION_NONE = 0,
+			CANVAS_RESIZE_OPTION_FIT = 1,
+			CANVAS_RESIZE_OPTION_FULL = 2,
+			CANVAS_RESIZE_LABEL_FULL = '<fmt:message key="label.tab.lesson.size.full" />',
+			CANVAS_RESIZE_LABEL_FIT = '<fmt:message key="label.tab.lesson.size.fit" />',
 
-		var CANVAS_RESIZE_OPTION_NONE = 0;
-		var CANVAS_RESIZE_OPTION_FIT = 1;
-		var CANVAS_RESIZE_OPTION_FULL = 2;
-		var CANVAS_RESIZE_LABEL_FULL = '<fmt:message key="label.tab.lesson.size.full" />';
-		var CANVAS_RESIZE_LABEL_FIT = '<fmt:message key="label.tab.lesson.size.fit" />';
-
-		var SPLIT_LEARNERS_DESCRIPTION = '<fmt:message key="label.tab.advanced.split.desc" />';
-		var LABEL_MISSING_LEARNERS = '<fmt:message key="error.tab.class.learners" />';
-		var LABEL_MISSING_MONITORS = '<fmt:message key="error.tab.class.monitors" />';
-		var LABEL_RUN_SEQUENCES_FOLDER = '<fmt:message key="label.tab.lesson.sequence.folder" />';
-		
+			SPLIT_LEARNERS_DESCRIPTION = '<fmt:message key="label.tab.advanced.split.desc" />',
+			LABEL_MISSING_LEARNERS = '<fmt:message key="error.tab.class.learners" />',
+			LABEL_MISSING_MONITORS = '<fmt:message key="error.tab.class.monitors" />',
+			LABEL_RUN_SEQUENCES_FOLDER = '<fmt:message key="label.tab.lesson.sequence.folder" />',
+			LABEL_NAME_INVALID_CHARACTERS = '<fmt:message key="error.lessonname.invalid.characters" />';
+				
 		$(document).ready(function(){
 			$('#tabs').tabs();
 			
Index: lams_central/web/includes/javascript/addLesson.js
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/includes/javascript/addLesson.js,v
diff -u -r1.6 -r1.7
--- lams_central/web/includes/javascript/addLesson.js	24 May 2013 09:15:02 -0000	1.6
+++ lams_central/web/includes/javascript/addLesson.js	15 Apr 2014 11:42:01 -0000	1.7
@@ -263,7 +263,15 @@
 	}
 	$('#ldIdField').val(ldNode.data.learningDesignId);
 	
-	if (!lessonName){
+	if (lessonName){
+		var nameValidator = /^[^<>^*@%$]*$/igm;	
+		if (!nameValidator.test(lessonName)) {
+			$('#lessonNameInput').addClass('errorField');
+			$('#tabs').tabs('option', 'selected', 0);
+			alert(LABEL_NAME_INVALID_CHARACTERS);
+			return;
+		}
+	} else {
 		$('#lessonNameInput').addClass('errorField');
 		$('#tabs').tabs('option', 'selected', 0);
 		return;
Index: lams_central/web/includes/javascript/authoring/authoringGeneral.js
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/includes/javascript/authoring/authoringGeneral.js,v
diff -u -r1.25 -r1.26
--- lams_central/web/includes/javascript/authoring/authoringGeneral.js	14 Apr 2014 14:40:40 -0000	1.25
+++ lams_central/web/includes/javascript/authoring/authoringGeneral.js	15 Apr 2014 11:42:01 -0000	1.26
@@ -5,6 +5,7 @@
 // few publicly visible variables 
 var paper = null,
 	canvas = null,
+	nameValidator = /^[^<>^*@%$]*$/igm,
 	
 // configuration and storage of various elements
 	layout = {
@@ -279,12 +280,17 @@
 			            	'click'  : function() {	
 			            		var dialog = $(this),
 			            			container = dialog.closest('.ui-dialog'),
-			            			title = $('#ldStoreDialogNameField', container).val();
+			            			title = $('#ldStoreDialogNameField', container).val().trim();
 			            		if (!title) {
 			            			alert('Please enter a title for the sequence');
 			            			return;
 			            		}
 			            		
+			            		if (!nameValidator.test(title)) {
+			            			alert('Sequence title can not contain any of these characters < > ^ * @ % $');
+			            			return;
+			            		}
+			            		
 			            		var tree = dialog.dialog('option', 'ldTree'),
 			            			node = tree.getHighlightedNode();
 			            		if (!node) {
@@ -434,7 +440,7 @@
 				'maxUIID'		   : 0
 			};
 			
-			$('#ldDescriptionFieldTitle').text(ld.title);
+			$('#ldDescriptionFieldTitle').html(escapeHtml(ld.title));
 			CKEDITOR.instances['ldDescriptionFieldDescription'].setData(ld.description);
 			
 			var arrangeNeeded = false,
@@ -1147,37 +1153,39 @@
 			'ld'			  : JSON.stringify(ld)
 		},
 		success : function(response) {
-			// if save was successful
+			layout.ld.folderID = folderID;
+			layout.ld.title = title;
+			
+			// check if there were any validation errors
+			if (response.validation.length > 0) {
+				var message = 'While saving the sequence there were following validation issues:\n';
+				$.each(response.validation, function() {
+					var uiid = this.UIID,
+						title = '';
+					if (uiid) {
+						// find which activity is the error about
+						$.each(layout.activities, function(){
+							if (uiid == this.uiid) {
+								title = this.title + ': ';
+							}
+						});
+					}
+					message += title + this.message + '\n';
+				});
+				
+				alert(message);
+			}
+			
+			// if save (even partially) was successful
 			if (response.ld) {
 				// assing the database-generated values
 				layout.ld.learningDesignID = response.ld.learningDesignID;
-				layout.ld.folderID = folderID;
-				layout.ld.title = title;
 				if (!layout.ld.contentFolderID) {
 					layout.ld.contentFolderID = response.ld.contentFolderID;
 				}
 				$('#ldDescriptionFieldTitle').text(title);
 				$('#ldDescriptionFieldDescription').text(description);
 				
-				// check if there were any validation errors
-				if (response.validation.length > 0) {
-					var message = 'While saving the sequence there were following validation issues:\n';
-					$.each(response.validation, function() {
-						var uiid = this.UIID,
-							title = '';
-						// find which activity is the error about
-						$.each(layout.activities, function(){
-							if (uiid == this.uiid) {
-								title = this.title + ': ';
-							}
-						});
-						message += title + this.message + '\n';
-					});
-					
-					alert(message);
-					return;
-				}
-				
 				// assign database-generated properties to activities
 				$.each(response.ld.activities, function() {
 					var updatedActivity = this;
@@ -1235,11 +1243,11 @@
 					});
 				});
 				
-				setModified(false);
-				alert('Congratulations! Your design is valid and has been saved.');
-				result = true;
-			} else {
-				alert('Error while saving the sequence');
+				if (response.validation.length == 0) {
+					setModified(false);
+					alert('Congratulations! Your design is valid and has been saved.');
+					result = true;
+				}
 			}
 		},
 		error : function(){
@@ -1315,4 +1323,17 @@
 		$('#exportButton').attr('disabled', null)
 		  				  .css('opacity', 1);
 	}
+}
+
+
+/**
+ * Escapes HTML tags to prevent XSS injection.
+ */
+function escapeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
 }
\ No newline at end of file
Index: lams_central/web/includes/javascript/authoring/authoringProperty.js
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/includes/javascript/authoring/authoringProperty.js,v
diff -u -r1.12 -r1.13
--- lams_central/web/includes/javascript/authoring/authoringProperty.js	10 Apr 2014 11:14:07 -0000	1.12
+++ lams_central/web/includes/javascript/authoring/authoringProperty.js	15 Apr 2014 11:42:01 -0000	1.13
@@ -44,9 +44,23 @@
 			            	'text'   : 'OK',
 			            	'click'  : function() {
 			            		var dialog = $(this),
-			            			activity = dialog.dialog('option', 'parentObject');
+			            			activity = dialog.dialog('option', 'parentObject'),
+			            			error = false;
 			            		
 			            		// extract group names from text fields
+			            		$('input', dialog).each(function(){
+			            			var groupName = $(this).val().trim();
+				            		if (!nameValidator.test(groupName)) {
+				            			alert('Group name can not contain any of these characters < > ^ * @ % $');
+				            			error = true;
+				            			return false;
+				            		}
+			            		});
+			            		
+			            		if (error) {
+			            			return;
+			            		}
+			            		
 			            		$('input', dialog).each(function(index){
 		            				activity.groups[index].groupName = $(this).val().trim();
 			            		});
@@ -163,11 +177,15 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != transition.title) {
-					transition.title = newTitle;
-					if (transition.branch) {
-						transition.branch.title = newTitle;
-					}
-					redrawNeeded = true;
+            		if (!nameValidator.test(newTitle)) {
+            			alert('Transition title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						transition.title = newTitle;
+						if (transition.branch) {
+							transition.branch.title = newTitle;
+						}
+						redrawNeeded = true;
+            		}
 				}
 				
 				if (redrawNeeded) {
@@ -202,8 +220,12 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('Activity title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				
 				var selectedGrouping = $('.propertiesContentFieldGrouping option:selected', content);
@@ -246,8 +268,12 @@
 					redrawNeeded = false,
 					newTitle = $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('Grouping title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				
 				activity.groupingType = $('.propertiesContentFieldGroupingType', content).val();
@@ -341,8 +367,12 @@
 					redrawNeeded = false,
 					newTitle = $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				activity.gateType = $('.propertiesContentFieldGateType', content).val();
 				if (activity.gateType == 'schedule') {
@@ -430,8 +460,12 @@
 					redrawNeeded = false,
 					newTitle = $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != branchingActivity.title) {
-					branchingActivity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						branchingActivity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				branchingActivity.branchingType = $('.propertiesContentFieldBranchingType', content).val();
 				
@@ -493,8 +527,12 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				var newGroupingValue = $('.propertiesContentFieldGrouping option:selected', content)
 									.data('grouping');
@@ -537,10 +575,14 @@
 					activity = content.data('parentObject'),
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					activity.draw();
-					ActivityLib.addSelectEffect(activity, true);
-					setModified(true);
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						activity.draw();
+						ActivityLib.addSelectEffect(activity, true);
+						setModified(true);
+            		}
 				}
 			});
 				
@@ -610,8 +652,12 @@
 					color = region.items.shape.attr('fill'),
 					newColor = $('.propertiesContentFieldColor', content).val();
 				if (newTitle != region.title) {
-					region.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						region.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				redrawNeeded |= newColor != color;
 				
@@ -646,8 +692,12 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != label.title) {
-					label.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						label.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				
 				if (redrawNeeded) {
Index: lams_common/conf/language/lams/ApplicationResources.properties
===================================================================
RCS file: /usr/local/cvsroot/lams_common/conf/language/lams/ApplicationResources.properties,v
diff -u -r1.32 -r1.33
--- lams_common/conf/language/lams/ApplicationResources.properties	26 Mar 2013 18:04:38 -0000	1.32
+++ lams_common/conf/language/lams/ApplicationResources.properties	15 Apr 2014 11:41:59 -0000	1.33
@@ -57,6 +57,7 @@
 validation.error.FloatingActivity  =If you are planning to have support activities you need at least one support activity in the container.
 validation.error.FloatingActivity.maximum  =A maximum of {0} support activities is allow. Please remove one or more support activities.
 validation.error.first.activity  =You need at least one activity in the sequence.
+validation.error.title.characters =The title can not contain any of these characters < > ^ * @ % $
 public.folder.name  =Public Folder
 email.notifications.problems.sending.emails  =Some problems occurred while sending emails. Please, contact your system administrator.
 
Index: lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java
===================================================================
RCS file: /usr/local/cvsroot/lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java,v
diff -u -r1.14 -r1.15
--- lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java	13 Jan 2009 07:00:30 -0000	1.14
+++ lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java	15 Apr 2014 11:41:59 -0000	1.15
@@ -51,6 +51,7 @@
 	public static final String GROUPING_ACTIVITY_MISSING_GROUPING_KEY = "validation.error.grouping.missing"; // GM
 	public static final String GROUPING_ACTIVITY_GROUP_COUNT_MISMATCH_KEY = "validation.error.group.count.mismatch"; // GC
 	public static final String FIRST_ACTIVITY_ERROR_KEY = "validation.error.first.activity"; // FIA
+	public static final String TITLE_CHARACTERS_ERROR_KEY = "validation.error.title.characters";
 	
 	public static final String BRANCHING_ACTIVITY_MUST_HAVE_A_BRANCH = "validation.error.branching.must.have.a.branch"; // BB
 	public static final String BRANCHING_ACTIVITY_MUST_HAVE_DEFAULT_BRANCH = "validation.error.toolBranchingMustHaveDefaultBranch"; // BDB
@@ -87,6 +88,7 @@
 	public static final String BRANCHING_ACTVITY_TOOLINPUT_ERROR_CODE = "BTI";
 	public static final String BRANCHING_ACTVITY_TOOLCONDITION_ERROR_CODE = "BTC";
 	public static final String FIRST_ACTIVITY_ERROR_CODE = "FIA";
+	public static final String TITLE_CHARACTERS_ERROR_CODE = "TCH";
 	
 	private static MessageResources resources = MessageResources.getMessageResources(ValidationErrorDTO.CONFIG_PARAM);
 	/**
Index: lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java
===================================================================
RCS file: /usr/local/cvsroot/lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java,v
diff -u -r1.7 -r1.8
--- lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java	1 Jul 2009 02:47:09 -0000	1.7
+++ lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java	15 Apr 2014 11:41:59 -0000	1.8
@@ -39,6 +39,7 @@
 import org.lamsfoundation.lams.learningdesign.Transition;
 import org.lamsfoundation.lams.learningdesign.dto.ValidationErrorDTO;
 import org.lamsfoundation.lams.util.MessageService;
+import org.lamsfoundation.lams.util.ValidationUtil;
 
 /**
  * Validates a learning design. Encapsulates all the validation rules that are "cross activity" for a learning design as
@@ -66,6 +67,11 @@
     public Vector<ValidationErrorDTO> validate() {
 	errors = new Vector<ValidationErrorDTO>(); // initialises the list of validation messages.
 
+	if (!ValidationUtil.isOrgNameValid(learningDesign.getTitle())) {
+	    errors.add(new ValidationErrorDTO(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_CODE, messageService
+		    .getMessage(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_KEY)));
+	}
+
 	// check the design has a starting or first activity
 	if (learningDesign.getFirstActivity() == null) {
 	    errors.add(new ValidationErrorDTO(ValidationErrorDTO.FIRST_ACTIVITY_ERROR_CODE, messageService
@@ -78,6 +84,11 @@
 	validateActivityTransitionRules(topLevelActivities, learningDesign.getTransitions());
 
 	for (Activity activity : (Set<Activity>) learningDesign.getActivities()) {
+	    if (!ValidationUtil.isOrgNameValid(activity.getTitle())) {
+		errors.add(new ValidationErrorDTO(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_CODE, messageService
+			.getMessage(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_KEY), activity.getActivityUIID()));
+	    }
+
 	    checkIfGroupingRequired(activity);
 	    validateGroupingIfGroupingIsApplied(activity);
 	    validateOptionalActivity(activity);
Index: lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java
===================================================================
RCS file: /usr/local/cvsroot/lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java,v
diff -u -r1.114 -r1.115
--- lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java	14 Apr 2014 15:45:36 -0000	1.114
+++ lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java	15 Apr 2014 11:42:03 -0000	1.115
@@ -81,6 +81,7 @@
 import org.lamsfoundation.lams.util.ConfigurationKeys;
 import org.lamsfoundation.lams.util.DateUtil;
 import org.lamsfoundation.lams.util.MessageService;
+import org.lamsfoundation.lams.util.ValidationUtil;
 import org.lamsfoundation.lams.util.WebUtil;
 import org.lamsfoundation.lams.util.audit.IAuditService;
 import org.lamsfoundation.lams.util.wddx.FlashMessage;
@@ -278,6 +279,10 @@
     public ActionForward addLesson(ActionMapping mapping, ActionForm form, HttpServletRequest request,
 	    HttpServletResponse response) throws IOException, ServletException, ParseException {
 	String lessonName = request.getParameter("lessonName");
+	if (!ValidationUtil.isOrgNameValid(lessonName)) {
+	    throw new IOException("Lesson name contains invalid characters");
+	}
+	
 	int organisationId = WebUtil.readIntParam(request, AttributeNames.PARAM_ORGANISATION_ID);
 	long ldId = WebUtil.readLongParam(request, AttributeNames.PARAM_LEARNINGDESIGN_ID);
 
Index: lams_monitoring/web/includes/javascript/monitorLesson.js
===================================================================
RCS file: /usr/local/cvsroot/lams_monitoring/web/includes/javascript/monitorLesson.js,v
diff -u -r1.38 -r1.39
--- lams_monitoring/web/includes/javascript/monitorLesson.js	20 Mar 2014 07:37:48 -0000	1.38
+++ lams_monitoring/web/includes/javascript/monitorLesson.js	15 Apr 2014 11:42:03 -0000	1.39
@@ -1026,7 +1026,7 @@
 			},
 			'stop' : function(event, ui) {
 				// jQuery droppable does not work for SVG, so this is a workaround
-				forceComplete(activity.id, learner.id, getLearnerDisplayName(learner),
+				forceComplete(activity.id, learner.id, getLearnerDisplayName(learner, true),
 						      ui.offset.left, ui.offset.top);
 			}
 		});
@@ -1095,7 +1095,7 @@
 					},
 					'stop' : function(event, ui) {
 						// jQuery droppable does not work for SVG, so this is a workaround
-						forceComplete(null, learner.id, getLearnerDisplayName(learner),
+						forceComplete(null, learner.id, getLearnerDisplayName(learner, true),
 								      ui.offset.left, ui.offset.top);
 					}
 				})
@@ -1210,7 +1210,7 @@
 			'userId'  : user.id
 			})
           .addClass('dialogListItem')
-	      .text(getLearnerDisplayName(user))
+	      .html(getLearnerDisplayName(user))
 	      .prepend(checkbox)
 	      .appendTo(list);
 		
@@ -1550,7 +1550,7 @@
 									'viewUrl'    : viewUrl
 									})
 			                      .addClass('dialogListItem')
-							      .text(getLearnerDisplayName(learner))
+							      .html(getLearnerDisplayName(learner))
 							      .appendTo(learnerGroupList);
 			
 			if (allowForceComplete || allowView || allowEmail) {
@@ -1594,12 +1594,26 @@
 /**
  * Formats learner name.
  */
-function getLearnerDisplayName(learner) {
-	return learner.firstName + ' ' + learner.lastName + ' (' + learner.login + ')';
+function getLearnerDisplayName(learner, raw) {
+	return raw ? learner.firstName + ' ' + learner.lastName + ' (' + learner.login + ')'
+			   : escapeHtml(learner.firstName) + ' ' + escapeHtml(learner.lastName) + ' (' + escapeHtml(learner.login) + ')';
 }
 
 
 /**
+ * Escapes HTML tags to prevent XSS injection.
+ */
+function escapeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
+}
+
+
+/**
  * Change order of learner sorting in group dialog.
  */
 function sortDialogList(listId) {