Index: openacs-4/packages/xowiki/tcl/folder-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/folder-procs.tcl,v
diff -u -N -r1.32 -r1.33
--- openacs-4/packages/xowiki/tcl/folder-procs.tcl	8 Jun 2015 09:42:26 -0000	1.32
+++ openacs-4/packages/xowiki/tcl/folder-procs.tcl	15 Jun 2015 19:21:06 -0000	1.33
@@ -649,7 +649,7 @@
     foreach v $viewers {
       set wf_link "${v}?p.folder=[${current_folder} name]"
       append wf_link "&m=create-or-use"
-      append viewer_links [subst -nocommands -nobackslashes {<li><a href="$wf_link">view with $v</a></li>}]
+      append viewer_links [subst -nocommands -nobackslashes {<li><a href="[ns_quotehtml $wf_link]">view with $v</a></li>}]
     }
     return "$menubar<ul>$viewer_links</ul> [$t asHTML]"
 
Index: openacs-4/packages/xowiki/tcl/form-field-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/form-field-procs.tcl,v
diff -u -N -r1.246 -r1.247
--- openacs-4/packages/xowiki/tcl/form-field-procs.tcl	8 Jun 2015 15:51:07 -0000	1.246
+++ openacs-4/packages/xowiki/tcl/form-field-procs.tcl	15 Jun 2015 19:21:06 -0000	1.247
@@ -1370,7 +1370,7 @@
       set date [$date_field pretty_value [$object property _last_modified]]
 
       if {[my with_user_link]} {
-        set user_link_begin "<a href='/shared/community-member?user_id=$v'>"
+        set user_link_begin "<a href='[ns_quotehrml /shared/community-member?user_id=$v]'>"
         set user_link_end "</a>"
       } else {
         set user_link_begin ""
@@ -1429,7 +1429,7 @@
         set link_label $v
       }
       regsub -all & $v "&amp;" v
-      return "<a href='$v'>$link_label</a>"
+      return "<a href='[ns_quotehtml $v]'>$link_label</a>"
     }
   }
 
@@ -1449,7 +1449,7 @@
     if {$v ne ""} {
       set link_label [my localize [my link_label]]
       regsub -all & $v "&amp;" v
-      return " <span class='more'>\[ <a href='$v'>$link_label</a> \]</span>"
+      return " <span class='more'>\[ <a href='[ns_quotehtml $v]'>$link_label</a> \]</span>"
     }
   }
 
@@ -2553,7 +2553,7 @@
       foreach o [my set options] {
         lassign $o label value
         set href [$package_id pretty_link -parent_id $parent_id $value]
-        set labels($value) "<a href='$href'>$label</a>"
+        set labels($value) "<a href='[ns_quotehtml $href]'>$label</a>"
       }
       set hrefs [list]
       foreach i $v {
@@ -2562,7 +2562,7 @@
           set labels($i) $i
         }
         set href [$package_id pretty_link -parent_id $parent_id $i]
-        lappend hrefs "<a href='$href'>$labels($i)</a>"
+        lappend hrefs "<a href='[ns_quotehtml $href]'>$labels($i)</a>"
       }
       if {[my multiple_style] eq "list"} {
         return "<ul><li>[join $hrefs {</li><li>}]</li></ul>\n"
@@ -2578,7 +2578,7 @@
             return [$object include [list $value -decoration rightbox]]
           }
           set href [$package_id pretty_link -parent_id $parent_id $value]
-          return "<a href='$href'>$label</a>"
+          return "<a href='[ns_quotehtml $href]'>$label</a>"
         }
       }
     }
Index: openacs-4/packages/xowiki/tcl/import-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/import-procs.tcl,v
diff -u -N -r1.29 -r1.30
--- openacs-4/packages/xowiki/tcl/import-procs.tcl	27 Apr 2015 15:28:22 -0000	1.29
+++ openacs-4/packages/xowiki/tcl/import-procs.tcl	15 Jun 2015 19:21:06 -0000	1.30
@@ -30,7 +30,7 @@
         "updated" { set operation "[_ xowiki.updated]" }
         "inherited" { set operation "[_ xowiki.inherited]" }
 	}
-    my append log "<tr><td>$operation</td><td><a href='$href'>$name</a></td></tr>\n"
+    my append log "<tr><td>$operation</td><td><a href='[ns_quotehtml $href]'>$name</a></td></tr>\n"
   }
   Importer instproc report {} {
     my instvar added updated replaced inherited
Index: openacs-4/packages/xowiki/tcl/includelet-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/includelet-procs.tcl,v
diff -u -N -r1.195 -r1.196
--- openacs-4/packages/xowiki/tcl/includelet-procs.tcl	12 Jun 2015 21:00:30 -0000	1.195
+++ openacs-4/packages/xowiki/tcl/includelet-procs.tcl	15 Jun 2015 19:21:06 -0000	1.196
@@ -66,7 +66,7 @@
               2 {
                 set v [lindex $pp 1]
                 if {$v eq ""} {set v {""}}
-                append result " [lindex $pp 0] <em>$v</em>"
+                append result " [lindex $pp 0] <em>[ns_quotehtml $v]</em>"
               }
             }
             #append result "\n"
@@ -81,11 +81,11 @@
   ::xowiki::Includelet proc available_includelets {} {
     if {[my array exists html]} {my array unset html}
     my describe_includelets [::xowiki::Includelet info subclass]
-    set result "<UL>"
+    set result "<ul>"
     foreach d [lsort [my array names html]] {
-      append result "<LI>" [my set html($d)] "</LI>" \n
+      append result "<li>" [my set html($d)] "</li>" \n
     }
-    append result "</UL>"
+    append result "</ul>"
     return $result
   }
 
@@ -441,7 +441,7 @@
     set html [next]
     set localized_title [::xo::localize $title]
     set link [expr {[string match "*:*" $name] ? 
-                    "<a href='[$package_id pretty_link $name]'>$localized_title</a>" : 
+                    "<a href='[ns_quotehtml [$package_id pretty_link $name]]'>[ns_quotehtml $localized_title]</a>" : 
                     $localized_title}]
     ::xo::render_localizer
     return [subst [[self class] set template]]
@@ -461,7 +461,7 @@
     set localized_title [::xo::localize $title]
     set edit_button [my include [list edit-item-button -book_mode true]]
     set link [expr {[string match "*:*" $name] ? 
-                    "<a href='[$package_id pretty_link $name]'>$localized_title</a>" : 
+                    "<a href='[ns_quotehtml [$package_id pretty_link $name]]'>[ns_quotehtml $localized_title]</a>" : 
                     $localized_title}]
     return [subst [[self class] set template]]
   } -set template {<div class='$class'><div class='portlet-wrapper'><div class='portlet-header'>
@@ -551,9 +551,8 @@
     my get_parameters
     set parent_ids [[my set __including_page] parent_id]
     set href [export_vars -base [$package_id package_url] {{rss $span} parent_ids name_filter title entries_of}]
-    regsub -all & $href "&amp;" href
     ::xo::Page requireLink -rel alternate -type application/rss+xml -title RSS -href $href
-    return "<a href=\"$href \" class='rss'>RSS</a>"
+    return "<a href=\"[ns_quotehtml $href]\" class='rss'>RSS</a>"
   }
 
   #############################################################################
@@ -584,8 +583,7 @@
                 'scrollbars=yes,width=700,height=575,status=yes,resizable=yes,scrollbars=yes'))
     }]
     regsub -all {[\n ]+} $href " " href
-    regsub -all & $href "&amp;" href
-    return "<a href=\"$href \" title='$label' class='rss'>$label</a>"
+    return "<a href='[ns_quotehtml $href]' title='[ns_quotehtml $label]' class='rss'>[ns_quotehtml $label]</a>"
   }
 
   #############################################################################
@@ -1198,14 +1196,15 @@
       return "No data available from $url<br>$detail"
     } else {
       set channel [$feed channel]
-      #set html "<H1>[$channel title]</H1>"
-      set html "<UL>\n"
+      #set html "<H1>[ns_quotehtml [$channel title]]</H1>"
+      set html "<ul>\n"
       set i 0
       foreach item [ $feed items ] {
-        append html "<LI><B>[$item title]</B><BR> [$item description] <a href='[$item link]'>#xowiki.weblog-more#</a>\n"
+        append html "<li><b>[ns_quotehtml [$item title]]</b><br>\
+           [ns_quotehtml [$item description]] <a href='[ns_quotehtml [$item link]]'>#xowiki.weblog-more#</a>\n"
         if {[incr i] >= $max_entries} break
       }
-      append html "</UL>\n"
+      append html "</ul>\n"
       return $html
     }
   }
@@ -1370,8 +1369,8 @@
       if {$summary} {lappend q "summary=$summary"}
       if {$popular} {lappend q "popular=$popular"}
       set link $href$tag?[join $q &]
-      #lappend entries "$tag <a href='$href'>($nr)</a>"
-      lappend entries "$tag <a rel='tag' href='$link'>($nr)</a>"
+      #lappend entries "$tag <a href='$href'>([ns_quotehtml $nr])</a>"
+      lappend entries "[ns_quotehtml $tag] <a rel='tag' href='[ns_quotehtml $link]'>([ns_quotehtml $nr])</a>"
     }
     return [expr {[llength $entries]  > 0 ? 
                   "<h3>$label</h3> <BLOCKQUOTE>[join $entries {, }]</BLOCKQUOTE>\n" :
@@ -1409,17 +1408,17 @@
 
     #foreach tag $tags {lappend entries "<a href='$href&tag=[ad_urlencode $tag]'>$tag</a>"}
     set href [$package_id package_url]/tag/
-    foreach tag $tags {lappend entries "<a rel='tag' href='$href[ad_urlencode $tag]?summary=$summary'>$tag</a>"}
+    foreach tag $tags {lappend entries "<a rel='tag' href='[ns_quotehtml $href[ad_urlencode $tag]?summary=$summary]'>[ns_quotehtml $tag]</a>"}
     set tags_with_links [join [lsort $entries] {, }]
 
     if {![my exists id]} {my set id [::xowiki::Includelet html_id [self]]}
     set content [subst -nobackslashes {
       #xowiki.your_tags_label#: $tags_with_links
       (<a href='#' onclick='document.getElementById("[my id]-edit_tags").style.display="block";return false;'>#xowiki.edit_link#</a>,
        <a href='#' onclick='get_popular_tags("[ns_quotehtml $popular_tags_link]","[my id]");return false;'>#xowiki.popular_tags_link#</a>)
-      <FORM id='[my id]-edit_tags' style='display: none' action="$save_tag_link" method='POST'>
-      <INPUT name='new_tags' type='text' value="$tags">
-      </FORM>
+      <form id='[my id]-edit_tags' style='display: none' action="[ns_quotehtml $save_tag_link]" method='POST'>
+      <div><INPUT name='new_tags' type='text' value="[ns_quotehtml $tags]"></div>
+      </form>
       <span id='[my id]-popular_tags' style='display: none'></span><br >
     }]
     return $content
@@ -1454,7 +1453,7 @@
     foreach cat_id [category::get_mapped_categories [$__including_page set item_id]] {
       lassign [category::get_data $cat_id] category_id category_name tree_id tree_name
       #my log "--cat $cat_id $category_id $category_name $tree_id $tree_name"
-      set entry "<a href='$href&amp;category_id=$category_id'>$category_name ($tree_name)</a>"
+      set entry "<a href='[ns_quotehtml $href&category_id=$category_id]'>[ns_quotehtml $category_name ($tree_name)]</a>"
       if {$notification_type ne ""} {
         set notification_text "Subscribe category $category_name in tree $tree_name"
         set notifications_return_url [expr {[info exists return_url] ? $return_url : [ad_return_url]}]
@@ -1467,7 +1466,7 @@
                                      {pretty_name $notification_text} \
                                      {type_id $notification_type} \
                                      {object_id $category_id}}]
-        append entry "<a href='$cat_notif_link'> " \
+        append entry "<a href='[ns_quotehtml $cat_notif_link]'> " \
             "<img style='border: 0px;' src='/resources/xowiki/email.png' " \
             "alt='$notification_text' title='$notification_text'>" </a>
 
@@ -1527,8 +1526,7 @@
       {title     "[string range [$__including_page title] 0 74]"}
       {body_text "[string range $description 0 349]"}
     }]
-    regsub -all & $digg_link "&amp;" digg_link
-    return "<a class='image-button' href='$digg_link'><img src='http://digg.com/img/badges/100x20-digg-button.png' width='100' height='20' alt='Digg!'></a>"
+    return "<a class='image-button' href='[ns_quotehtml $digg_link]'><img src='http://digg.com/img/badges/100x20-digg-button.png' width='100' height='20' alt='Digg!'></a>"
   }
 
   ::xowiki::IncludeletClass create delicious \
@@ -1559,8 +1557,7 @@
       {notes "[string range $description 0 199]"}
       tags
     }]
-    regsub -all & $delicious_link "&amp;" delicious_link
-    return "<a class='image-button' href='$delicious_link'><img src='http://i.i.com.com/cnwk.1d/i/ne05/fmwk/delicious_14x14.gif' width='14' height='14' alt='Add to your del.icio.us' />del.icio.us</a>"
+    return "<a class='image-button' href='[ns_quotehtml $delicious_link]'><img src='http://i.i.com.com/cnwk.1d/i/ne05/fmwk/delicious_14x14.gif' width='14' height='14' alt='Add to your del.icio.us' />del.icio.us</a>"
   }
 
 
@@ -1583,7 +1580,7 @@
     set rssurl    [ad_urlencode $rssurl]
     set my_yahoo_link "http://us.rd.yahoo.com/my/atm/$publisher/$feedname/*http://add.my.yahoo.com/rss?url=$rssurl"
 
-    return "<a class='image-button' href='$my_yahoo_link'><img src='http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo4.gif' width='91' height='17' align='middle' alt='Add to My Yahoo!'></a>"
+    return "<a class='image-button' href='[ns_quotehtml $my_yahoo_link]'><img src='http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo4.gif' width='91' height='17' align='middle' alt='Add to My Yahoo!'></a>"
   }
 
 
@@ -1613,7 +1610,7 @@
       }
       if {$pid ne ""} {
         ::xowiki::Package require $pid
-        lappend refs "<a href='[$pid pretty_link -parent_id $parent_id $name]'>$name</a>"
+        lappend refs "<a href='[ns_quotehtml [$pid pretty_link -parent_id $parent_id $name]]'>[ns_quotehtml $name]</a>"
       }
     }
     set references [join $refs ", "]
@@ -1658,7 +1655,7 @@
       }
       if {$pid ne ""} {
         ::xowiki::Package require $pid
-        lappend refs "<a href='[$pid pretty_link -parent_id $parent_id $name]'>$name</a>"
+        lappend refs "<a href='[ns_quotehtml [$pid pretty_link -parent_id $parent_id $name]]'>[ns_quotehtml $name]</a>"
       }
     }
 
@@ -2948,10 +2945,10 @@
     if {$link ne ""} {
       set button_class [namespace tail [my info class]]
       set props ""
-      if {$alt ne ""} {append props "alt=\"$alt\" "}
-      if {$title ne ""} {append props "title=\"$title\" "}
-      if {$target ne ""} {append props "target=\"$target\" "}
-      set html "<a class='$button_class' href=\"$link\" $props>&nbsp;</a>"
+      if {$alt ne ""} {append props "alt=\"[ns_quotehtml $alt]\" "}
+      if {$title ne ""} {append props "title=\"[ns_quotehtml $title]\" "}
+      if {$target ne ""} {append props "target=\"[ns_quotehtml $target]\" "}
+      set html "<a class='$button_class' href=\"[ns_quotehtml $link]\" $props>&nbsp;</a>"
     }
     return $html
   }
@@ -3122,8 +3119,8 @@
     array set n $nodes
 
     foreach {node label} $nodes {
-      set link "<a href='$base?$attrib=$node'>$label</a>"
-      append nodesHTML "<div id='$node' style='position:relative;'>&nbsp;&nbsp;&nbsp;&nbsp;$link</div>\n"
+      set link "<a href='[ns_quotehtml $base?$attrib=$node]'>[ns_quotehtml $label]</a>"
+      append nodesHTML "<div id='[ns_quotehtml $node]' style='position:relative;'>&nbsp;&nbsp;&nbsp;&nbsp;[ns_quotehtml $link]</div>\n"
     }
 
     set edgesHTML ""; set c 0
@@ -3306,7 +3303,7 @@
     } elseif {[array size user] == 1} {
       set user_id [lindex [array names user] 0]
       append result "<p>Last $total activities were done by user " \
-          "<a href='collab?$user_id'>[::xo::get_user_name $user_id]</a>."
+          "<a href='[ns_quotehtml collab?$user_id]'>[ns_quotehtml [::xo::get_user_name $user_id]]</a>."
     } else {
       append result "<p>Collaborations in last $total activities by [array size user] Users in this wiki</p>"
 
@@ -3463,7 +3460,7 @@
     }
     set msg_key [namespace tail [my info class]]
     set label [_ xowiki.$msg_key [list form_name [$form name]]]$label_suffix
-    return "<a href='$link'>$label</a>"
+    return "<a href='[ns_quotehtml $link]'>[ns_quotehtml $label]</a>"
   }
 
   Class create form-menu-button-new -superclass form-menu-button -parameter {
@@ -4076,17 +4073,17 @@
     set label [$form_item name]
 
     if {$with_form_link} {
-      append html [_ xowiki.entries_using_form [list form "<a href='$base'>$label</a>"]]
+      append html [_ xowiki.entries_using_form [list form "<a href='[ns_quotehtml $base]'>[ns_quotehtml $label]</a>"]]
     }
     append html [t1 asHTML]
 
     if {$csv} {
       set csv_href "[::xo::cc url]?[::xo::cc actual_query]&includelet_key=[ns_urlencode $includelet_key]&generate=csv"
-      lappend links "<a href='$csv_href'>csv</a>"
+      lappend links "<a href='[ns_quotehtml $csv_href]'>csv</a>"
     }
     if {[info exists voting_form]} {
       set href "[::xo::cc url]?[::xo::cc actual_query]&includelet_key=[ns_urlencode $includelet_key]&generate=voting_form"
-      lappend links " <a href='$href'>Generate Voting Form $voting_form</a>"
+      lappend links " <a href='[ns_quotehtml $href]'>Generate Voting Form $voting_form</a>"
     }
     append html [join $links ,]
     #my log "render done"
@@ -4180,7 +4177,7 @@
       set form_href [$item_id pretty_link]
       set action updated
     }
-    return "#xowiki.form-$action# <a href='$form_href'>$form_name</a>"
+    return "#xowiki.form-$action# <a href='[ns_quotehtml $form_href]'>[ns_quotehtml $form_name]</a>"
   }
 }
 
@@ -4204,8 +4201,8 @@
     my get_parameters
     
     if {$title eq ""} {set title $url}
-    set content "<iframe src='$url' width='$width' height='$height'></iframe>"
-    append content "<p><a href='$url' title='$title'>$title</a></p>"
+    set content "<iframe src='[ns_quotehtml $url]' width='[ns_quotehtml $width]' height='[ns_quotehtml $height]'></iframe>"
+    append content "<p><a href='[ns_quotehtml $ur][' title='[ns_quotehtml $title]'>[ns_quotehtml $title]</a></p>"
     return $content
   }
 
@@ -4507,7 +4504,7 @@
   
   flowplayer instproc render {} {
     my get_parameters
-    return "<a href='$mp4' style='display:block;width:425px;height:300px;' id='player'> </a>
+    return "<a href='[ns_quotehtml $mp4]' style='display:block;width:425px;height:300px;' id='player'> </a>
     <script type='text/javascript'>
  flowplayer('player', '/resources/xowiki/flowplayer/flowplayer-3.2.7.swf', {
         
Index: openacs-4/packages/xowiki/tcl/link-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/link-procs.tcl,v
diff -u -N -r1.93 -r1.94
--- openacs-4/packages/xowiki/tcl/link-procs.tcl	10 Jun 2015 09:26:04 -0000	1.93
+++ openacs-4/packages/xowiki/tcl/link-procs.tcl	15 Jun 2015 19:21:06 -0000	1.94
@@ -51,7 +51,7 @@
   ExternalLink instproc render {} {
     my instvar href label
     set css_atts [my mk_css_class_and_id -additional external]
-    return "<a [my anchor_atts] href='$href'>$label<span class='external'>&nbsp;</span></a>"
+    return "<a [my anchor_atts] href='[ns_quotehtml $href]'>$label<span class='external'>&nbsp;</span></a>"
   }
 
   #
@@ -127,7 +127,7 @@
       return $result
     } else {
       ns_log notice "xowiki::link: unknown target $target"
-      return "<a [my anchor_atts] [my mk_css_class_and_id] href='$href'>$label</a>"
+      return "<a [my anchor_atts] [my mk_css_class_and_id] href='[ns_quotehtml $href]'>[ns_quotehtml $label]</a>"
     }
   }
   
@@ -137,14 +137,14 @@
     } elseif {[my exists target] && ![my built_in_target]} {
       return [my render_target $href $label]
     } else {
-      return "<a [my anchor_atts] [my mk_css_class_and_id] href='$href'>$label</a>"
+      return "<a [my anchor_atts] [my mk_css_class_and_id] href='[ns_quotehtml $href]'>[ns_quotehtml $label]</a>"
     }
   }
   Link instproc render_not_found {href label} {
     if {$href eq ""} {
       return \[$label\]
     } else {
-      return "<a [my mk_css_class_and_id -additional missing] href='$href'> $label</a>"
+      return "<a [my mk_css_class_and_id -additional missing] href='[ns_quotehtml $href]'> [ns_quotehtml $label]</a>"
     }
   }
   Link instproc pretty_link {item_id} {
@@ -238,7 +238,7 @@
   # Small bootstrap modal
   #
   ::xowiki::LinkTemplate create ::xowiki::template::modal-sm -link_template {
-<a href="#$id" role="button" data-toggle="modal">$label</a>
+    <a href="#[ns_quotehtml $id]" role="button" data-toggle="modal">[ns_quotehtml $label]</a>
   } -body_template {
 <div class="modal fade" id="$id" tabindex="-1" role="dialog" aria-hidden="true">
   <div class="modal-dialog modal-sm">
@@ -262,9 +262,9 @@
   # Large bootstrap modal
   #
   ::xowiki::LinkTemplate create ::xowiki::template::modal-lg -link_template {
-<a href="#$id" role="button" data-toggle="modal">$label</a>
+    <a href="#[ns_quotehtml $id]" role="button" data-toggle="modal">$label</a>
   } -body_template {
-<div class="modal fade" id="$id" tabindex="-1" role="dialog" aria-hidden="true">
+    <div class="modal fade" id="[ns_quotehtml $id]" tabindex="-1" role="dialog" aria-hidden="true">
   <div class="modal-dialog modal-lg">
     <div class="modal-content">
       <div class="modal-header">
@@ -286,7 +286,7 @@
   # Small bootstrap modal using ajax
   #
   ::xowiki::LinkTemplate create ::xowiki::template::modal-sm-ajax -render_content false -link_template {
-    <a href="$href?template_file=view-modal-content" id='$id-button' role="button" data-target='#$id' data-toggle="modal">$label</a>
+    <a href="[ns_quotehtml $href]?template_file=view-modal-content" id='[ns_quotehtml $id]-button' role="button" data-target='#$id' data-toggle="modal">[ns_quotehtml $label]</a>
   } -body_template {
 <div class="modal fade" id="$id" tabindex="-1" role="dialog" aria-hidden="true">
     <div class="modal-dialog modal-sm">
@@ -311,7 +311,7 @@
   # Large bootstrap modal using ajax
   #
   ::xowiki::LinkTemplate create ::xowiki::template::modal-lg-ajax -render_content false -link_template {
-    <a href="$href?template_file=view-modal-content" id='$id-button' role="button" data-target='#$id' data-toggle="modal">$label</a>
+<a href="[ns_quotehtml $href]?template_file=view-modal-content" id='$id-button' role="button" data-target='#$id' data-toggle="modal">$label</a>
   } -body_template {
 <div class="modal fade" id="$id" tabindex="-1" role="dialog" aria-hidden="true">
     <div class="modal-dialog modal-lg">
@@ -372,7 +372,7 @@
     }
     if {$link ne ""} {
       $page lappend lang_links($image_css_class) \
-          "<a href='$link' [my mk_css_class_and_id]><img class='$image_css_class' \
+          "<a href='[ns_quotehtml $link]' [my mk_css_class_and_id]><img class='[ns_quotehtml $image_css_class]' \
                 src='/resources/xowiki/flags/$lang.png' alt='$lang'></a>"
     }
     return ""
@@ -436,7 +436,7 @@
       set href [my set href]
       if {[string match "java*" $href]} {set href .}
       if {[my exists revision_id]} {append href ?revision_id=[my revision_id]}
-      return "$pre<a $cls href='$href'><img $cls src='$link' alt='$label' title='$label' $style></a>$post"
+      return "$pre<a $cls href='[ns_quotehtml $href]'><img $cls src='[ns_quotehtml $link]' alt='[ns_quotehtml $label]' title='[ns_quotehtml $label]' $style></a>$post"
     } else {
       if {[my exists revision_id]} {append link ?revision_id=[my revision_id]}
       return "$pre<img $cls src='$link' alt='$label' title='$label' $style>$post"
@@ -482,7 +482,7 @@
       if {[my exists revision_id]} {append internal_href ?revision_id=[my revision_id]}
     }
     if {![info exists embed_options]} {
-      return "<a href='$internal_href' [my mk_css_class_and_id -additional file]>$label<span class='file'>&nbsp;</span></a>"
+      return "<a href='[ns_quotehtml $internal_href]' [my mk_css_class_and_id -additional file]>[ns_quotehtml $label]<span class='file'>&nbsp;</span></a>"
     } else {
       set internal_href [string map [list %2e .] $internal_href]
       return "<embed src='$internal_href' name=\"[my name]\" $embed_options></embed>"
@@ -662,8 +662,8 @@
     ::xo::Page requireJS  "/resources/xowiki/get-http-object.js"
     ::xo::Page requireJS  "/resources/xowiki/popup-handler.js"
     ::xo::Page requireJS  "/resources/xowiki/overlib/overlib.js"
-    return "<a href='$href' onclick=\"showInfo('$href?master=0','$label'); return false;\"\
-        [my mk_css_class_and_id -additional glossary]>$label</a>"
+    return "<a href='[ns_quotehtml $href]' onclick=\"showInfo('[ns_quotehtml $href?master=0]','[ns_quotehtml $label]'); return false;\"\
+        [my mk_css_class_and_id -additional glossary]>[ns_quotehtml $label]</a>"
   }
 
   #
Index: openacs-4/packages/xowiki/tcl/notification-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/notification-procs.tcl,v
diff -u -N -r1.20 -r1.21
--- openacs-4/packages/xowiki/tcl/notification-procs.tcl	27 Oct 2014 16:42:05 -0000	1.20
+++ openacs-4/packages/xowiki/tcl/notification-procs.tcl	15 Jun 2015 19:21:06 -0000	1.21
@@ -115,7 +115,7 @@
     #ns_log notice "--n xowiki::notification::do_notifications called for item_id [$page set revision_id] publish_status=[$page set publish_status] XXX"
     $page instvar package_id
     set link [$page pretty_link -absolute 1]
-    append html "<p>For more details, see <a href='$link'>[$page set title]</a></p>"
+    append html "<p>For more details, see <a href='[ns_quotehtml $link]'>[ns_quotehtml [$page set title]]</a></p>"
     append text "\nFor more details, see $link ...<hr>\n"
 
     set state [expr {[$page set last_modified] eq [$page set creation_date] ? "New" : "Updated"}]
Index: openacs-4/packages/xowiki/tcl/package-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/package-procs.tcl,v
diff -u -N -r1.288 -r1.289
--- openacs-4/packages/xowiki/tcl/package-procs.tcl	8 Jun 2015 09:42:26 -0000	1.288
+++ openacs-4/packages/xowiki/tcl/package-procs.tcl	15 Jun 2015 19:21:06 -0000	1.289
@@ -773,7 +773,7 @@
     set name ${lang}:$local_name
     set new_link [my make_link [my id] edit-new object_type return_url name] 
     if {$new_link ne ""} {
-      return "<p>Do you want to create page <a href='$new_link'>$name</a> new?"
+      return "<p>Do you want to create page <a href='[ns_quotehtml $new_link]'>$name</a> new?"
     } else {
       return ""
     }
Index: openacs-4/packages/xowiki/tcl/syndicate-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/syndicate-procs.tcl,v
diff -u -N -r1.43 -r1.44
--- openacs-4/packages/xowiki/tcl/syndicate-procs.tcl	2 May 2015 15:47:45 -0000	1.43
+++ openacs-4/packages/xowiki/tcl/syndicate-procs.tcl	15 Jun 2015 19:21:06 -0000	1.44
@@ -59,7 +59,7 @@
                         "<!-- [string repeat deadbef 100] -->" : ""
                       }]
       set css_link [expr {[string match "/*" $css] ? $css : "/resources/xowiki/$css"}]
-      return "\n<?xml-stylesheet type='text/css' href='$css_link' ?>\n$filler"
+      return "\n<?xml-stylesheet type='text/css' href='[ns_quotehtml $css_link]' ?>\n$filler"
     }
     return ""
   }
Index: openacs-4/packages/xowiki/tcl/tree-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/tree-procs.tcl,v
diff -u -N -r1.12 -r1.13
--- openacs-4/packages/xowiki/tcl/tree-procs.tcl	27 Apr 2015 15:28:23 -0000	1.12
+++ openacs-4/packages/xowiki/tcl/tree-procs.tcl	15 Jun 2015 19:21:06 -0000	1.13
@@ -233,7 +233,7 @@
     if {![$item exists encoded(prefix)]} {set prefix [::xowiki::Includelet html_encode $prefix]}
     if {![$item exists encoded(suffix)]} {set suffix [::xowiki::Includelet html_encode $suffix]}
     append entry \
-        $prefix "<a href='$href'>" [::xowiki::Includelet html_encode $title] "</a>" $suffix
+        $prefix "<a href='[ns_quotehtml $href]'>" [::xowiki::Includelet html_encode $title] "</a>" $suffix
     if {$highlight} {
       return "<li class='liItem'><b>$entry</b></li>\n"
     } else {
@@ -253,10 +253,10 @@
 
     set label [::xowiki::Includelet html_encode [my label]]
     if {[my exists count]} {
-      set entry "$label <a href='[my href]'>([my count])</a>"
+      set entry "$label <a href='[ns_quotehtml [my href]]'>([my count])</a>"
     } else {
       if {[my href] ne ""} {
-        set entry "<a href='[my href]'>$label</a>"
+        set entry "<a href='[ns_quotehtml [my href]]'>[ns_quotehtml $label]</a>"
       } else {
         set entry [my label]
       }
@@ -387,7 +387,7 @@
     if {![$item exists encoded(prefix)]} {set prefix [::xowiki::Includelet html_encode $prefix]}
     if {![$item exists encoded(suffix)]} {set suffix [::xowiki::Includelet html_encode $suffix]}
     append entry \
-        $prefix "<a href='$href'>" [::xowiki::Includelet html_encode $title] "</a>" $suffix
+        $prefix "<a href='[ns_quotehtml $href]'>" [::xowiki::Includelet html_encode $title] "</a>" $suffix
     if {$highlight} {
       return "<b>$entry</b><br>\n"
     } else {
Index: openacs-4/packages/xowiki/tcl/weblog-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/weblog-procs.tcl,v
diff -u -N -r1.67 -r1.68
--- openacs-4/packages/xowiki/tcl/weblog-procs.tcl	12 Jun 2015 09:05:29 -0000	1.67
+++ openacs-4/packages/xowiki/tcl/weblog-procs.tcl	15 Jun 2015 19:21:07 -0000	1.68
@@ -269,8 +269,8 @@
     set query [::xo::update_query $query summary [expr {!$summary}]]
     set weblog_href [::xo::cc url]?$query
     #set weblog_href [$package_id package_url][$package_id get_parameter weblog_page]
-    #set flink "<a href='$weblog_href?summary=[expr {!$summary}]$query_parm'>$smsg($summary)</a>"
-    set flink "<a href='$weblog_href'>$smsg($summary)</a>"
+    #set flink "<a href='[ns_quotehtml $weblog_href?summary=[expr {!$summary}]$query_parm]'>[ns_quotehtml $smsg($summary)]</a>"
+    set flink "<a href='[ns_quotehtml $weblog_href]'>[ns_quotehtml $smsg($summary)]</a>"
     
     if {$page_number ne ""} {
       set nr [llength [$items children]] 
@@ -279,9 +279,9 @@
       set range [expr {$nr > 1 ? "$from - $to" : $from}]
       
       if {$filter_msg ne ""} {
-        append filter_msg ", $range of $nr_items $entry_label (<a href='$weblog_href'>all</a>, $flink)"
+        append filter_msg ", $range of $nr_items $entry_label (<a href='[ns_quotehtml $weblog_href]'>all</a>, [ns_quotehtml $flink])"
       } else {
-        append filter_msg "Showing $range of $nr_items $entry_label ($flink)"
+        append filter_msg "Showing $range of $nr_items $entry_label ([ns_quotehtml $flink])"
       }
       
       set next_p [expr {$nr_items > $page_number*$page_size}]
@@ -331,11 +331,11 @@
     set link [my pretty_link]
     regsub -all & $link "&amp;" link
     set more [expr {[$weblog_obj summary] ? 
-                    " <span class='more'> \[<a href='$link'>#xowiki.weblog-more#</a>\]</span>" : ""}]
+                    " <span class='more'> \[<a href='[ns_quotehtml $link]'>#xowiki.weblog-more#</a>\]</span>" : ""}]
     #append more "<p></p>"
 
     append content "<DIV class='post'>" \
-        "<h2><a href='$link'>$title</a></h2>" \
+        "<h2><a href='[ns_quotehtml $link]'>[ns_quotehtml $title]</a></h2>" \
         "<p class='auth'>Created by $creator, " \
         "last modfied by [::xo::get_user_name $creation_user] " \
         "<span class='date'>$pretty_date</span></p>" \
@@ -356,12 +356,12 @@
       set filter  "<div class='filter'>$filter_msg</div>"
     } 
     if {[info exists prev_page_link]} {
-      set prev "<a href='$prev_page_link'>\
+      set prev "<a href='[ns_quotehtml $prev_page_link]'>\
         <img border='0' src='/resources/acs-subsite/left.gif' width='13' height='13' \
              alt='Previous Page' style='float: left;  top: 0px;'></a>"
     }
     if {[info exists next_page_link]} {
-      set next "<a href='$next_page_link'>\
+      set next "<a href='[ns_quotehtml $next_page_link]'>\
         <img border='0' src='/resources/acs-subsite/right.gif' width='13' height='13'\
              alt='Next Page' style='float: left;  top: 0px;'></a>"
     }
Index: openacs-4/packages/xowiki/tcl/xowiki-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/xowiki-procs.tcl,v
diff -u -N -r1.479 -r1.480
--- openacs-4/packages/xowiki/tcl/xowiki-procs.tcl	7 Jun 2015 10:46:58 -0000	1.479
+++ openacs-4/packages/xowiki/tcl/xowiki-procs.tcl	15 Jun 2015 19:21:07 -0000	1.480
@@ -4000,7 +4000,7 @@
   }
 
   File instproc render_icon {} {
-    return [list text "<img src='/resources/file-storage/file.gif' width='12'>" is_richtext true]
+    return [list text "<img src='/resources/file-storage/file.gif' width='12' alt='file'>" is_richtext true]
   }
 
   FormPage instproc render_icon {} {
@@ -4010,20 +4010,20 @@
     }
     switch [$page_template name] {
       en:folder.form {
-        return [list text "<img src='/resources/file-storage/folder.gif' width='12'>" is_richtext true]
+        return [list text "<img src='/resources/file-storage/folder.gif' width='12' alt='folder'>" is_richtext true]
       }
       en:link.form {
         set link_type [my get_property_from_link_page link_type "unresolved"]
         set link_icon "http://www.ejoe.at/typo3/sysext/rtehtmlarea/res/accessibilityicons/img/internal_link.gif"
         if {$link_type eq "unresolved"} {
-          return [list text "<img src='$link_icon' width='12'> \
+          return [list text "<img src='$link_icon' width='12' alt='internal-link'> \
         <img src='http://www.deeptrawl.com/images/icons/brokenLinks.png' width='15'>" is_richtext true]
         }
         if {$link_type eq "folder_link"} {
-          return [list text "<img src='$link_icon' width='12'> \
-        <img src='/resources/file-storage/folder.gif' width='12'>" is_richtext true]
+          return [list text "<img src='$link_icon' width='12' alt='folder-link'> \
+          <img src='/resources/file-storage/folder.gif' width='12' alt='folder'>" is_richtext true]
         }
-        return [list text "<img src='$link_icon' width='12'>" is_richtext true]
+        return [list text "<img src='$link_icon' width='12' alt='interal-link'>" is_richtext true]
       }
       default {
         return [list text [$page_template title] is_richtext false]
Index: openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl,v
diff -u -N -r1.324 -r1.325
--- openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl	8 Jun 2015 07:48:14 -0000	1.324
+++ openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl	15 Jun 2015 19:21:07 -0000	1.325
@@ -1059,7 +1059,7 @@
              -groupby "tag" \
              -orderby "nr" \
              -limit $limit] {
-               lappend entries "<a href='$href&ptag=[ad_urlencode $tag]'>$tag ($nr)</a>"
+               lappend entries "<a href='[ns_quotehtml $href&ptag=[ad_urlencode $tag]]'>[ns_quotehtml $tag ($nr)]</a>"
              }
     ns_return 200 text/html "[_ xowiki.popular_tags_label]: [join $entries {, }]"
   }
@@ -1864,7 +1864,7 @@
   Page instproc mutual_overwrite_occurred {} {
      util_user_message -html \
          -message "[_ xowiki.User] <em>[::xo::get_user_name [my set modifying_user]]</em> [_ xowiki.has_modified_this_page]. \
-   [_ xowiki.Please_open] <a href='[::xo::cc url]' target='_blank'>[_ xowiki.modified_page]</a> [_ xowiki.new_window_or_OK]."
+   [_ xowiki.Please_open] <a href='[ns_quotehtml [::xo::cc url]]' target='_blank'>[_ xowiki.modified_page]</a> [_ xowiki.new_window_or_OK]."
     # return 1 to flag validation error, 0 to ignore this fact
     return 1
   }
Index: openacs-4/packages/xowiki/tcl/yui-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/yui-procs.tcl,v
diff -u -N -r1.3 -r1.4
--- openacs-4/packages/xowiki/tcl/yui-procs.tcl	27 Apr 2015 15:28:23 -0000	1.3
+++ openacs-4/packages/xowiki/tcl/yui-procs.tcl	15 Jun 2015 19:21:07 -0000	1.4
@@ -91,7 +91,7 @@
       html::t \n
       html::div -class "bd" {
         foreach group [my split_menu_groups [my children]] {
-          html::ul {
+          html::ul -class yuiml {
             foreach menuitemlist $group {$menuitemlist render}
           }
         }
@@ -217,7 +217,7 @@
     my append CSSclass " yuimenu"
     html::div [my get_attributes id {CSSclass class}] {
       html::div -class "bd" {
-        html::ul {
+        html::ul -class yuicm {
           foreach li [my children] {$li render}
         }
       }
@@ -482,7 +482,7 @@
       if {[$field hide]} continue
       if {[$field istype HiddenField]} continue
       if {[$field istype BulkAction]} {
-        set label "<input type='checkbox' onclick='acs_ListCheckAll(\\\"objects\\\",this.checked)'></input>"
+        set label "<input type='checkbox' onclick='[ns_quotehtml acs_ListCheckAll(\"objects\",this.checked)]'></input>"
         set sortable false
       } else {
         set label [$field label]