Add a few more escape calls to prevent nasty HTML being rendered. Also

[rails.git] / app / views / message / new.rhtml

diff --git a/app/views/message/new.rhtml b/app/views/message/new.rhtml
index 44ef84dfcb183c7195bd1ffd0bfe3170fa695766..27c50132218e0388d7e27fba2eea93c0eb81d360 100644 (file)
--- a/app/views/message/new.rhtml
+++ b/app/views/message/new.rhtml
@@ -3,7 +3,7 @@
 <h2>Send a new message to <%= display_name %></h2>
 
 <% if params[:display_name] %>
-<p>Writing a new message to <%= params[:display_name] %></p>  
+<p>Writing a new message to <%= h(params[:display_name]) %></p>  
 <p>TODO: drop down box of your friends</p>
 <%end%>
 
@@ -21,7 +21,7 @@
     </tr>
     <tr>
       <th></th>
-      <td><%= f.submit_tag 'Send' %></td>
+      <td><%= submit_tag 'Send' %></td>
     </tr>
   </table>
 <% end %>