Ticket #1357: 1357.patch

core/formfields.py

@@ -427 +427 @@
             selected_html = ''
             if str(value) == str_data:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, display_name))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(display_name)))
         output.append('  </select>')
         return '\n'.join(output)