Potlatch 0.7

[rails.git] / app / views / site / _search.rhtml

diff --git a/app/views/site/_search.rhtml b/app/views/site/_search.rhtml
index 19b4ca2d1351d199ffa1ce31afb326e61cf0243a..bdfc2fb57a44df4382054f82d520ad7420d34f93 100644 (file)
--- a/app/views/site/_search.rhtml
+++ b/app/views/site/_search.rhtml
@@ -24,7 +24,7 @@
   <% if params[:query] %>
   <%= remote_function(:loading => "startSearch()",
                       :complete => "endSearch()",
-                      :url => { :controller => :geocoder, :action => :search, :query => params[:query] }) %>
+                      :url => { :controller => :geocoder, :action => :search, :query => h(params[:query]) }) %>
   <% end %>
 // -->
 </script>
@@ -38,7 +38,7 @@
     <% form_remote_tag(:loading => "startSearch()",
                        :complete => "endSearch()",
                        :url => { :controller => :geocoder, :action => :search }) do %>
-      <%= text_field_tag :query, params[:query] %>
+      <%= text_field_tag :query, h(params[:query]) %>
     <% end %>
     </span>
     <p id="search_active">Searching...</p>