X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/516aef5d07eaaad43311bc60018648b952d95a1d..d6b36b5752ff50c0c2aa0e78f784b17a624ee994:/app/views/site/_search.rhtml

diff --git a/app/views/site/_search.rhtml b/app/views/site/_search.rhtml
index 19b4ca2d1..6ddcc851c 100644
--- a/app/views/site/_search.rhtml
+++ b/app/views/site/_search.rhtml
@@ -1,7 +1,7 @@
 <script type="text/javascript">
 <!--
   function startSearch() {
-    updateSidebar("Search Results", "<p class='search_results_entry'>Searching...</p>");
+    updateSidebar("Search Results", "<p class='search_results_entry'>Searching...<\/p>");
 
     $("search_field").style.display = "none";
     $("search_active").style.display = "inline";
@@ -24,7 +24,7 @@
   <% if params[:query] %>
   <%= remote_function(:loading => "startSearch()",
                       :complete => "endSearch()",
-                      :url => { :controller => :geocoder, :action => :search, :query => params[:query] }) %>
+                      :url => { :controller => :geocoder, :action => :search, :query => h(params[:query]) }) %>
   <% end %>
 // -->
 </script>
@@ -34,13 +34,14 @@
     <span class="oboxheader">Search</span>
     <span class="whereami"><a href="javascript:describeLocation()">Where am I?</a></span>
     <div class="search_form">
-    <span id="search_field">
+    <div id="search_field">
     <% form_remote_tag(:loading => "startSearch()",
                        :complete => "endSearch()",
                        :url => { :controller => :geocoder, :action => :search }) do %>
-      <%= text_field_tag :query, params[:query] %>
+      <%= text_field_tag :query, h(params[:query]) %>
+      <%= submit_tag "Go" %>
     <% end %>
-    </span>
+    </div>
     <p id="search_active">Searching...</p>
     </div>
     <p class="search_help">