diff options
| author | Adrian Holovaty <adrian@holovaty.com> | 2006-02-17 17:55:41 +0000 |
|---|---|---|
| committer | Adrian Holovaty <adrian@holovaty.com> | 2006-02-17 17:55:41 +0000 |
| commit | 15f57d8c55d74e41e8102ccad27fcc7d73a67771 (patch) | |
| tree | 948ba6f772e355ef16fd8cbf1a637cee4bb5c39a | |
| parent | af33a72fb55b6d5e1b27d18aafa7b74e7446c2c6 (diff) | |
Fixed #1357 and #614 -- <select> formfields now escape values
git-svn-id: http://code.djangoproject.com/svn/django/trunk@2321 bcc190cf-cafb-0310-a4f2-bffc1f526a37
| -rw-r--r-- | django/core/formfields.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/django/core/formfields.py b/django/core/formfields.py index 1d018aff5c..3289be5235 100644 --- a/django/core/formfields.py +++ b/django/core/formfields.py @@ -427,7 +427,7 @@ class SelectField(FormField): selected_html = '' if str(value) == str_data: selected_html = ' selected="selected"' - output.append(' <option value="%s"%s>%s</option>' % (escape(value), selected_html, display_name)) + output.append(' <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(display_name))) output.append(' </select>') return '\n'.join(output) |