Commit 7098389f authored by Adrian Holovaty's avatar Adrian Holovaty
Browse files

Fixed #2020 -- <option> values are now escaped in SelectMultipleField 

git-svn-id: http://code.djangoproject.com/svn/django/trunk@3021 bcc190cf-cafb-0310-a4f2-bffc1f526a37
parent 8623bd12

django/forms/__init__.py

+1 −1
Original line number Diff line number Diff line
@@ -577,7 +577,7 @@ class SelectMultipleField(SelectField): 
            selected_html = ''

            if str(value) in str_data_list:

                selected_html = ' selected="selected"'

            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, choice))

            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(choice)))

        output.append('  </select>')

        return '\n'.join(output)