=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/java/org/hisp/dhis/caseentry/action/reminder/GetProgramTrackingListAction.java'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/java/org/hisp/dhis/caseentry/action/reminder/GetProgramTrackingListAction.java	2012-11-21 15:17:33 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/java/org/hisp/dhis/caseentry/action/reminder/GetProgramTrackingListAction.java	2012-11-22 03:15:27 +0000
@@ -27,7 +27,6 @@
 
 package org.hisp.dhis.caseentry.action.reminder;
 
-import java.lang.reflect.InvocationTargetException;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/activityPlanRecords.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/activityPlanRecords.vm	2012-11-16 05:20:34 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/activityPlanRecords.vm	2012-11-22 03:15:27 +0000
@@ -67,8 +67,8 @@
 												 <input type="button" name="programStageBtn"
 													id="ps_$!programStageInstance.id"
 													psid="$programStageInstance.programStage.id"
-													psname="$programStageInstance.programStage.name"
-													orgunit="$!programStageInstance.organisationUnit.name"
+													psname="$encoder.htmlEncode($programStageInstance.programStage.name)"
+													orgunit="$encoder.htmlEncode($!programStageInstance.organisationUnit.name)"
 													programType='$programInstance.program.type'
 													reportDate="$!format.formatDate( $!programStageInstance.executionDate )"
 													reportDateDes="$programStageInstance.programStage.reportDateDescription"
@@ -77,7 +77,7 @@
 													index="$idx"
 													class="stage-object" 
 													title="$title"
-													value="$programStageInstance.programStage.name&#13;&#10;$valueDate" 
+													value="$encoder.htmlEncode($programStageInstance.programStage.name)&#13;&#10;$valueDate" 
 													onclick="javascript:loadDataEntry( $programStageInstance.id );">
 												<script>	
 													var status = $programStageInstance.getEventStatus();

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/addRelationshipPatientForm.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/addRelationshipPatientForm.vm	2012-11-14 09:07:24 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/addRelationshipPatientForm.vm	2012-11-22 03:15:27 +0000
@@ -55,8 +55,8 @@
 			<select name="relationshipTypeId" id="relationshipTypeId" class="{validate:{required:true}}" >
 				<option value="">[$i18n.getString( "please_select" )]</option>        
 				#foreach ($relationship in $relationshipTypes)
-					<option value="$relationship.id" relationshipFromA='true'>${relationship.aIsToB} $i18n.getString("of") $patient.getFullName() (${relationship.bIsToA})</option>
-					<option value="$relationship.id" relationshipFromA='false'>${relationship.bIsToA} $i18n.getString("of") $patient.getFullName() (${relationship.aIsToB})</option>
+					<option value="$relationship.id" relationshipFromA='true'>$encoder.htmlEncode(${relationship.aIsToB}) $i18n.getString("of") $encoder.htmlEncode($patient.getFullName()) ($encoder.htmlEncode(${relationship.bIsToA}))</option>
+					<option value="$relationship.id" relationshipFromA='false'>$encoder.htmlEncode(${relationship.bIsToA}) $i18n.getString("of") $encoder.htmlEncode($patient.getFullName()) ($encoder.htmlEncode(${relationship.aIsToB}))</option>
 				#end
 			</select>
 		</td>

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/caseAggregationResultDetails.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/caseAggregationResultDetails.vm	2012-10-09 10:03:00 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/caseAggregationResultDetails.vm	2012-11-22 03:15:27 +0000
@@ -12,7 +12,7 @@
 			</tr>
 			#end
 			<tr>
-				<td>$!patient.getFullName()</td>
+				<td>$encoder.htmlEncode($!patient.getFullName())</td>
 				<td>$i18n.getString($!patient.gender)</td>
 				<td>$format.formatDate($!patient.birthDate)</td>
 				<td>$!patient.getAge()</td>
@@ -69,8 +69,8 @@
 				#set( $mark = false )
 				#foreach( $dataValue in $dataValues )
 					<tr #alternate( $mark )>
-						<td>$dataValue.programStageInstance.programStage.name</td>
-						<td>$dataValue.dataElement.name</td>
+						<td>$encoder.htmlEncode($dataValue.programStageInstance.programStage.name)</td>
+						<td>$encoder.htmlEncode($dataValue.dataElement.name)</td>
 						<td>$dataValue.value</td>
 						<td>$format.formatDate($dataValue.timestamp)</td>
 					</tr>

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/dataentryRecords.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/dataentryRecords.vm	2012-09-27 08:00:40 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/dataentryRecords.vm	2012-11-22 03:15:27 +0000
@@ -41,7 +41,7 @@
 						#if($value=="")
 							#set($value=$patient.getFullName())
 						#end
-						<input type='button' class='patient-object' value="$value"
+						<input type='button' class='patient-object' value="$encoder.htmlEncode($value)"
 							onclick='javascript:showPatientHistory( "$patient.id" );' title='$i18n.getString( "patient_details_and_history" )'>
 					</td>
 					#set( $programStageInstances = $programInstance.programStageInstances )

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/detailsPartner.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/detailsPartner.vm	2012-11-15 03:47:43 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/detailsPartner.vm	2012-11-22 03:15:27 +0000
@@ -5,7 +5,7 @@
 	
 	<tr>
 		<td>$i18n.getString( "full_name" )</td>
-		<td>: $partner.getFullName()</td>
+		<td>: $encoder.htmlEncode($partner.getFullName())</td>
 	</tr>
 	
 	<tr>
@@ -49,7 +49,7 @@
 			#if( $patientAttributeValueMap.get( $attribute.id ) != " " )
 			<tr>
 				<td>$attribute.name</td>
-				<td>: $patientAttributeValueMap.get( $attribute.id )</td>
+				<td>: $encoder.htmlEncode($patientAttributeValueMap.get( $attribute.id ))</td>
 			</tr>
 			#end
 		#end
@@ -60,7 +60,7 @@
 		<td><label class="bold">$i18n.getString( "enrolled_in_program" )</label></td>
 		<td>: 
 		#foreach( $program in $partner.programs )
-			$program.name
+			$encoder.htmlEncode($program.name)
 		#end
 		</td>
 	</tr>

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/listPatient.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/listPatient.vm	2012-11-15 03:47:43 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/listPatient.vm	2012-11-22 03:15:27 +0000
@@ -45,7 +45,7 @@
 			<th>#</th>
             #foreach( $identifierType in $identifierTypes)
 				<th>
-					$identifierType.name
+					$encoder.htmlEncode($identifierType.name)
 				</th>
 			#end
 			#if( $identifierTypes.size()==0 )
@@ -82,7 +82,7 @@
 					#set($value=$patient.getFullName())
 				#end
 				<td style='cursor:pointer;' onclick="javascript:">
-					<a>$value</a>
+					<a>$encoder.htmlEncode($value)</a>
 				</td>
 				<td>			
 					$i18n.getString( $patient.gender )

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/patientForm.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/patientForm.vm	2012-10-31 04:49:44 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/patientForm.vm	2012-11-22 03:15:27 +0000
@@ -127,7 +127,7 @@
 			#set( $identifier = '' )
 			#set( $identifier = $identiferMap.get( $identifierType.id ) )
 			<tr> 
-				<td class='text-column'><label>$identifierType.name #if($identifierType.mandatory)<em title="$i18n.getString( "required" )" class="required">*</em> #end</label></td>
+				<td class='text-column'><label>$encoder.htmlEncode($identifierType.name) #if($identifierType.mandatory)<em title="$i18n.getString( "required" )" class="required">*</em> #end</label></td>
 				<td class="input-column"><input type="text" id="iden$identifierType.id" name="iden$identifierType.id" value="$!identifier" data="{related:$identifierType.related}" #if($identifierType.related && $!patient.underAge) disabled="disabled" #end class="{validate:{required:$identifierType.mandatory, #if($!identifierType.noChars) maxlength:$identifierType.noChars, #end #if($identifierType.type=='number') number:true #elseif($!identifierType.type=='letter') lettersonly:true #end }}" /></td>	
 			</tr>
 		#end
@@ -144,7 +144,7 @@
 		#set($value = "")
 		#set($value = $patientAttributeValueMap.get($attribute.id))
 		<tr>
-			<td class='text-column'><label>$attribute.name #if($attribute.mandatory)<em title="$i18n.getString( 'required' )" class="required">*</em> #end</label></td>
+			<td class='text-column'><label>$encoder.htmlEncode($attribute.name) #if($attribute.mandatory)<em title="$i18n.getString( 'required' )" class="required">*</em> #end</label></td>
 			<td class="input-column">
 				#if( $attribute.valueType == "YES/NO" )
 					<select id="attr$attribute.id" name="attr$attribute.id" inherit="$!attribute.inherit"> 
@@ -184,7 +184,7 @@
 		#set( $attributeValue = "" )
 		#set( $attributeValue = $!patientAttributeValueMap.get( $attribute.id ) )
 		<tr>
-			<td class='text-column'><label>$attribute.name #if($attribute.mandatory)<em title="$i18n.getString( "required" )" class="required">*</em> #end</label></td>
+			<td class='text-column'><label>$encoder.htmlEncode($attribute.name) #if($attribute.mandatory)<em title="$i18n.getString( "required" )" class="required">*</em> #end</label></td>
 			<td class="input-column">
 				#if( $attribute.valueType == "YES/NO" )
 					<select id="attr$attribute.id"  name="attr$attribute.id" inherit="$!attribute.inherit">              

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/patientRegistrationList.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/patientRegistrationList.vm	2012-10-26 04:51:33 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/patientRegistrationList.vm	2012-11-22 03:15:27 +0000
@@ -49,14 +49,12 @@
 				<th>#</th>
 				#foreach( $attribute in $patientAttributes )
 					#if($attribute)
-						<th id="patientAttributeName">$attribute.name</th>
+						<th id="patientAttributeName">$encoder.htmlEncode($attribute.name)</th>
 					#end
 				#end
 				
 				#foreach( $identifierType in $identifierTypes)
-					<th>
-						$identifierType.name
-					</th>
+					<th>$encoder.htmlEncode($identifierType.name)</th>
 				#end
 				#if( $identifierTypes.size()==0 )
 					<th>$i18n.getString( "full_name" )</th>          
@@ -107,7 +105,7 @@
 					#set($value=$patient.getFullName())
 				#end
 				<td style="cursor:pointer;" onclick="javascript:isDashboard=true;showPatientDashboardForm( '$patient.id' )">
-					<a>$value</a>
+					<a>$encoder.htmlEncode($value)</a>
 				</td>
 				
 				<td>$i18n.getString($!patient.gender)</td>

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/programTrackingList.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/programTrackingList.vm	2012-11-21 15:17:33 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/programTrackingList.vm	2012-11-22 03:15:27 +0000
@@ -1,7 +1,7 @@
 <h3>
  <a href="javascript:onClickBackBtn();">$i18n.getString( 'program_tracking' )</a>
  &#8226; <a href="javascript:showPatientDashboardForm( $programStageInstance.programInstance.patient.id );">$i18n.getString( 'patient_dashboard' )</a>
- &raquo; $programStageInstance.programStage.name
+ &raquo; $encoder.htmlEncode($programStageInstance.programStage.name)
 </h3>
 
 <input type='hidden' id='currentUsername' name='currentUsername' value='$currentUsername'>
@@ -15,7 +15,7 @@
 			<table>
 				<tr>            
 					<td class="bold">$i18n.getString( "full_name" ):</td>
-					<td>$programStageInstance.programInstance.patient.getFullName() ( $programStageInstance.programInstance.patient.gender )</td>
+					<td>$encoder.htmlEncode($programStageInstance.programInstance.patient.getFullName() ( $programStageInstance.programInstance.patient.gender ))</td>
 				</tr>
 				<tr>
 					<td class="bold">$i18n.getString( "date_of_birth" ):</td>
@@ -35,7 +35,7 @@
 					<td class="bold">$i18n.getString("health_worker")</td>
 					<td>
 						#if($!programStageInstance.programInstance.patient.healthWorker )
-							$!programStageInstance.programInstance.patient.healthWorker.name
+							$encoder.htmlEncode($!programStageInstance.programInstance.patient.healthWorker.name)
 						#else
 							[$i18n.getString('none')]
 						#end
@@ -134,18 +134,18 @@
 		#foreach( $comment in $comments )
 			<tr id="comment_$comment.id">
 				<td>$format.formatDateTime($comment.createdDate)</td>
-				<td>$programStageInstance.programStage.name</td>
-				<td>$comment.creator</td>
-				<td>$comment.commentText</td>
+				<td>$encoder.htmlEncode($programStageInstance.programStage.name)</td>
+				<td>$encoder.htmlEncode($comment.creator)</td>
+				<td>$encoder.htmlEncode($comment.commentText)</td>
 			</tr>
 		#end
 		
 		#foreach( $sms in $outboundSms )
 			<tr id="tr${sms.id}" >
 				<td>$format.formatDateTime($!sms.date)</td>
-				<td>$programStageInstance.programStage.name</td>
-				<td>$sms.sender</td>
-				<td>$sms.message</td>
+				<td>$encoder.htmlEncode($programStageInstance.programStage.name)</td>
+				<td>$encoder.htmlEncode($sms.sender)</td>
+				<td>$encoder.htmlEncode($sms.message)</td>
 			</tr>
 		#end
 	</tbody>

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/programTrackingRecords.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/programTrackingRecords.vm	2012-11-16 05:20:34 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/programTrackingRecords.vm	2012-11-22 03:15:27 +0000
@@ -80,7 +80,7 @@
 												
 												<input type='button' id='ps_$programStageInstance.id' name='programStageBtn' 
 													programStageInstanceId='$programStageInstance.id' 
-													programStageName='$programStageInstance.programStage.name' 
+													programStageName='$encoder.htmlEncode($programStageInstance.programStage.name)' 
 													programStageId='$programStageInstance.programStage.id' 
 													programInstanceId='$programInstance.id'
 													dueDate='$format.formatDate( $programStageInstance.dueDate )'

=== modified file 'dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/updatePatientForm.vm'
--- dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/updatePatientForm.vm	2012-11-14 09:07:24 +0000
+++ dhis-2/dhis-web/dhis-web-caseentry/src/main/webapp/dhis-web-caseentry/updatePatientForm.vm	2012-11-22 03:15:27 +0000
@@ -90,23 +90,23 @@
 <div id="representativeInfo" class='hidden text-column'>
 	<table>
 		<tr>
-			<td class="bold text-column">$i18n.getString("full_name"):</td>
-			<td>$!representative.getFullName()</td>
-		</tr>
-		<tr>
-			<td class="bold text-column">$i18n.getString("relationship"):</td>
-			<td>$!relationship.relationshipType.aIsToB</td>
-		</tr>
-		<tr>
-			<td class="bold text-column">$i18n.getString("gender"):</td>
-			<td> $!representative.gender</td>
-		</tr>
-		<tr>
-			<td class="bold text-column">$i18n.getString("date_of_birth"):</td>
+			<td class="bold text-column">$i18n.getString("full_name"): </td>
+			<td>$encoder.htmlEncode($!representative.getFullName())</td>
+		</tr>
+		<tr>
+			<td class="bold text-column">$i18n.getString("relationship"): </td>
+			<td>$encoder.htmlEncode($!relationship.relationshipType.aIsToB)</td>
+		</tr>
+		<tr>
+			<td class="bold text-column">$i18n.getString("gender"): </td>
+			<td>$!representative.gender</td>
+		</tr>
+		<tr>
+			<td class="bold text-column">$i18n.getString("date_of_birth"): </td>
 			<td>$!format.formatDate( $!representative.birthDate )</td>
 		</tr>
 		<tr>
-			<td class="bold text-column">$i18n.getString("age"):</td>
+			<td class="bold text-column">$i18n.getString("age"): </td>
 			<td> $!representative.getAge() </td>
 		</tr>
 		#foreach( $patientIdentifier in $representative.identifiers )
@@ -119,13 +119,12 @@
 			<td class="bold text-column">$i18n.getString("enrolled_in_program"):</td>
 			<td>  
 				 #foreach( $program in $representative.programs )
-					#if( $velocityCount == 1 )
-						 $program.name
-					#else , $program.name 
+					$encoder.htmlEncode($program.name)
+					#if( $velocityCount > 1 )
+						<br>
 					#end
 				 #end  
 			</td>
 		</tr>
-			   
 	</table>
 </div>