diff --git a/web/CXM_making_a_web_site.anubis b/web/CXM_making_a_web_site.anubis
index d4e7dcb..7bade8d 100644
--- a/web/CXM_making_a_web_site.anubis
+++ b/web/CXM_making_a_web_site.anubis
@@ -67,6 +67,63 @@ transmit CXM_web_action.anubis
 
 transmit calexium_lib/web/types/web_action_name.anubis
 
+//TODO move anywhere
+
+
+define List(Word8)
+/** Test for HTML entity which must be encoded
+ * and return the encoded entity if needed
+ */
+  get_entity
+  (
+    Word8       _char,
+    List(Word8) tail
+  )=
+  //test for the ampersand
+  if      _char = '&' then 
+    //test if it's already an encoded string like & < etc. In that case we do nothing
+    if      insensitive_equal(['&','a','m','p',';'],      tail, 0) then [_char]
+    else if insensitive_equal(['&','l','t',';'],          tail, 0) then [_char]
+    else if insensitive_equal(['&','g','t',';'],          tail, 0) then [_char]
+    else if insensitive_equal(['&','q','u','o','t',';'],  tail, 0) then [_char]
+    else
+      [';','p','m','a','&']
+  //test for '<' etc.
+  else if _char = '<'   then  [';','t','l','&']
+  else if _char = '>'   then  [';','t','g','&']
+  else if _char = '\"'  then  [';','t','o','u','q','&']
+  else                        [_char]
+.
+
+define String
+  _HTML_encode_entities
+  (
+    List(Word8) source,
+    List(Word8) current
+  )=
+  if source is
+  {
+    []      then implode(reverse(current)),
+    [c . t]  then
+      _HTML_encode_entities(t, get_entity(c, t) + current)
+  }
+.
+
+public define String
+  encode_HTML_entities
+  (
+    String source
+  )=
+  _HTML_encode_entities(explode(source), [])
+.
+
+//public define String
+//  encode_HTML_entities
+//  (
+//    String source
+//  )=
+//.
+
 //read CXM_html_tooltip.anubis
 
    * (1) Structure of a web site. 
@@ -4293,7 +4350,7 @@ public define Printable_tree
       [ ] then [ ], 
       [h . t] then
        if h is (attrs,val,item) 
-        then ["<option value=\""+val.value+"\" "+format_attrs(attrs)+">", item, "</option>\n" . format_choices(t)]
+        then ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+">", item, "</option>\n" . format_choices(t)]
     }.
    
 public define Printable_tree
@@ -4308,8 +4365,8 @@ public define Printable_tree
       [h . t] then 
        if h is (attrs,val,item) then 
        if val.value = selected.value 
-         then ["<option value=\""+val.value+"\" "+format_attrs(attrs)+" selected=\"selected\">", item, "</option>\n" . format_choices(t)]
-         else ["<option value=\""+val.value+"\" "+format_attrs(attrs)+" >", item, "</option>\n" . format_choices(t,selected)]
+         then ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+" selected=\"selected\">", item, "</option>\n" . format_choices(t)]
+         else ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+" >", item, "</option>\n" . format_choices(t,selected)]
     }.
    
    
@@ -4938,9 +4995,9 @@ define Printable_tree
                               url(_)                    then ""
                             },
                             if action_name = "" then  
-                              ["<input type=\"button\" value=\"",text,"\"", format_attrs(options), " />"]
+                              ["<input type=\"button\" value=\"",encode_HTML_entities(text),"\"", format_attrs(options), " />"]
                             else
-                              [s,"<input type=\"button\" value=\"",text,"\"", format_attrs(options), " onclick=\"",h,"\" />"]
+                              [s,"<input type=\"button\" value=\"",encode_HTML_entities(text),"\"", format_attrs(options), " onclick=\"",h,"\" />"]
            }
          ], 
        button(url_off,url_on) then 
@@ -5779,18 +5836,17 @@ define Printable_tree
          format(cinfo,ic_v,any_foreign_link(options,url,name),format_element,is_https, action_count, head_tags), 
        private_download(url,name,extra,action)    then 
          format(cinfo,ic_v,any_private_download(url,name,extra,action),format_element,is_https, action_count, head_tags),    
-       text_input(options, label_text, id, name, i, w)           then 
-         
+       text_input(options, label_text, id, name, init, w)           then 
          [ format_label(label_text, id), 
-           "<input type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       text_input_ro(options, label_text, id, name,i,w)           then 
+           "<input type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       text_input_ro(options, label_text, id, name, init, w)           then 
          [ format_label(label_text, id), 
-           "<input readonly=\"readonly\" type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       password_input(options, label_text, id, name,i,w)         then 
+           "<input readonly=\"readonly\" type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       password_input(options, label_text, id, name, init, w)         then 
          [ format_label(label_text, id), 
-           "<input type=\"password\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       text_area(options,label_text, id, n,i,w,h)          then
-         [ format_label(label_text, id), "<textarea ",format(options)," id=\"",id,"\" name=\"",n,"\" cols=\"",w,"\" rows=\"",h,"\">",i,"</textarea>"],
+           "<input type=\"password\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       text_area(options,label_text, id, n, init, w, h)          then
+         [ format_label(label_text, id), "<textarea ",format(options)," id=\"",id,"\" name=\"",n,"\" cols=\"",w,"\" rows=\"",h,"\">",encode_HTML_entities(init.value),"</textarea>"],
        file_upload(options, label, id, n, w)            then 
          [ format_label(label, id), 
            "<input type=\"file\" id=\"",id,"\" size=\"",w,"\" name=\"",n,"\"",format_attrs([class("in") . options])," />"],
@@ -5807,11 +5863,11 @@ define Printable_tree
          [ format_label(label, id), 
           "<select id=\"",id,"\" name=\"",n,"\" size=\"",s,"\" ",format_attrs([class("in") . options]),">",format_choices(cs,sd),"</select>"],
    
-       radio_button(options, label, id, n, v, c)         then  
+       radio_button(options, label, id, n, value, c)         then  
          [ format_label(label, id), 
-           "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",v,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />"],
-       radio_button_r(options, label, id, n, v, c)         then  
-         [ "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",v,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />",
+           "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",value,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />"],
+       radio_button_r(options, label, id, n, value, c)         then  
+         [ "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",value,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />",
            format_label(label, id)],
        check_box(options, label, id, n, c)              then 
          [ format_label(label, id), 
@@ -5823,9 +5879,9 @@ define Printable_tree
         format(cinfo,ic_v,any_div(options, e),format_element,is_https, action_count, head_tags),    
        div_empty(options)               then
         format(cinfo,ic_v,any_div_empty(options),format_element,is_https, action_count, head_tags),
-      hidden(_id, name, value)          then
+      hidden(_id, name, init)          then
         since _id is html_Id(id),
-         ["<input type=\"hidden\"",(if id = "" then "" else " id=\""+id+"\"")," name=\"",name,"\" value=\"",value,"\" />"],
+         ["<input type=\"hidden\"",(if id = "" then "" else " id=\""+id+"\"")," name=\"",name,"\" value=\"",encode_HTML_entities(init.value),"\" />"],
        partial(p_content)               then
         if p_content is partial_content(tags, html_elements) then
           head_tags <- *head_tags + tags;
--
libgit2 0.21.4