Index: openacs-4/packages/acs-automated-testing/www/admin/testcase.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-automated-testing/www/admin/testcase.tcl,v
diff -u -r1.10 -r1.11
--- openacs-4/packages/acs-automated-testing/www/admin/testcase.tcl	27 Oct 2014 16:39:03 -0000	1.10
+++ openacs-4/packages/acs-automated-testing/www/admin/testcase.tcl	22 Jun 2015 21:03:12 -0000	1.11
@@ -93,7 +93,7 @@
         # <component_id> element is a link.
         #
         regsub -all {aa_call_component\s+(["]?)([^\s]*)(["]?)} $body \
-            "aa_call_component <a href=\"${url}\\&component_id=\\2\">\\1\\2\\3</a>" body
+            "aa_call_component <a href='$url\\&component_id=\\2'>\\1\\2\\3</a>" body
         template::multirow append bodys $body_count $body
         incr body_count
     }
Index: openacs-4/packages/acs-bootstrap-installer/installer/index.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-bootstrap-installer/installer/index.tcl,v
diff -u -r1.29 -r1.30
--- openacs-4/packages/acs-bootstrap-installer/installer/index.tcl	27 Oct 2014 16:39:04 -0000	1.29
+++ openacs-4/packages/acs-bootstrap-installer/installer/index.tcl	22 Jun 2015 21:03:12 -0000	1.30
@@ -77,10 +77,10 @@
 "
 
     if { $acs_application(home) ne "" } {
-        append body "<p>
+        append body [subst {<p>
 For more information about the $acs_application(pretty_name) application visit the
-<a href=\"$acs_application(home)\">$acs_application(pretty_name) home page</a>
-"
+<a href="[ns_quotehtml $acs_application(home)]">$acs_application(pretty_name) home page</a>
+	}
     }
 } else {
     set acs_application(name) openacs
Index: openacs-4/packages/acs-developer-support/www/css-edit.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-developer-support/www/css-edit.tcl,v
diff -u -r1.3 -r1.4
--- openacs-4/packages/acs-developer-support/www/css-edit.tcl	27 Oct 2014 16:39:33 -0000	1.3
+++ openacs-4/packages/acs-developer-support/www/css-edit.tcl	22 Jun 2015 21:03:12 -0000	1.4
@@ -28,8 +28,8 @@
     } -on_request {
 
 	set package_id [ad_conn package_id]
-	set css_path "<a href='$css_location'>$css_location</a>"
-	set fp [open "$file_location" "r"]
+	set css_path "<a href='[ns_quotehtml $css_location]'>$css_location</a>"
+	set fp [open $file_location "r"]
 	set css_content ""
 	while { [gets $fp line] >= 0 } {
 	    append css_content "$line \n"
@@ -40,12 +40,15 @@
 	set revision_html ""
 	if {$item_id ne ""} {
 	    append revision_html "<ol>"
-	    db_foreach revision {select revision_id, publish_date, description from cr_revisions where item_id = :item_id order by publish_date desc} {
+	    db_foreach revision {select revision_id, publish_date, description
+		from cr_revisions where item_id = :item_id order by publish_date desc
+	    } {
 		if { [content::revision::is_live -revision_id $revision_id] == "t" } {
 		    set make_live "<strong>that's live!</strong>"
 		} else {
 		    set return_url_2 [ad_return_url]
-		    set make_live "<a href=\"[export_vars -base "css-make-live" -url {revision_id return_url_2 file_location}]\">make live!</a>"
+		    set href [export_vars -base css-make-live -url {revision_id return_url_2 file_location}]
+		    set make_live [subst {<a href="[ns_quotehtml $href]">make live!</a>]
 		}
 		set return_url ""
 		append revision_html "<li><a href='/o/$revision_id'>$publish_date</a> \[$make_live\]: [string range $description 0 50]</li>"
@@ -75,7 +78,11 @@
             set old_css_content [read $fp]
 	    close $fp
 
-	    set item_id [content::item::new -name $file_location -parent_id $package_id -title "$css_location" -description "First revision" -text $old_css_content]
+	    set item_id [content::item::new -name $file_location \
+			     -parent_id $package_id \
+			     -title "$css_location" \
+			     -description "First revision" \
+			     -text $old_css_content]
 	}
 
 	
@@ -94,4 +101,4 @@
     } -cancel_url $return_url
 } else {
     ad_returnredirect $return_url
-}
\ No newline at end of file
+}
Index: openacs-4/packages/acs-service-contract/www/binding-display.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-service-contract/www/binding-display.tcl,v
diff -u -r1.5 -r1.6
--- openacs-4/packages/acs-service-contract/www/binding-display.tcl	27 Oct 2014 16:39:44 -0000	1.5
+++ openacs-4/packages/acs-service-contract/www/binding-display.tcl	22 Jun 2015 21:03:12 -0000	1.6
@@ -52,7 +52,7 @@
         regsub {^::} $impl_alias {} impl_alias
         if {[info commands ::$impl_alias] ne ""} {
             append impl_alias "</b> {[info args ::$impl_alias]}"
-        } elseif {[llength $impl_alias]>1 
+        } elseif {[llength $impl_alias] > 1 
 		  && [info commands ::xotcl::Object] ne "" 
 		  && [::xotcl::Object isobject [lindex $impl_alias 0]]
 		  && [[lindex $impl_alias 0] info methods [lindex $impl_alias 1]] ne ""} {
@@ -62,7 +62,7 @@
 	    # - the second word is a method for the object, 
 	    # ... so provide a link to the XOTcl api browser
 	    set href "/xotcl/show-object?object=[lindex $impl_alias 0]&show_methods=2"
-	    append impl_alias "<a href='$href'>" \
+	    append impl_alias "<a href='[ns_quotehtml $href]'>" \
 		"<img border='0' src='/resources/acs-subsite/ZoomIn16.gif'></a>"
 	} else {
             append impl_alias {</b> - <b style="color: red">NOT FOUND!</b>}
Index: openacs-4/packages/acs-subsite/tcl/email-image-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/tcl/email-image-procs.tcl,v
diff -u -r1.12 -r1.13
--- openacs-4/packages/acs-subsite/tcl/email-image-procs.tcl	27 Oct 2014 16:39:45 -0000	1.12
+++ openacs-4/packages/acs-subsite/tcl/email-image-procs.tcl	22 Jun 2015 21:03:12 -0000	1.13
@@ -60,18 +60,18 @@
         # We use the privacy level that the user select
         set priv_level $user_level
     }
-    set send_email_url [ad_quotehtml "/shared/send-email?sendto=$user_id&return_url=$return_url"]
+    set send_email_url [ns_quotehtml "/shared/send-email?sendto=$user_id&return_url=$return_url"]
     switch $priv_level {
         "4" {
-            return "<a href=\"mailto:$email\" title=\"#acs-subsite.Send_email_to_this_user#\">$email</a>"
+            return [subsr {<a href="mailto:$email" title="#acs-subsite.Send_email_to_this_user#">$email</a>}]
         }
         "3" {
             set email_image_id [email_image::get_related_item_id -user_id $user_id]
             if { $email_image_id != "-1" } {
                 # The user has an email image stored in the content repository
                 set revision_id [content::item::get_latest_revision -item_id $email_image_id]
-                set img_src [ad_quotehtml "/shared/email-image-bits.tcl?user_id=$user_id&revision_id=$revision_id"]
-                set email_image "<a href=\"$send_email_url\"><img style=\"border:0\" src=\"$img_src\" alt=\"#acs-subsite.Email#\"></a>"
+                set img_src [ns_quotehtml "/shared/email-image-bits.tcl?user_id=$user_id&revision_id=$revision_id"]
+		return [subst {<a href="$send_email_url"><img style="border:0" src="$img_src" alt="#acs-subsite.Email#"></a>}]
             } else {
                 # Create a new email_image
                 if { [catch { set email_image [email_image::new_item -user_id $user_id -return_url $return_url -bgcolor $bgcolor -transparent $transparent] } errmsg ] } {
@@ -80,13 +80,13 @@
                     # an image replacing the "@" symbol
                     set email_user [lindex [split $email '@'] 0]
                     set email_domain [lindex [split $email '@'] 1]
-                    set email_image "<a href=\"$send_email_url\">${email_user}<img style=\"border:0\" src=\"/shared/images/at.gif\" alt=\"@\">${email_domain}</a>"
+                    set email_image [subst {<a href="$send_email_url">$email_user<img style="border:0" src="/shared/images/at.gif" alt="@">$email_domain</a>}]
                 }
             }
             return $email_image
         }
         "2" {
-            return "<a href=\"$send_email_url\">\#acs-subsite.Send_email_to_this_user\#</a>"
+            return [subst {<a href="$send_email_url">#acs-subsite.Send_email_to_this_user#</a>}]
         }
         "1" { 
             #Do not show e-mail
@@ -183,7 +183,7 @@
     
     set img_src [ad_quotehtml "/shared/email-image-bits.tcl?user_id=$user_id&revision_id=$revision_id"]
     set send_email_url [ad_quotehtml "/shared/send-email?sendto=$user_id&return_url=$return_url"]
-    set email_image "<a href=\"$send_email_url\"><img style=\"border:0\" src=\"$img_src\" alt=\"#acs-subsite.Email#\"></a>"
+    set email_image [subst {<a href="$send_email_url"><img style="border:0" src="$img_src" alt="#acs-subsite.Email#"></a>}
 
     return "$email_image"
 }
Index: openacs-4/packages/acs-subsite/www/register/user-join.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/register/user-join.tcl,v
diff -u -r1.13 -r1.14
--- openacs-4/packages/acs-subsite/www/register/user-join.tcl	27 Oct 2014 16:40:01 -0000	1.13
+++ openacs-4/packages/acs-subsite/www/register/user-join.tcl	22 Jun 2015 21:03:13 -0000	1.14
@@ -34,8 +34,8 @@
 set join_policy $group_info(join_policy)
 
 
-if { ([info exists return_url] && $return_url ne "") } {
-    set ret_link "<a href=\"$return_url\">Return to previous page.</a>"
+if { $return_url ne "" } {
+    set ret_link [subst {<a href="[ns_quotehtml $return_url]">Return to previous page.</a>}]
 } else {
     set ret_link ""
 }
Index: openacs-4/packages/acs-tcl/tcl/table-display-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/Attic/table-display-procs.tcl,v
diff -u -r1.22 -r1.23
--- openacs-4/packages/acs-tcl/tcl/table-display-procs.tcl	12 Jun 2015 21:01:56 -0000	1.22
+++ openacs-4/packages/acs-tcl/tcl/table-display-procs.tcl	22 Jun 2015 21:03:13 -0000	1.23
@@ -72,7 +72,7 @@
     append html "<tr>\n"
 
     foreach option $option_list { 
-        append html " <td align=\"center\">\["
+        append html " <td align='center'>\["
 
         # find out what the current option value is.
         # check if a default is set otherwise the first value is used
@@ -97,7 +97,8 @@
             if {$option_val eq $thisoption } {
                 append html "<strong>[ns_quotehtml [lindex $option_value 1]]</strong>"
             } else {
-                append html "<a href=\"[ns_quotehtml $url?[export_ns_set_vars "url" $option_key $options_set]&[ns_urlencode $option_key]=[ns_urlencode $thisoption]]\">[ns_quotehtml [lindex $option_value 1]]</a>"
+		set href $url?[export_ns_set_vars url $option_key $options_set]&[ns_urlencode $option_key]=[ns_urlencode $thisoption]
+                append html [subst {<a href="[ns_quotehtml $href]">[ns_quotehtml [lindex $option_value 1]]</a>}]
             }
         }
         append html "\]</td>\n"
@@ -362,8 +363,10 @@
 		} else {
 		    set Tasord {}
 		}
-		append Theader " <th><a href=\"$Tsort_url[ns_urlencode [ad_new_sort_by [lindex $Tcol 0] $Torderby]]\">\n"
-		append Theader "[lindex $Tcol 1]</a>&nbsp;$Tasord</th>\n"
+		set href $Tsort_url[ns_urlencode [ad_new_sort_by [lindex $Tcol 0] $Torderby]]
+		append Theader \
+		    [subst { <th><a href="[ns_urlencode $href]">}] \
+		    "\n[lindex $Tcol 1]</a>&nbsp;$Tasord</th>\n"
 	    }
 	}
 	append Theader "</tr>\n"
@@ -887,7 +890,8 @@
         set form [ns_getform]
     }
     set url_vars [export_ns_set_vars url $variable $form]
-    return "<a href=\"[ad_conn url]?$variable=[ns_urlencode $value]$url_vars\">$text</a>"
+    set href "[ad_conn url]?$variable=[ns_urlencode $value]$url_vars"
+    return [subst {<a href="[ns_quotehtml $href]">[ns_quotehtml $text]</a>}]
 }
 
 ad_proc ad_reverse order { 
@@ -935,15 +939,15 @@
     }]
     
     set break {}
-    foreach item $items { 
+    foreach item $items {
         if {$item_set eq $item } {
-            append html "$break<strong>$item</strong>&nbsp;(<a href=\"$custom_url$item\">edit</a>)"
+            append html "$break<strong>$item</strong>&nbsp;(<a href=\"[ns_quotehtml $custom_url$item]\">edit</a>)"
         } else { 
-            append html "$break<a href=\"$target_url$item\">$item</a>"
+            append html "$break<a href=\"[ns_quotehtml $target_url$item]\">$item</a>"
         }
         set break " | "
     }
-    append html "$break (<a href=\"${custom_url}CreateNewCustom\">$new_string</a>)\n"
+    append html "$break (<a href=\"[ns_quotehtml ${custom_url}CreateNewCustom]\">$new_string</a>)\n"
     
     return $html
 }
Index: openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl,v
diff -u -r1.138 -r1.139
--- openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl	15 Jun 2015 13:03:32 -0000	1.138
+++ openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl	22 Jun 2015 21:03:13 -0000	1.139
@@ -1181,7 +1181,7 @@
                 if {$format eq "url"} {
                     lappend return_list "[ns_urlencode $name]=[ns_urlencode $value]"
                 } else {
-                    lappend return_list " name=\"[ad_quotehtml $name]\" value=\"[ad_quotehtml $value]\""
+                    lappend return_list " name=\"[ns_quotehtml $name]\" value=\"[ns_quotehtml $value]\""
                 }
             }
             incr set_counter_i
@@ -1190,7 +1190,7 @@
     if {$format eq "url"} {
         return [join $return_list "&"]
     } else {
-        return "<div><input type=\"hidden\" [join $return_list " ></div>\n <div><input type=\"hidden\" "] ></div>"
+        return "<div><input type='hidden' [join $return_list " ></div>\n <div><input type='hidden' "] ></div>"
     }
 }
 
@@ -2228,17 +2228,17 @@
     Meta Refresh page instead of a redirect.                                                                                                                   
     
 } {
-    ad_return_top_of_page "
+    ad_return_top_of_page [subst {
     <head>
-    <meta http-equiv=\"refresh\" content=\"$seconds_delay;URL=$url\">
-    <script type=\"text/javascript\">
-    window.location.href=\"$url\";
+    <meta http-equiv="refresh" content="$seconds_delay;URL=[ns_quotehtml $url]">
+    <script type="text/javascript">
+    window.location.href = "[ns_quotehtml $url]";
     </script>
     </head>
     <body>
     <h2>Loading...</h2>
-    If your browser does not automatically redirect you, <a href=\"$url\">please click here</a>.
-    </body>"
+    If your browser does not automatically redirect you, <a href="[ns_quotethml $url]">please click here</a>.
+    </body>}]
 }
 
 # Brad Duell (bduell@ncacasi.org) 07/10/2003
Index: openacs-4/packages/acs-templating/tcl/acs-integration-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/acs-integration-procs.tcl,v
diff -u -r1.21 -r1.22
--- openacs-4/packages/acs-templating/tcl/acs-integration-procs.tcl	27 Oct 2014 16:40:10 -0000	1.21
+++ openacs-4/packages/acs-templating/tcl/acs-integration-procs.tcl	22 Jun 2015 21:03:13 -0000	1.22
@@ -141,16 +141,16 @@
                     { locale {[ad_conn locale]} } package_key message_key { return_url [ad_return_url] } }]
 
                 if { [lang::message::message_exists_p [ad_conn locale] $key] } {
-                    set edit_link "<a href=\"$edit_url\" title=\"$key\" style=\"color: green;\"><b>o</b></a>"
+                    set edit_link [subst {<a href="[ns_quotehtml $edit_url]" title="$key" style="color: green;"><b>o</b></a>}]
                 } else {
                     if { [lang::message::message_exists_p "en_US" $key] } {
                         # Translation missing in this locale
-                        set edit_link "<a href=\"$edit_url\" title=\"$key\" style=\"background-color: yellow; color: red;\"><b>*</b></a>"
+                        set edit_link [subst {<a href="[ns_quotehtml $edit_url]" title="$key" style="background-color: yellow; color: red;"><b>*</b></a>}]
                     } else {
                         # Message key missing entirely
                         set new_url [export_vars -base "${apm_package_url}admin/localized-message-new" { 
                             { locale en_US } package_key message_key { return_url [ad_return_url] } }]
-                        set edit_link "<a href=\"$new_url\" title=\"$key\" style=\"background-color: red; color: white;\"><b>@</b></a>"
+                        set edit_link [subst {<a href="[ns_quotehtml $new_url]" title="$key" style="background-color: red; color: white;"><b>@</b></a>"
                     }
                 }
 
Index: openacs-4/packages/acs-templating/tcl/list-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/list-procs.tcl,v
diff -u -r1.59 -r1.60
--- openacs-4/packages/acs-templating/tcl/list-procs.tcl	27 Apr 2015 15:28:18 -0000	1.59
+++ openacs-4/packages/acs-templating/tcl/list-procs.tcl	22 Jun 2015 21:03:13 -0000	1.60
@@ -2219,22 +2219,22 @@
     set link_url {}
     set link_html {}
 
-    if { ([info exists element_properties(link_url_col)] && $element_properties(link_url_col) ne "") } {
+    if { [info exists element_properties(link_url_col)] && $element_properties(link_url_col) ne "" } {
         set link_url "@$multirow.$element_properties(link_url_col)@"
-    } elseif { ([info exists element_properties(link_url)] && $element_properties(link_url) ne "") } {
+    } elseif { [info exists element_properties(link_url)] && $element_properties(link_url) ne "" } {
         set link_url $element_properties(link_url)
     }
     
-    if { ([info exists element_properties(link_html_col)] && $element_properties(link_html_col) ne "") } {
+    if { [info exists element_properties(link_html_col)] && $element_properties(link_html_col) ne "" } {
         set link_html "@$multirow.$element_properties(link_html_col)@"
-    } elseif { ([info exists element_properties(link_html)] && $element_properties(link_html) ne "") } {
+    } elseif { [info exists element_properties(link_html)] && $element_properties(link_html) ne "" } {
         set link_html $element_properties(link_html)
     }
     
     if { $link_url ne "" } {
         set old_output $output
 
-        set output "<if \"$link_url\" not nil><a href=\"$link_url\"[template::list::util_html_to_attributes_string $link_html]>$old_output</a></if><else>$old_output</else>"
+        set output [subst {<if "$link_url" not nil><a href="$link_url"[template::list::util_html_to_attributes_string $link_html]>$old_output</a></if><else>$old_output</else>}]
     }
 
     return $output
Index: openacs-4/packages/acs-templating/tcl/paginator-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/paginator-procs.tcl,v
diff -u -r1.21 -r1.22
--- openacs-4/packages/acs-templating/tcl/paginator-procs.tcl	27 Apr 2015 15:28:18 -0000	1.21
+++ openacs-4/packages/acs-templating/tcl/paginator-procs.tcl	22 Jun 2015 21:03:13 -0000	1.22
@@ -117,12 +117,13 @@
     # recommended. Unfortunately, several places in OpenACS have this
     # problem.
     #
-    if { ($row_ids eq {} && ![::cache exists $cache_key]) || ([info exists opts(flush_p)] && $opts(flush_p) == "t") } {
+    if { ($row_ids eq {} && ![::cache exists $cache_key])
+	 || ([info exists opts(flush_p)] && $opts(flush_p) == "t") } {
       if { [info exists opts(printing_prefs)] && $opts(printing_prefs) ne "" } {
 	  set title [lindex $opts(printing_prefs) 0]
 	  set stylesheet [lindex $opts(printing_prefs) 1]
 	  if { $stylesheet ne "" } {
-	      set css_link "<link rel=\"stylesheet\" href=\"$stylesheet\" type=\"text/css\">"
+	      set css_link [subst {<link rel="stylesheet" href="[ns_quotehtml $stylesheet]" type="text/css">}]
 	  } else {
 	      set css_link ""
 	  }
@@ -159,15 +160,14 @@
 	      #if { [llength $opts(row_ids)]==0 } {
 	      #	  nsv_set __template_cache_timeout $cache_key $opts(timeout)
 	      #}
-	      ns_write "
-          <SCRIPT type=\"text/javascript\">
+	      ns_write [subst {
+          <script type="text/javascript">
           <!-- Begin
-          document.location.href=\"$return_url\";
+	  document.location.href="[ns_quotehtml $return_url]";
           // End -->
           </script>
-          <noscript>
-          <a href=\"$return_url\">Click here to Continue</a>
-          </noscript>"
+	  <noscript><a href="[ns_quotehtml $return_url]">Click here to continue.</a></noscript>
+	      }]
 	  }
 	  ad_script_abort
       } else {
Index: openacs-4/packages/acs-templating/tcl/richtext-or-file-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/richtext-or-file-procs.tcl,v
diff -u -r1.6 -r1.7
--- openacs-4/packages/acs-templating/tcl/richtext-or-file-procs.tcl	27 Oct 2014 16:40:12 -0000	1.6
+++ openacs-4/packages/acs-templating/tcl/richtext-or-file-procs.tcl	22 Jun 2015 21:03:13 -0000	1.7
@@ -238,7 +238,7 @@
                     return [ad_html_text_convert -from $mime_type -to "text/html" -- $text]
                 }
                 file {
-                    return "<a href=\"$content_url\">Download file</a>"
+                    return "<a href=\"[ns_quotehtml $content_url]\">Download file</a>"
                 }
             }
             return {}
Index: openacs-4/packages/acs-templating/tcl/tab-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/tab-procs.tcl,v
diff -u -r1.6 -r1.7
--- openacs-4/packages/acs-templating/tcl/tab-procs.tcl	27 Oct 2014 16:40:12 -0000	1.6
+++ openacs-4/packages/acs-templating/tcl/tab-procs.tcl	22 Jun 2015 21:03:13 -0000	1.7
@@ -41,7 +41,7 @@
     }
 
     set id $element(form_id)
-    set output "<a href=\"${url}${joiner}${id}_tab=$element(name)\">"
+    set output "<a href=\"[ns_quotehtml ${url}${joiner}${id}_tab=$element(name)]\">"
     append output "$element(label)</a>"
   } else {  
     append output "<b>$element(label)</b>"
Index: openacs-4/packages/acs-templating/tcl/table-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/table-procs.tcl,v
diff -u -r1.8 -r1.9
--- openacs-4/packages/acs-templating/tcl/table-procs.tcl	27 Oct 2014 16:40:12 -0000	1.8
+++ openacs-4/packages/acs-templating/tcl/table-procs.tcl	22 Jun 2015 21:03:13 -0000	1.9
@@ -223,7 +223,7 @@
         set row(html) "<b>$label</b>"
         set row(selected) "t"
       } else {
-        set row(html)    "<a href=\"${url}${the_joiner}tablewidget:${name}_orderby\=$row(name)\">"
+	set row(html)    "<a href=\"[ns_quotehtml ${url}${the_joiner}tablewidget:${name}_orderby\=$row(name)]\">"
         append row(html) "$label</a>"
         set row(selected) "f"
       }