diff --git a/config/alfresco/templates/client/node_summary_panel.ftl b/config/alfresco/templates/client/node_summary_panel.ftl
index 84d49d97e5..05f6704196 100644
--- a/config/alfresco/templates/client/node_summary_panel.ftl
+++ b/config/alfresco/templates/client/node_summary_panel.ftl
@@ -64,7 +64,7 @@
 	               <tr><td>&nbsp;Owner:</td><td>${node.properties.owner}</td></tr>
 	            </#if>
 	            <#if node.properties.author?exists>
-	               <tr><td>&nbsp;Author:</td><td>${node.properties.author}</td></tr>
+	               <tr><td>&nbsp;Author:</td><td>${node.properties.author?html}</td></tr>
 	            </#if>
 	            <#if node.isDocument>
 	               <tr><td>&nbsp;Size:</td><td>${(node.size / 1000)?string("0.##")} KB</td></tr>
diff --git a/config/alfresco/templates/client/portlet_node_summary_panel.ftl b/config/alfresco/templates/client/portlet_node_summary_panel.ftl
index 7297635258..86d6d46329 100644
--- a/config/alfresco/templates/client/portlet_node_summary_panel.ftl
+++ b/config/alfresco/templates/client/portlet_node_summary_panel.ftl
@@ -62,7 +62,7 @@
 	               <tr><td>&nbsp;Owner:</td><td>${node.properties.owner}</td></tr>
 	            </#if>
 	            <#if node.properties.author?exists>
-	               <tr><td>&nbsp;Author:</td><td>${node.properties.author}</td></tr>
+	               <tr><td>&nbsp;Author:</td><td>${node.properties.author?html}</td></tr>
 	            </#if>
 	            <#if node.isDocument>
 	               <tr><td>&nbsp;Size:</td><td>${(node.size / 1000)?string("0.##")} KB</td></tr>
diff --git a/config/alfresco/templates/client/task_summary_panel.ftl b/config/alfresco/templates/client/task_summary_panel.ftl
index 86864129a2..573ed2c276 100644
--- a/config/alfresco/templates/client/task_summary_panel.ftl
+++ b/config/alfresco/templates/client/task_summary_panel.ftl
@@ -4,7 +4,7 @@
 	      <td colspan='2' class='mainSubTitle'>
 	         <table cellspacing='0' cellpadding='0' width='100%' style='cursor:move' id='dragable'>
 	            <tr>
-	               <td class='mainSubTitle'>${task.description}</td>
+	               <td class='mainSubTitle'>${task.description?html}</td>
 	               <td width=14 align=right><img src='${url.context}/images/icons/close_panel.gif' onclick="TaskInfoMgr.close('${task.id}');" style='cursor:pointer' width=14 height=14 border=0 title="Close" alt="Close"></td>
 	            </tr>
 	         </table>
diff --git a/source/java/org/alfresco/web/bean/actions/RunActionWizard.java b/source/java/org/alfresco/web/bean/actions/RunActionWizard.java
index b62cea5942..0ec2fa9253 100644
--- a/source/java/org/alfresco/web/bean/actions/RunActionWizard.java
+++ b/source/java/org/alfresco/web/bean/actions/RunActionWizard.java
@@ -43,6 +43,7 @@ import org.alfresco.web.bean.repository.Node;
 import org.alfresco.web.bean.repository.Repository;
 import org.alfresco.web.data.IDataContainer;
 import org.alfresco.web.data.QuickSort;
+import org.alfresco.web.ui.common.Utils;
 
 /**
  * Bean implementation for the "Run Action" wizard.
@@ -176,8 +177,8 @@ public class RunActionWizard extends BaseActionWizard
       StringBuilder actionsSummary = new StringBuilder();
       for (Map<String, Serializable> props : this.allActionsProperties)
       {
-         actionsSummary.append(props.get(PROP_ACTION_SUMMARY));
-         actionsSummary.append("<br/>");
+         actionsSummary.append(Utils.encode(props.get(PROP_ACTION_SUMMARY).toString()));
+         actionsSummary.append("<br>");
       }
       
       ResourceBundle bundle = Application.getBundle(FacesContext.getCurrentInstance());
diff --git a/source/java/org/alfresco/web/bean/forums/ForumsBean.java b/source/java/org/alfresco/web/bean/forums/ForumsBean.java
index 3d3f29b51c..521d3a55df 100644
--- a/source/java/org/alfresco/web/bean/forums/ForumsBean.java
+++ b/source/java/org/alfresco/web/bean/forums/ForumsBean.java
@@ -932,7 +932,7 @@ public class ForumsBean implements IContextListener
             ContentModel.PROP_CONTENT);  
       if (reader != null)
       {
-         replyContent = reader.getContentString();
+         replyContent = Utils.stripUnsafeHTMLTags(reader.getContentString());
       }
       
       // get the date of the article being replied to
diff --git a/source/java/org/alfresco/web/bean/rules/CreateRuleWizard.java b/source/java/org/alfresco/web/bean/rules/CreateRuleWizard.java
index 3a120d1b13..aea6d45782 100644
--- a/source/java/org/alfresco/web/bean/rules/CreateRuleWizard.java
+++ b/source/java/org/alfresco/web/bean/rules/CreateRuleWizard.java
@@ -203,7 +203,7 @@ public class CreateRuleWizard extends BaseActionWizard
       for (Map<String, Serializable> props : this.allConditionsProperties)
       {
          conditionsSummary.append(props.get(PROP_CONDITION_SUMMARY));
-         conditionsSummary.append("<br/>");
+         conditionsSummary.append("<br>");
       }
       
       // create the summary using all the actions
@@ -211,7 +211,7 @@ public class CreateRuleWizard extends BaseActionWizard
       for (Map<String, Serializable> props : this.allActionsProperties)
       {
          actionsSummary.append(props.get(PROP_ACTION_SUMMARY));
-         actionsSummary.append("<br/>");
+         actionsSummary.append("<br>");
       }
       
       ResourceBundle bundle = Application.getBundle(FacesContext.getCurrentInstance());
@@ -224,7 +224,8 @@ public class CreateRuleWizard extends BaseActionWizard
             new String[] {bundle.getString("rule_type"), bundle.getString("name"), bundle.getString("description"),
                           bundle.getString("apply_to_sub_spaces"), bundle.getString("run_in_background"), bundle.getString("rule_disabled"),
                           bundle.getString("conditions"), bundle.getString("actions")},
-            new String[] {this.type, this.title, this.description, subSpacesYesNo, backgroundYesNo, ruleDisabledYesNo,
+            new String[] {this.type, Utils.encode(this.title), Utils.encode(this.description),
+                          subSpacesYesNo, backgroundYesNo, ruleDisabledYesNo,
                           conditionsSummary.toString(), actionsSummary.toString()});
    }
    
diff --git a/source/java/org/alfresco/web/bean/spaces/CreateSpaceWizard.java b/source/java/org/alfresco/web/bean/spaces/CreateSpaceWizard.java
index 96177775c3..8087b21fea 100644
--- a/source/java/org/alfresco/web/bean/spaces/CreateSpaceWizard.java
+++ b/source/java/org/alfresco/web/bean/spaces/CreateSpaceWizard.java
@@ -472,7 +472,7 @@ public class CreateSpaceWizard extends BaseWizardBean
       return buildSummary(
             new String[] {bundle.getString("space_type"), bundle.getString("name"),
                           bundle.getString("description"), bundle.getString("creating_from")},
-            new String[] {spaceTypeLabel, this.name, this.description, summaryCreateType});
+            new String[] {spaceTypeLabel, this.name, Utils.encode(this.description), summaryCreateType});
    }
 
    /**
diff --git a/source/java/org/alfresco/web/bean/users/UsersBeanProperties.java b/source/java/org/alfresco/web/bean/users/UsersBeanProperties.java
index 8594f71bb5..4852967083 100644
--- a/source/java/org/alfresco/web/bean/users/UsersBeanProperties.java
+++ b/source/java/org/alfresco/web/bean/users/UsersBeanProperties.java
@@ -51,15 +51,13 @@ public class UsersBeanProperties
     /** action context */
     private Node person = null;
     
-   
-    
     private String password = null;
     private String oldPassword = null;
     private String confirm = null;
     private String searchCriteria = null;
     
     
- // ------------------------------------------------------------------------------
+    // ------------------------------------------------------------------------------
     // Bean property getters and setters
 
     /**
@@ -142,8 +140,6 @@ public class UsersBeanProperties
        this.usersRichList = usersRichList;
     }
 
- 
-    
     /**
      * @return Returns the search criteria
      */
@@ -223,6 +219,4 @@ public class UsersBeanProperties
     {
        this.person = person;
     }
-
-    
 }
diff --git a/source/java/org/alfresco/web/bean/users/UsersDialog.java b/source/java/org/alfresco/web/bean/users/UsersDialog.java
index 4001480f88..c5e0ecc74a 100644
--- a/source/java/org/alfresco/web/bean/users/UsersDialog.java
+++ b/source/java/org/alfresco/web/bean/users/UsersDialog.java
@@ -201,8 +201,12 @@ public class UsersDialog extends BaseDialogBean implements IContextListener
       String outcome = DIALOG_CLOSE;
       
       FacesContext context = FacesContext.getCurrentInstance();
+      UserTransaction tx = null;
       try
       {
+         tx = Repository.getUserTransaction(context, true);
+         tx.begin();
+
          Map<QName, Serializable> props = properties.getNodeService().getProperties(properties.getPerson().getNodeRef());
          props.put(ContentModel.PROP_FIRSTNAME,
                (String) properties.getPerson().getProperties().get(ContentModel.PROP_FIRSTNAME));
@@ -214,6 +218,8 @@ public class UsersDialog extends BaseDialogBean implements IContextListener
          // persist changes
          properties.getNodeService().setProperties(properties.getPerson().getNodeRef(), props);
          
+         tx.commit();
+         
          // if the above call was successful, then reset Person Node in the session
          Application.getCurrentUser(context).reset();
       }
@@ -221,6 +227,7 @@ public class UsersDialog extends BaseDialogBean implements IContextListener
       {
          Utils.addErrorMessage(MessageFormat.format(Application.getMessage(
                context, Repository.ERROR_GENERIC), err.getMessage()), err );
+         try { if (tx != null) {tx.rollback();} } catch (Exception tex) {}
       }
       
       return outcome;
diff --git a/source/java/org/alfresco/web/bean/wcm/CreateWebsiteWizard.java b/source/java/org/alfresco/web/bean/wcm/CreateWebsiteWizard.java
index d740b1c3b1..d7f1f03807 100644
--- a/source/java/org/alfresco/web/bean/wcm/CreateWebsiteWizard.java
+++ b/source/java/org/alfresco/web/bean/wcm/CreateWebsiteWizard.java
@@ -71,6 +71,7 @@ import org.alfresco.web.forms.Form;
 import org.alfresco.web.forms.FormNotFoundException;
 import org.alfresco.web.forms.FormsService;
 import org.alfresco.web.forms.RenderingEngineTemplate;
+import org.alfresco.web.ui.common.Utils;
 import org.alfresco.web.ui.common.component.UIListItem;
 import org.alfresco.web.ui.common.component.UISelectList;
 import org.alfresco.web.ui.wcm.WebResources;
@@ -935,7 +936,7 @@ public class CreateWebsiteWizard extends BaseWizardBean
          {
             foundCurrentUser = true;
          }
-         buf.append(userRole.getLabel());
+         buf.append(Utils.encode(userRole.getLabel()));
          buf.append("<br>");
       }
       if (foundCurrentUser == false)
diff --git a/source/java/org/alfresco/web/bean/wcm/InviteWebsiteUsersWizard.java b/source/java/org/alfresco/web/bean/wcm/InviteWebsiteUsersWizard.java
index d91a29128b..e6abd59786 100644
--- a/source/java/org/alfresco/web/bean/wcm/InviteWebsiteUsersWizard.java
+++ b/source/java/org/alfresco/web/bean/wcm/InviteWebsiteUsersWizard.java
@@ -45,6 +45,7 @@ import org.alfresco.service.namespace.RegexQNamePattern;
 import org.alfresco.web.app.Application;
 import org.alfresco.web.bean.repository.Node;
 import org.alfresco.web.bean.wizard.InviteUsersWizard;
+import org.alfresco.web.ui.common.Utils;
 
 /**
  * Bean providing the ability to invite users to a web project space.
@@ -313,7 +314,7 @@ public class InviteWebsiteUsersWizard extends InviteUsersWizard
          {
             foundCurrentUser = true;
          }
-         buf.append(userRole.getLabel());
+         buf.append(Utils.encode(userRole.getLabel()));
          buf.append("<br>");
       }
       if (isStandalone() == false && foundCurrentUser == false)
diff --git a/source/java/org/alfresco/web/bean/wizard/AbstractWizardBean.java b/source/java/org/alfresco/web/bean/wizard/AbstractWizardBean.java
index 73b50af2bc..c2fb8846b6 100644
--- a/source/java/org/alfresco/web/bean/wizard/AbstractWizardBean.java
+++ b/source/java/org/alfresco/web/bean/wizard/AbstractWizardBean.java
@@ -34,6 +34,7 @@ import org.alfresco.web.app.Application;
 import org.alfresco.web.app.context.UIContextService;
 import org.alfresco.web.bean.BrowseBean;
 import org.alfresco.web.bean.NavigationBean;
+import org.alfresco.web.ui.common.Utils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
@@ -322,7 +323,7 @@ public abstract class AbstractWizardBean
          buf.append("<tr><td valign='top'><b>");
          buf.append(labels[i]);
          buf.append(":</b></td><td>");
-         buf.append(value != null ? value : notSetMsg);
+         buf.append(value != null ? Utils.encode(value) : notSetMsg);
          buf.append("</td></tr>");
       }
       buf.append("</table>");
diff --git a/source/java/org/alfresco/web/bean/wizard/InviteUsersWizard.java b/source/java/org/alfresco/web/bean/wizard/InviteUsersWizard.java
index dcfeaced31..ba1a7df855 100644
--- a/source/java/org/alfresco/web/bean/wizard/InviteUsersWizard.java
+++ b/source/java/org/alfresco/web/bean/wizard/InviteUsersWizard.java
@@ -592,7 +592,7 @@ public abstract class InviteUsersWizard extends BaseWizardBean
       StringBuilder buf = new StringBuilder(128);
       for (UserGroupRole userRole : this.userGroupRoles)
       {
-         buf.append(userRole.getLabel());
+         buf.append(Utils.encode(userRole.getLabel()));
          buf.append("<br>");
       }
       
diff --git a/source/java/org/alfresco/web/ui/common/Utils.java b/source/java/org/alfresco/web/ui/common/Utils.java
index 09ebdc1f69..23e65b7f3a 100644
--- a/source/java/org/alfresco/web/ui/common/Utils.java
+++ b/source/java/org/alfresco/web/ui/common/Utils.java
@@ -896,16 +896,12 @@ public final class Utils
     * 
     * @return Populated <code>img</code> tag
     */
-   public static String buildImageTag(final FacesContext context, 
-                                      final String image, 
-                                      final int width, 
-                                      final int height,
-                                      String alt, 
-                                      final String onclick, 
-                                      final String verticalAlign)
+   public static String buildImageTag(FacesContext context, String image, int width, int height,
+                                      String alt, String onclick, String verticalAlign)
    {
       StringBuilder buf = new StringBuilder(200);
-      StringBuilder style = new StringBuilder("border-width:0px;");
+      
+      String style = "border-width:0px;";
       buf.append("<img src='")
          .append(context.getExternalContext().getRequestContextPath())
          .append(image)
@@ -931,15 +927,20 @@ public final class Utils
 
       if (verticalAlign != null)
       {
-         style.append("vertical-align:").append(verticalAlign).append(";");
+         StringBuilder styleBuf = new StringBuilder(40);
+         styleBuf.append(style).append("vertical-align:").append(verticalAlign).append(";");
+         style = styleBuf.toString();
       }
       
       if (onclick != null)
       {
          buf.append(" onclick=\"").append(onclick).append('"');
-         style.append("cursor:pointer;");
+         StringBuilder styleBuf = new StringBuilder(style.length() + 16);
+         styleBuf.append(style).append("cursor:pointer;");
+         style = styleBuf.toString();
       }
       buf.append(" style='").append(style).append("'/>");
+      
       return buf.toString();
    }
    
@@ -986,18 +987,15 @@ public final class Utils
     * 
     * @return Populated <code>img</code> tag
     */
-   public static String buildImageTag(final FacesContext context, 
-                                      final String image, 
-                                      String alt, 
-                                      final String verticalAlign)
+   public static String buildImageTag(FacesContext context, String image, String alt, String verticalAlign)
    {
-      final StringBuilder buf = new StringBuilder(128);
+      StringBuilder buf = new StringBuilder(128);
       buf.append("<img src='")
          .append(context.getExternalContext().getRequestContextPath())
          .append(image)
          .append("' ");
 
-      final StringBuilder style = new StringBuilder("border-width:0px;");
+      String style = "border-width:0px;";
       if (alt != null)
       {
          alt = Utils.encode(alt);
@@ -1014,7 +1012,9 @@ public final class Utils
 
       if (verticalAlign != null)
       {
-         style.append("vertical-align:").append(verticalAlign).append(";");
+         StringBuilder styleBuf = new StringBuilder(40);
+         styleBuf.append(style).append("vertical-align:").append(verticalAlign).append(";");
+         style = styleBuf.toString();
       }
       
       buf.append(" style='").append(style).append("'/>");
diff --git a/source/java/org/alfresco/web/ui/common/component/UIGenericPicker.java b/source/java/org/alfresco/web/ui/common/component/UIGenericPicker.java
index d67eb2cc80..b764e3dca6 100644
--- a/source/java/org/alfresco/web/ui/common/component/UIGenericPicker.java
+++ b/source/java/org/alfresco/web/ui/common/component/UIGenericPicker.java
@@ -383,7 +383,7 @@ public class UIGenericPicker extends UICommand
             out.write("<option value=\"");
             out.write(currentResults[i].getValue().toString());
             out.write("\">");
-            out.write(currentResults[i].getLabel());
+            out.write(Utils.encode(currentResults[i].getLabel()));
             out.write("</option>");
          }
       }
diff --git a/source/java/org/alfresco/web/ui/repo/component/UINodeWorkflowInfo.java b/source/java/org/alfresco/web/ui/repo/component/UINodeWorkflowInfo.java
index 613c07289a..b40bf14809 100644
--- a/source/java/org/alfresco/web/ui/repo/component/UINodeWorkflowInfo.java
+++ b/source/java/org/alfresco/web/ui/repo/component/UINodeWorkflowInfo.java
@@ -47,6 +47,7 @@ import org.alfresco.web.app.Application;
 import org.alfresco.web.bean.repository.Node;
 import org.alfresco.web.bean.repository.Repository;
 import org.alfresco.web.bean.repository.User;
+import org.alfresco.web.ui.common.Utils;
 import org.alfresco.web.ui.common.component.SelfRenderingComponent;
 
 /**
@@ -243,7 +244,7 @@ public class UINodeWorkflowInfo extends SelfRenderingComponent
          {
             actionPattern = Application.getMessage(FacesContext.getCurrentInstance(), "space_action");
          }
-         Object[] params = new Object[] {action, approveFolderName, approveStepName};
+         Object[] params = new Object[] {action, approveFolderName, Utils.encode(approveStepName)};
          out.write(MessageFormat.format(actionPattern, params));
          
          // add details of the reject step if there is one
@@ -259,7 +260,7 @@ public class UINodeWorkflowInfo extends SelfRenderingComponent
             }
             
             out.write("&nbsp;");
-            params = new Object[] {action, rejectFolderName, rejectStepName};
+            params = new Object[] {action, rejectFolderName, Utils.encode(rejectStepName)};
             out.write(MessageFormat.format(actionPattern, params));
          }
       }
@@ -334,7 +335,7 @@ public class UINodeWorkflowInfo extends SelfRenderingComponent
                if (wi.description != null && wi.description.length() > 0)
                {
                   out.write("&nbsp;(");
-                  out.write(wi.description);
+                  out.write(Utils.encode(wi.description));
                   out.write(")");
                }
                out.write(" ");
@@ -349,7 +350,7 @@ public class UINodeWorkflowInfo extends SelfRenderingComponent
                {
                   out.write(bundle.getString("by"));
                   out.write("&nbsp;");
-                  out.write(User.getFullName(nodeService, wi.initiator));
+                  out.write(Utils.encode(User.getFullName(nodeService, wi.initiator)));
                   out.write(".");
                }
                out.write("</li>");
diff --git a/source/java/org/alfresco/web/ui/repo/component/UIUserGroupPicker.java b/source/java/org/alfresco/web/ui/repo/component/UIUserGroupPicker.java
index 87dd7bea76..a46fc99fb7 100644
--- a/source/java/org/alfresco/web/ui/repo/component/UIUserGroupPicker.java
+++ b/source/java/org/alfresco/web/ui/repo/component/UIUserGroupPicker.java
@@ -179,7 +179,7 @@ public class UIUserGroupPicker extends UICommand
             {
                out.write("<span style='color:#93a8b2'>");
             }
-            out.write((String)authority.get("fullName"));
+            out.write(Utils.encode((String)authority.get("fullName")));
             out.write(" (");
             out.write((String)authority.get("roles"));
             out.write(")");
diff --git a/source/java/org/alfresco/web/ui/repo/component/UIWorkflowHistory.java b/source/java/org/alfresco/web/ui/repo/component/UIWorkflowHistory.java
index 24da579b6d..339536d960 100644
--- a/source/java/org/alfresco/web/ui/repo/component/UIWorkflowHistory.java
+++ b/source/java/org/alfresco/web/ui/repo/component/UIWorkflowHistory.java
@@ -190,7 +190,7 @@ public class UIWorkflowHistory extends SelfRenderingComponent
                }
                
                out.write("<tr><td>");
-               out.write(desc == null ? "" : desc);
+               out.write(desc == null ? "" : Utils.encode(desc));
                out.write("</td><td>");
                out.write(task.title);
                out.write("</td><td>");
@@ -200,7 +200,7 @@ public class UIWorkflowHistory extends SelfRenderingComponent
                out.write("</td><td>");
                out.write(owner == null ? "" : owner);
                out.write("</td><td>");
-               out.write(comment == null ? "" : comment);
+               out.write(comment == null ? "" : Utils.encode(comment));
                out.write("</td><td>");
                out.write(Utils.getDateTimeFormat(context).format(completedDate));
                out.write("</td><td>");
diff --git a/source/java/org/alfresco/web/ui/repo/component/UIWorkflowSummary.java b/source/java/org/alfresco/web/ui/repo/component/UIWorkflowSummary.java
index 894fecdc79..8a0f955ff8 100644
--- a/source/java/org/alfresco/web/ui/repo/component/UIWorkflowSummary.java
+++ b/source/java/org/alfresco/web/ui/repo/component/UIWorkflowSummary.java
@@ -36,6 +36,7 @@ import org.alfresco.service.cmr.workflow.WorkflowInstance;
 import org.alfresco.web.app.Application;
 import org.alfresco.web.bean.repository.Repository;
 import org.alfresco.web.bean.repository.User;
+import org.alfresco.web.ui.common.Utils;
 import org.alfresco.web.ui.common.component.SelfRenderingComponent;
 
 /**
@@ -113,7 +114,7 @@ public class UIWorkflowSummary extends SelfRenderingComponent
          if (wi.definition.description != null && wi.definition.description.length() > 0)
          {
             out.write("&nbsp;(");
-            out.write(wi.definition.description);
+            out.write(Utils.encode(wi.definition.description));
             out.write(")");
          }
          out.write("</td></tr><tr><td>");
@@ -121,8 +122,8 @@ public class UIWorkflowSummary extends SelfRenderingComponent
          out.write(":</td><td>");
          if (wi.initiator != null)
          {
-            out.write(User.getFullName(Repository.getServiceRegistry(
-                  context).getNodeService(), wi.initiator));
+            out.write(Utils.encode(User.getFullName(Repository.getServiceRegistry(
+                  context).getNodeService(), wi.initiator)));
          }
          out.write("</td></tr><tr><td>");
          out.write(bundle.getString("started_on"));
diff --git a/source/java/org/alfresco/web/ui/repo/component/property/BaseAssociationEditor.java b/source/java/org/alfresco/web/ui/repo/component/property/BaseAssociationEditor.java
index 6294e5ad14..1688bfb704 100644
--- a/source/java/org/alfresco/web/ui/repo/component/property/BaseAssociationEditor.java
+++ b/source/java/org/alfresco/web/ui/repo/component/property/BaseAssociationEditor.java
@@ -717,7 +717,7 @@ public abstract class BaseAssociationEditor extends UIInput
 
       if (ContentModel.TYPE_PERSON.equals(nodeService.getType(targetRef)))
       {
-         out.write(User.getFullName(nodeService, targetRef));
+         out.write(Utils.encode(User.getFullName(nodeService, targetRef)));
       }
       else if (ContentModel.TYPE_AUTHORITY_CONTAINER.equals(nodeService.getType(targetRef)))
       {
@@ -849,7 +849,7 @@ public abstract class BaseAssociationEditor extends UIInput
                      out.write("<option value='");
                      out.write(item.toString());
                      out.write("'>");
-                     out.write(User.getFullName(nodeService, item));
+                     out.write(Utils.encode(User.getFullName(nodeService, item)));
                      out.write("</option>");
                   }
                }
diff --git a/source/java/org/alfresco/web/ui/repo/component/property/UIAssociationEditor.java b/source/java/org/alfresco/web/ui/repo/component/property/UIAssociationEditor.java
index cd6bb3e697..da382e09b2 100644
--- a/source/java/org/alfresco/web/ui/repo/component/property/UIAssociationEditor.java
+++ b/source/java/org/alfresco/web/ui/repo/component/property/UIAssociationEditor.java
@@ -44,6 +44,7 @@ import org.alfresco.web.app.Application;
 import org.alfresco.web.bean.repository.Node;
 import org.alfresco.web.bean.repository.Repository;
 import org.alfresco.web.bean.repository.User;
+import org.alfresco.web.ui.common.Utils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
@@ -170,7 +171,7 @@ public class UIAssociationEditor extends BaseAssociationEditor
             if (ContentModel.TYPE_PERSON.equals(nodeService.getType(targetNode)))
             {
                // if the node represents a person, show the username instead of the name
-               out.write(User.getFullName(nodeService, targetNode));
+               out.write(Utils.encode(User.getFullName(nodeService, targetNode)));
             }
             else if (ContentModel.TYPE_AUTHORITY_CONTAINER.equals(nodeService.getType(targetNode)))
             {
diff --git a/source/java/org/alfresco/web/ui/repo/component/property/UIChildAssociationEditor.java b/source/java/org/alfresco/web/ui/repo/component/property/UIChildAssociationEditor.java
index 5f3f6be402..0199de7f0d 100644
--- a/source/java/org/alfresco/web/ui/repo/component/property/UIChildAssociationEditor.java
+++ b/source/java/org/alfresco/web/ui/repo/component/property/UIChildAssociationEditor.java
@@ -43,6 +43,7 @@ import org.alfresco.service.namespace.QName;
 import org.alfresco.web.bean.repository.Node;
 import org.alfresco.web.bean.repository.Repository;
 import org.alfresco.web.bean.repository.User;
+import org.alfresco.web.ui.common.Utils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
@@ -167,7 +168,7 @@ public class UIChildAssociationEditor extends BaseAssociationEditor
             // if the node represents a person, show the username instead of the name
             if (ContentModel.TYPE_PERSON.equals(nodeService.getType(targetNode)))
             {
-               out.write(User.getFullName(nodeService, targetNode));
+               out.write(Utils.encode(User.getFullName(nodeService, targetNode)));
             }
             else if (ContentModel.TYPE_AUTHORITY_CONTAINER.equals(nodeService.getType(targetNode)))
             {
diff --git a/source/web/jsp/roles/edit-user-roles.jsp b/source/web/jsp/roles/edit-user-roles.jsp
index ca4508e75c..7d5a8fcad9 100644
--- a/source/web/jsp/roles/edit-user-roles.jsp
+++ b/source/web/jsp/roles/edit-user-roles.jsp
@@ -29,66 +29,64 @@
 <%@ taglib uri="/WEB-INF/repo.tld" prefix="r" %>
 
 <f:verbatim>
-<table cellpadding="2" cellspacing="2" border="0" width="100%">
-<tr>
-<td class="mainSubTitle"><h:outputText value="#{msg.change_user_roles}" /></td>
-</tr>
-<tr><td class="paddingRow"></td></tr>
-<tr>
-<td>1.&nbsp;</f:verbatim><h:outputText value="#{msg.select_role}" /><f:verbatim></td>
-</tr>
-<tr>
-<td>
-</f:verbatim>
-<h:selectOneListbox id="roles" style="width:250px" size="5">
-<f:selectItems value="#{InviteSpaceUsersWizard.roles}" />
-</h:selectOneListbox>
-<f:verbatim>
-</td>
-</tr>
-<tr>
-<td>
-2.&nbsp;</f:verbatim><h:commandButton value="#{msg.add_to_list_button}" actionListener="#{DialogManager.bean.addRole}" />
-<f:verbatim>
-</td>
-</tr>
-<tr><td class="paddingRow"></td></tr>
-<tr>
-<td></f:verbatim><h:outputText value="#{msg.selected_roles}" /><f:verbatim></td>
-</tr>
-<tr>
-<td>
-</f:verbatim>
-<h:dataTable value="#{DialogManager.bean.personRolesDataModel}" var="row"
-rowClasses="selectedItemsRow,selectedItemsRowAlt"
-styleClass="selectedItems" headerClass="selectedItemsHeader"
-cellspacing="0" cellpadding="4"
-rendered="#{DialogManager.bean.personRolesDataModel.rowCount != 0}">
-<h:column>
-<f:facet name="header">
-<h:outputText value="#{msg.name}" />
-</f:facet>
-<h:outputText value="#{row.role}" />
-</h:column>
-<h:column>
-<a:actionLink actionListener="#{DialogManager.bean.removeRole}" image="/images/icons/delete.gif"
-value="#{msg.remove}" showLink="false" style="padding-left:6px" />
-</h:column>
-</h:dataTable>
-<a:panel id="no-items" rendered="#{DialogManager.bean.personRolesDataModel.rowCount == 0}"><f:verbatim>
-<table cellspacing='0' cellpadding='2' border='0' class='selectedItems'>
-<tr>
-<td colspan='2' class='selectedItemsHeader'><h:outputText id="no-items-name" value="#{msg.name}" /></td>
-</tr>
-<tr>
-<td class='selectedItemsRow'><h:outputText id="no-items-msg" value="#{msg.no_selected_items}" /></td>
-</tr>
-</table>
-</f:verbatim>
-</a:panel>
-<f:verbatim>
-</td>
-</tr>
-<tr><td colspan=2 class="paddingRow"></td></tr>
-</table>
+	<table cellpadding="2" cellspacing="2" border="0" width="100%">
+		<tr>
+			<td class="mainSubTitle"></f:verbatim><h:outputText value="#{msg.change_user_roles}" /><f:verbatim></td>
+		</tr>
+		<tr><td class="paddingRow"></td></tr>
+		<tr>
+			<td>1.&nbsp;</f:verbatim><h:outputText value="#{msg.select_role}" /><f:verbatim></td>
+		</tr>
+		<tr>
+			<td>
+				</f:verbatim>
+				<h:selectOneListbox id="roles" style="width:250px" size="5">
+					<f:selectItems value="#{InviteSpaceUsersWizard.roles}" />
+				</h:selectOneListbox>
+				<f:verbatim>
+			</td>
+		</tr>
+		<tr>
+			<td>2.&nbsp;</f:verbatim><h:commandButton value="#{msg.add_to_list_button}" actionListener="#{DialogManager.bean.addRole}" /><f:verbatim></td>
+		</tr>
+		<tr><td class="paddingRow"></td></tr>
+		<tr>
+			<td></f:verbatim><h:outputText value="#{msg.selected_roles}" /><f:verbatim></td>
+		</tr>
+		<tr>
+			<td>
+				</f:verbatim>
+					<h:dataTable value="#{DialogManager.bean.personRolesDataModel}" var="row"
+							rowClasses="selectedItemsRow,selectedItemsRowAlt"
+							styleClass="selectedItems" headerClass="selectedItemsHeader"
+							cellspacing="0" cellpadding="4"
+							rendered="#{DialogManager.bean.personRolesDataModel.rowCount != 0}">
+						<h:column>
+							<f:facet name="header">
+								<h:outputText value="#{msg.name}" />
+							</f:facet>
+							<h:outputText value="#{row.role}" />
+						</h:column>
+						<h:column>
+							<a:actionLink actionListener="#{DialogManager.bean.removeRole}" image="/images/icons/delete.gif"
+									value="#{msg.remove}" showLink="false" style="padding-left:6px" />
+						</h:column>
+					</h:dataTable>
+					<a:panel id="no-items" rendered="#{DialogManager.bean.personRolesDataModel.rowCount == 0}">
+						<f:verbatim>
+							<table cellspacing='0' cellpadding='2' border='0' class='selectedItems'>
+								<tr>
+									<td colspan='2' class='selectedItemsHeader'><f:verbatim><h:outputText id="no-items-name" value="#{msg.name}" /></f:verbatim></td>
+								</tr>
+								<tr>
+									<td class='selectedItemsRow'><f:verbatim><h:outputText id="no-items-msg" value="#{msg.no_selected_items}" /></f:verbatim></td>
+								</tr>
+							</table>
+						</f:verbatim>
+					</a:panel>
+				<f:verbatim>
+			</td>
+		</tr>
+		<tr><td colspan=2 class="paddingRow"></td></tr>
+	</table>
 </f:verbatim>
\ No newline at end of file
diff --git a/source/web/jsp/roles/remove-content-user.jsp b/source/web/jsp/roles/remove-content-user.jsp
index b2f902e592..25226eaddb 100644
--- a/source/web/jsp/roles/remove-content-user.jsp
+++ b/source/web/jsp/roles/remove-content-user.jsp
@@ -30,20 +30,14 @@
 
 <f:verbatim>
 <table cellpadding="2" cellspacing="2" border="0">
-<tr>
-<td class="mainSubTitle">
-</f:verbatim><h:outputFormat value="#{msg.remove_content_user_confirm}">
-<f:param value="#{DialogManager.bean.personName}"/>
-</h:outputFormat><f:verbatim>
-</td>
-</tr>
-<tr>
-<td>
-<%-- Error Messages --%>
-<%-- messages tag to show messages not handled by other specific message tags --%>
-</f:verbatim><h:messages globalOnly="true" styleClass="errorMessage" layout="table" /><f:verbatim>
-<td>
-</tr>
+	<tr>
+		<td class="mainSubTitle">
+			</f:verbatim>
+			<h:outputFormat value="#{msg.remove_content_user_confirm}">
+				<f:param value="#{DialogManager.bean.personName}"/>
+			</h:outputFormat>
+			<f:verbatim>
+		</td>
+	</tr>
 </table>
-</f:verbatim>
-
+</f:verbatim>
\ No newline at end of file
diff --git a/source/web/jsp/roles/remove-invited-user.jsp b/source/web/jsp/roles/remove-invited-user.jsp
index 3970343153..b799758957 100644
--- a/source/web/jsp/roles/remove-invited-user.jsp
+++ b/source/web/jsp/roles/remove-invited-user.jsp
@@ -40,4 +40,4 @@
       </td>
    </tr>
 </table>
-</f:verbatim>
+</f:verbatim>
\ No newline at end of file
diff --git a/source/web/jsp/wcm/create-website-wizard/summary.jsp b/source/web/jsp/wcm/create-website-wizard/summary.jsp
index c34733a0a2..d251374728 100644
--- a/source/web/jsp/wcm/create-website-wizard/summary.jsp
+++ b/source/web/jsp/wcm/create-website-wizard/summary.jsp
@@ -177,7 +177,7 @@
             style="width:100%;" itemStyle="vertical-align: top; margin-right: 5px;">
          <c:forEach items="${WizardManager.bean.invitedUsers}" var="r">
             <a:listItem value="${r.name}" image="/images/icons/user_large.gif">
-               <jsp:attribute name="label"><b>${r.name}</b></jsp:attribute>
+               <jsp:attribute name="label"><b><c:out escapeXml="true" value="${r.name}"/></b></jsp:attribute>
                <jsp:attribute name="description">
                   <table width="100%" cellspacing="0" cellpadding="0" border="0">
                      <colgroup><col width="25%"/><col width="75%"/></colgroup>