@@ -, +, @@ eg Bad stuff as the name Note the js is executed Notice the html is not escaped Notice the html is now escaped --- .../prog/en/modules/virtualshelves/tables/shelves_results.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt @@ -9,7 +9,7 @@ "dt_type": "[% data.type %]", "dt_shelfname": - "[% data.shelfname %]", + "[% data.shelfname | html%]", "dt_count": "[% data.count %] item(s)", "dt_owner": --