1 files changed, 8 insertions, 5 deletions

diff --git a/js/codeq/hint.js b/js/codeq/hint.js
index a94f571..06eceb0 100644
--- a/js/codeq/hint.js
+++ b/js/codeq/hint.js
@@ -35,14 +35,17 @@
                 if (!args)
                     return template;
                 return template.replace(/\[%=(\w+)%\]/g, function(match, name) {
-                    return args[name];
+                    return args[name].toString()
+                                     .replace(/&/g, '&amp')
+                                     .replace(/</g, '&lt;')
+                                     .replace(/>/g, '&gt;');
                 });
             },
 
             typeHandlers = {
                 'static': function (type, template, serverHint) {
                     var args = serverHint.args,
-                        jqContainer, jqButton, i, lastIndex;
+                        jqContainer, jqButton, i, N;
                     if (template instanceof Array) { // unwrap the template if there's only one
                         if (template.length == 0) template = '';
                         else if (template.length == 1) template = template[0] + ''; // it must be a string
@@ -52,14 +55,14 @@
                         jqContainer = $('<div class="hint-static-group"></div>');
                         jqButton = $('<button type="button">More...</button>'); // TODO: translate "more"
                         jqHints.append(jqContainer);
-                        lastIndex = template.length - 1;
+                        N = template.length;
                         jqContainer.append('<div class="hint-static">' + processTemplate(template[0], args) + '</div>');
                         jqContainer.append(jqButton);
                         i = 1;
                         jqButton.on('click', function () {
                             var jqNext = $('<div class="hint-static">' + processTemplate(template[i], args) + '</div>');
                             i++;
-                            if (i < lastIndex) {
+                            if (i < N) {
                                 jqButton.before(jqNext);
                             }
                             else {
@@ -181,4 +184,4 @@
             }
         };
     };
-})();
\ No newline at end of file
+})();