use xml_escape

views.py

@@ -8,7 +8,7 @@ __docformat__ = "restructuredtext en"
 
 _ = unicode
 
-from logilab.mtconverter import html_escape
+from logilab.mtconverter import xml_escape
 
 from cubicweb import Unauthorized
 from cubicweb.selectors import implements
@@ -29,7 +29,7 @@ class BasketPrimaryView(baseviews.PrimaryView):
 
     def display_title(self, entity):
         self.w(u"<span class='title'><b>%s : %s</b></span>" % (
-            self._cw._(self.entity_name), html_escape(entity.name)))
+            self._cw._(self.entity_name), xml_escape(entity.name)))
 
     def display_content(self, entity):
         rset = self._cw.execute('Any I WHERE I in_basket B,  B eid %(x)s',
@@ -91,14 +91,14 @@ class BasketBox(box.UserRQLBoxTemplate):
     def build_inbasket_link(self, box, basket):
         rset = basket.related('in_basket', 'object')
         title = u'%s <span class="basketName">%s</span> (%s)' % (
-            _('view basket'), html_escape(basket.name), len(rset))
+            _('view basket'), xml_escape(basket.name), len(rset))
         box.append(self.mk_action(title, basket.absolute_url(),
                                   escape=False))
         return rset, [row[0] for row in rset]
 
     def build_add_link(self, box, basket, addable, rql, vid):
         title = u'%s <span class="basketName">%s</span>' % (
-            _('add to basket'), html_escape(basket.name))
+            _('add to basket'), xml_escape(basket.name))
         linkto = u'in_basket:%s:object' % '_'.join(addable)
         msg =  _('selection added to basket')
         url = self.build_url('edit', eid=basket.eid, rql=rql,
@@ -108,7 +108,7 @@ class BasketBox(box.UserRQLBoxTemplate):
                                   escape=False))
     def build_delete_link(self, box, basket, inbasketeids, rql, vid):
         title = '%s <span class="basketName">%s</span>' % (
-            _('reset basket'), html_escape(basket.name))
+            _('reset basket'), xml_escape(basket.name))
         delete = '%s:in_basket:%s' % ('_'.join(str(eid) for eid in inbasketeids),
                                       basket.eid)
         msg =  _('Basket %s emptied') % basket.name