From 7098389fae47ecc791809f21d60193f2c5449a7b Mon Sep 17 00:00:00 2001
From: Adrian Holovaty <adrian@holovaty.com>
Date: Wed, 31 May 2006 14:58:20 +0000
Subject: [PATCH] Fixed #2020 -- <option> values are now escaped in
 SelectMultipleField

git-svn-id: http://code.djangoproject.com/svn/django/trunk@3021 bcc190cf-cafb-0310-a4f2-bffc1f526a37
---
 django/forms/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/django/forms/__init__.py b/django/forms/__init__.py
index 7ad26a4d71a..52092aff7b6 100644
--- a/django/forms/__init__.py
+++ b/django/forms/__init__.py
@@ -577,7 +577,7 @@ class SelectMultipleField(SelectField):
             selected_html = ''
             if str(value) in str_data_list:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, choice))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(choice)))
         output.append('  </select>')
         return '\n'.join(output)