ARAI#36601 Iets safer omgaan met teksten

svn path=/Website/branches/v2016.1/; revision=29511

APPL/KPI/kpi_search_list.asp

@@ -93,7 +93,7 @@ function loadGraph(nr, params)
 
     var url = "../fac/fac_usrgraph.asp"
             + "?usrgraph_key="  + params.view_names[nr].graph_key
-            + "&fclt_text="     + fclt_text.join(",")
+            + "&fclt_text="     + safe.url(fclt_text.join(","))
             + "&widget_height=" + params.widget_height;
     var id = "kpiGraph";
 
@@ -102,7 +102,7 @@ function loadGraph(nr, params)
   <div id="frm_<%=id%>" class="fcltframe">
     <div class="inside">
       <iframe id="<%=id%>" name="<%=id%>" frameborder="0" width="100%" height="<%=params.initHeight||'20px'%>"
-              src="<%=url%>" scrolling="no"
+              src="<%=safe.htmlattr(url)%>" scrolling="no"
               onload="FcltMgr.iframeLoaded(this);">
       </iframe>
     </div>
@@ -152,7 +152,7 @@ function loadGraph(nr, params)
         <tr onclick="$(this).next().toggle();$(this).toggleClass('collapsed');FcltMgr.resized(window)">
           <td colspan="3">
             <div class="fcltframeheader">
-              <span style="float:left"><nobr><%=proces %>&nbsp;<span id="extratitle"></span></nobr></span>
+              <span style="float:left"><nobr><%=safe.html(proces) %>&nbsp;<span id="extratitle"></span></nobr></span>
             </div>
           </td>
         </tr>