diff -ruN moodle/course/lib.php public_html/course/lib.php
--- moodle/course/lib.php	2007-02-23 09:26:38.000000000 +0000
+++ public_html/course/lib.php	2007-02-23 10:17:40.000000000 +0000
@@ -520,7 +520,7 @@
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
             echo "<td class=\"cell c0\">\n";
-            echo "    <a href=\"{$CFG->wwwroot}/course/view.php?id={$log->course}\">".$courses[$log->course]."</a>\n";
+            echo "    <a href=\"{$CFG->wwwroot}/course/view.php?id={$log->course}\">".s($courses[$log->course])."</a>\n";
             echo "</td>\n";
         }
         echo "<td class=\"cell c1\" align=\"right\">".userdate($log->time, '%a').
@@ -627,7 +627,7 @@
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
             echo "<td class=\"r$row c0\" >\n";
-            echo "    <a href=\"{$CFG->wwwroot}/course/view.php?id={$log->course}\">".$courses[$log->course]."</a>\n";
+            echo "    <a href=\"{$CFG->wwwroot}/course/view.php?id={$log->course}\">".s($courses[$log->course])."</a>\n";
             echo "</td>\n";
         }
         echo "<td class=\"r$row c1\" align=\"right\">".userdate($log->time, '%a').
@@ -988,7 +988,7 @@
         if (empty($course->visible)) {
             $linkcss = 'class="dimmed"';
         }
-        print_heading('<a title="'.$course->fullname.'" '.$linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.$course->fullname.'</a>');
+        print_heading('<a title="'.$course->fullname.'" '.$linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.s($course->fullname).'</a>');
         if (array_key_exists($course->id,$htmlarray)) {
             foreach ($htmlarray[$course->id] as $modname => $html) {
                 echo $html;
@@ -1678,7 +1678,7 @@
 
         echo '<td valign="top" class="category image">'.$catimage.'</td>';
         echo '<td valign="top" class="category name">';
-        echo '<a '.$catlinkcss.' href="'.$CFG->wwwroot.'/course/category.php?id='.$category->id.'">'.$category->name.'</a>';
+        echo '<a '.$catlinkcss.' href="'.$CFG->wwwroot.'/course/category.php?id='.$category->id.'">'.s($category->name).'</a>';
         echo '</td>';
         echo '<td class="category info">&nbsp;</td>';
         echo '</tr>';
@@ -1688,7 +1688,7 @@
                 $linkcss = $course->visible ? '' : ' class="dimmed" ';
                 echo '<tr><td valign="top">&nbsp;';
                 echo '</td><td valign="top" class="course name">';
-                echo '<a '.$linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.$course->fullname.'</a>';
+                echo '<a '.$linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.s($course->fullname).'</a>';
                 echo '</td><td align="right" valign="top" class="course info">';
                 if ($course->guest ) {
                     echo '<a title="'.$strallowguests.'" href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">';
@@ -1724,7 +1724,7 @@
         }
 
         echo '<td valign="top" class="category name">';
-        echo '<a '.$catlinkcss.' href="'.$CFG->wwwroot.'/course/category.php?id='.$category->id.'">'.$category->name.'</a>';
+        echo '<a '.$catlinkcss.' href="'.$CFG->wwwroot.'/course/category.php?id='.$category->id.'">'.s($category->name).'</a>';
         echo '</td>';
         echo '<td valign="top" class="category number">';
         if ($category->coursecount) {
@@ -1791,7 +1791,7 @@
     echo '<div class="info">';
     echo '<div class="name"><a title="'.get_string('entercourse').'"'.
          $linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.
-         $course->fullname.'</a></div>';   
+         s($course->fullname).'</a></div>';   
     
     /// first find all roles that are supposed to be displayed
     if ($managerroles = get_config('', 'coursemanager')) {