From 15f57d8c55d74e41e8102ccad27fcc7d73a67771 Mon Sep 17 00:00:00 2001
From: Adrian Holovaty <adrian@holovaty.com>
Date: Fri, 17 Feb 2006 17:55:41 +0000
Subject: [PATCH] Fixed #1357 and #614 -- <select> formfields now escape values

git-svn-id: http://code.djangoproject.com/svn/django/trunk@2321 bcc190cf-cafb-0310-a4f2-bffc1f526a37
---
 django/core/formfields.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/django/core/formfields.py b/django/core/formfields.py
index 1d018aff5c..3289be5235 100644
--- a/django/core/formfields.py
+++ b/django/core/formfields.py
@@ -427,7 +427,7 @@ class SelectField(FormField):
             selected_html = ''
             if str(value) == str_data:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, display_name))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(display_name)))
         output.append('  </select>')
         return '\n'.join(output)