More escaping... (Fixes https://trac.openstreetmap.org/ticket/4775)

15 files changed, 146 insertions, 146 deletions

diff --git a/web/viewsjs/key.js.erb b/web/viewsjs/key.js.erb
index e2a53bd..f40af36 100644
--- a/web/viewsjs/key.js.erb
+++ b/web/viewsjs/key.js.erb
@@ -8,9 +8,9 @@ var create_flexigrid_for = {
         create_flexigrid('grid-overview', {
             url: '/api/4/key/stats?key=' + encodeURIComponent(key),
             colModel: [
-                { display: '<%= misc.object_type %>', name: 'type', width: 100, sortable: true },
-                { display: '<%= page.number_objects %>', name: 'count', width: 260, sortable: true, align: 'center' },
-                { display: '<%= page.number_values %>', name: 'value', width: 140, sortable: true, align: 'right' }
+                { display: '<%= h(misc.object_type) %>', name: 'type', width: 100, sortable: true },
+                { display: '<%= h(page.number_objects) %>', name: 'count', width: 260, sortable: true, align: 'center' },
+                { display: '<%= h(page.number_values) %>', name: 'value', width: 140, sortable: true, align: 'right' }
             ],
             usepager: false,
             useRp: false,
@@ -33,13 +33,13 @@ var create_flexigrid_for = {
         create_flexigrid('grid-values', {
             url: '/api/4/key/values?key=' + encodeURIComponent(key) + '&filter=' + encodeURIComponent(filter_type) + '&lang=' + encodeURIComponent(lang),
             colModel: [
-                { display: '<%= osm.value %>', name: 'value', width: 200, sortable: true },
-                { display: '<%= misc.count %>', name: 'count', width: 260, sortable: true, align: 'center' },
-                { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
-                { display: '<span title="<%= page.tag_description_from_wiki %>"><%= misc.description %></span>', name: 'description', width: 600, sortable: false, align: 'left' }
+                { display: '<%= h(osm.value) %>', name: 'value', width: 200, sortable: true },
+                { display: '<%= h(misc.count) %>', name: 'count', width: 260, sortable: true, align: 'center' },
+                { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(page.tag_description_from_wiki) %>"><%= h(misc.description) %></span>', name: 'description', width: 600, sortable: false, align: 'left' }
             ],
             searchitems: [
-                { display: '<%= osm.value %>', name: 'value' }
+                { display: '<%= h(osm.value) %>', name: 'value' }
             ],
             sortname: 'count',
             sortorder: 'desc',
@@ -61,12 +61,12 @@ var create_flexigrid_for = {
         create_flexigrid('grid-keys', {
             url: '/api/4/key/combinations?key=' + encodeURIComponent(key) + '&filter=' + encodeURIComponent(filter_type),
             colModel: [
-                { display: '<span title="<%= page.other_keys_used.to_count_tooltip %>"><%= misc.count %> &rarr;</span>', name: 'to_count', width: 260, sortable: true, align: 'center' },
-                { display: '<span title="<%= page.other_keys_used.other_key_tooltip %>"><%= page.other_keys_used.other %></span>', name: 'other_key', width: 400, sortable: true },
-                { display: '<span title="<%= page.other_keys_used.from_count_tooltip %>">&rarr; <%= misc.count %></span>', name: 'from_count', width: 260, sortable: true, align: 'center' }
+                { display: '<span title="<%= h(page.other_keys_used.to_count_tooltip) %>"><%= h(misc.count) %> &rarr;</span>', name: 'to_count', width: 260, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(page.other_keys_used.other_key_tooltip) %>"><%= h(page.other_keys_used.other) %></span>', name: 'other_key', width: 400, sortable: true },
+                { display: '<span title="<%= h(page.other_keys_used.from_count_tooltip) %>">&rarr; <%= h(misc.count) %></span>', name: 'from_count', width: 260, sortable: true, align: 'center' }
             ],
             searchitems: [
-                { display: '<%= page.other_keys_used.other %>', name: 'other_key' }
+                { display: '<%= h(page.other_keys_used.other) %>', name: 'other_key' }
             ],
             sortname: 'to_count',
             sortorder: 'desc',
@@ -86,14 +86,14 @@ var create_flexigrid_for = {
         create_flexigrid('grid-wiki', {
             url: '/api/4/key/wiki_pages?key=' + encodeURIComponent(key),
             colModel: [
-                { display: '<%= misc.language %>', name: 'lang', width: 150, sortable: false },
-                { display: '<%= page.wiki_pages.wiki_page %>', name: 'title', width: 160, sortable: false, align: 'right' },
-                { display: '<%= misc.description %>', name: 'description', width: 400, sortable: false },
-                { display: '<%= misc.image %>', name: 'image', width: 120, sortable: false },
-                { display: '<%= osm.objects %>', name: 'objects', width:  80, sortable: false },
-                { display: '<%= page.wiki_pages.implied_tags %>', name: 'tags_implied', width: 120, sortable: false },
-                { display: '<%= page.wiki_pages.combined_tags %>', name: 'tags_combination', width: 120, sortable: false },
-                { display: '<%= page.wiki_pages.linked_tags %>', name: 'tags_linked', width: 220, sortable: false }
+                { display: '<%= h(misc.language) %>', name: 'lang', width: 150, sortable: false },
+                { display: '<%= h(page.wiki_pages.wiki_page) %>', name: 'title', width: 160, sortable: false, align: 'right' },
+                { display: '<%= h(misc.description) %>', name: 'description', width: 400, sortable: false },
+                { display: '<%= h(misc.image) %>', name: 'image', width: 120, sortable: false },
+                { display: '<%= h(osm.objects) %>', name: 'objects', width:  80, sortable: false },
+                { display: '<%= h(page.wiki_pages.implied_tags) %>', name: 'tags_implied', width: 120, sortable: false },
+                { display: '<%= h(page.wiki_pages.combined_tags) %>', name: 'tags_combination', width: 120, sortable: false },
+                { display: '<%= h(page.wiki_pages.linked_tags) %>', name: 'tags_linked', width: 220, sortable: false }
             ],
             usepager: false,
             useRp: false,
@@ -124,10 +124,10 @@ var create_flexigrid_for = {
         create_flexigrid('grid-josm', {
             url: '/api/4/key/josm/style/rules?style=standard&key=' + encodeURIComponent(key),
             colModel: [
-                { display: '<%= osm.value %>', name: 'value', width: 400, sortable: true },
-                { display: '<%= misc.icon %>', name: 'icon', width: 40, sortable: false, align: 'center' },
-                { display: '<%= misc.line %>', name: 'line', width: 40, sortable: false, align: 'center' },
-                { display: '<%= misc.area %>', name: 'area', width: 40, sortable: false, align: 'center' }
+                { display: '<%= h(osm.value) %>', name: 'value', width: 400, sortable: true },
+                { display: '<%= h(misc.icon) %>', name: 'icon', width: 40, sortable: false, align: 'center' },
+                { display: '<%= h(misc.line) %>', name: 'line', width: 40, sortable: false, align: 'center' },
+                { display: '<%= h(misc.area) %>', name: 'area', width: 40, sortable: false, align: 'center' }
             ],
             sortname: 'value',
             sortorder: 'asc',
diff --git a/web/viewsjs/keys.js.erb b/web/viewsjs/keys.js.erb
index df63387..13652f2 100644
--- a/web/viewsjs/keys.js.erb
+++ b/web/viewsjs/keys.js.erb
@@ -6,19 +6,19 @@ function page_init() {
     create_flexigrid('grid-keys', {
         url: '/api/4/keys/all?include=prevalent_values',
         colModel: [
-            { display: '<%= osm.key %>', name: 'key', width: 160, sortable: true },
-            { display: '<span title="<%= misc.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.objects %></span>', name: 'count_all', width: 160, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.nodes_tooltip %>"><img src="/img/types/node.16.png" width="16" height="16" alt=""/> <%= osm.nodes %></span>', name: 'count_nodes', width: 250, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.ways_tooltip %>"><img src="/img/types/way.16.png" width="16" height="16" alt=""/> <%= osm.ways %></span>', name: 'count_ways', width: 250, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.relations_tooltip %>"><img src="/img/types/relation.16.png" width="16" height="16" alt=""/> <%= osm.relations %></span>', name: 'count_relations',  width: 250, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.users_tooltip %>"><%= osm.users %></span>', name: 'users_all', width: 44, sortable: true, align: 'right' },
-            { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
-            { display: '<img src="/img/sources/josm.16.png" alt="JOSM" width="16" height="16" title="<%= misc.in_josm_tooltip %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.values_tooltip %>"><%= osm.values %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
-            { display: '<span title="<%= misc.prevalent_values_tooltip %>"><%= misc.prevalent_values %></span>', name: 'prevalent_values', width: 500, sortable: true }
+            { display: '<%= h(osm.key) %>', name: 'key', width: 160, sortable: true },
+            { display: '<span title="<%= h(misc.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.objects) %></span>', name: 'count_all', width: 160, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.nodes_tooltip) %>"><img src="/img/types/node.16.png" width="16" height="16" alt=""/> <%= h(osm.nodes) %></span>', name: 'count_nodes', width: 250, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.ways_tooltip) %>"><img src="/img/types/way.16.png" width="16" height="16" alt=""/> <%= h(osm.ways) %></span>', name: 'count_ways', width: 250, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.relations_tooltip) %>"><img src="/img/types/relation.16.png" width="16" height="16" alt=""/> <%= h(osm.relations) %></span>', name: 'count_relations',  width: 250, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.users_tooltip) %>"><%= h(osm.users) %></span>', name: 'users_all', width: 44, sortable: true, align: 'right' },
+            { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
+            { display: '<img src="/img/sources/josm.16.png" alt="JOSM" width="16" height="16" title="<%= h(misc.in_josm_tooltip) %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.values_tooltip) %>"><%= h(osm.values) %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
+            { display: '<span title="<%= h(misc.prevalent_values_tooltip) %>"><%= h(misc.prevalent_values) %></span>', name: 'prevalent_values', width: 500, sortable: true }
         ],
         searchitems: [
-            { display: '<%= osm.key %>', name: 'key' }
+            { display: '<%= h(osm.key) %>', name: 'key' }
         ],
         sortname: 'count_all',
         sortorder: 'desc',
diff --git a/web/viewsjs/relation.js.erb b/web/viewsjs/relation.js.erb
index f0f6bb4..f192ffd 100644
--- a/web/viewsjs/relation.js.erb
+++ b/web/viewsjs/relation.js.erb
@@ -8,8 +8,8 @@ var create_flexigrid_for = {
         create_flexigrid('grid-overview', {
             url: '/api/4/relation/stats?rtype=' + encodeURIComponent(rtype),
             colModel: [
-                { display: '<%= page.overview.member_type %>', name: 'type', width: 100, sortable: true },
-                { display: '<%= page.overview.member_count %>', name: 'count', width: 260, sortable: true, align: 'right' }
+                { display: '<%= h(page.overview.member_type) %>', name: 'type', width: 100, sortable: true },
+                { display: '<%= h(page.overview.member_count) %>', name: 'count', width: 260, sortable: true, align: 'right' }
             ],
             usepager: false,
             useRp: false,
@@ -31,14 +31,14 @@ var create_flexigrid_for = {
         create_flexigrid('grid-roles', {
             url: '/api/4/relation/roles?rtype=' + encodeURIComponent(rtype),
             colModel: [
-                { display: '<%= osm.relation_member_role %>', name: 'role', width: 250, sortable: true },
-                { display: '<span title="<%= page.roles.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.relation_members %></span>', name: 'count_all_members', width: 250, sortable: true, align: 'center' },
-                { display: '<span title="<%= page.roles.nodes_tooltip %>"><img src="/img/types/node.16.png" width="16" height="16" alt=""/> <%= osm.relation_member_nodes %></span>', name: 'count_node_members', width: 250, sortable: true, align: 'center' },
-                { display: '<span title="<%= page.roles.ways_tooltip %>"><img src="/img/types/way.16.png" width="16" height="16" alt=""/> <%= osm.relation_member_ways %></span>', name: 'count_way_members', width: 250, sortable: true, align: 'center' },
-                { display: '<span title="<%= page.roles.relations_tooltip %>"><img src="/img/types/relation.16.png" width="16" height="16" alt=""/> <%= osm.relation_member_relations %></span>', name: 'count_relation_members', width: 250, sortable: true, align: 'center' },
+                { display: '<%= h(osm.relation_member_role) %>', name: 'role', width: 250, sortable: true },
+                { display: '<span title="<%= h(page.roles.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.relation_members) %></span>', name: 'count_all_members', width: 250, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(page.roles.nodes_tooltip) %>"><img src="/img/types/node.16.png" width="16" height="16" alt=""/> <%= h(osm.relation_member_nodes) %></span>', name: 'count_node_members', width: 250, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(page.roles.ways_tooltip) %>"><img src="/img/types/way.16.png" width="16" height="16" alt=""/> <%= h(osm.relation_member_ways) %></span>', name: 'count_way_members', width: 250, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(page.roles.relations_tooltip) %>"><img src="/img/types/relation.16.png" width="16" height="16" alt=""/> <%= h(osm.relation_member_relations) %></span>', name: 'count_relation_members', width: 250, sortable: true, align: 'center' },
             ],
             searchitems: [
-                { display: '<%= osm.relation_member_role %>', name: 'role' }
+                { display: '<%= h(osm.relation_member_role) %>', name: 'role' }
             ],
             sortname: 'count_all_members',
             sortorder: 'desc',
@@ -60,10 +60,10 @@ var create_flexigrid_for = {
         create_flexigrid('grid-wiki', {
             url: '/api/4/relation/wiki_pages?rtype=' + encodeURIComponent(rtype),
             colModel: [
-                { display: '<%= misc.language %>', name: 'lang', width: 150, sortable: false },
-                { display: '<%= page.wiki_pages.wiki_page %>', name: 'title', width: 160, sortable: false, align: 'right' },
-                { display: '<%= misc.description %>', name: 'description', width: 500, sortable: false },
-                { display: '<%= misc.image %>', name: 'image', width: 300, sortable: false }
+                { display: '<%= h(misc.language) %>', name: 'lang', width: 150, sortable: false },
+                { display: '<%= h(page.wiki_pages.wiki_page) %>', name: 'title', width: 160, sortable: false, align: 'right' },
+                { display: '<%= h(misc.description) %>', name: 'description', width: 500, sortable: false },
+                { display: '<%= h(misc.image) %>', name: 'image', width: 300, sortable: false }
             ],
             usepager: false,
             useRp: false,
diff --git a/web/viewsjs/relations.js.erb b/web/viewsjs/relations.js.erb
index a9389d6..3ce5979 100644
--- a/web/viewsjs/relations.js.erb
+++ b/web/viewsjs/relations.js.erb
@@ -6,13 +6,13 @@ function page_init() {
     create_flexigrid('grid-relations', {
         url: '/api/4/relations/all',
         colModel: [
-            { display: '<%= osm.relation_type %>', name: 'rtype', width: 220, sortable: true },
-            { display: '<span title="<%= page.relations_of_type_tooltip %>"><%= osm.relations %></span>', name: 'count', width: 250, sortable: true, align: 'center' },
-            { display: '<%= osm.tag %>', name: 'tag', width: 250, sortable: false },
-            { display: '<span title="<%= page.prevalent_roles_tooltip %>"><%= page.prevalent_roles %></span>', name: 'prevalent_roles', width: 550, sortable: false }
+            { display: '<%= h(osm.relation_type) %>', name: 'rtype', width: 220, sortable: true },
+            { display: '<span title="<%= h(page.relations_of_type_tooltip) %>"><%= h(osm.relations) %></span>', name: 'count', width: 250, sortable: true, align: 'center' },
+            { display: '<%= h(osm.tag) %>', name: 'tag', width: 250, sortable: false },
+            { display: '<span title="<%= h(page.prevalent_roles_tooltip) %>"><%= h(page.prevalent_roles) %></span>', name: 'prevalent_roles', width: 550, sortable: false }
         ],
         searchitems: [
-            { display: '<%= osm.relation_type %>', name: 'rtype' }
+            { display: '<%= h(osm.relation_type) %>', name: 'rtype' }
         ],
         sortname: 'count',
         sortorder: 'desc',
@@ -32,7 +32,7 @@ function page_init() {
 
 function fmt_prevalent_role_list(list) {
     if (list === null) {
-        return empty('<%= page.no_information %>');
+        return empty('<%= h(page.no_information) %>');
     }
     if (list.length == 0) {
         return empty(page.roles_less_than_one_percent);
@@ -41,7 +41,7 @@ function fmt_prevalent_role_list(list) {
         if (item.role) {
             return tag('span', fmt_role(item.role), { tipsy: 'e', title: html_escape(item.role) + ' (' + fmt_as_percent(item.fraction) + ')' });
         } else {
-            return tag('span', empty('<%= page.empty_role %>'), { tipsy: 'e', title: '(' + fmt_as_percent(item.fraction) + ')' });
+            return tag('span', empty('<%= h(page.empty_role) %>'), { tipsy: 'e', title: '(' + fmt_as_percent(item.fraction) + ')' });
         }
     }).join(' &bull; ');
 }
diff --git a/web/viewsjs/reports/characters_in_keys.js.erb b/web/viewsjs/reports/characters_in_keys.js.erb
index e322dcc..622652b 100644
--- a/web/viewsjs/reports/characters_in_keys.js.erb
+++ b/web/viewsjs/reports/characters_in_keys.js.erb
@@ -7,16 +7,16 @@ var create_flexigrid_for = {
         create_flexigrid('grid-whitespace', {
             url: '/api/4/keys/all?filters=characters_space&include=prevalent_values',
             colModel: [
-                { display: '<%= osm.key %>', name: 'key', width: 250, sortable: true },
-                { display: '<span title="<%= misc.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.objects %></span>', name: 'count_all', width: 150, sortable: true, align: 'center' },
-                { display: '<span title="<%= misc.users_tooltip %>"><%= osm.users %></span>', name: 'users_all', width: 44, sortable: true, align: 'right' },
-                { display: '<img src="/img/sources/wiki.16.png" width="16" height="16" alt="Wiki" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
-                { display: '<img src="/img/sources/josm.16.png" width="16" height="16" alt="JOSM" title="<%= misc.in_josm_tooltip %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
-                { display: '<span title="<%= misc.values_tooltip %>"><%= osm.values %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
-                { display: '<span title="<%= misc.prevalent_values_tooltip %>"><%= misc.prevalent_values %></span>', name: 'prevalent_values', width: 600, sortable: true }
+                { display: '<%= h(osm.key) %>', name: 'key', width: 250, sortable: true },
+                { display: '<span title="<%= h(misc.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.objects) %></span>', name: 'count_all', width: 150, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(misc.users_tooltip) %>"><%= h(osm.users) %></span>', name: 'users_all', width: 44, sortable: true, align: 'right' },
+                { display: '<img src="/img/sources/wiki.16.png" width="16" height="16" alt="Wiki" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
+                { display: '<img src="/img/sources/josm.16.png" width="16" height="16" alt="JOSM" title="<%= h(misc.in_josm_tooltip) %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(misc.values_tooltip) %>"><%= h(osm.values) %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
+                { display: '<span title="<%= h(misc.prevalent_values_tooltip) %>"><%= h(misc.prevalent_values) %></span>', name: 'prevalent_values', width: 600, sortable: true }
             ],
             searchitems: [
-                { display: '<%= osm.key %>', name: 'key' }
+                { display: '<%= h(osm.key) %>', name: 'key' }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
@@ -40,16 +40,16 @@ var create_flexigrid_for = {
         create_flexigrid('grid-problematic', {
             url: '/api/4/keys/all?filters=characters_problematic&include=prevalent_values',
             colModel: [
-                { display: '<%= osm.key %>', name: 'key', width: 250, sortable: true },
-                { display: '<span title="<%= misc.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.objects %></span>', name: 'count_all', width: 150, sortable: true, align: 'center' },
-                { display: '<span title="<%= misc.users_tooltip %>"><%= osm.users %></span>', name: 'users_all', width: 44, sortable: true, align: 'right' },
-                { display: '<img src="/img/sources/wiki.16.png" width="16" height="16" alt="Wiki" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
-                { display: '<img src="/img/sources/josm.16.png" width="16" height="16" alt="JOSM" title="<%= misc.in_josm_tooltip %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
-                { display: '<span title="<%= misc.values_tooltip %>"><%= osm.values %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
-                { display: '<span title="<%= misc.prevalent_values_tooltip %>"><%= misc.prevalent_values %></span>', name: 'prevalent_values', width: 600, sortable: true }
+                { display: '<%= h(osm.key) %>', name: 'key', width: 250, sortable: true },
+                { display: '<span title="<%= h(misc.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.objects) %></span>', name: 'count_all', width: 150, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(misc.users_tooltip) %>"><%= h(osm.users) %></span>', name: 'users_all', width: 44, sortable: true, align: 'right' },
+                { display: '<img src="/img/sources/wiki.16.png" width="16" height="16" alt="Wiki" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
+                { display: '<img src="/img/sources/josm.16.png" width="16" height="16" alt="JOSM" title="<%= h(misc.in_josm_tooltip) %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(misc.values_tooltip) %>"><%= h(osm.values) %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
+                { display: '<span title="<%= h(misc.prevalent_values_tooltip) %>"><%= h(misc.prevalent_values) %></span>', name: 'prevalent_values', width: 600, sortable: true }
             ],
             searchitems: [
-                { display: '<%= osm.key %>', name: 'key' }
+                { display: '<%= h(osm.key) %>', name: 'key' }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
diff --git a/web/viewsjs/reports/frequently_used_keys_without_wiki_page.js.erb b/web/viewsjs/reports/frequently_used_keys_without_wiki_page.js.erb
index ace2de2..f92cc45 100644
--- a/web/viewsjs/reports/frequently_used_keys_without_wiki_page.js.erb
+++ b/web/viewsjs/reports/frequently_used_keys_without_wiki_page.js.erb
@@ -7,15 +7,15 @@ function create_flexigrid_with_option(english) {
     create_flexigrid('grid-keys', {
         url: '/api/4/keys/without_wiki_page?english=' + english,
         colModel: [
-            { display: '<%= page.table.create_wiki_page %>', name: 'create_wiki_page', width: 200, sortable: false },
-            { display: '<%= osm.key %>', name: 'key', width: 180, sortable: true },
-            { display: '<span title="<%= misc.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.objects %></span>', name: 'count_all', width: 70, sortable: true, align: 'right' },
-            { display: '<%= osm.users %>', name: 'users_all', width: 44, sortable: true, align: 'right' },
-            { display: '<span title="<%= misc.values_tooltip %>"><%= osm.values %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
-            { display: '<span title="<%= misc.prevalent_values_tooltip %>"><%= misc.prevalent_values %></span>', name: 'prevalent_values', width: 500, sortable: true }
+            { display: '<%= h(page.table.create_wiki_page) %>', name: 'create_wiki_page', width: 200, sortable: false },
+            { display: '<%= h(osm.key) %>', name: 'key', width: 180, sortable: true },
+            { display: '<span title="<%= h(misc.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.objects) %></span>', name: 'count_all', width: 70, sortable: true, align: 'right' },
+            { display: '<%= h(osm.users) %>', name: 'users_all', width: 44, sortable: true, align: 'right' },
+            { display: '<span title="<%= h(misc.values_tooltip) %>"><%= h(osm.values) %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
+            { display: '<span title="<%= h(misc.prevalent_values_tooltip) %>"><%= h(misc.prevalent_values) %></span>', name: 'prevalent_values', width: 500, sortable: true }
         ],
         searchitems: [
-            { display: '<%= osm.key %>', name: 'key' }
+            { display: '<%= h(osm.key) %>', name: 'key' }
         ],
         sortname: 'count_all',
         sortorder: 'desc',
diff --git a/web/viewsjs/reports/josm_styles.js.erb b/web/viewsjs/reports/josm_styles.js.erb
index 4e0db90..6e49956 100644
--- a/web/viewsjs/reports/josm_styles.js.erb
+++ b/web/viewsjs/reports/josm_styles.js.erb
@@ -6,14 +6,14 @@ function create_flexigrid_with_option(stylename) {
     create_flexigrid('grid-rules', {
         url: '/api/4/josm/style/rules?style=' + stylename,
         colModel: [
-            { display: '<%= osm.key %>',   name: 'key', width: 300, sortable: true },
-            { display: '<%= osm.value %>', name: 'value', width: 300, sortable: true },
-            { display: '<%= misc.icon %>', name: 'icon', width: 40, sortable: false, align: 'center' },
-            { display: '<%= misc.line %>', name: 'line', width: 40, sortable: false, align: 'center' },
-            { display: '<%= misc.area %>', name: 'area', width: 40, sortable: false, align: 'center' }
+            { display: '<%= h(osm.key) %>',   name: 'key', width: 300, sortable: true },
+            { display: '<%= h(osm.value) %>', name: 'value', width: 300, sortable: true },
+            { display: '<%= h(misc.icon) %>', name: 'icon', width: 40, sortable: false, align: 'center' },
+            { display: '<%= h(misc.line) %>', name: 'line', width: 40, sortable: false, align: 'center' },
+            { display: '<%= h(misc.area) %>', name: 'area', width: 40, sortable: false, align: 'center' }
         ],
         searchitems: [
-            { display: '<%= osm.key %>/<%= osm.value %>', name: 'key' }
+            { display: '<%= h(osm.key) %>/<%= h(osm.value) %>', name: 'key' }
         ],
         sortname: 'key',
         sortorder: 'asc',
diff --git a/web/viewsjs/reports/key_lengths.js.erb b/web/viewsjs/reports/key_lengths.js.erb
index fc343d3..d0d691d 100644
--- a/web/viewsjs/reports/key_lengths.js.erb
+++ b/web/viewsjs/reports/key_lengths.js.erb
@@ -8,16 +8,16 @@ var create_flexigrid_for = {
         create_flexigrid('grid-keys', {
             url: '/api/4/keys/all?include=prevalent_values',
             colModel: [
-                { display: '<%= misc.length %>', name: 'length', width: 60, sortable: true, align: 'right' },
-                { display: '<%= osm.key %>', name: 'key', width: 180, sortable: true },
-                { display: '<span title="<%= misc.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.objects %></span>', name: 'count_all', width: 200, sortable: true, align: 'center' },
-                { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
-                { display: '<img src="/img/sources/josm.16.png" alt="JOSM" width="16" height="16" title="<%= misc.in_josm_tooltip %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
-                { display: '<span title="<%= misc.values_tooltip %>"><%= osm.values %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
-                { display: '<span title="<%= misc.prevalent_values_tooltip %>"><%= misc.prevalent_values %></span>', name: 'prevalent_values', width: 550, sortable: true }
+                { display: '<%= h(misc.length) %>', name: 'length', width: 60, sortable: true, align: 'right' },
+                { display: '<%= h(osm.key) %>', name: 'key', width: 180, sortable: true },
+                { display: '<span title="<%= h(misc.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.objects) %></span>', name: 'count_all', width: 200, sortable: true, align: 'center' },
+                { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
+                { display: '<img src="/img/sources/josm.16.png" alt="JOSM" width="16" height="16" title="<%= h(misc.in_josm_tooltip) %>"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(misc.values_tooltip) %>"><%= h(osm.values) %></span>', name: 'values_all', width: 70, sortable: true, align: 'right' },
+                { display: '<span title="<%= h(misc.prevalent_values_tooltip) %>"><%= h(misc.prevalent_values) %></span>', name: 'prevalent_values', width: 550, sortable: true }
             ],
             searchitems: [
-                { display: '<%= osm.key %>', name: 'key' }
+                { display: '<%= h(osm.key) %>', name: 'key' }
             ],
             sortname: 'length',
             sortorder: 'asc',
diff --git a/web/viewsjs/reports/language_comparison_table_for_keys_in_the_wiki.js.erb b/web/viewsjs/reports/language_comparison_table_for_keys_in_the_wiki.js.erb
index 85184a8..7609c96 100644
--- a/web/viewsjs/reports/language_comparison_table_for_keys_in_the_wiki.js.erb
+++ b/web/viewsjs/reports/language_comparison_table_for_keys_in_the_wiki.js.erb
@@ -23,13 +23,13 @@ function page_init() {
         method: 'GET',
         dataType: 'json',
         colModel: [
-            { display: '<br/><%= osm.key %>', name: 'key', width: 200, sortable: true },
+            { display: '<br/><%= h(osm.key) %>', name: 'key', width: 200, sortable: true },
             <% @languages.each do |lang| %>
-            { display: '<%= ::Language[lang].native_name %><br /><span class="lang" style="margin-top: 2px;"><%= lang %></span>', name: '<%= lang %>', align: 'center', width: 60, sortable: false },
+            { display: '<%= ::Language[lang].native_name %><br /><span class="lang" style="margin-top: 2px;"><%= h(lang) %></span>', name: '<%= h(lang) %>', align: 'center', width: 60, sortable: false },
             <% end %>
         ],
         searchitems: [
-            { display: '<%= osm.key %>', name: 'key' }
+            { display: '<%= h(osm.key) %>', name: 'key' }
         ],
         sortname: 'key',
         sortorder: 'asc',
diff --git a/web/viewsjs/reports/languages.js.erb b/web/viewsjs/reports/languages.js.erb
index 23e02be..06ca0b6 100644
--- a/web/viewsjs/reports/languages.js.erb
+++ b/web/viewsjs/reports/languages.js.erb
@@ -4,11 +4,11 @@ function page_init() {
     create_flexigrid('grid-langs', {
         url: '/api/4/wiki/languages',
         colModel: [
-            { display: '<%= page.code %>', name: 'code', width: 60, sortable: true },
-            { display: '<%= page.native_name %>', name: 'native_name', width: 150, sortable: true },
-            { display: '<%= page.english_name %>', name: 'english_name', width: 150, sortable: true },
-            { display: '<%= page.wiki_key_pages %>', name: 'wiki_key_pages', width: 260, sortable: true, align: 'center' },
-            { display: '<%= page.wiki_tag_pages %>', name: 'wiki_tag_pages', width: 260, sortable: true, align: 'center' }
+            { display: '<%= h(page.code) %>', name: 'code', width: 60, sortable: true },
+            { display: '<%= h(page.native_name) %>', name: 'native_name', width: 150, sortable: true },
+            { display: '<%= h(page.english_name) %>', name: 'english_name', width: 150, sortable: true },
+            { display: '<%= h(page.wiki_key_pages) %>', name: 'wiki_key_pages', width: 260, sortable: true, align: 'center' },
+            { display: '<%= h(page.wiki_tag_pages) %>', name: 'wiki_tag_pages', width: 260, sortable: true, align: 'center' }
         ],
         sortname: 'code',
         sortorder: 'asc',
diff --git a/web/viewsjs/reports/name_tags.js.erb b/web/viewsjs/reports/name_tags.js.erb
index d558a29..b8ef586 100644
--- a/web/viewsjs/reports/name_tags.js.erb
+++ b/web/viewsjs/reports/name_tags.js.erb
@@ -11,9 +11,9 @@ var create_flexigrid_for = {
         create_flexigrid('grid-name', {
             url: '/api/0/keys/name',
             colModel: [
-                { display: '<%= osm.key %>', name: 'key', width: 250, sortable: true },
-                { display: '<%= osm.objects %>', name: 'count_all', width: 100, sortable: true, align: 'right' },
-                { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
+                { display: '<%= h(osm.key) %>', name: 'key', width: 250, sortable: true },
+                { display: '<%= h(osm.objects) %>', name: 'count_all', width: 100, sortable: true, align: 'right' },
+                { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
                 { display: 'Prefix', name: 'prefix', width: 100, sortable: true },
                 { display: 'Type', name: 'type', width: 100, sortable: true },
                 { display: 'Langtag', name: 'langtag', width: 100, sortable: true },
@@ -23,7 +23,7 @@ var create_flexigrid_for = {
                 { display: 'Notes', name: 'notes', width: 500, sortable: true }
             ],
             searchitems: [
-                { display: '<%= osm.key %>', name: 'key' }
+                { display: '<%= h(osm.key) %>', name: 'key' }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
diff --git a/web/viewsjs/reports/wiki_pages_about_non_existing_keys.js.erb b/web/viewsjs/reports/wiki_pages_about_non_existing_keys.js.erb
index fa8023c..e376f10 100644
--- a/web/viewsjs/reports/wiki_pages_about_non_existing_keys.js.erb
+++ b/web/viewsjs/reports/wiki_pages_about_non_existing_keys.js.erb
@@ -9,11 +9,11 @@ function page_init() {
         colModel: [
             { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="Wiki"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' },
             { display: '<img src="/img/sources/josm.16.png" alt="JOSM" width="16" height="16" title="JOSM"/>', name: 'in_josm', width: 20, sortable: true, align: 'center' },
-            { display: '<%= osm.key %>', name: 'key', width: 250, sortable: true, align: 'left' },
-            { display: '<%= page.wiki_pages %>', name: 'wikipages', width: 600, sortable: false, align: 'left' }
+            { display: '<%= h(osm.key) %>', name: 'key', width: 250, sortable: true, align: 'left' },
+            { display: '<%= h(page.wiki_pages) %>', name: 'wikipages', width: 600, sortable: false, align: 'left' }
         ],
         searchitems: [
-            { display: '<%= osm.key %>', name: 'key' }
+            { display: '<%= h(osm.key) %>', name: 'key' }
         ],
         sortname: 'count_all',
         sortorder: 'desc',
diff --git a/web/viewsjs/search.js.erb b/web/viewsjs/search.js.erb
index 3e65214..195f2fc 100644
--- a/web/viewsjs/search.js.erb
+++ b/web/viewsjs/search.js.erb
@@ -34,8 +34,8 @@ var create_flexigrid_for = {
         create_flexigrid('grid-keys', {
             url: '/api/4/keys/all?query=' + encodeURIComponent(query),
             colModel: [
-                { display: '<%= misc.count %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
-                { display: '<%= osm.key %>', name: 'key', width: 500, sortable: true }
+                { display: '<%= h(misc.count) %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
+                { display: '<%= h(osm.key) %>', name: 'key', width: 500, sortable: true }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
@@ -54,9 +54,9 @@ var create_flexigrid_for = {
         create_flexigrid('grid-values', {
             url: '/api/4/search/by_value?query=' + encodeURIComponent(query),
             colModel: [
-                { display: '<%= misc.count %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
-                { display: '<%= osm.key %>', name: 'key', width: 250, sortable: true },
-                { display: '<%= osm.value %>', name: 'value', width: 500, sortable: true }
+                { display: '<%= h(misc.count) %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
+                { display: '<%= h(osm.key) %>', name: 'key', width: 250, sortable: true },
+                { display: '<%= h(osm.value) %>', name: 'value', width: 500, sortable: true }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
@@ -76,8 +76,8 @@ var create_flexigrid_for = {
         create_flexigrid('grid-relations', {
             url: '/api/4/relations/all?query=' + encodeURIComponent(query),
             colModel: [
-                { display: '<%= misc.count %>', name: 'count', width: 80, sortable: true, align: 'right' },
-                { display: '<%= osm.relation_type %>', name: 'rtype', width: 500, sortable: true }
+                { display: '<%= h(misc.count) %>', name: 'count', width: 80, sortable: true, align: 'right' },
+                { display: '<%= h(osm.relation_type) %>', name: 'rtype', width: 500, sortable: true }
             ],
             sortname: 'count',
             sortorder: 'desc',
@@ -96,9 +96,9 @@ var create_flexigrid_for = {
         create_flexigrid('grid-roles', {
             url: '/api/4/search/by_role?query=' + encodeURIComponent(query),
             colModel: [
-                { display: '<%= misc.count %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
-                { display: '<%= osm.relation_types %>', name: 'rtype', width: 250, sortable: true },
-                { display: '<%= osm.relation_member_roles %>', name: 'role', width: 500, sortable: true }
+                { display: '<%= h(misc.count) %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
+                { display: '<%= h(osm.relation_types) %>', name: 'rtype', width: 250, sortable: true },
+                { display: '<%= h(osm.relation_member_roles) %>', name: 'role', width: 500, sortable: true }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
@@ -119,9 +119,9 @@ var create_flexigrid_for = {
         create_flexigrid('grid-tags', {
             url: '/api/4/search/by_key_and_value?query=' + encodeURIComponent(query),
             colModel: [
-                { display: '<%= misc.count %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
-                { display: '<%= osm.key %>', name: 'key', width: 300, sortable: true },
-                { display: '<%= osm.value %>', name: 'value', width: 500, sortable: true }
+                { display: '<%= h(misc.count) %>', name: 'count_all', width: 80, sortable: true, align: 'right' },
+                { display: '<%= h(osm.key) %>', name: 'key', width: 300, sortable: true },
+                { display: '<%= h(osm.value) %>', name: 'value', width: 500, sortable: true }
             ],
             sortname: 'count_all',
             sortorder: 'desc',
@@ -141,8 +141,8 @@ var create_flexigrid_for = {
         create_flexigrid('grid-fulltext', {
             url: '/api/4/search/by_keyword?query=' + encodeURIComponent(query),
             colModel: [
-                { display: '<%= osm.key %>', name: 'key', width: 300, sortable: true },
-                { display: '<%= osm.value %>', name: 'value', width: 500, sortable: true }
+                { display: '<%= h(osm.key) %>', name: 'key', width: 300, sortable: true },
+                { display: '<%= h(osm.value) %>', name: 'value', width: 500, sortable: true }
             ],
             sortname: 'key',
             sortorder: 'asc',
diff --git a/web/viewsjs/tag.js.erb b/web/viewsjs/tag.js.erb
index f71990d..f9181d4 100644
--- a/web/viewsjs/tag.js.erb
+++ b/web/viewsjs/tag.js.erb
@@ -18,8 +18,8 @@ var create_flexigrid_for = {
         create_flexigrid('grid-overview', {
             url: '/api/4/tag/stats?key=' + encodeURIComponent(key) + '&value=' + encodeURIComponent(value),
             colModel: [
-                { display: '<%= misc.object_type %>', name: 'type', width: 100, sortable: true },
-                { display: '<%= page.number_objects %>', name: 'count', width: 260, sortable: true, align: 'center' }
+                { display: '<%= h(misc.object_type) %>', name: 'type', width: 100, sortable: true },
+                { display: '<%= h(page.number_objects) %>', name: 'count', width: 260, sortable: true, align: 'center' }
             ],
             usepager: false,
             useRp: false,
@@ -41,12 +41,12 @@ var create_flexigrid_for = {
         create_flexigrid('grid-combinations', {
             url: '/api/4/tag/combinations?key=' + encodeURIComponent(key) + '&value=' + encodeURIComponent(value) + '&filter=' + encodeURIComponent(filter_type),
             colModel: [
-                { display: '<span title="<%= page.other_tags_used.to_count_tooltip %>"><%= misc.count %> &rarr;</span>', name: 'to_count', width: 260, sortable: true, align: 'center' },
-                { display: '<span title="<%= page.other_tags_used.other_key_tooltip %>"><%= page.other_tags_used.other %></span>', name: 'other_tag', width: 400, sortable: true },
-                { display: '<span title="<%= page.other_tags_used.from_count_tooltip %>">&rarr; <%= misc.count %></span>', name: 'from_count', width: 260, sortable: true, align: 'center' }
+                { display: '<span title="<%= h(page.other_tags_used.to_count_tooltip) %>"><%= h(misc.count) %> &rarr;</span>', name: 'to_count', width: 260, sortable: true, align: 'center' },
+                { display: '<span title="<%= h(page.other_tags_used.other_key_tooltip) %>"><%= h(page.other_tags_used.other) %></span>', name: 'other_tag', width: 400, sortable: true },
+                { display: '<span title="<%= h(page.other_tags_used.from_count_tooltip) %>">&rarr; <%= h(misc.count) %></span>', name: 'from_count', width: 260, sortable: true, align: 'center' }
             ],
             searchitems: [
-                { display: '<%= page.other_tags_used.other %>', name: 'other_tag' }
+                { display: '<%= h(page.other_tags_used.other) %>', name: 'other_tag' }
             ],
             sortname: 'to_count',
             sortorder: 'desc',
@@ -66,14 +66,14 @@ var create_flexigrid_for = {
         create_flexigrid('grid-wiki', {
             url: '/api/4/tag/wiki_pages?key=' + encodeURIComponent(key) + '&value=' + encodeURIComponent(value),
             colModel: [
-                { display: '<%= misc.language %>', name: 'lang', width: 150, sortable: false },
-                { display: '<%= page.wiki_pages.wiki_page %>', name: 'title', width: 200, sortable: false, align: 'right' },
-                { display: '<%= misc.description %>', name: 'description', width: 400, sortable: false },
-                { display: '<%= misc.image %>', name: 'image', width: 120, sortable: false },
-                { display: '<%= osm.objects %>', name: 'objects', width:  80, sortable: false },
-                { display: '<%= page.wiki_pages.implied_tags %>', name: 'tags_implied', width: 120, sortable: false },
-                { display: '<%= page.wiki_pages.combined_tags %>', name: 'tags_combination', width: 120, sortable: false },
-                { display: '<%= page.wiki_pages.linked_tags %>', name: 'tags_linked', width: 220, sortable: false }
+                { display: '<%= h(misc.language) %>', name: 'lang', width: 150, sortable: false },
+                { display: '<%= h(page.wiki_pages.wiki_page) %>', name: 'title', width: 200, sortable: false, align: 'right' },
+                { display: '<%= h(misc.description) %>', name: 'description', width: 400, sortable: false },
+                { display: '<%= h(misc.image) %>', name: 'image', width: 120, sortable: false },
+                { display: '<%= h(osm.objects) %>', name: 'objects', width:  80, sortable: false },
+                { display: '<%= h(page.wiki_pages.implied_tags) %>', name: 'tags_implied', width: 120, sortable: false },
+                { display: '<%= h(page.wiki_pages.combined_tags) %>', name: 'tags_combination', width: 120, sortable: false },
+                { display: '<%= h(page.wiki_pages.linked_tags) %>', name: 'tags_linked', width: 220, sortable: false }
             ],
             usepager: false,
             useRp: false,
@@ -104,10 +104,10 @@ var create_flexigrid_for = {
         create_flexigrid('grid-josm', {
             url: '/api/4/tag/josm/style/rules?style=standard&key=' + encodeURIComponent(key) + '&value=' + encodeURIComponent(value),
             colModel: [
-                { display: '<%= osm.value %>', name: 'value', width: 400, sortable: false },
-                { display: '<%= misc.icon %>', name: 'icon', width: 40, sortable: false, align: 'center' },
-                { display: '<%= misc.line %>', name: 'line', width: 40, sortable: false, align: 'center' },
-                { display: '<%= misc.area %>', name: 'area', width: 40, sortable: false, align: 'center' }
+                { display: '<%= h(osm.value) %>', name: 'value', width: 400, sortable: false },
+                { display: '<%= h(misc.icon) %>', name: 'icon', width: 40, sortable: false, align: 'center' },
+                { display: '<%= h(misc.line) %>', name: 'line', width: 40, sortable: false, align: 'center' },
+                { display: '<%= h(misc.area) %>', name: 'area', width: 40, sortable: false, align: 'center' }
             ],
             sortname: 'value',
             sortorder: 'asc',
diff --git a/web/viewsjs/tags.js.erb b/web/viewsjs/tags.js.erb
index f87351d..3c44bc4 100644
--- a/web/viewsjs/tags.js.erb
+++ b/web/viewsjs/tags.js.erb
@@ -6,15 +6,15 @@ function page_init() {
     create_flexigrid('grid-tags', {
         url: '/api/4/tags/popular',
         colModel: [
-            { display: '<%= osm.tag %>', name: 'tag', width: 300, sortable: true },
-            { display: '<span title="<%= misc.objects_tooltip %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= osm.objects %></span>', name: 'count_all', width: 220, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.nodes_tooltip %>"><img src="/img/types/node.16.png" width="16" height="16" alt=""/> <%= osm.nodes %></span>', name: 'count_nodes', width: 220, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.ways_tooltip %>"><img src="/img/types/way.16.png" width="16" height="16" alt=""/> <%= osm.ways %></span>', name: 'count_ways', width: 220, sortable: true, align: 'center' },
-            { display: '<span title="<%= misc.relations_tooltip %>"><img src="/img/types/relation.16.png" width="16" height="16" alt=""/> <%= osm.relations %></span>', name: 'count_relations',  width: 220, sortable: true, align: 'center' },
-            { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= misc.in_wiki_tooltip %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' }
+            { display: '<%= h(osm.tag) %>', name: 'tag', width: 300, sortable: true },
+            { display: '<span title="<%= h(misc.objects_tooltip) %>"><img src="/img/types/all.16.png" width="16" height="16" alt=""/> <%= h(osm.objects) %></span>', name: 'count_all', width: 220, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.nodes_tooltip) %>"><img src="/img/types/node.16.png" width="16" height="16" alt=""/> <%= h(osm.nodes) %></span>', name: 'count_nodes', width: 220, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.ways_tooltip) %>"><img src="/img/types/way.16.png" width="16" height="16" alt=""/> <%= h(osm.ways) %></span>', name: 'count_ways', width: 220, sortable: true, align: 'center' },
+            { display: '<span title="<%= h(misc.relations_tooltip) %>"><img src="/img/types/relation.16.png" width="16" height="16" alt=""/> <%= h(osm.relations) %></span>', name: 'count_relations',  width: 220, sortable: true, align: 'center' },
+            { display: '<img src="/img/sources/wiki.16.png" alt="Wiki" width="16" height="16" title="<%= h(misc.in_wiki_tooltip) %>"/>', name: 'in_wiki', width: 20, sortable: true, align: 'center' }
         ],
         searchitems: [
-            { display: '<%= osm.tag %>', name: 'tag' }
+            { display: '<%= h(osm.tag) %>', name: 'tag' }
         ],
         sortname: 'count_all',
         sortorder: 'desc',