diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index f2e2b1ae..76c662b7 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -110,19 +110,18 @@ class ApplicationController < ActionController::Base
   def for_autocomplete(coll, substr)
     if substr # protect agains empty request
       filtered = coll.find_all{|item| item.name.downcase.include? substr.downcase}
-      json_elems = "[{" + filtered.map {|item| "\"value\" : \"#{item.name}\", \"id\" : \"#{item.id}\""}.join("},{") + "}]"
-      return json_elems == "[{}]" ? "" : json_elems
+      json_elems = Array[*filtered.map{ |e| {:id => e.id.to_s, :value => e.name} }].to_json
+      return json_elems
     else
       return ""
     end
   end
 
   def format_dependencies_as_json_for_auto_complete(entries)
-    json_elems = "[{" + entries.map {|item| "\"value\" : \"#{item.id}\", \"label\" : \"#{item.specification()}\""}.join("},{") + "}]"
-    return json_elems == "[{}]" ? "" : json_elems
+    json_elems = Array[*entries.map{ |e| {:value => e.id.to_s, :label => e.specification} }].to_json
+    return json_elems
   end
 
-
   # Uses RedCloth to transform text using either Textile or Markdown Need to
   # require redcloth above RedCloth 3.0 or greater is needed to use Markdown,
   # otherwise it only handles Textile
diff --git a/app/helpers/todos_helper.rb b/app/helpers/todos_helper.rb
index 1f347fb4..c39dbdce 100644
--- a/app/helpers/todos_helper.rb
+++ b/app/helpers/todos_helper.rb
@@ -264,13 +264,13 @@ module TodosHelper
   end
   
   def default_contexts_for_autocomplete
-    projects = current_user.projects.find(:all, :include => [:context], :conditions => ['default_context_id is not null'])
-    Hash[*projects.map{ |p| [p.name, p.default_context.name] }.flatten].to_json
+    projects = current_user.uncompleted.projects.find(:all, :include => [:context], :conditions => ['default_context_id is not null'])
+    Hash[*projects.map{ |p| [escape_javascript(p.name), escape_javascript(p.default_context.name)] }.flatten].to_json
   end
   
   def default_tags_for_autocomplete
-    projects = current_user.projects.find(:all, :conditions => ["default_tags != ''"])
-    Hash[*projects.map{ |p| [p.name, p.default_tags] }.flatten].to_json
+    projects = current_user.projects.uncompleted.find(:all, :conditions => ["default_tags != ''"])
+    Hash[*projects.map{ |p| [escape_javascript(p.name), p.default_tags] }.flatten].to_json
   end
 
   def format_ical_notes(notes)
diff --git a/app/views/todos/_new_todo_form.rhtml b/app/views/todos/_new_todo_form.rhtml
index 2d5c7b33..7a258d74 100644
--- a/app/views/todos/_new_todo_form.rhtml
+++ b/app/views/todos/_new_todo_form.rhtml
@@ -2,8 +2,8 @@
 
 <div id="todo_new_action">
   <% form_for(todo, :html=> { :id=>'todo-form-new-action', :name=>'todo', :class => 'inline-form new_todo_form' }) do |t|%>
-    <input id="default_project_name_id" name="default_project_name" type="hidden" value="<%=@initial_project_name-%>" />
-    <input id="default_context_name_id" name="default_context_name" type="hidden" value="<%=@initial_context_name-%>" />
+    <input id="default_project_name_id" name="default_project_name" type="hidden" value="<%= h(@initial_project_name)-%>" />
+    <input id="default_context_name_id" name="default_context_name" type="hidden" value="<%= h(@initial_context_name)-%>" />
 
     <div id="error_status"><%= error_messages_for("item", :object_name => 'action') %></div>
 
@@ -14,11 +14,11 @@
     <%= t.text_area("notes", "cols" => 29, "rows" => 6, "tabindex" => 2) %>
 
     <label for="todo_project_name"><%= Todo.human_attribute_name('project') %></label>
-    <input id="todo_project_name" name="project_name" autocomplete="off" tabindex="3" size="30" type="text" value="<%= @initial_project_name %>" />
+    <input id="todo_project_name" name="project_name" autocomplete="off" tabindex="3" size="30" type="text" value="<%= h(@initial_project_name) %>" />
     <div class="page_name_auto_complete" id="project_list" style="display:none"></div>
 
     <label for="todo_context_name"><%= Todo.human_attribute_name('context') %></label>
-    <input id="todo_context_name" name="context_name" autocomplete="off" tabindex="4" size="30" type="text" value="<%= @initial_context_name %>" />
+    <input id="todo_context_name" name="context_name" autocomplete="off" tabindex="4" size="30" type="text" value="<%= h(@initial_context_name) %>" />
 
     <label for="tag_list"><%= Todo.human_attribute_name('tags') + ' (' + t('shared.separate_tags_with_commas') + ')' %></label>
     <%= text_field_tag "tag_list", @default_tags, :size => 30, :tabindex => 5 %>