diff --git a/app/views/contexts/_context_listing.rhtml b/app/views/contexts/_context_listing.rhtml
index 50e12306..ed647b30 100644
--- a/app/views/contexts/_context_listing.rhtml
+++ b/app/views/contexts/_context_listing.rhtml
@@ -21,7 +21,7 @@
       <% end %>
       <a class="delete_context_button" href="<%= formatted_context_path(context, :js) %>" title="delete the context '<%= context.name %>'"><%= image_tag( "blank.png", :title => "Delete context", :class=>"delete_item") %></a>
       <%= apply_behavior "a.delete_context_button:click", { :prevent_default => true, :external => true} do |page, element|
-               page.confirming "Are you sure that you want to delete the context \"#{context.name}\"? Be aware that this will also delete all (repeating) actions in this context!" do
+               page.confirming "Are you sure that you want to delete the context \"#{escape_javascript(h(context.name))}\"? Be aware that this will also delete all (repeating) actions in this context!" do
                  element.up('.context').start_waiting
                  page << remote_to_href(:method => 'delete')
                end
diff --git a/app/views/shared/_add_new_item_form.rhtml b/app/views/shared/_add_new_item_form.rhtml
index d3d64c7d..7c8c292c 100644
--- a/app/views/shared/_add_new_item_form.rhtml
+++ b/app/views/shared/_add_new_item_form.rhtml
@@ -28,7 +28,7 @@
 
 <script type="text/javascript" charset="utf-8">
   function askIfNewContextProvided() {
-    var contexts = new Array(<%= @contexts.map{|c| '\'' + c.name + '\''}.join(", ") %>);
+    var contexts = new Array(<%= @contexts.map{|c| '\'' + escape_javascript(c.name) + '\''}.join(", ") %>);
     var givenContextName = $('todo_context_name').value;
     if (givenContextName.length == 0) return true; // show rails validation error
     for (var i = 0; i < contexts.length; ++i) {
@@ -48,9 +48,9 @@
 <label for="todo_notes">Notes</label>
 <%= text_area( "todo", "notes", "cols" => 29, "rows" => 6, "tabindex" => 2) %>
 
-<input id="default_project_name_id" name="default_project_name" type="hidden" value="<%=@initial_project_name-%>" />
+<input id="default_project_name_id" name="default_project_name" type="hidden" value="<%= h @initial_project_name-%>" />
 <label for="todo_project_name">Project</label>
-<input id="todo_project_name" name="project_name" autocomplete="off" tabindex="3" size="30" type="text" value="<%= @initial_project_name %>" />
+<input id="todo_project_name" name="project_name" autocomplete="off" tabindex="3" size="30" type="text" value="<%= h @initial_project_name %>" />
 <div class="page_name_auto_complete" id="project_list" style="display:none"></div>
 
 <script type="text/javascript">
@@ -67,9 +67,9 @@ Event.observe($('todo_project_name'), "click", projectAutoCompleter.activate.bin
 Event.observe($('todo_project_name'), "blur", selectDefaultContext.bind($('todo_project_name')));
 </script>
 
-<input id="default_context_name_id" name="default_context_name" type="hidden" value="<%=@initial_context_name-%>" />
+<input id="default_context_name_id" name="default_context_name" type="hidden" value="<%=  h @initial_context_name-%>" />
 <label for="todo_context_name">Context</label>
-<input id="todo_context_name" name="context_name" autocomplete="off" tabindex="4" size="30" type="text" value="<%= @initial_context_name %>" />
+<input id="todo_context_name" name="context_name" autocomplete="off" tabindex="4" size="30" type="text" value="<%= h @initial_context_name %>" />
 <div class="page_name_auto_complete" id="context_list" style="display:none"></div>
 
 <script type="text/javascript">
diff --git a/app/views/todos/_edit_form.rhtml b/app/views/todos/_edit_form.rhtml
index 10b9e3ed..e19954e5 100644
--- a/app/views/todos/_edit_form.rhtml
+++ b/app/views/todos/_edit_form.rhtml
@@ -12,7 +12,7 @@
 
 <div class="project_input">
 <label for="<%= dom_id(@todo, 'project_name') %>">Project</label>
-<input id="<%= dom_id(@todo, 'project_name') %>" name="project_name" autocomplete="off" tabindex="10" size="30" type="text" value="<%= @todo.project.nil? ? 'None' : @todo.project.name.gsub(/"/,"&quot;") %>" />
+<input id="<%= dom_id(@todo, 'project_name') %>" name="project_name" autocomplete="off" tabindex="10" size="30" type="text" value="<%= @todo.project.nil? ? 'None' : h(@todo.project.name) %>" />
 <div class="page_name_auto_complete" id="<%= dom_id(@todo, 'project_list') %>" style="display:none"></div>
 
 <script type="text/javascript">
@@ -32,7 +32,7 @@ Event.observe($('<%= dom_id(@todo, 'project_name') %>'), "blur", selectDefaultCo
 
 <div class="context_input">
 <label for="<%= dom_id(@todo, 'context_name') %>">Context</label>
-<input id="<%= dom_id(@todo, 'context_name') %>" name="context_name" autocomplete="off" tabindex="11" size="30" type="text" value="<%= @todo.context.name %>" />
+<input id="<%= dom_id(@todo, 'context_name') %>" name="context_name" autocomplete="off" tabindex="11" size="30" type="text" value="<%= h @todo.context.name %>" />
 <div class="page_name_auto_complete" id="<%= dom_id(@todo, 'context_list') %>" style="display:none"></div>
 
 <script type="text/javascript">