From 4d28066bde9581b82996a22d22e0ed252c54bfee Mon Sep 17 00:00:00 2001
From: bnu <bnufactory@gmail.com>
Date: Thu, 27 Sep 2018 13:08:44 +0900
Subject: [PATCH] =?UTF-8?q?#2301=20noescape=20=EB=AA=85=EC=8B=9C=EC=A0=81?=
 =?UTF-8?q?=20=EC=A7=80=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 layouts/default/layout.html                   |  12 +--
 layouts/user_layout/layout.html               |  12 +--
 layouts/xedition/layout.html                  |   6 +-
 m.layouts/colorCode/layout.html               | 100 +++++++++---------
 m.layouts/default/layout.html                 |   2 +-
 m.layouts/simpleGray/layout.html              |   2 +-
 modules/admin/tpl/layout.html                 |   2 +-
 modules/board/m.skins/default/_list.html      |   4 +-
 modules/board/m.skins/default/comment.html    |  96 ++++++++---------
 .../board/m.skins/default/comment_form.html   |   4 +-
 modules/board/m.skins/default/read.html       |   8 +-
 modules/board/m.skins/default/write_form.html |   4 +-
 modules/board/m.skins/simpleGray/_list.html   |   4 +-
 .../m.skins/simpleGray/comment_form.html      |   4 +-
 modules/board/m.skins/simpleGray/read.html    |   8 +-
 .../board/m.skins/simpleGray/write_form.html  |   4 +-
 modules/board/skins/default/_comment.html     |   4 +-
 modules/board/skins/default/_footer.html      |   2 +-
 modules/board/skins/default/_read.html        |   8 +-
 modules/board/skins/default/comment_form.html |   4 +-
 .../skins/default/delete_comment_form.html    |   2 +-
 modules/board/skins/default/delete_form.html  |   4 +-
 modules/board/skins/default/list.html         |  10 +-
 modules/board/skins/default/write_form.html   |   4 +-
 modules/board/skins/xedition/_read.html       |   4 +-
 .../board/skins/xedition/comment_form.html    |   4 +-
 .../skins/xedition/delete_comment_form.html   |   2 +-
 modules/board/skins/xedition/delete_form.html |   4 +-
 modules/board/skins/xedition/list.html        |  10 +-
 modules/board/skins/xedition/write_form.html  |   4 +-
 modules/board/tpl/addition_setup.html         |   2 +-
 .../board/tpl/smartphone/comment_list.html    |   2 +-
 .../board/tpl/smartphone/view_document.html   |   2 +-
 .../m.skins/default/read_message.html         |   2 +-
 .../m.skins/default/send_message.html         |   4 +-
 .../communication/skins/default/messages.html |   2 +-
 .../skins/default/new_message.html            |   2 +-
 .../skins/default/send_message.html           |   2 +-
 modules/document/tpl/checked_list.html        |   4 +-
 modules/document/tpl/declared_list.html       |   4 +-
 modules/document/tpl/document_alias.html      |   2 +-
 modules/document/tpl/document_trash_list.html |   2 +-
 modules/document/tpl/print_page.html          |   4 +-
 modules/document/tpl/saved_list_popup.html    |   4 +-
 modules/file/tpl/file_list.html               |   2 +-
 .../skins/default/document.html               |   2 +-
 modules/member/skins/default/saved_list.html  |   4 +-
 .../tpl/include.module_addition_setup.html    |   2 +-
 modules/module/tpl/module_addition_setup.html |   2 +-
 modules/page/m.skins/default/mobile.html      |   4 +-
 modules/page/skins/default/content.html       |   4 +-
 modules/page/tpl/addition_setup.html          |   2 +-
 modules/page/tpl/article_content_modify.html  |   2 +-
 modules/page/tpl/skin_info.html               |   2 +-
 modules/trash/tpl/trash_list.html             |   2 +-
 widgets/content/skins/default/gallery.html    |   2 +-
 .../content/skins/default/image_title.html    |   8 +-
 .../skins/default/image_title_content.html    |   6 +-
 widgets/content/skins/default/normal.html     |   8 +-
 .../content/skins/default/title_content.html  |  12 +--
 .../mcontent/skins/default/image_title.html   |   2 +-
 .../skins/default/image_title_content.html    |   4 +-
 widgets/mcontent/skins/default/normal.html    |   2 +-
 widgetstyles/simple/widgetstyle.html          |   2 +-
 64 files changed, 225 insertions(+), 225 deletions(-)

diff --git a/layouts/default/layout.html b/layouts/default/layout.html
index 9de14f4c12..b8a2997269 100644
--- a/layouts/default/layout.html
+++ b/layouts/default/layout.html
@@ -31,9 +31,9 @@ <h1>
 		<nav class="gnb" id="gnb">
 			<ul>
 				<li loop="$GNB->list=>$key1,$val1" class="active"|cond="$val1['selected']">
-					<a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']}</a>
+					<a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']|noescape}</a>
 					<ul cond="$val1['list']">
-						<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']}</a></li>
+						<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']|noescape}</a></li>
 					</ul>
 				</li>
 			</ul>
@@ -86,11 +86,11 @@ <h1>
 	<div class="body main"|cond="$layout_info->LAYOUT_TYPE=='MAIN_PAGE'" class="body sub"|cond="$layout_info->LAYOUT_TYPE=='SUB_PAGE'">
 		<!-- LNB -->
 		<nav class="lnb" cond="$layout_info->LAYOUT_TYPE == 'SUB_PAGE'">
-			<h1 loop="$GNB->list=>$key1,$val1" cond="$val1['selected']"><a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']}</a></h1>
+			<h1 loop="$GNB->list=>$key1,$val1" cond="$val1['selected']"><a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']|noescape}</a></h1>
 			<ul loop="$GNB->list=>$key1,$val1" cond="$val1['selected'] && $val1['list']">
-				<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']}</a>
+				<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']|noescape}</a>
 					<ul cond="$val2['list']">
-						<li loop="$val2['list']=>$key3,$val3" class="active"|cond="$val3['selected']"><a href="{$val3['href']}" target="_blank"|cond="$val3['open_window']=='Y'">{$val3['link']}</a></li>
+						<li loop="$val2['list']=>$key3,$val3" class="active"|cond="$val3['selected']"><a href="{$val3['href']}" target="_blank"|cond="$val3['open_window']=='Y'">{$val3['link']|noescape}</a></li>
 					</ul>
 				</li>
 			</ul>
@@ -98,7 +98,7 @@ <h1 loop="$GNB->list=>$key1,$val1" cond="$val1['selected']"><a href="{$val1['hre
 		<!-- /LNB -->
 		<!-- CONTENT -->
 		<div class="content" id="content">
-			{$content}
+			{$content|noescape}
 		</div>
 		<!-- /CONTENT -->
 	</div>
diff --git a/layouts/user_layout/layout.html b/layouts/user_layout/layout.html
index 0a2f46f6fa..9314cd3a36 100644
--- a/layouts/user_layout/layout.html
+++ b/layouts/user_layout/layout.html
@@ -13,9 +13,9 @@ <h1>Site Logo</h1>
 		<div class="gnb">
 			.gnb
 			<ul>
-				<li loop="$global_menu->list=>$key1,$val1" class="active"|cond="$val1['selected']"><a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']}</a>
+				<li loop="$global_menu->list=>$key1,$val1" class="active"|cond="$val1['selected']"><a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']|noescape}</a>
 					<ul cond="$val1['list']">
-						<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']}</a></li>
+						<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']|noescape}</a></li>
 					</ul>
 				</li>
 			</ul>
@@ -29,18 +29,18 @@ <h1>Site Logo</h1>
 			</div>
 			<hr />
 			.lnb
-			<h2 loop="$global_menu->list=>$key1,$val1" cond="$val1['selected']"><a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']}</a></h2>
+			<h2 loop="$global_menu->list=>$key1,$val1" cond="$val1['selected']"><a href="{$val1['href']}" target="_blank"|cond="$val1['open_window']=='Y'">{$val1['link']|noescape}</a></h2>
 			<ul loop="$global_menu->list=>$key1,$val1" cond="$val1['selected'] && $val1['list']">
-				<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']}</a>
+				<li loop="$val1['list']=>$key2,$val2" class="active"|cond="$val2['selected']"><a href="{$val2['href']}" target="_blank"|cond="$val2['open_window']=='Y'">{$val2['link']|noescape}</a>
 					<ul cond="$val2['list']">
-						<li loop="$val2['list']=>$key3,$val3" class="active"|cond="$val3['selected']"><a href="{$val3['href']}" target="_blank"|cond="$val3['open_window']=='Y'">{$val3['link']}</a>
+						<li loop="$val2['list']=>$key3,$val3" class="active"|cond="$val3['selected']"><a href="{$val3['href']}" target="_blank"|cond="$val3['open_window']=='Y'">{$val3['link']|noescape}</a>
 						</li>
 					</ul>
 				</li>
 			</ul>
 		</div>
 		<hr />
-		<div class="content">.content{$content}</div>
+		<div class="content">.content {$content|noescape}</div>
 	</div>
 	<hr />
 	<div class="footer">.footer</div>
diff --git a/layouts/xedition/layout.html b/layouts/xedition/layout.html
index d88c4be558..49e6428cf9 100644
--- a/layouts/xedition/layout.html
+++ b/layouts/xedition/layout.html
@@ -253,7 +253,7 @@ <h1 class="logo-item">
 			<div cond="$_enable_unb && $UNB->list" class="custom_area">
 				<ul>
 					<li loop="$UNB->list => $key, $val">
-						<a href="{$val['href']}" target="_blank"|cond="$val['open_window'] == 'Y'">{$val['link']}</a>
+						<a href="{$val['href']}" target="_blank"|cond="$val['open_window'] == 'Y'">{$val['link']|noescape}</a>
 					</li>
 				</ul>
 			</div>
@@ -370,7 +370,7 @@ <h1>{$sub_header_title}</h1>
 		<!-- /LNB -->
 		<!-- CONTENT -->
 			<div class="content" id="content">
-				{$content}
+				{$content|noescape}
 			</div>
 			<!--@if($layout_info->use_demo === 'Y')-->
 				<include target="./demo/welcome_main.html" />
@@ -392,7 +392,7 @@ <h1>{$sub_header_title}</h1>
 							<!--@end-->
 						</a>
 					</p>
-					<p class="sub_desc">{$layout_info->footer_text}</p>
+					<p class="sub_desc">{$layout_info->footer_text|noescape}</p>
 				<!--@else-->
 					<include target="./demo/footer.html" />
 				<!--@end-->
diff --git a/m.layouts/colorCode/layout.html b/m.layouts/colorCode/layout.html
index 8563482710..00ab7df934 100644
--- a/m.layouts/colorCode/layout.html
+++ b/m.layouts/colorCode/layout.html
@@ -1,50 +1,50 @@
-<load target="css/Blue/layout.css" cond="$layout_info->colorset=='blue' || !$layout_info->colorset" />
-<load target="css/Gray/layout.css" cond="$layout_info->colorset=='gray'" />
-<load target="css/Red/layout.css" cond="$layout_info->colorset=='red'" />
-<load target="css/Orange/layout.css" cond="$layout_info->colorset=='orange'" />
-<load target="css/nGreenA/layout.css" cond="$layout_info->colorset=='ngreena'" />
-<load target="css/nGreenB/layout.css" cond="$layout_info->colorset=='ngreenb'" />
-<load target="js/layout.js" />
-<div class="skip"><a href="#ct">Skip to Content</a></div>
-<header class="lo_head">
-	<a href="{$layout_info->index_url}" class="btn_home">Home</a>
-
-<!--@if($layout_info->menu->main_menu->menu_srl)-->
-	<!--@if($act=='dispMenuMenu')-->
-	<a class="btn_menu" href="#" onclick="history.back(); return false;" title="{$lang->cmd_back}"><span class="b">Back</span></a>
-	<!--@else-->
-	<a class="btn_menu" href="{getUrl('act','dispMenuMenu','menu_srl',$layout_info->menu->main_menu->menu_srl)}" title="{$lang->menu}"><span class="m">Menu</span></a>
-	<!--@end-->
-<!--@end-->
-<!--@if($layout_info->logo_image)-->
-	<h1 class="title"><a href="{$layout_info->index_url}" class="img"><img src="{$layout_info->logo_image}" alt="{$layout_info->index_title}"|cond="$layout_info->index_title" alt="{Context::getSiteTitle()}"|cond="!$layout_info->index_title && Context::getSiteTitle()" /></a></h1>
-<!--@elseif($layout_info->index_title)-->
-	<h1 class="title"><span class="txt">{$layout_info->index_title}</span></h1>
-<!--@end-->
-</header>
-<hr class="head_hr" />
-<section id="ct" class="ct">
-{$content}
-</section>
-<footer class="lo_foot">
-	<ul class="link">
-	<!--@if($is_logged)-->
-	<li><a href="{getUrl('act','dispMemberLogout')}">{$lang->cmd_logout}</a></li>
-	<li><a href="{getUrl('act', 'dispMemberInfo')}">{$lang->cmd_view_member_info}</a></li>
-	<!--@elseif($act!='dispMemberLoginForm')-->
-	<li><a href="{getUrl('act','dispMemberLoginForm')}" >{$lang->cmd_login}...</a></li>
-	<!--@end-->
-	<li><a href="{getUrl('m',0)}">PC</a></li>
-	<li class="lang off" cond="count($lang_supported)>1">
-		<a href="#" onclick="return false;" title="{$lang_type}">{$lang_supported[$lang_type]} <i class="icon_arr_draw"></i></a>
-		<ul class="lang_lst">
-		<!--@foreach($lang_supported as $key=>$val)-->
-
-			<li cond="$key != $lang_type"><a href="{getUrl('act',$oldact,'l',$key)}">{$val}</a></li>
-
-		<!--@end-->
-		</ul>
-	</li>
-	</ul>
-	<p class="cr">{$layout_info->footer_title}</p>
-</footer>
+<load target="css/Blue/layout.css" cond="$layout_info->colorset=='blue' || !$layout_info->colorset" />
+<load target="css/Gray/layout.css" cond="$layout_info->colorset=='gray'" />
+<load target="css/Red/layout.css" cond="$layout_info->colorset=='red'" />
+<load target="css/Orange/layout.css" cond="$layout_info->colorset=='orange'" />
+<load target="css/nGreenA/layout.css" cond="$layout_info->colorset=='ngreena'" />
+<load target="css/nGreenB/layout.css" cond="$layout_info->colorset=='ngreenb'" />
+<load target="js/layout.js" />
+<div class="skip"><a href="#ct">Skip to Content</a></div>
+<header class="lo_head">
+	<a href="{$layout_info->index_url}" class="btn_home">Home</a>
+
+<!--@if($layout_info->menu->main_menu->menu_srl)-->
+	<!--@if($act=='dispMenuMenu')-->
+	<a class="btn_menu" href="#" onclick="history.back(); return false;" title="{$lang->cmd_back}"><span class="b">Back</span></a>
+	<!--@else-->
+	<a class="btn_menu" href="{getUrl('act','dispMenuMenu','menu_srl',$layout_info->menu->main_menu->menu_srl)}" title="{$lang->menu}"><span class="m">Menu</span></a>
+	<!--@end-->
+<!--@end-->
+<!--@if($layout_info->logo_image)-->
+	<h1 class="title"><a href="{$layout_info->index_url}" class="img"><img src="{$layout_info->logo_image}" alt="{$layout_info->index_title}"|cond="$layout_info->index_title" alt="{Context::getSiteTitle()}"|cond="!$layout_info->index_title && Context::getSiteTitle()" /></a></h1>
+<!--@elseif($layout_info->index_title)-->
+	<h1 class="title"><span class="txt">{$layout_info->index_title}</span></h1>
+<!--@end-->
+</header>
+<hr class="head_hr" />
+<section id="ct" class="ct">
+{$content|noescape}
+</section>
+<footer class="lo_foot">
+	<ul class="link">
+	<!--@if($is_logged)-->
+	<li><a href="{getUrl('act','dispMemberLogout')}">{$lang->cmd_logout}</a></li>
+	<li><a href="{getUrl('act', 'dispMemberInfo')}">{$lang->cmd_view_member_info}</a></li>
+	<!--@elseif($act!='dispMemberLoginForm')-->
+	<li><a href="{getUrl('act','dispMemberLoginForm')}" >{$lang->cmd_login}...</a></li>
+	<!--@end-->
+	<li><a href="{getUrl('m',0)}">PC</a></li>
+	<li class="lang off" cond="count($lang_supported)>1">
+		<a href="#" onclick="return false;" title="{$lang_type}">{$lang_supported[$lang_type]} <i class="icon_arr_draw"></i></a>
+		<ul class="lang_lst">
+		<!--@foreach($lang_supported as $key=>$val)-->
+
+			<li cond="$key != $lang_type"><a href="{getUrl('act',$oldact,'l',$key)}">{$val}</a></li>
+
+		<!--@end-->
+		</ul>
+	</li>
+	</ul>
+	<p class="cr">{$layout_info->footer_title}</p>
+</footer>
diff --git a/m.layouts/default/layout.html b/m.layouts/default/layout.html
index bed11053de..3af2ff8e71 100644
--- a/m.layouts/default/layout.html
+++ b/m.layouts/default/layout.html
@@ -19,7 +19,7 @@ <h1 class="h1"><a href="{$layout_info->index_url}"|cond="$layout_info->index_url
 		<!--@end-->
 	<!--@end-->
 </div>
-{$content}
+{$content|noescape}
 <ul class="ft">
 	<!--@if($is_logged)-->
 	<li class="fl"><a href="{getUrl('act','dispMemberLogout')}">{$lang->cmd_logout}</a></li>
diff --git a/m.layouts/simpleGray/layout.html b/m.layouts/simpleGray/layout.html
index 6f7b685253..f2e93728db 100644
--- a/m.layouts/simpleGray/layout.html
+++ b/m.layouts/simpleGray/layout.html
@@ -5,7 +5,7 @@ <h1 class="h1"><a href="{$layout_info->index_url}">{$layout_info->index_title}</
 	<div class="fr"><a href="{getUrl('act','dispMenuMenu','menu_srl',$layout_info->menu->main_menu->menu_srl)}" class="bn">{$lang->menu}</a></div>
 	<!--@end-->
 </div>
-{$content}
+{$content|noescape}
 <ul class="eg ft">
 	<!--@if($is_logged)-->
 	<li class="fl"><a href="{getUrl('act','dispMemberLogout')}">{$lang->cmd_logout}</a></li>
diff --git a/modules/admin/tpl/layout.html b/modules/admin/tpl/layout.html
index 06f1a97cb1..e34aefb7c1 100644
--- a/modules/admin/tpl/layout.html
+++ b/modules/admin/tpl/layout.html
@@ -1,6 +1,6 @@
 <include target="./_header.html" />
 <div class="content" id="content">
-	{$content}
+	{$content|noescape}
 </div>
 <include target="./_footer.html" />
 
diff --git a/modules/board/m.skins/default/_list.html b/modules/board/m.skins/default/_list.html
index 302ecde79f..6147e6b7ba 100644
--- a/modules/board/m.skins/default/_list.html
+++ b/modules/board/m.skins/default/_list.html
@@ -7,7 +7,7 @@ <h2><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->browser_title}</
 	<!--@foreach($notice_list as $no => $document)-->
 	<li>
 		<a href="{getUrl('document_srl', $document->document_srl)}">
-		<span class="title"><span class="notice">{$lang->notice}</span> <!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--> <strong>{$document->getTitle($module_info->subject_cut_size)}</strong> <!--@if($document->getCommentCount())--><em>[{$document->getCommentCount()}]</em><!--@endif--></span>
+		<span class="title"><span class="notice">{$lang->notice}</span> <!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--> <strong>{$document->getTitle($module_info->subject_cut_size)|noescape}</strong> <!--@if($document->getCommentCount())--><em>[{$document->getCommentCount()}]</em><!--@endif--></span>
 			<span class="auth"><strong>{$document->getNickName()}</strong> <span class="time">{$document->getRegDate("Y.m.d")}</span></span>
 		</a>
 	</li>
@@ -15,7 +15,7 @@ <h2><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->browser_title}</
 	<!--@foreach($document_list as $no => $document)-->
 	<li>
 		<a href="{getUrl('document_srl', $document->document_srl)}">
-			<span class="title"><!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--> <strong>{$document->getTitle($module_info->subject_cut_size)}</strong> <!--@if($document->getCommentCount())--><em>[{$document->getCommentCount()}]</em><!--@endif--></span>
+			<span class="title"><!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--> <strong>{$document->getTitle($module_info->subject_cut_size)|noescape}</strong> <!--@if($document->getCommentCount())--><em>[{$document->getCommentCount()}]</em><!--@endif--></span>
 			<span class="auth"><strong>{$document->getNickName()}</strong> <span class="time">{$document->getRegDate("Y.m.d")}</span></span>
 		</a>
 	</li>
diff --git a/modules/board/m.skins/default/comment.html b/modules/board/m.skins/default/comment.html
index 9ec551a8e0..4fdad181a0 100644
--- a/modules/board/m.skins/default/comment.html
+++ b/modules/board/m.skins/default/comment.html
@@ -1,48 +1,48 @@
-<ul id="cl" class="rp tgo open">
-	{@ $_comment_list = $oDocument->getComments() }
-	{@ $start = true }
-	{@ $depth = 0 }
-	<!--@foreach($_comment_list as $key => $comment)-->
-	<!--@if(!$start && $comment->get('depth') == $depth)-->
-	</li>
-	<!--@end-->
-	<!--@if($comment->get('depth') > $depth)-->
-	<ul>
-	<!--@else-->
-	<!--@while($comment->get('depth') < $depth)-->
-	</li>
-	</ul>
-	{@ $depth -= 1 }
-	<!--@end-->
-	<!--@endif-->
-	<li>
-		{$comment->getContent(false)}
-		<span class="auth">
-			<em>{$comment->getNickName()}</em>
-			<span class="time">{$comment->getRegdate("Y.m.d")}</span>
-			<!--@if($comment->isGranted() || !$comment->get('member_srl'))-->
-			<a href="{getUrl('act','dispBoardDeleteComment','comment_srl',$comment->comment_srl)}" class="btn de">{$lang->cmd_delete}</a>
-			<!--@endif-->
-			<a href="{getUrl('act','dispBoardReplyComment','comment_srl',$comment->comment_srl)}" class="btn re">{$lang->cmd_reply}</a>
-			{@ $start = false }
-			{@ $depth = $comment->get('depth') }
-		</span>
-	<!--@endforeach-->
-	<!--@while($depth > 0)-->
-	</li>
-	</ul>
-	{@ $depth -= 1}
-	<!--@end-->
-	</li>
-</ul>
-<!--@if($oDocument->comment_page_navigation)-->
-	<div id="clpn" class="pn">
-	<!--@if($oDocument->comment_page_navigation->cur_page != 1)-->
-	<a href="#" onclick="loadPage({$oDocument->document_srl}, {$oDocument->comment_page_navigation->cur_page-1}); return false;">&lsaquo; {$lang->cmd_prev}</a>
-	<!--@endif-->
-	<strong id="curpage">{$oDocument->comment_page_navigation->cur_page} / {$oDocument->comment_page_navigation->last_page}</strong>
-	<!--@if($oDocument->comment_page_navigation->cur_page != $oDocument->comment_page_navigation->last_page)-->
-	<a href="#" onclick="loadPage({$oDocument->document_srl}, {$oDocument->comment_page_navigation->cur_page+1}); return false;">{$lang->cmd_next} &rsaquo;</a>
-	<!--@endif-->
-	</div>
-<!--@endif-->
+<ul id="cl" class="rp tgo open">
+	{@ $_comment_list = $oDocument->getComments() }
+	{@ $start = true }
+	{@ $depth = 0 }
+	<!--@foreach($_comment_list as $key => $comment)-->
+	<!--@if(!$start && $comment->get('depth') == $depth)-->
+	</li>
+	<!--@end-->
+	<!--@if($comment->get('depth') > $depth)-->
+	<ul>
+	<!--@else-->
+	<!--@while($comment->get('depth') < $depth)-->
+	</li>
+	</ul>
+	{@ $depth -= 1 }
+	<!--@end-->
+	<!--@endif-->
+	<li>
+		{$comment->getContent(false)|noescape}
+		<span class="auth">
+			<em>{$comment->getNickName()}</em>
+			<span class="time">{$comment->getRegdate("Y.m.d")}</span>
+			<!--@if($comment->isGranted() || !$comment->get('member_srl'))-->
+			<a href="{getUrl('act','dispBoardDeleteComment','comment_srl',$comment->comment_srl)}" class="btn de">{$lang->cmd_delete}</a>
+			<!--@endif-->
+			<a href="{getUrl('act','dispBoardReplyComment','comment_srl',$comment->comment_srl)}" class="btn re">{$lang->cmd_reply}</a>
+			{@ $start = false }
+			{@ $depth = $comment->get('depth') }
+		</span>
+	<!--@endforeach-->
+	<!--@while($depth > 0)-->
+	</li>
+	</ul>
+	{@ $depth -= 1}
+	<!--@end-->
+	</li>
+</ul>
+<!--@if($oDocument->comment_page_navigation)-->
+	<div id="clpn" class="pn">
+	<!--@if($oDocument->comment_page_navigation->cur_page != 1)-->
+	<a href="#" onclick="loadPage({$oDocument->document_srl}, {$oDocument->comment_page_navigation->cur_page-1}); return false;">&lsaquo; {$lang->cmd_prev}</a>
+	<!--@endif-->
+	<strong id="curpage">{$oDocument->comment_page_navigation->cur_page} / {$oDocument->comment_page_navigation->last_page}</strong>
+	<!--@if($oDocument->comment_page_navigation->cur_page != $oDocument->comment_page_navigation->last_page)-->
+	<a href="#" onclick="loadPage({$oDocument->document_srl}, {$oDocument->comment_page_navigation->cur_page+1}); return false;">{$lang->cmd_next} &rsaquo;</a>
+	<!--@endif-->
+	</div>
+<!--@endif-->
diff --git a/modules/board/m.skins/default/comment_form.html b/modules/board/m.skins/default/comment_form.html
index 9b65bf0796..879ae54d6a 100644
--- a/modules/board/m.skins/default/comment_form.html
+++ b/modules/board/m.skins/default/comment_form.html
@@ -7,7 +7,7 @@ <h2><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->browser_title}</
 	</div>
 
 	<!--@if($oSourceComment->isExists())-->
-	<div class="origin">{$oSourceComment->getContent(false)}</div>
+	<div class="origin">{$oSourceComment->getContent(false)|noescape}</div>
 	<!--@end-->
 
 	<form action="./" method="post" class="ff tgo open" onsubmit="return procFilter(this, insert_comment);">
@@ -20,7 +20,7 @@ <h2><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->browser_title}</
 				<label for="rText">{$lang->comment}</label>
 				<!--@if($module_info->mobile_use_editor === 'Y')-->
 					<input type="hidden" name="content" value="{$oComment->getContentText()}">
-					{$oComment->getEditor()}
+					{$oComment->getEditor()|noescape}
 				<!--@else-->
 					<textarea name="content" rows="8" cols="42" id="rText">{$oComment->getContentText()}</textarea>
 				<!--@endif-->
diff --git a/modules/board/m.skins/default/read.html b/modules/board/m.skins/default/read.html
index 97ce21bf1c..2ac8fb291d 100644
--- a/modules/board/m.skins/default/read.html
+++ b/modules/board/m.skins/default/read.html
@@ -3,7 +3,7 @@
 
 <div class="hx h2">
 	<h2><a href="{getUrl('document_srl','','category','','page','')}">{$module_info->browser_title}</a> 
-		<!--@if($module_info->use_category == "Y" && $oDocument->get('category_srl'))-->&rsaquo; <a href="{getUrl('document_srl','','category',$oDocument->get('category_srl'))}">{$category_list[$oDocument->get('category_srl')]->title}</a><!--@end--> &rsaquo; {$oDocument->getTitle()}</h2>
+		<!--@if($module_info->use_category == "Y" && $oDocument->get('category_srl'))-->&rsaquo; <a href="{getUrl('document_srl','','category',$oDocument->get('category_srl'))}">{$category_list[$oDocument->get('category_srl')]->title}</a><!--@end--> &rsaquo; {$oDocument->getTitle()|noescape}</h2>
 	<span class="ex">{$oDocument->getNickName()} | {$oDocument->getRegdate()} | <a href="#skip_co">{$lang->skip_to_content}</a></span>
 	<a href="{getUrl('act','dispBoardWrite','document_srl','')}" class="write">{$lang->cmd_write}</a>
 </div>
@@ -23,11 +23,11 @@ <h2><a href="{getUrl('document_srl','','category','','page','')}">{$module_info-
 			<dl class="xv">
 			<!--@foreach($_extra_vars as $key => $val)-->
 				<dt>{$val->name}</dt>
-				<dd>{$val->getValueHTML()}</dd>
+				<dd>{$val->getValueHTML()|noescape}</dd>
 			<!--@end-->
 			</dl>
 		<!--@end-->
-		{$oDocument->getContent(false)}
+		{$oDocument->getContent(false)|noescape}
 		<!--@end-->
 </div>
 <div id="skip_co"></div>
@@ -84,7 +84,7 @@ <h3>{$lang->write_comment}</h3>
 			<label for="rText">{$lang->comment}</label>
 			<!--@if($module_info->mobile_use_editor === 'Y')-->
 				<input type="hidden" name="content" value="">
-				{$oDocument->getCommentEditor()}
+				{$oDocument->getCommentEditor()|noescape}
 			<!--@else-->
 				<textarea name="content" rows="8" cols="42" id="rText"></textarea>
 			<!--@endif-->
diff --git a/modules/board/m.skins/default/write_form.html b/modules/board/m.skins/default/write_form.html
index bb16137178..ac1b2e573e 100644
--- a/modules/board/m.skins/default/write_form.html
+++ b/modules/board/m.skins/default/write_form.html
@@ -32,7 +32,7 @@ <h3>{$lang->cmd_write}</h3>
 			<!--@foreach($extra_keys as $key=> $val)-->
 			<li class="exvar">
 				<label for="ex_{$val->name}">{$val->name} <!--@if($val->is_required=="Y")-->*<!--@end--></label>
-				{$val->getFormHTML()}
+				{$val->getFormHTML()|noescape}
 			</li>
 			<!--@endforeach-->
 			<!--@endif-->
@@ -41,7 +41,7 @@ <h3>{$lang->cmd_write}</h3>
 				<label for="nText">{$lang->content}</label>
 				<!--@if($module_info->mobile_use_editor === 'Y')-->
 					<input type="hidden" name="content" value="{$oDocument->getContentText()}" />
-					{$oDocument->getEditor()}
+					{$oDocument->getEditor()|noescape}
 				<!--@else-->
 					<textarea name="content" rows="8" cols="42" id="nText"></textarea>
 				<!--@endif-->
diff --git a/modules/board/m.skins/simpleGray/_list.html b/modules/board/m.skins/simpleGray/_list.html
index dc02056828..b7cecbc271 100644
--- a/modules/board/m.skins/simpleGray/_list.html
+++ b/modules/board/m.skins/simpleGray/_list.html
@@ -3,7 +3,7 @@ <h2 class="h2"><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->brows
 		<!--@foreach($notice_list as $no => $document)-->
 		<li>
 			<a href="{getUrl('document_srl', $document->document_srl)}">
-				<span class="notice">{$lang->notice}</span> <span class="title"><!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--><strong>{$document->getTitle($module_info->subject_cut_size)}</strong> <!--@if($document->getCommentCount())--><span>[{$document->getCommentCount()}]</span><!--@endif--></span>
+				<span class="notice">{$lang->notice}</span> <span class="title"><!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--><strong>{$document->getTitle($module_info->subject_cut_size)|noescape}</strong> <!--@if($document->getCommentCount())--><span>[{$document->getCommentCount()}]</span><!--@endif--></span>
 				<span class="auth"><em>{$document->getNickName()}</em> <span>{$document->getRegDate("Y.m.d")}</span></span>
 			</a>
 		</li>
@@ -11,7 +11,7 @@ <h2 class="h2"><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->brows
 		<!--@foreach($document_list as $no => $document)-->
 		<li>
 			<a href="{getUrl('document_srl', $document->document_srl)}">
-				<span class="title"><!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--><strong>{$document->getTitle($module_info->subject_cut_size)}</strong> <!--@if($document->getCommentCount())--><span>[{$document->getCommentCount()}]</span><!--@endif--></span>
+				<span class="title"><!--@if($module_info->use_category == "Y" && $document->get('category_srl'))-->{$category_list[$document->get('category_srl')]->title} &rsaquo;<!--@end--><strong>{$document->getTitle($module_info->subject_cut_size)|noescape}</strong> <!--@if($document->getCommentCount())--><span>[{$document->getCommentCount()}]</span><!--@endif--></span>
 				<span class="auth"><em>{$document->getNickName()}</em> <span>{$document->getRegDate("Y.m.d")}</span></span>
 			</a>
 		</li>
diff --git a/modules/board/m.skins/simpleGray/comment_form.html b/modules/board/m.skins/simpleGray/comment_form.html
index 24ab157a37..a6d6a62d36 100644
--- a/modules/board/m.skins/simpleGray/comment_form.html
+++ b/modules/board/m.skins/simpleGray/comment_form.html
@@ -3,7 +3,7 @@
 
 <div class="bd rd">
 <!--@if($oSourceComment->isExists())-->
-<div class="origin">{$oSourceComment->getContent(false)}</div>
+<div class="origin">{$oSourceComment->getContent(false)|noescape}</div>
 <!--@end-->
 
 		<form action="./" method="POST" class="sn tgo open" onsubmit="return procFilter(this, insert_comment);">
@@ -16,7 +16,7 @@
 				<label for="rText" class="db fb">{$lang->comment}</label>
 				<!--@if($module_info->mobile_use_editor === 'Y')-->
 					<input type="hidden" name="content" value="{$oComment->getContentText()}">
-					{$oComment->getEditor()}
+					{$oComment->getEditor()|noescape}
 				<!--@else-->
 					<textarea name="content" rows="8" cols="42" id="rText" class="itxx">{$oComment->getContentText()}</textarea>
 				<!--@endif-->
diff --git a/modules/board/m.skins/simpleGray/read.html b/modules/board/m.skins/simpleGray/read.html
index a614e486a9..f5e415d5fc 100644
--- a/modules/board/m.skins/simpleGray/read.html
+++ b/modules/board/m.skins/simpleGray/read.html
@@ -4,7 +4,7 @@
 	<div class="rd">
 		<div class="hx">
 			<h2><a href="{getUrl('document_srl','','category','','page','')}">{$module_info->browser_title}</a>
-				<!--@if($module_info->use_category == "Y" && $oDocument->get('category_srl'))-->&rsaquo; <a href="{getUrl('document_srl','','category',$oDocument->get('category_srl'))}">{$category_list[$oDocument->get('category_srl')]->title}</a><!--@end--> &rsaquo; {$oDocument->getTitle()}</h2>
+				<!--@if($module_info->use_category == "Y" && $oDocument->get('category_srl'))-->&rsaquo; <a href="{getUrl('document_srl','','category',$oDocument->get('category_srl'))}">{$category_list[$oDocument->get('category_srl')]->title}</a><!--@end--> &rsaquo; {$oDocument->getTitle()|noescape}</h2>
 			<em><a href="#">{$oDocument->getNickName()}</a></em>
 			<span>{$oDocument->getRegdate()}</span>
 		</div>
@@ -29,11 +29,11 @@ <h2><a href="{getUrl('document_srl','','category','','page','')}">{$module_info-
 					<dl class="xv">
 					<!--@foreach($_extra_vars as $key => $val)-->
 						<dt>{$val->name}</dt>
-						<dd>{$val->getValueHTML()}</dd>
+						<dd>{$val->getValueHTML()|noescape}</dd>
 					<!--@end-->
 					</dl>
 				<!--@end-->
-			    {$oDocument->getContent(false)}
+			    {$oDocument->getContent(false)|noescape}
 				<!--@end-->
 		</div>
 		<!--@if($oDocument->hasUploadedFiles())-->
@@ -75,7 +75,7 @@ <h3 class="h3">{$lang->write_comment} <button type="button" class="tg" title="op
 				<label for="rText" class="db fb">{$lang->comment}</label>
 				<!--@if($module_info->mobile_use_editor === 'Y')-->
 					<input type="hidden" name="content" value="">
-					{$oDocument->getCommentEditor()}
+					{$oDocument->getCommentEditor()|noescape}
 				<!--@else-->
 					<textarea name="content" rows="8" cols="42" id="rText" class="itxx"></textarea>
 				<!--@endif-->
diff --git a/modules/board/m.skins/simpleGray/write_form.html b/modules/board/m.skins/simpleGray/write_form.html
index df8607468d..4dafbe2f2c 100644
--- a/modules/board/m.skins/simpleGray/write_form.html
+++ b/modules/board/m.skins/simpleGray/write_form.html
@@ -27,7 +27,7 @@ <h2 class="h2"><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->brows
 			<!--@foreach($extra_keys as $key=> $val)-->
 			<li class="exvar">
 				<label for="ex_{$val->name}" class="db fb">{$val->name} <!--@if($val->is_required=="Y")-->*<!--@end--></label>
-				{$val->getFormHTML()}
+				{$val->getFormHTML()|noescape}
 			</li>
 			<!--@endforeach-->
 			<!--@end-->
@@ -35,7 +35,7 @@ <h2 class="h2"><a href="{getUrl('','vid',$vid,'mid',$mid)}">{$module_info->brows
 				<label for="nText" class="db fb">{$lang->content}</label>
 				<!--@if($module_info->mobile_use_editor === 'Y')-->
 					<input type="hidden" name="content" value="{$oDocument->getContentText()}" />
-					{$oDocument->getEditor()}
+					{$oDocument->getEditor()|noescape}
 				<!--@else-->
 					<textarea name="content" rows="8" cols="42" id="nText" class="itxx" value="{$oDocument->getContentText()}"></textarea>
 				<!--@endif-->
diff --git a/modules/board/skins/default/_comment.html b/modules/board/skins/default/_comment.html
index 5f05b144cb..0eac7a14ab 100644
--- a/modules/board/skins/default/_comment.html
+++ b/modules/board/skins/default/_comment.html
@@ -25,7 +25,7 @@ <h3 class="author">
 				<input type="hidden" name="comment_srl" value="{$comment->get('comment_srl')}" />
 			</form>
 			<!--@else-->
-			{$comment->getContent(false)}
+			{$comment->getContent(false)|noescape}
 			<!--@end-->
 			<div cond="$comment->hasUploadedFiles()" class="fileList">
 				<button type="button" class="toggleFile" onclick="jQuery(this).next('ul.files').toggle();">{$lang->uploaded_file} [<strong>{$comment->get('uploaded_count')}</strong>]</button>
@@ -55,7 +55,7 @@ <h3 class="author">
 		<input type="hidden" name="document_srl" value="{$oDocument->document_srl}" />
 		<input type="hidden" name="comment_srl" value="" />
         <input type="hidden" name="content" value="" />
-        {$oDocument->getCommentEditor()}
+        {$oDocument->getCommentEditor()|noescape}
 		<div class="write_author">
 			<span class="item" cond="!$is_logged">
 				<label for="userName" class="iLabel">{$lang->writer}</label>
diff --git a/modules/board/skins/default/_footer.html b/modules/board/skins/default/_footer.html
index 01eb519658..11c4c49bc0 100644
--- a/modules/board/skins/default/_footer.html
+++ b/modules/board/skins/default/_footer.html
@@ -1,2 +1,2 @@
-	{$module_info->footer_text}
+	{$module_info->footer_text|noescape}
 </div>
diff --git a/modules/board/skins/default/_read.html b/modules/board/skins/default/_read.html
index 97ba0c8bf7..519415110a 100644
--- a/modules/board/skins/default/_read.html
+++ b/modules/board/skins/default/_read.html
@@ -3,7 +3,7 @@
 	<div class="read_header">
 		<h1>
 			<a href="{getUrl('category',$oDocument->get('category_srl'), 'document_srl', '')}" class="category" cond="$module_info->use_category=='Y'">{$category_list[$oDocument->get('category_srl')]->title}</a>
-			<a href="{$oDocument->getPermanentUrl()}">{$oDocument->getTitle()}</a>
+			<a href="{$oDocument->getPermanentUrl()}">{$oDocument->getTitle()|noescape}</a>
 		</h1>
 		<p class="time">
 			{$oDocument->getRegdate('Y.m.d H:i')}
@@ -24,7 +24,7 @@ <h1>
 		<table border="1" cellspacing="0" summary="Extra Form Output">
 			<tr loop="$oDocument->getExtraVars() => $key,$val">
 				<th scope="row">{$val->name}</th>
-				<td>{$val->getValueHTML()}&nbsp;</td>
+				<td>{$val->getValueHTML()|noescape}&nbsp;</td>
 			</tr>
 		</table>
 	</div>
@@ -41,7 +41,7 @@ <h1>
 			</p>
 		</form>
 		<!--@else-->
-		{$oDocument->getContent(false)}
+		{$oDocument->getContent(false)|noescape}
 		<!--@end-->
 	</div>
 	<!-- /READ BODY -->
@@ -87,7 +87,7 @@ <h1>
 		</div>
 		<div class="sign" cond="$module_info->display_sign!='N'&&($oDocument->getProfileImage()||$oDocument->getSignature())">
 			<img cond="$oDocument->getProfileImage()" src="{$oDocument->getProfileImage()}" alt="Profile" class="pf" />
-			<div cond="$oDocument->getSignature()" class="tx">{$oDocument->getSignature()}</div>
+			<div cond="$oDocument->getSignature()" class="tx">{$oDocument->getSignature()|noescape}</div>
 		</div>
 		<div class="btnArea"> 
 			<a cond="$oDocument->isEditable()" class="btn" href="{getUrl('act','dispBoardWrite','document_srl',$oDocument->document_srl,'comment_srl','')}" rel="nofollow">{$lang->cmd_modify}</a>
diff --git a/modules/board/skins/default/comment_form.html b/modules/board/skins/default/comment_form.html
index 9745238a06..23d251fbbb 100644
--- a/modules/board/skins/default/comment_form.html
+++ b/modules/board/skins/default/comment_form.html
@@ -4,7 +4,7 @@ <h3 class="author">
 		<a cond="$oSourceComment->homepage" href="{$oSourceComment->homepage}" rel="nofollow noopener">{$oSourceComment->getNickName()}</a>
 		<strong cond="!$oSourceComment->homepage">{$oSourceComment->getNickName()}</strong>
 	</h3>
-	{$oSourceComment->getContent(false)}
+	{$oSourceComment->getContent(false)|noescape}
 </div>
 <div class="feedback">
 	<form action="./" method="post" onsubmit="return procFilter(this, insert_comment)" class="write_comment">
@@ -13,7 +13,7 @@ <h3 class="author">
 		<input type="hidden" name="comment_srl" value="{$oComment->get('comment_srl')}" />
 		<input type="hidden" name="parent_srl" value="{$oComment->get('parent_srl')}" />
         <input type="hidden" name="content" value="{htmlspecialchars($oComment->get('content'))}" />
-        {$oComment->getEditor()}
+        {$oComment->getEditor()|noescape}
 		<div class="write_author">
 			<span class="item" cond="!$is_logged">
 				<label for="userName" class="iLabel">{$lang->writer}</label>
diff --git a/modules/board/skins/default/delete_comment_form.html b/modules/board/skins/default/delete_comment_form.html
index bb1e6995b8..e9a0e63199 100644
--- a/modules/board/skins/default/delete_comment_form.html
+++ b/modules/board/skins/default/delete_comment_form.html
@@ -4,7 +4,7 @@ <h3 class="author">
 		<a cond="$oComment->homepage" href="{$oComment->homepage}" rel="nofollow noopener">{$oComment->getNickName()}</a>
 		<strong cond="!$oComment->homepage">{$oComment->getNickName()}</strong>
 	</h3>
-	{$oComment->getContent(false)}
+	{$oComment->getContent(false)|noescape}
 </div>
 <form action="./" method="get" onsubmit="return procFilter(this, delete_comment)" class="context_message">
 	<input type="hidden" name="mid" value="{$mid}" />
diff --git a/modules/board/skins/default/delete_form.html b/modules/board/skins/default/delete_form.html
index 4bc49cf59b..47c201c315 100644
--- a/modules/board/skins/default/delete_form.html
+++ b/modules/board/skins/default/delete_form.html
@@ -1,6 +1,6 @@
 <include target="_header.html" />
 <div cond="$oDocument->isExists()" class="context_data">
-	<h3 class="title">{$oDocument->getTitle()}</h3>
+	<h3 class="title">{$oDocument->getTitle()|noescape}</h3>
 	<p class="author">
 		<strong>{$oDocument->getNickName()}</strong>
 	</p>
@@ -15,4 +15,4 @@ <h1>{sprintf($lang->comfirm_act_msg,$lang->document,$lang->cmd_delete,$lang->msg
 		<button type="button" class="btn" onclick="history.back()">{$lang->cmd_cancel}</button>
 	</div>
 </form>
-<include target="_footer.html" />
\ No newline at end of file
+<include target="_footer.html" />
diff --git a/modules/board/skins/default/list.html b/modules/board/skins/default/list.html
index 0f7b75a391..957376dc7f 100644
--- a/modules/board/skins/default/list.html
+++ b/modules/board/skins/default/list.html
@@ -40,7 +40,7 @@
 				</td>
 				<td class="title" cond="$val->type=='title' && $val->idx==-1">
 					<a href="{getUrl('document_srl',$document->document_srl, 'listStyle', $listStyle, 'cpage','')}">
-						{$document->getTitle()}
+						{$document->getTitle()|noescape}
 					</a>
 					<a cond="$document->getCommentCount()" href="{getUrl('document_srl', $document->document_srl)}#comment" class="replyNum" title="Replies">
 						[{$document->getCommentCount()}]
@@ -69,7 +69,7 @@
 				<td class="readNum" cond="$val->type=='readed_count' && $val->idx==-1">{$document->get('readed_count')>0?$document->get('readed_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='voted_count' && $val->idx==-1">{$document->get('voted_count')!=0?$document->get('voted_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='blamed_count' && $val->idx==-1">{$document->get('blamed_count')!=0?$document->get('blamed_count'):'0'}</td>
-				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)}&nbsp;</td>
+				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)|noescape}&nbsp;</td>
 				</block>
 				<td cond="$grant->manager" class="check"><input type="checkbox" name="cart" value="{$document->document_srl}" class="iCheck" title="Check This Article" onclick="doAddDocumentCart(this)" checked="checked"|cond="$document->isCarted()" /></td>
 			</tr>
@@ -82,10 +82,10 @@
 					<block cond="$document_srl!=$document->document_srl">{$no}</block>
 				</td>
 				<td class="title" cond="$val->type=='title' && $val->idx==-1">
-					<a href="{getUrl('document_srl',$document->document_srl, 'listStyle', $listStyle, 'cpage','')}" rel="nofollow">{$document->getTitle()}</a>
+					<a href="{getUrl('document_srl',$document->document_srl, 'listStyle', $listStyle, 'cpage','')}" rel="nofollow">{$document->getTitle()|noescape}</a>
 					<a cond="$document->getCommentCount()" href="{getUrl('document_srl', $document->document_srl)}#comment" class="replyNum" title="Replies">[{$document->getCommentCount()}]</a>
 					<a cond="$document->getTrackbackCount()" href="{getUrl('document_srl', $document->document_srl)}#trackback" class="trackbackNum" title="Trackbacks">[{$document->getTrackbackCount()}]</a>
-					{$document->printExtraImages(60*60*$module_info->duration_new)}
+					{$document->printExtraImages(60*60*$module_info->duration_new)|noescape}
 				</td>
 				<td class="author" cond="$val->type=='nick_name' && $val->idx==-1"><a href="#popup_menu_area" class="member_{$document->get('member_srl')}" onclick="return false">{$document->getNickName()}</a></td>
 				<td class="author" cond="$val->type=='user_id' && $val->idx==-1">{$document->getUserID()}</td>
@@ -107,7 +107,7 @@
 				<td class="readNum" cond="$val->type=='readed_count' && $val->idx==-1">{$document->get('readed_count')>0?$document->get('readed_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='voted_count' && $val->idx==-1">{$document->get('voted_count')!=0?$document->get('voted_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='blamed_count' && $val->idx==-1">{$document->get('blamed_count')!=0?$document->get('blamed_count'):'0'}</td>
-				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)}&nbsp;</td>
+				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)|noescape}&nbsp;</td>
 				</block>
 				<td cond="$grant->manager" class="check"><input type="checkbox" name="cart" value="{$document->document_srl}" class="iCheck" title="Check This Article" onclick="doAddDocumentCart(this)" checked="checked"|cond="$document->isCarted()" /></td>
 			</tr>
diff --git a/modules/board/skins/default/write_form.html b/modules/board/skins/default/write_form.html
index f3e13930ea..3737ba9524 100644
--- a/modules/board/skins/default/write_form.html
+++ b/modules/board/skins/default/write_form.html
@@ -20,12 +20,12 @@
 			<caption><em>*</em> : {$lang->is_required}</caption>
 			<tr loop="$extra_keys=>$key,$val">
 				<th scope="row"><em cond="$val->is_required=='Y'">*</em> {$val->name}</th>
-				<td>{$val->getFormHTML()}</td>
+				<td>{$val->getFormHTML()|noescape}</td>
 			</tr>
 		</table>
 	</div>
     <div class="write_editor">
-		{$oDocument->getEditor()}
+		{$oDocument->getEditor()|noescape}
 	</div>
 	<div class="write_footer">
 		<div class="write_option">
diff --git a/modules/board/skins/xedition/_read.html b/modules/board/skins/xedition/_read.html
index 71a649728b..275a766299 100644
--- a/modules/board/skins/xedition/_read.html
+++ b/modules/board/skins/xedition/_read.html
@@ -3,7 +3,7 @@
 	<div class="read_header">
 		<h1>
 			<a href="{getUrl('category',$oDocument->get('category_srl'), 'document_srl', '')}" class="category" cond="$module_info->use_category=='Y' && $oDocument->get('category_srl')">{$category_list[$oDocument->get('category_srl')]->title}</a>
-			<a href="{$oDocument->getPermanentUrl()}">{$oDocument->getTitle()}</a>
+			<a href="{$oDocument->getPermanentUrl()}">{$oDocument->getTitle()|noescape}</a>
 		</h1>
 		<p class="meta">
 			<span class="author">
@@ -45,7 +45,7 @@ <h1>
 			</p>
 		</form>
 		<!--@else-->
-		{$oDocument->getContent(false)}
+		{$oDocument->getContent(false)|noescape}
 		<!--@end-->
 	</div>
 	<!-- /READ BODY -->
diff --git a/modules/board/skins/xedition/comment_form.html b/modules/board/skins/xedition/comment_form.html
index c97c506b5a..74b4922a24 100644
--- a/modules/board/skins/xedition/comment_form.html
+++ b/modules/board/skins/xedition/comment_form.html
@@ -4,7 +4,7 @@ <h3 class="author">
 		<a cond="$oSourceComment->homepage" href="{$oSourceComment->homepage}" rel="nofollow noopener">{$oSourceComment->getNickName()}</a>
 		<strong cond="!$oSourceComment->homepage">{$oSourceComment->getNickName()}</strong>
 	</h3>
-	{$oSourceComment->getContent(false)}
+	{$oSourceComment->getContent(false)|noescape}
 </div>
 <div class="feedback">
 	<form action="./" method="post" onsubmit="return procFilter(this, insert_comment)" class="write_comment">
@@ -13,7 +13,7 @@ <h3 class="author">
 		<input type="hidden" name="comment_srl" value="{$oComment->get('comment_srl')}" />
 		<input type="hidden" name="parent_srl" value="{$oComment->get('parent_srl')}" />
         <input type="hidden" name="content" value="{htmlspecialchars($oComment->get('content'))}" />
-        {$oComment->getEditor()}
+        {$oComment->getEditor()|noescape}
 		<div class="write_author">
 			<span class="item" cond="!$is_logged">
 				<label for="userName" class="iLabel">{$lang->writer}</label>
diff --git a/modules/board/skins/xedition/delete_comment_form.html b/modules/board/skins/xedition/delete_comment_form.html
index bb1e6995b8..e9a0e63199 100644
--- a/modules/board/skins/xedition/delete_comment_form.html
+++ b/modules/board/skins/xedition/delete_comment_form.html
@@ -4,7 +4,7 @@ <h3 class="author">
 		<a cond="$oComment->homepage" href="{$oComment->homepage}" rel="nofollow noopener">{$oComment->getNickName()}</a>
 		<strong cond="!$oComment->homepage">{$oComment->getNickName()}</strong>
 	</h3>
-	{$oComment->getContent(false)}
+	{$oComment->getContent(false)|noescape}
 </div>
 <form action="./" method="get" onsubmit="return procFilter(this, delete_comment)" class="context_message">
 	<input type="hidden" name="mid" value="{$mid}" />
diff --git a/modules/board/skins/xedition/delete_form.html b/modules/board/skins/xedition/delete_form.html
index 4bc49cf59b..47c201c315 100644
--- a/modules/board/skins/xedition/delete_form.html
+++ b/modules/board/skins/xedition/delete_form.html
@@ -1,6 +1,6 @@
 <include target="_header.html" />
 <div cond="$oDocument->isExists()" class="context_data">
-	<h3 class="title">{$oDocument->getTitle()}</h3>
+	<h3 class="title">{$oDocument->getTitle()|noescape}</h3>
 	<p class="author">
 		<strong>{$oDocument->getNickName()}</strong>
 	</p>
@@ -15,4 +15,4 @@ <h1>{sprintf($lang->comfirm_act_msg,$lang->document,$lang->cmd_delete,$lang->msg
 		<button type="button" class="btn" onclick="history.back()">{$lang->cmd_cancel}</button>
 	</div>
 </form>
-<include target="_footer.html" />
\ No newline at end of file
+<include target="_footer.html" />
diff --git a/modules/board/skins/xedition/list.html b/modules/board/skins/xedition/list.html
index e2828d0d65..ba3dd60ee1 100644
--- a/modules/board/skins/xedition/list.html
+++ b/modules/board/skins/xedition/list.html
@@ -48,7 +48,7 @@
 				</td>
 				<td class="title" cond="$val->type=='title' && $val->idx==-1">
 					<a href="{getUrl('document_srl',$document->document_srl, 'listStyle', $listStyle, 'cpage','')}">
-						{$document->getTitle()}
+						{$document->getTitle()|noescape}
 					</a>
 					<a cond="$document->getCommentCount()" href="{getUrl('document_srl', $document->document_srl)}#comment" class="replyNum" title="Replies">
 						[{$document->getCommentCount()}]
@@ -77,7 +77,7 @@
 				<td class="readNum" cond="$val->type=='readed_count' && $val->idx==-1">{$document->get('readed_count')>0?$document->get('readed_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='voted_count' && $val->idx==-1">{$document->get('voted_count')!=0?$document->get('voted_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='blamed_count' && $val->idx==-1">{$document->get('blamed_count')!=0?$document->get('blamed_count'):'0'}</td>
-				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)}&nbsp;</td>
+				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)|noescape}&nbsp;</td>
 				</block>
 				<td cond="$grant->manager" class="check"><input type="checkbox" name="cart" value="{$document->document_srl}" class="iCheck" title="Check This Article" onclick="doAddDocumentCart(this)" checked="checked"|cond="$document->isCarted()" /></td>
 			</tr>
@@ -90,10 +90,10 @@
 					<block cond="$document_srl!=$document->document_srl">{$no}</block>
 				</td>
 				<td class="title" cond="$val->type=='title' && $val->idx==-1">
-					<a href="{getUrl('document_srl',$document->document_srl, 'listStyle', $listStyle, 'cpage','')}">{$document->getTitle()}</a>
+					<a href="{getUrl('document_srl',$document->document_srl, 'listStyle', $listStyle, 'cpage','')}">{$document->getTitle()|noescape}</a>
 					<a cond="$document->getCommentCount()" href="{getUrl('document_srl', $document->document_srl)}#comment" class="replyNum" title="Replies">[{$document->getCommentCount()}]</a>
 					<a cond="$document->getTrackbackCount()" href="{getUrl('document_srl', $document->document_srl)}#trackback" class="trackbackNum" title="Trackbacks">[{$document->getTrackbackCount()}]</a>
-					{$document->printExtraImages(60*60*$module_info->duration_new)}
+					{$document->printExtraImages(60*60*$module_info->duration_new)|noescape}
 				</td>
 				<td class="author" cond="$val->type=='nick_name' && $val->idx==-1"><a href="#popup_menu_area" class="member_{$document->get('member_srl')}" onclick="return false">{$document->getNickName()}</a></td>
 				<td class="author" cond="$val->type=='user_id' && $val->idx==-1">{$document->getUserID()}</td>
@@ -115,7 +115,7 @@
 				<td class="readNum" cond="$val->type=='readed_count' && $val->idx==-1">{$document->get('readed_count')>0?$document->get('readed_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='voted_count' && $val->idx==-1">{$document->get('voted_count')!=0?$document->get('voted_count'):'0'}</td>
 				<td class="voteNum" cond="$val->type=='blamed_count' && $val->idx==-1">{$document->get('blamed_count')!=0?$document->get('blamed_count'):'0'}</td>
-				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)}&nbsp;</td>
+				<td cond="$val->idx!=-1">{$document->getExtraValueHTML($val->idx)|noescape}&nbsp;</td>
 				</block>
 				<td cond="$grant->manager" class="check"><input type="checkbox" name="cart" value="{$document->document_srl}" class="iCheck" title="Check This Article" onclick="doAddDocumentCart(this)" checked="checked"|cond="$document->isCarted()" /></td>
 			</tr>
diff --git a/modules/board/skins/xedition/write_form.html b/modules/board/skins/xedition/write_form.html
index e9a197a074..7480cffc33 100644
--- a/modules/board/skins/xedition/write_form.html
+++ b/modules/board/skins/xedition/write_form.html
@@ -20,12 +20,12 @@
 			<caption><em>*</em> : {$lang->is_required}</caption>
 			<tr loop="$extra_keys=>$key,$val">
 				<th scope="row"><em cond="$val->is_required=='Y'">*</em> {$val->name}</th>
-				<td>{$val->getFormHTML()}</td>
+				<td>{$val->getFormHTML()|noescape}</td>
 			</tr>
 		</table>
 	</div>
     <div class="write_editor">
-		{$oDocument->getEditor()}
+		{$oDocument->getEditor()|noescape}
 	</div>
 	<div class="write_footer">
 		<div class="write_option">
diff --git a/modules/board/tpl/addition_setup.html b/modules/board/tpl/addition_setup.html
index 627cc393da..3b7609f5eb 100644
--- a/modules/board/tpl/addition_setup.html
+++ b/modules/board/tpl/addition_setup.html
@@ -3,4 +3,4 @@
 <div cond="$XE_VALIDATOR_MESSAGE" class="message {$XE_VALIDATOR_MESSAGE_TYPE}">
 	<p>{$XE_VALIDATOR_MESSAGE}</p>
 </div>
-{$setup_content}
+{$setup_content|noescape}
diff --git a/modules/board/tpl/smartphone/comment_list.html b/modules/board/tpl/smartphone/comment_list.html
index a3a692a5e4..81fe0d727b 100644
--- a/modules/board/tpl/smartphone/comment_list.html
+++ b/modules/board/tpl/smartphone/comment_list.html
@@ -3,7 +3,7 @@
 
 <!--@foreach($comment_list as $val)-->
     <li class="item">
-        <span class="title">{$val->getContent(false)}</span>
+        <span class="title">{$val->getContent(false)|noescape}</span>
         <span class="info">
             {$val->getRegdate()} 
             [{$val->getNickName()}] 
diff --git a/modules/board/tpl/smartphone/view_document.html b/modules/board/tpl/smartphone/view_document.html
index 07a681d5d0..168b1ed557 100644
--- a/modules/board/tpl/smartphone/view_document.html
+++ b/modules/board/tpl/smartphone/view_document.html
@@ -4,7 +4,7 @@
         <span class="date">{$oDocument->getRegdate()}</span>
     </div>
 
-    {$oDocument->getContent(false)}
+    {$oDocument->getContent(false)|noescape}
 
     <!--@if($oDocument->getCommentCount())-->
     <div class="link"><a href="{getUrl('comment','true')}">{$lang->replies} : {$oDocument->getCommentCount()}</a></div>
diff --git a/modules/communication/m.skins/default/read_message.html b/modules/communication/m.skins/default/read_message.html
index 233e9fdf62..c56b70bbea 100644
--- a/modules/communication/m.skins/default/read_message.html
+++ b/modules/communication/m.skins/default/read_message.html
@@ -4,7 +4,7 @@
 	<h2>{$message->title}</h2><span class="ex">{$message->nick_name} | {zdate($message->regdate, "Y.m.d H:i")}</span>
 </div>
 <div class="co">
-	<div class="xe_content">{$message->content}</div>
+	<div class="xe_content">{$message->content|noescape}</div>
 </div>
 <div class="bna">
 	<span class="fl"><a href="{getUrl('message_srl', '')}" class="bn white">{$lang->cmd_list}</a></span>
diff --git a/modules/communication/m.skins/default/send_message.html b/modules/communication/m.skins/default/send_message.html
index f9541753ae..1b7c1834ca 100644
--- a/modules/communication/m.skins/default/send_message.html
+++ b/modules/communication/m.skins/default/send_message.html
@@ -12,7 +12,7 @@ <h2>{$lang->cmd_send_message}</h2>
 	<input type="hidden" name="is_popup" value="Y" />
 	<input type="hidden" name="act" value="procCommunicationSendMessage" />
 	<input type="hidden" name="receiver_srl" value="{$receiver_info->member_srl}" />
-	<input type="hidden" name="source_content" value="{htmlspecialchars($source_message->content, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" />
+	<input type="hidden" name="source_content" value="{$source_message->content}" />
 	<input type="hidden" name="content" value="" />
 	<input type="hidden" name="xe_validator_id" value="modules/communication/m.skins/default/send_message/1" />
 	<input type="hidden" name="success_return_url" value="{getNotEncodedUrl('','act', 'dispCommunicationSendMessage', 'receiver_srl', $receiver_info->member_srl)}" />
@@ -25,7 +25,7 @@ <h2>{$lang->cmd_send_message}</h2>
 			<input type="text" name="title" id="message_title" value="{$source_message->title}"/>
 		</li>
 		<li class="xe_content">
-			{$source_message->content}
+			{$source_message->content|noescape}
 		</li>
 		<li>
 			<label for="message_content">{$lang->content}</label>
diff --git a/modules/communication/skins/default/messages.html b/modules/communication/skins/default/messages.html
index bec7911829..9573b36de5 100644
--- a/modules/communication/skins/default/messages.html
+++ b/modules/communication/skins/default/messages.html
@@ -30,7 +30,7 @@
 	</tr>
 	<tr>
 		<td class="xe_content">
-			{$message->content}
+			{$message->content|noescape}
 		</td>
 	</tr>
 </table>
diff --git a/modules/communication/skins/default/new_message.html b/modules/communication/skins/default/new_message.html
index f1826c7b81..cecbfc9ce6 100644
--- a/modules/communication/skins/default/new_message.html
+++ b/modules/communication/skins/default/new_message.html
@@ -14,7 +14,7 @@ <h1>{$lang->message_received}</h1>
 			<td>{htmlspecialchars($message->title, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}</td>
 		</tr>
 		<tr>
-			<td colspan="2" class="xe_content">{$message->content}</td>
+			<td colspan="2" class="xe_content">{$message->content|noescape}</td>
 		</tr>
 	</table>
 	<div class="btnArea">
diff --git a/modules/communication/skins/default/send_message.html b/modules/communication/skins/default/send_message.html
index 461d05f4cb..8787c4d839 100644
--- a/modules/communication/skins/default/send_message.html
+++ b/modules/communication/skins/default/send_message.html
@@ -8,7 +8,7 @@ <h1>{$lang->cmd_send_message}</h1>
 	<form ruleset="sendMessage" action="./" method="post">
 		<input type="hidden" name="module" value="communication" />
 		<input type="hidden" name="act" value="procCommunicationSendMessage" />
-		<input type="hidden" name="content" value="{htmlspecialchars($source_message->content, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" />
+		<input type="hidden" name="content" value="{$source_message->content}" />
 		<input type="hidden" name="receiver_srl" value="{$receiver_info->member_srl}" />
 		<input type="hidden" name="xe_validator_id" value="modules/communication/skins/default/send_message/1" />
 		<table class="table table-striped table-hover">
diff --git a/modules/document/tpl/checked_list.html b/modules/document/tpl/checked_list.html
index 03a8096330..2814b3afb6 100644
--- a/modules/document/tpl/checked_list.html
+++ b/modules/document/tpl/checked_list.html
@@ -15,7 +15,7 @@ <h1>{$lang->cmd_manage_document}</h1>
 			<div class="x_controls">
 				<ul style="margin-top:5px">
 					<li class="document_list" loop="$document_list => $key, $document">
-						<input type="hidden" name="cart" value="{$document->document_srl}" />{$document->getTitle()} <i class="vr">|</i> {$document->getNickName()}
+						<input type="hidden" name="cart" value="{$document->document_srl}" />{$document->getTitle()|noescape} <i class="vr">|</i> {$document->getNickName()}
 					</li>
 				</ul>
 			</div>
@@ -54,4 +54,4 @@ <h1>{$lang->cmd_manage_document}</h1>
 		</span>
 	</div>
 	<!--@end-->
-</form>
\ No newline at end of file
+</form>
diff --git a/modules/document/tpl/declared_list.html b/modules/document/tpl/declared_list.html
index c25920d3ef..41bdce1cce 100644
--- a/modules/document/tpl/declared_list.html
+++ b/modules/document/tpl/declared_list.html
@@ -45,7 +45,7 @@
 		</thead>
 		<tbody>
 			<tr loop="$document_list => $no,$oDocument">
-				<td class="title"><a href="{getUrl('','document_srl',$oDocument->document_srl)}" target="_blank">{$oDocument->getTitle()}</a></td>
+				<td class="title"><a href="{getUrl('','document_srl',$oDocument->document_srl)}" target="_blank">{$oDocument->getTitle()|noescape}</a></td>
 				<td class="nowr"><a href="#popup_menu_area" class="member_{$oDocument->get('member_srl')}">{$oDocument->getNickName()}</a></td>
 				<td class="nowr">{$oDocument->get('declared_count')}</td>
 				<td class="nowr">{$oDocument->get('readed_count')}</td>
@@ -199,4 +199,4 @@ <h1>{$lang->msg_select_menu}</h1>
 		}
 	});
 });
-</script>
\ No newline at end of file
+</script>
diff --git a/modules/document/tpl/document_alias.html b/modules/document/tpl/document_alias.html
index 6a290ec475..47f597e6c9 100644
--- a/modules/document/tpl/document_alias.html
+++ b/modules/document/tpl/document_alias.html
@@ -29,7 +29,7 @@ <h1>{$lang->alias}</h1>
 		</thead>
 		<tbody>
 			<tr>
-				<td rowspan="{count($aliases)+1}">{$oDocument->getTitle()}</td>
+				<td rowspan="{count($aliases)+1}">{$oDocument->getTitle()|noescape}</td>
 				{@ $bFirst = true; }
 				<!--@foreach($aliases as $val)-->
 				<!--@if(!$bFirst)-->
diff --git a/modules/document/tpl/document_trash_list.html b/modules/document/tpl/document_trash_list.html
index 9b13e8a1a1..0a45bf444b 100644
--- a/modules/document/tpl/document_trash_list.html
+++ b/modules/document/tpl/document_trash_list.html
@@ -34,7 +34,7 @@
 		<tr>
 			<td>{$no}</td>
 			<td>
-				{$oDocument->getTitle()}
+				{$oDocument->getTitle()|noescape}
 				
 				<!--@if($oDocument->getCommentCount())-->
 				[{$oDocument->getCommentCount()}]
diff --git a/modules/document/tpl/print_page.html b/modules/document/tpl/print_page.html
index 0fc1743530..78ab42abd8 100644
--- a/modules/document/tpl/print_page.html
+++ b/modules/document/tpl/print_page.html
@@ -4,10 +4,10 @@ <h1 class="h1">{$oDocument->getTitleText()}</h1>
 {$oDocument->getRegdate()}
 <!--@if($oDocument->isExtraVarsExists() && (!$oDocument->isSecret() || $oDocument->isGranted()) )-->
 <!--@foreach($oDocument->getExtraVars() as $key => $val)-->    
-{$val->name}: {$val->getValueHtml()}
+{$val->name}: {$val->getValueHtml()|noescape}
 <!--@end-->
 <!--@end-->    
-{$oDocument->getContent(false, false)} 
+{$oDocument->getContent(false, false)|noescape} 
 <script>
 //<![CDATA[
     jQuery(window).load(function() { window.print(); } );
diff --git a/modules/document/tpl/saved_list_popup.html b/modules/document/tpl/saved_list_popup.html
index 0ea345a057..350e5060d4 100644
--- a/modules/document/tpl/saved_list_popup.html
+++ b/modules/document/tpl/saved_list_popup.html
@@ -13,8 +13,8 @@ <h1 class="h1">{$lang->cmd_view_saved_document}</h1>
 		<!--@foreach($document_list as $no => $val)-->
 		<tr>
 			<td>{$val->getRegdate("Y-m-d H:i:s")}</td>
-			<td > <a href="#" onclick="jQuery('#saved_document_{$val->document_srl}').toggle(); setFixedPopupSize(); return false;">{$val->getTitle()}</a>
-				<div id="saved_document_{$val->document_srl}" class="saved_content" style="display:none;">{$val->getContent(false)}</div>
+			<td > <a href="#" onclick="jQuery('#saved_document_{$val->document_srl}').toggle(); setFixedPopupSize(); return false;">{$val->getTitle()|noescape}</a>
+				<div id="saved_document_{$val->document_srl}" class="saved_content" style="display:none;">{$val->getContent(false)|noescape}</div>
 			</td>
 			<td><a href="#" onclick="doDocumentSelect('{$val->document_srl}', '{$val->getDocumentType()}'); return false;" class="buttonSet buttonActive"><span>{$lang->cmd_select}</span></a></td>
 		</tr>
diff --git a/modules/file/tpl/file_list.html b/modules/file/tpl/file_list.html
index a11f42b82c..742ae28832 100644
--- a/modules/file/tpl/file_list.html
+++ b/modules/file/tpl/file_list.html
@@ -62,7 +62,7 @@ <h1>{$lang->file} <a class="x_icon-question-sign" href="./admin/help/index.html#
 						<!--@if($val->upload_target_type == 'doc' && $document_list[$document_srl] && $document_list[$document_srl]->get('module_srl') == 0)-->[{$lang->cmd_trash}] <!--@end-->
 						<a href="{getUrl('', 'mid', $module_list[$val->module_srl]->mid)}" target="_blank">{$module_list[$val->module_srl]->browser_title}</a>
 						<!--@if($document_list[$document_srl] && ($val->upload_target_type == 'doc' || $val->upload_target_type == 'com'))-->
-						 - <!--@if($document_list[$document_srl]->get('module_srl') != $document_list[$document_srl]->get('member_srl'))--><a href="{$move_uri}" target="_blank">{$document_list[$document_srl]->getTitle()}</a><!--@else-->{$document_list[$document_srl]->getTitle()}<!--@end-->
+						 - <!--@if($document_list[$document_srl]->get('module_srl') != $document_list[$document_srl]->get('member_srl'))--><a href="{$move_uri}" target="_blank">{$document_list[$document_srl]->getTitle()|noescape}</a><!--@else-->{$document_list[$document_srl]->getTitle()|noescape}<!--@end-->
 						<!--@end-->
 					<!--@end-->
 				</th>
diff --git a/modules/integration_search/skins/default/document.html b/modules/integration_search/skins/default/document.html
index efe3d6278b..1fa51594de 100644
--- a/modules/integration_search/skins/default/document.html
+++ b/modules/integration_search/skins/default/document.html
@@ -25,7 +25,7 @@ <h3 class="subTitle">{$lang->document} <span>({number_format($output->total_coun
             <a href="{getUrl('','document_srl',$document->document_srl)}" target="_blank"><img src="{$document->getThumbnail(80)}" alt="" width="80" height="80" class="thumb" /></a>
             <!--@end-->
             <dl>
-                <dt><a href="{getUrl('','document_srl',$document->document_srl)}" target="_blank">{$document->getTitle()}</a> <!--@if($document->getCommentCount())--><span class="reply">[<em>{$document->getCommentCount()}</em>]</span> <!--@end--></dt>
+                <dt><a href="{getUrl('','document_srl',$document->document_srl)}" target="_blank">{$document->getTitle()|noescape}</a> <!--@if($document->getCommentCount())--><span class="reply">[<em>{$document->getCommentCount()}</em>]</span> <!--@end--></dt>
 
                 <dd>{$document->getSummary(200)}</dd>
             </dl>
diff --git a/modules/member/skins/default/saved_list.html b/modules/member/skins/default/saved_list.html
index 7ae9ddf061..ae29fd7329 100644
--- a/modules/member/skins/default/saved_list.html
+++ b/modules/member/skins/default/saved_list.html
@@ -12,8 +12,8 @@ <h1>{$member_title = $lang->cmd_view_saved_document}</h1>
 	<tbody>
 		<tr loop="$document_list => $no,$val">
 			<td class="title">
-				<a href="#saved_document_{$val->document_srl}" onclick="jQuery('#saved_document_{$val->document_srl}').toggle(); return false;">{$val->getTitle()}</a>
-				<div id="saved_document_{$val->document_srl}" class="savedContent" style="display:none;">{$val->getContent(false)}</div>
+				<a href="#saved_document_{$val->document_srl}" onclick="jQuery('#saved_document_{$val->document_srl}').toggle(); return false;">{$val->getTitle()|noescape}</a>
+				<div id="saved_document_{$val->document_srl}" class="savedContent" style="display:none;">{$val->getContent(false)|noescape}</div>
 			</td>
 			<td>{$val->getRegdate("Y-m-d")}</td>
 			<td><button type="button" class="text" onclick="doDeleteSavedDocument('{$val->document_srl}','{$lang->confirm_delete}');">{$lang->cmd_delete}</button></td>
diff --git a/modules/module/tpl/include.module_addition_setup.html b/modules/module/tpl/include.module_addition_setup.html
index 1cf1b813a3..d5bf5258bd 100644
--- a/modules/module/tpl/include.module_addition_setup.html
+++ b/modules/module/tpl/include.module_addition_setup.html
@@ -1,3 +1,3 @@
 <div id="manageSelectedModuleAddition">
-	{$setup_content}
+	{$setup_content|noescape}
 </div>
diff --git a/modules/module/tpl/module_addition_setup.html b/modules/module/tpl/module_addition_setup.html
index e8c4a87e73..d0cffb3ea2 100644
--- a/modules/module/tpl/module_addition_setup.html
+++ b/modules/module/tpl/module_addition_setup.html
@@ -1,2 +1,2 @@
 <h1>{$lang->bundle_addition_setup}</h1>
-{$setup_content}
+{$setup_content|noescape}
diff --git a/modules/page/m.skins/default/mobile.html b/modules/page/m.skins/default/mobile.html
index 85984b8b6d..3966f71ed0 100644
--- a/modules/page/m.skins/default/mobile.html
+++ b/modules/page/m.skins/default/mobile.html
@@ -1,2 +1,2 @@
-<h1 cond="$module_info->display_mobile_title != 'hide'">{$oDocument->getTitle()}</h1>
-{$oDocument->getContent($module_info->display_popupmenu != 'hide')}
+<h1 cond="$module_info->display_mobile_title != 'hide'">{$oDocument->getTitle()|noescape}</h1>
+{$oDocument->getContent($module_info->display_popupmenu != 'hide')|noescape}
diff --git a/modules/page/skins/default/content.html b/modules/page/skins/default/content.html
index 8fa98b30e9..087afcf859 100644
--- a/modules/page/skins/default/content.html
+++ b/modules/page/skins/default/content.html
@@ -1,6 +1,6 @@
 <block cond="$oDocument">
-<h1 cond="$module_info->display_title != 'hide'">{$oDocument->getTitle()}</h1>
-{$oDocument->getContent($module_info->display_popupmenu != 'hide')}
+<h1 cond="$module_info->display_title != 'hide'">{$oDocument->getTitle()|noescape}</h1>
+{$oDocument->getContent($module_info->display_popupmenu != 'hide')|noescape}
 </block>
 <block cond="!$oDocument">
 {$lang->none_content}
diff --git a/modules/page/tpl/addition_setup.html b/modules/page/tpl/addition_setup.html
index 344cf5e520..e12c1ec2a3 100644
--- a/modules/page/tpl/addition_setup.html
+++ b/modules/page/tpl/addition_setup.html
@@ -2,4 +2,4 @@
 <div cond="$XE_VALIDATOR_MESSAGE" class="message {$XE_VALIDATOR_MESSAGE_TYPE}">
 	<p>{$XE_VALIDATOR_MESSAGE}</p>
 </div>
-{$setup_content}
+{$setup_content|noescape}
diff --git a/modules/page/tpl/article_content_modify.html b/modules/page/tpl/article_content_modify.html
index e7de6efa7a..152547537e 100644
--- a/modules/page/tpl/article_content_modify.html
+++ b/modules/page/tpl/article_content_modify.html
@@ -8,7 +8,7 @@
 		<input type="text" name="title" value="{htmlspecialchars($oDocument->getTitleText(), ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" title="{$lang->title}" style="width:100%" />
 	</div>
 
-    <div class="editor">{$oDocument->getEditor()}</div>
+    <div class="editor">{$oDocument->getEditor()|noescape}</div>
 
     <div class="tag">
         <input type="text" name="tags" value="{htmlspecialchars($oDocument->get('tags'), ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" class="iText" title="Tag" />
diff --git a/modules/page/tpl/skin_info.html b/modules/page/tpl/skin_info.html
index 0ad67b69fd..7f12b367e3 100644
--- a/modules/page/tpl/skin_info.html
+++ b/modules/page/tpl/skin_info.html
@@ -1,3 +1,3 @@
 <!--#include("./header.html")-->
 
-{$skin_content}
+{$skin_content|noescape}
diff --git a/modules/trash/tpl/trash_list.html b/modules/trash/tpl/trash_list.html
index 802f5b69ee..c1772fd454 100644
--- a/modules/trash/tpl/trash_list.html
+++ b/modules/trash/tpl/trash_list.html
@@ -47,7 +47,7 @@ <h1>{$lang->trash} <a class="x_icon-question-sign" href="./admin/help/index.html
 						<block cond="isset($module_list[$oTrashVO->unserializedObject['module_srl']])">
 						<a href="{getUrl('', 'mid', $module_list[$oTrashVO->unserializedObject['module_srl']]->mid)}" target="_blank">{$module_list[$oTrashVO->unserializedObject['module_srl']]->browser_title}</a> - 
 						</block>
-						<a href="{getUrl('act','dispTrashAdminView','trash_srl',$oTrashVO->getTrashSrl())}">{$oTrashVO->getTitle()}</a>
+						<a href="{getUrl('act','dispTrashAdminView','trash_srl',$oTrashVO->getTrashSrl())}">{$oTrashVO->getTitle()|noescape}</a>
 					</block>
 				</td>
 				<td class="nowr"><a href="#popup_menu_area" class="member_{$oTrashVO->unserializedObject['member_srl']}">{$oTrashVO->unserializedObject['nick_name']}</a></td>
diff --git a/widgets/content/skins/default/gallery.html b/widgets/content/skins/default/gallery.html
index e7a02ef12c..153f6e25e7 100644
--- a/widgets/content/skins/default/gallery.html
+++ b/widgets/content/skins/default/gallery.html
@@ -19,7 +19,7 @@
                 </a>
 
             <!--@else if($v=='title')-->
-                <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+                <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
                 <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                     <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment">{$item->getCommentCount()}</a></em>
                 <!--@end-->
diff --git a/widgets/content/skins/default/image_title.html b/widgets/content/skins/default/image_title.html
index 8a0b7fdfca..10c914223b 100644
--- a/widgets/content/skins/default/image_title.html
+++ b/widgets/content/skins/default/image_title.html
@@ -24,7 +24,7 @@
                         <a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
                     <!--@end-->
 
-                    <a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+                    <a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 
                     <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                         <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment">{$item->getCommentCount()}</a></em>
@@ -35,7 +35,7 @@
                     <!--@end-->
 
                     <!--@if($widget_info->show_icon=='Y')-->
-                        <span class="icon">{$item->printExtraImages()}</span>
+                        <span class="icon">{$item->printExtraImages()|noescape}</span>
                     <!--@end-->
                 <!--@else if($v=='nickname')-->
                     <a href="#" onclick="return false;" class="author member_{$item->getMemberSrl()}">{$item->getNickName($widget_info->nickname_cut_size)}</a>
@@ -85,7 +85,7 @@
                     <a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
                 <!--@end-->
 
-                <a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+                <a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 
                 <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                     <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment" target="_blank"|cond="$widget_info->new_window">{$item->getCommentCount()}</a></em>
@@ -96,7 +96,7 @@
                 <!--@end-->
 
                 <!--@if($widget_info->show_icon=='Y')-->
-                    <span class="icon">{$item->printExtraImages()}</span>
+                    <span class="icon">{$item->printExtraImages()|noescape}</span>
                 <!--@end-->
             </td>
         <!--@else if($v=='nickname')-->
diff --git a/widgets/content/skins/default/image_title_content.html b/widgets/content/skins/default/image_title_content.html
index 6fc83a5f36..2f28364ead 100644
--- a/widgets/content/skins/default/image_title_content.html
+++ b/widgets/content/skins/default/image_title_content.html
@@ -30,7 +30,7 @@
                 <a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
             <!--@end-->
 
-            <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+            <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 
             <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                 <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment" target="_blank"|cond="$widget_info->new_window">{$item->getCommentCount()}</a></em>
@@ -41,7 +41,7 @@
             <!--@end-->
 
             <!--@if($widget_info->show_icon=='Y')-->
-                <span class="icon">{$item->printExtraImages()}</span>
+                <span class="icon">{$item->printExtraImages()|noescape}</span>
             <!--@end-->
 
             <!--@if($widget_info->option_view_arr[$j+1]=='regdate')-->
@@ -51,7 +51,7 @@
 
         <!--@else if($widget_info->option_view_arr[$j]=='content')-->
         <p class="text" style="margin-left:{$widget_info->thumbnail_width+20}px;">
-            {$item->getContent()}
+            {$item->getContent()|noescape}
             <!--@if($widget_info->option_view_arr[$j+1]=='regdate')-->
                 <span class="date">{$item->getRegdate("Y-m-d")}</span> <span class="hour">{$item->getRegdate("H:i")}</span>
             <!--@end-->
diff --git a/widgets/content/skins/default/normal.html b/widgets/content/skins/default/normal.html
index 1a9d29dc7d..18def591c4 100644
--- a/widgets/content/skins/default/normal.html
+++ b/widgets/content/skins/default/normal.html
@@ -14,7 +14,7 @@
                         <a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
                     <!--@end-->
 
-                    <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+                    <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 
                     <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                         <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment" target="_blank"|cond="$widget_info->new_window">{$item->getCommentCount()}</a></em>
@@ -25,7 +25,7 @@
                     <!--@end-->
 
                     <!--@if($widget_info->show_icon=='Y')-->
-                        <span class="icon">{$item->printExtraImages()}</span>
+                        <span class="icon">{$item->printExtraImages()|noescape}</span>
                     <!--@end-->
 
                 <!--@else if($v=='nickname')-->
@@ -66,7 +66,7 @@
                 <a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
             <!--@end-->
 
-            <a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+            <a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 
             <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                 <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment" target="_blank"|cond="$widget_info->new_window">{$item->getCommentCount()}</a></em>
@@ -77,7 +77,7 @@
             <!--@end-->
 
             <!--@if($widget_info->show_icon=='Y')-->
-                <span class="icon">{$item->printExtraImages()}</span>
+                <span class="icon">{$item->printExtraImages()|noescape}</span>
             <!--@end-->
         </td>
     <!--@else if($v=='nickname')-->
diff --git a/widgets/content/skins/default/title_content.html b/widgets/content/skins/default/title_content.html
index 74c6c91063..55bb5a62ce 100644
--- a/widgets/content/skins/default/title_content.html
+++ b/widgets/content/skins/default/title_content.html
@@ -14,7 +14,7 @@
                         <a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
                     <!--@end-->
 
-                    <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+                    <a href="{$item->getLink()}" class="title" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 
                     <!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
                         <em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment" target="_blank"|cond="$widget_info->new_window">{$item->getCommentCount()}</a></em>
@@ -25,7 +25,7 @@
                     <!--@end-->
 
                     <!--@if($widget_info->show_icon=='Y')-->
-                        <span class="icon">{$item->printExtraImages()}</span>
+                        <span class="icon">{$item->printExtraImages()|noescape}</span>
                     <!--@end-->
 
                 <!--@else if($v=='nickname')-->
@@ -35,7 +35,7 @@
                     <span class="date">{$item->getRegdate("Y-m-d")}</span> <span class="hour">{$item->getRegdate("H:i")}</span>
 				
 				<!--@else if($v=='content')-->
-					<p class="summary"><a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getContent()}</a></p>
+					<p class="summary"><a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getContent()|noescape}</a></p>
 				<!--@end-->
             <!--@end-->
         </li>
@@ -69,7 +69,7 @@
 					<a href="{getSiteUrl($item->domain,'','mid',$item->get('mid'),'category',$item->get('category_srl'))}" target="_blank"|cond="$widget_info->new_window"><strong class="category">{$item->getCategory()}</strong></a>
 				<!--@end-->
 	
-				<a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)}</a>
+				<a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getTitle($widget_info->subject_cut_size)|noescape}</a>
 	
 				<!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
 					<em class="replyNum" title="Replies"><a href="{$item->getLink()}#comment" target="_blank"|cond="$widget_info->new_window">{$item->getCommentCount()}</a></em>
@@ -80,7 +80,7 @@
 				<!--@end-->
 	
 				<!--@if($widget_info->show_icon=='Y')-->
-					<span class="icon">{$item->printExtraImages()}</span>
+					<span class="icon">{$item->printExtraImages()|noescape}</span>
 				<!--@end-->
 			</td>
 		<!--@else if($v=='nickname')-->
@@ -92,7 +92,7 @@
         </tr>
 	<!--@if($v=='content')-->
 		<tr>
-			<td colspan="3" class="summary"><a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getContent()}</a></td>
+			<td colspan="3" class="summary"><a href="{$item->getLink()}" target="_blank"|cond="$widget_info->new_window">{$item->getContent()|noescape}</a></td>
 		</tr>
 	<!--@end-->
     {@$_idx++}
diff --git a/widgets/mcontent/skins/default/image_title.html b/widgets/mcontent/skins/default/image_title.html
index 89d9c9796a..e7dc39732f 100644
--- a/widgets/mcontent/skins/default/image_title.html
+++ b/widgets/mcontent/skins/default/image_title.html
@@ -27,7 +27,7 @@ <h2>{$__module_info->browser_title}</h2>
 					{$item->getCategory()} &rsaquo;
 					<!--@end-->
 					
-					<strong>{$item->getTitle($widget_info->subject_cut_size)}</strong>
+					<strong>{$item->getTitle($widget_info->subject_cut_size)|noescape}</strong>
 					
 					<!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
 					<em title="Replies">[{$item->getCommentCount()}]</em>
diff --git a/widgets/mcontent/skins/default/image_title_content.html b/widgets/mcontent/skins/default/image_title_content.html
index fc31352931..1f310fa523 100644
--- a/widgets/mcontent/skins/default/image_title_content.html
+++ b/widgets/mcontent/skins/default/image_title_content.html
@@ -27,7 +27,7 @@ <h2>{$__module_info->browser_title}</h2>
 					{$item->getCategory()} &rsaquo;
 					<!--@end-->
 					
-					<strong>{$item->getTitle($widget_info->subject_cut_size)}</strong>
+					<strong>{$item->getTitle($widget_info->subject_cut_size)|noescape}</strong>
 					
 					<!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
 					<em title="Replies">[{$item->getCommentCount()}]</em>
@@ -45,7 +45,7 @@ <h2>{$__module_info->browser_title}</h2>
 				</span>
 				
 				<!--@else if($widget_info->option_view_arr[$j]=='content')-->
-				<span class="text">{$item->getContent()}</span>
+				<span class="text">{$item->getContent()|noescape}</span>
 				<!--@end-->
 			<!--@end-->
 		</a>
diff --git a/widgets/mcontent/skins/default/normal.html b/widgets/mcontent/skins/default/normal.html
index ef5448bd83..88a251e544 100644
--- a/widgets/mcontent/skins/default/normal.html
+++ b/widgets/mcontent/skins/default/normal.html
@@ -21,7 +21,7 @@ <h2>{$__module_info->browser_title}</h2>
 					{$item->getCategory()} &rsaquo;
 					<!--@end-->
 
-					<strong>{$item->getTitle($widget_info->subject_cut_size)}</strong>
+					<strong>{$item->getTitle($widget_info->subject_cut_size)|noescape}</strong>
 
 					<!--@if($widget_info->show_comment_count=='Y' && $item->getCommentCount())-->
 					<em title="Replies">[{$item->getCommentCount()}]</em>
diff --git a/widgetstyles/simple/widgetstyle.html b/widgetstyles/simple/widgetstyle.html
index 2a8ed67f04..d9a3bae689 100644
--- a/widgetstyles/simple/widgetstyle.html
+++ b/widgetstyles/simple/widgetstyle.html
@@ -19,5 +19,5 @@ <h2>{$widgetstyle_extra_var->ws_title}</h2>
             <!--@end-->
             {$widgetstyle_extra_var->ws_more_text}</a>
         <!--@end-->
-    {$widget_content}
+    {$widget_content|noescape}
 </div>