Index: /main/trunk/greenstone2/macros/authen.dm
===================================================================
--- /main/trunk/greenstone2/macros/authen.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/authen.dm	(revision 28898)
@@ -16,5 +16,5 @@
   <form name="login" method="post" action="_gwcgi_">
 )
-<input type=hidden name="e" value="_If_(_cgiarger_,_cgiargerAttrsafe_,_decodedcompressedoptions_)">
+<input type=hidden name="e" value="_If_(_cgiarger_,_cgiargerAttrsafe_,_decodedcompressedoptionsAttrsafe_)">
 _hiddenargs_
 <center><table width="_pagewidth_">
Index: /main/trunk/greenstone2/macros/browse.dm
===================================================================
--- /main/trunk/greenstone2/macros/browse.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/browse.dm	(revision 28898)
@@ -42,5 +42,5 @@
 
 <input type=hidden name="a" value="br">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
        <p>
        _textfilterby_ _anyallselect_ _textwords_<br> 
Index: /main/trunk/greenstone2/macros/collect.dm
===================================================================
--- /main/trunk/greenstone2/macros/collect.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/collect.dm	(revision 28898)
@@ -52,5 +52,5 @@
 _introcontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 
 <center>
@@ -143,5 +143,5 @@
 _existingcontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 <input type=hidden name="bc1dodelete" value="0">
@@ -246,5 +246,5 @@
 _infocontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 <input type=hidden name="bc1infochanged" value="0">
@@ -370,5 +370,5 @@
 _srcecontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 <input type=hidden name="bc1fromsrce" value="0">
@@ -423,5 +423,5 @@
 _confcontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 <input type=hidden name="bc1cfgchanged" value="_cgiargbc1cfgchangedAttrsafe_">
@@ -475,5 +475,5 @@
 
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -528,5 +528,5 @@
 _bildframe1content_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="bildcancel">
 
@@ -571,5 +571,5 @@
 _bildcancelcontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -630,5 +630,5 @@
 _bildstatuscontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <center>
 <table width=_pagewidth_>
@@ -682,5 +682,5 @@
 _bildfailcontent_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -739,5 +739,5 @@
 _messagehead_ {
 <form name="collectorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 
 <center>
Index: /main/trunk/greenstone2/macros/dateqry.dm
===================================================================
--- /main/trunk/greenstone2/macros/dateqry.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/dateqry.dm	(revision 28898)
@@ -67,5 +67,5 @@
 
 <input type=hidden name="a" value="q">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="r" value="1">
 <input type=hidden name="hs" value="1">
Index: /main/trunk/greenstone2/macros/deposit.dm
===================================================================
--- /main/trunk/greenstone2/macros/deposit.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/deposit.dm	(revision 28898)
@@ -125,5 +125,5 @@
 _selectcontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="intro">
 <input type=hidden name="c" value="">
@@ -229,5 +229,5 @@
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
 
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -274,5 +274,5 @@
 _step2content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 <center>
@@ -310,5 +310,5 @@
 _step3content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 <center>
@@ -347,5 +347,5 @@
 
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -406,5 +406,5 @@
 _bildframe1content_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="bildcancel">
 
@@ -449,5 +449,5 @@
 _bildcancelcontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -508,5 +508,5 @@
 _bildstatuscontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 
 <center>
@@ -572,5 +572,5 @@
 _bildfailcontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -631,5 +631,5 @@
 _messagehead_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 
 <center>
Index: /main/trunk/greenstone2/macros/depositdspace.dm
===================================================================
--- /main/trunk/greenstone2/macros/depositdspace.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/depositdspace.dm	(revision 28898)
@@ -636,5 +636,5 @@
 _selectcontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="intro">
 <input type=hidden name="c" value="">
@@ -672,5 +672,5 @@
 _step0content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step1">
 
@@ -803,5 +803,5 @@
 _step1content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step1">
         <center>
@@ -1018,5 +1018,5 @@
 _step2content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step2">
 
@@ -1127,5 +1127,5 @@
 _step3content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step3">
 
@@ -1210,5 +1210,5 @@
 _step4content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step4">
 
@@ -1324,5 +1324,5 @@
 _step5content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step5">
 
@@ -1547,5 +1547,5 @@
 _step6content_ {
 <form id="depositorform" name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step6">
 
@@ -1649,5 +1649,5 @@
 _step7content_ {
 <form name="depositorform" method=post action="_gwcgi_" enctype="multipart/form-data">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="step7">
 
@@ -1700,5 +1700,5 @@
 
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -1759,5 +1759,5 @@
 _bildframe1content_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="bildcancel">
 
@@ -1802,5 +1802,5 @@
 _bildcancelcontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -1861,5 +1861,5 @@
 _bildstatuscontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 
 <center>
@@ -1925,5 +1925,5 @@
 _bildfailcontent_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="p" value="_cgiargpAttrsafe_">
 
@@ -1984,5 +1984,5 @@
 _messagehead_ {
 <form name="depositorform" method=post action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 
 <center>
Index: /main/trunk/greenstone2/macros/document.dm
===================================================================
--- /main/trunk/greenstone2/macros/document.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/document.dm	(revision 28898)
@@ -296,5 +296,5 @@
 _gotoform_ {
 <form name="GotoForm" method="get" action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="d" value="_cgiargdAttrsafe_">
 <input type=hidden name="cl" value="_cgiargclAttrsafe_">
Index: /main/trunk/greenstone2/macros/pref.dm
===================================================================
--- /main/trunk/greenstone2/macros/pref.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/pref.dm	(revision 28898)
@@ -511,5 +511,5 @@
 
 <form name=PrefForm method=get action="_gwcgi_">
-<input type="hidden" name="e" value="_decodedcompressedoptions_">
+<input type="hidden" name="e" value="_decodedcompressedoptionsAttrsafe_">
 _If_(_collectionoption_,_collectionprefs_)
 _presentationprefs_
Index: /main/trunk/greenstone2/macros/query.dm
===================================================================
--- /main/trunk/greenstone2/macros/query.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/query.dm	(revision 28898)
@@ -884,9 +884,9 @@
 }
 
-_smallquerybox_ {<nobr><input type="text" name="q" value="_cgiargqAttrsafe_" size="50">&nbsp;<input type="submit" value="_textbeginsearch_"></nobr>}
+_smallquerybox_ {<nobr><input type="text" name="q" value="_cgiargq_" size="50">&nbsp;<input type="submit" value="_textbeginsearch_"></nobr>}
 
 _largequerybox_ {
 <tr><td><textarea name="q" cols="63" rows="10">
-_cgiargqHtmlsafe_
+_cgiargq_
 </textarea></td></tr>
 <tr align="right"><td><table>
@@ -973,5 +973,5 @@
 <table>
 <tr><td align="left">_textadvquery_</td></tr>
-<tr><td><textarea name="q" cols="57" rows="3" onChange="updateq();">_cgiargqHtmlsafe_</textarea></td>
+<tr><td><textarea name="q" cols="57" rows="3" onChange="updateq();">_cgiargq_</textarea></td>
 <td valign="bottom">
 <input type="button" value="_textrunquery_" onClick="runQuery();"></td></tr>
Index: /main/trunk/greenstone2/macros/status.dm
===================================================================
--- /main/trunk/greenstone2/macros/status.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/status.dm	(revision 28898)
@@ -123,5 +123,5 @@
 <form name="maincfgform" method=post action="_gwcgi_">
 <input type=hidden name="p" value="changemaincfg">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <p>_If_(_maincfgfile_,<textarea name="cfgfile" cols=72 rows=18 wrap=off>
 _maincfgfile_
Index: /main/trunk/greenstone2/macros/users.dm
===================================================================
--- /main/trunk/greenstone2/macros/users.dm	(revision 28897)
+++ /main/trunk/greenstone2/macros/users.dm	(revision 28898)
@@ -57,5 +57,5 @@
 
 <form name="edituser" method="post" action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="a" value="um">
 <input type=hidden name="uma" value="_cgiargumaAttrsafe_">
@@ -110,5 +110,5 @@
 <tr><td>
 <form name="deleteuser" method="post" action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="a" value="um">
 <input type=hidden name="uma" value="_cgiargumaAttrsafe_">
@@ -148,5 +148,5 @@
 <p>
 <form name="changepasswd" method="post" action="_gwcgi_">
-<input type=hidden name="e" value="_decodedcompressedoptions_">
+<input type=hidden name="e" value="_decodedcompressedoptionsAttrsafe_">
 <input type=hidden name="a" value="um">
 <input type=hidden name="uma" value="_cgiargumaAttrsafe_">
Index: /main/trunk/greenstone2/runtime-src/src/recpt/receptionist.cpp
===================================================================
--- /main/trunk/greenstone2/runtime-src/src/recpt/receptionist.cpp	(revision 28897)
+++ /main/trunk/greenstone2/runtime-src/src/recpt/receptionist.cpp	(revision 28898)
@@ -1532,5 +1532,5 @@
     text_t attrsafe = encodeForHTMLAttr(macrovalue);
     text_t urlsafe = encodeForURL(macrovalue);
-    text_t jssafe = encodeForJavascript(macrovalue);
+    text_t jssafe = encodeForJavascript(macrovalue); // with default setting will return \\x and \\u for macro files
     text_t csssafe = encodeForCSS(macrovalue);
 
Index: /main/trunk/greenstone2/runtime-src/src/recpt/securitytools.cpp
===================================================================
--- /main/trunk/greenstone2/runtime-src/src/recpt/securitytools.cpp	(revision 28897)
+++ /main/trunk/greenstone2/runtime-src/src/recpt/securitytools.cpp	(revision 28898)
@@ -125,14 +125,15 @@
 }
 
-text_t encodeForJavascript(const text_t& in, const text_t& immuneChars) {
-  text_t out;
-  text_t::const_iterator here = in.begin();
-  text_t::const_iterator end = in.end();
-  while (here != end) {
-    out += encodeForJavascript(immuneChars, *here); // IMMUNE_JAVASCRIPT by default
-    ++here;
-  }
-  return out;
-}
+text_t encodeForJavascript(const text_t& in, const text_t& immuneChars, bool dmsafe) {
+  text_t out;
+  text_t::const_iterator here = in.begin();
+  text_t::const_iterator end = in.end();
+  while (here != end) {
+    out += encodeForJavascript(immuneChars, *here, dmsafe); // IMMUNE_JAVASCRIPT by default
+    ++here;
+  }
+  return out;
+}
+
 
 text_t encodeForMySQL(const text_t& in, const text_t& immuneChars, const SQLMode mode) {
@@ -259,5 +260,5 @@
 
 // http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/JavaScriptCodec.java
-text_t encodeForJavascript(const text_t& immuneChars, const unsigned short in) {
+text_t encodeForJavascript(const text_t& immuneChars, const unsigned short in, bool dmsafe) {
   
   text_t result = "";
@@ -294,5 +295,10 @@
       char hex_char[3];
       sprintf(hex_char,"%02X",in);
-      result = "\\x" + text_t(hex_char);
+
+      if(dmsafe) { // double escape backslashes for macro files
+	result = "\\\\x" + text_t(hex_char);
+      } else {
+	result = "\\x" + text_t(hex_char);
+      }
     }
     // otherwise encode with \\uHHHH
@@ -300,5 +306,9 @@
       char hex_char[5];
       sprintf(hex_char,"%04X",in);
-      result = "\\u" + text_t(hex_char);
+      if(dmsafe) { // double escape backslashes for macro files
+	result = "\\\\u" + text_t(hex_char);
+      } else {
+	result = "\\u" + text_t(hex_char);      
+      }
     }
     
Index: /main/trunk/greenstone2/runtime-src/src/recpt/securitytools.h
===================================================================
--- /main/trunk/greenstone2/runtime-src/src/recpt/securitytools.h	(revision 28897)
+++ /main/trunk/greenstone2/runtime-src/src/recpt/securitytools.h	(revision 28898)
@@ -25,5 +25,5 @@
 text_t encodeForHTML(const text_t& input, const text_t& immuneChars=IMMUNE_HTML);
 text_t encodeForURL(const text_t& input, const text_t& immuneChars=IMMUNE_URL);
-text_t encodeForJavascript(const text_t& input, const text_t& immuneChars=IMMUNE_JAVASCRIPT);
+text_t encodeForJavascript(const text_t& input, const text_t& immuneChars=IMMUNE_JAVASCRIPT, bool dmsafe=true);
 text_t encodeForHTMLAttr(const text_t& input, const text_t& immuneChars=IMMUNE_HTMLATTR);
 text_t encodeForCSS(const text_t& input, const text_t& immuneChars=IMMUNE_CSS);
@@ -33,5 +33,5 @@
 text_t encodeForHTML(const text_t& immuneChars, const unsigned short input);
 text_t encodeForURL(const text_t& immuneChars, const unsigned short input);
-text_t encodeForJavascript(const text_t& immuneChars, const unsigned short input);
+text_t encodeForJavascript(const text_t& immuneChars, const unsigned short input, bool dmsafe);
 text_t encodeForCSS(const text_t& immuneChars, const unsigned short input);
 text_t encodeForMySQL(const text_t& immuneChars, const unsigned short input, const SQLMode mode);
