Fixed #1357 and #614 -- <select> formfields now escape values

git-svn-id: http://code.djangoproject.com/svn/django/trunk@2321 bcc190cf-cafb-0310-a4f2-bffc1f526a37

django/core/formfields.py

@@ -427,7 +427,7 @@ class SelectField(FormField):
             selected_html = ''
             if str(value) == str_data:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, display_name))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(display_name)))
         output.append('  </select>')
         return '\n'.join(output)