Index: applications/blog/src/main/resources/Blog/CategoriesCode.xml
===================================================================
--- applications/blog/src/main/resources/Blog/CategoriesCode.xml	(revision 27744)
+++ applications/blog/src/main/resources/Blog/CategoriesCode.xml	(working copy)
@@ -41,15 +41,17 @@
   #getCategoriesHierarchy('' $tree)
   #set($subcategories = $util.arrayList)
   #getSubcategories($tree $category $subcategories)
-  #set($categories = "'${category}'")
+  #set($categories = ["${category}"])
+  #set($discard = $categories.addAll(${subcategories}))
+  #set($parameters = "?")
   #foreach($subcategory in $subcategories)
-    #set($categories = "$!{categories}, '$subcategory'")
+    #set($parameters = "$!{parameters}, ?")
   #end
   #getBlogEntriesBaseQuery($query)
-  #set ($query = ", DBStringListProperty as categories join categories.list as category${query} and obj.id = categories.id.id and categories.id.name='category' and category in (${categories})")
-  #set($totalEntries = $xwiki.countDocuments(${query}))
+  #set ($query = ", DBStringListProperty as categories join categories.list as category${query} and obj.id = categories.id.id and categories.id.name='category' and category in (${parameters})")
+  #set($totalEntries = $xwiki.countDocuments(${query}, ${categories}))
   #preparePagedViewParams($totalEntries 10)
-  #set($entries = $xwiki.searchDocuments("${query} order by publishDate.value desc", $itemsPerPage, $startAt))
+  #set($entries = $xwiki.searchDocuments("${query} order by publishDate.value desc", $itemsPerPage, $startAt, ${categories}))
 #end
 #macro(getSubcategories $tree $category $subcategories)
   #if(!$subcategories.contains($category))
@@ -192,13 +194,14 @@
  *###
 #macro(displaySelectableCategory $name $level)
   #set($categoryDoc = $xwiki.getDocument($name))
+  #set($nameUrl = $escapetool.url($name).replace("+", "%20"))
   #foreach($i in [1..$level])*#end ##
 &lt;span class="blog-category-level"&gt;&lt;span class="blog-category"&gt;##
 &lt;label id='blog_category_${name}' title="#getCategoryDescription($categoryDoc)"&gt;&lt;input name="${blogPostClassname}_$!{entryObj.number}_category" value="$name" type="checkbox"#if($entryObj.getProperty('category').getValue().contains($name)) checked="checked" #end/&gt; #getCategoryName($categoryDoc)&lt;/label&gt;##
 &lt;/span&gt;##
 #if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; ("$!{request.xaction}" != "showAddCategory" || "$!{request.parentCategory}" != $name))
 &lt;span class="blog-category-tools"&gt;##
-&lt;a href="$doc.getURL('view', "xaction=showAddCategory&amp;amp;parentCategory=$name")" class="tool add-subcategory"&gt;#toolImage('chart_organisation_add' 'Add a subcategory ')&lt;/a&gt;##
+&lt;a href="$doc.getURL('view', "xaction=showAddCategory&amp;amp;parentCategory=$nameUrl")" class="tool add-subcategory"&gt;#toolImage('chart_organisation_add' 'Add a subcategory ')&lt;/a&gt;##
 &lt;/span&gt;##
 #end
 &lt;/span&gt;
@@ -242,14 +245,15 @@
 ## DO NOT CHANGE INDENTATION
 #macro(displayEditableCategory $name $level)
   #getEntriesForCategory($name $discard $totalEntries)
+  #set($nameUrl = $escapetool.url($name).replace("+", "%20"))
   #foreach($i in [1..$level])*#end ##
 &lt;span class="blog-category-level"&gt;&lt;span class="blog-category"&gt;##
-&lt;a href="$xwiki.getURL('Blog.CategoryRss', 'view', "xpage=plain&amp;amp;category=$name")" title="RSS"&gt;&lt;img class="icon icon-manage" src="$xwiki.getSkinFile("icons/xwiki/rss-medium.png")" alt="[RSS]"/&gt;&lt;/a&gt;##
+&lt;a href="$xwiki.getURL('Blog.CategoryRss', 'view', "xpage=plain&amp;amp;category=$nameUrl")" title="RSS"&gt;&lt;img class="icon icon-manage" src="$xwiki.getSkinFile("icons/xwiki/rss-medium.png")" alt="[RSS]"/&gt;&lt;/a&gt;##
 [[#getCategoryName($xwiki.getDocument($name)) (% class="itemCount" %)($totalEntries)(%%)&gt;&gt;${name}]]&lt;/span&gt; ##
 &lt;span class="blog-category-tools"&gt;##
-#if($xwiki.hasAccessLevel('delete', $context.user, $name) &amp;&amp; ("$!{request.xaction}" != 'showRenameCategory' || "$!{request.category}" != $name))&lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=showRenameCategory&amp;amp;category=$name")" class="tool rename"&gt;#toolImage('pencil' 'Rename ')&lt;/a&gt;#end ##
-#if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; ("$!{request.xaction}" != "showAddCategory" || "$!{request.parentCategory}" != $name))&lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=showAddCategory&amp;amp;parentCategory=$name")" class="tool add-subcategory"&gt;#toolImage('chart_organisation_add' 'Add a subcategory ')&lt;/a&gt; #end ##
-#if($xwiki.hasAccessLevel('delete', $context.user, $name)) &lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=delete&amp;amp;category=$name")" class="tool delete"&gt;#toolImage('cross' 'Delete ')&lt;/a&gt;#end ##
+#if($xwiki.hasAccessLevel('delete', $context.user, $name) &amp;&amp; ("$!{request.xaction}" != 'showRenameCategory' || "$!{request.category}" != $name))&lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=showRenameCategory&amp;amp;category=$nameUrl")" class="tool rename"&gt;#toolImage('pencil' 'Rename ')&lt;/a&gt;#end ##
+#if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; ("$!{request.xaction}" != "showAddCategory" || "$!{request.parentCategory}" != $name))&lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=showAddCategory&amp;amp;parentCategory=$nameUrl")" class="tool add-subcategory"&gt;#toolImage('chart_organisation_add' 'Add a subcategory ')&lt;/a&gt; #end ##
+#if($xwiki.hasAccessLevel('delete', $context.user, $name)) &lt;a href="$xwiki.getURL('Blog.ManageCategories', 'view', "xaction=delete&amp;amp;category=$nameUrl")" class="tool delete"&gt;#toolImage('cross' 'Delete ')&lt;/a&gt;#end ##
 &lt;/span&gt;##
 #if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; "$!{request.xaction}" == "showRenameCategory" &amp;&amp; "$!{request.category}" == $name) #renameCategoryForm() #end##
 #if($xwiki.hasAccessLevel('edit', $context.user, $doc.fullName) &amp;&amp; "$!{request.xaction}" == "showAddCategory" &amp;&amp; "$!{request.parentCategory}" == $name) #addCategoryForm() #end##
@@ -279,13 +283,15 @@
  *###
 #macro(displaySimpleCategory $name $level)
   #getEntriesForCategory($name $discard $totalEntries)
-  #foreach($i in [1..$level])*#end &lt;span class="blog-category-level"&gt;&lt;a href="$xwiki.getURL('Blog.CategoryRss', 'view', "xpage=plain&amp;amp;category=$name")" title="RSS"&gt;#toolImage('bullet_feed', '[RSS]')&lt;/a&gt; &lt;a href="$xwiki.getURL($name)"&gt;#getCategoryName($xwiki.getDocument($name))&lt;/a&gt; &lt;span class="itemCount"&gt; ($totalEntries)&lt;/span&gt;&lt;/span&gt;
+  #set($nameUrl = $escapetool.url($name).replace("+", "%20"))
+  #foreach($i in [1..$level])*#end &lt;span class="blog-category-level"&gt;&lt;a href="$xwiki.getURL('Blog.CategoryRss', 'view', "xpage=plain&amp;amp;category=$nameUrl")" title="RSS"&gt;#toolImage('bullet_feed', '[RSS]')&lt;/a&gt; &lt;a href="$xwiki.getURL($name)"&gt;#getCategoryName($xwiki.getDocument($name))&lt;/a&gt; &lt;span class="itemCount"&gt; ($totalEntries)&lt;/span&gt;&lt;/span&gt;
 #end
 ##
 ##
 ##
 #**
  * Prints the name of a category, indicated by its document.
+ * The result is HTML-escaped
  * 
  * @param categoryDoc The document containing the category to be displayed.
  *###
@@ -295,19 +301,20 @@
 #if($result == '')
 #set($result = $categoryDoc.name)
 #end
-$result##
+$escapetool.html($result)##
 #end
 ##
 ##
 ##
 #**
  * Prints the description of a category, indicated by its document.
+ * The result is HTML-escaped
  * 
  * @param categoryDoc The document containing the category to be displayed.
  *###
 #macro(getCategoryDescription $categoryDoc)
 ## Don't indent!
-$!categoryDoc.getObject(${blogCategoryClassname}).getProperty('description').value.trim()##
+$escapetool.html($!categoryDoc.getObject(${blogCategoryClassname}).getProperty('description').value.trim())##
 #end
 ##
 ##
@@ -380,12 +387,13 @@
   #if($categoryParent == '')
     #set($categoryParent = "{$defaultCategoryParent}"))
   #end
+  #set($parameterValues = ["$!{category}"])
   #set($query = ', BaseObject obj where ')
   #if($space != '')
     #set($query = "${query}doc.space = '${space}' and ")
   #end
-  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName &lt;&gt; 'Blog.CategoryTemplate' and doc.parent = '$category' order by doc.name")
-  #foreach($item in $xwiki.searchDocuments($query))
+  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName &lt;&gt; 'Blog.CategoryTemplate' and doc.parent = ? order by doc.name")
+  #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
     #if($xwiki.hasAccessLevel('edit', $context.user, $item))
       #set($subcategoryDoc = $xwiki.getDocument($item))
       $subcategoryDoc.setParent($categoryParent)
@@ -396,8 +404,8 @@
   #if($space != '')
     #set($query = "${query}doc.space = '${space}' and ")
   #end
-  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName &lt;&gt; 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = '$category' order by doc.name")
-  #foreach($item in $xwiki.searchDocuments($query))
+  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName &lt;&gt; 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = ? order by doc.name")
+  #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
     #if($xwiki.hasAccessLevel('edit', $context.user, $item))
       #set($blogEntryDoc = $xwiki.getDocument($item))
       #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.remove($category))
@@ -418,9 +426,10 @@
 #macro(renameCategory $category $newCategoryName)
   #set($categoryDoc = $xwiki.getDocument($category))
   #set($newCategoryDoc = $xwiki.getDocument($newCategoryName))
+  #set($parameterValues = ["$!{category}"])
   #set($query = ', BaseObject obj where ')
-  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName &lt;&gt; 'Blog.CategoryTemplate' and doc.parent = '$category' order by doc.name")
-  #foreach($item in $xwiki.searchDocuments($query))
+  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName &lt;&gt; 'Blog.CategoryTemplate' and doc.parent = ? order by doc.name")
+  #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
     #if($xwiki.hasAccessLevel('edit', $context.user, $item))
       #set($subcategoryDoc = $xwiki.getDocument($item))
       $subcategoryDoc.setParent($newCategoryDoc.fullName)
@@ -428,8 +437,8 @@
     #end
   #end
   #set($query = ', BaseObject obj, DBStringListProperty categories join categories.list as category where ')
-  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName &lt;&gt; 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = '$category' order by doc.name")
-  #foreach($item in $xwiki.searchDocuments($query))
+  #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName &lt;&gt; 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = ? order by doc.name")
+  #foreach($item in $xwiki.searchDocuments($query, $parameterValues))
     #if($xwiki.hasAccessLevel('edit', $context.user, $item))
       #set($blogEntryDoc = $xwiki.getDocument($item))
       #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.remove($category))
Index: applications/blog/src/main/resources/Blog/CategorySheet.xml
===================================================================
--- applications/blog/src/main/resources/Blog/CategorySheet.xml	(revision 27744)
+++ applications/blog/src/main/resources/Blog/CategorySheet.xml	(working copy)
@@ -61,7 +61,7 @@
 #if($doc.getObject($blogCategoryClassname))
   #getEntriesForCategory($doc.fullName $discard $totalEntries)
 
-&lt;h1&gt;Category: #getCategoryName($doc) ($totalEntries posts) &lt;a href="$xwiki.getURL('Blog.CategoryRss', 'view', "xpage=plain&amp;amp;category=${doc.fullName}")" title="RSS"&gt;#toolImage('feed' '[RSS]')&lt;/a&gt;&lt;/h1&gt;
+&lt;h1&gt;Category: #getCategoryName($doc) ($totalEntries posts) &lt;a href="$xwiki.getURL('Blog.CategoryRss', 'view', "xpage=plain&amp;amp;category=${escapetool.url($doc.fullName)}")" title="RSS"&gt;#toolImage('feed' '[RSS]')&lt;/a&gt;&lt;/h1&gt;
   #if($context.action != 'inline')
     {{include document="Blog.CreatePost"/}}
     #getCategoriesHierarchy($doc.space $tree)
