Index: web/standard/src/main/webapp/templates/attachmentsinline.vm
===================================================================
--- web/standard/src/main/webapp/templates/attachmentsinline.vm	(revision 28933)
+++ web/standard/src/main/webapp/templates/attachmentsinline.vm	(working copy)
@@ -6,7 +6,7 @@
 ### TODO: web service?
 ###
 #if($request.xredirect)
-#set( $redirect = $request.xredirect)
+#set( $redirect = "$!{escapetool.xml($request.xredirect)}")
 #else
 #set( $redirect = "${doc.getURL()}#Attachments")
 #end
@@ -24,7 +24,7 @@
 #if($hasEdit || $hasAdmin)
           <span class="xwikibuttonlinks">
             ## Delete attachment link
-            <a class="deletelink" href="$doc.getAttachmentURL(${attach.filename}, 'delattachment', "xredirect=${redirect}")"  title="$msg.get('core.viewers.attachments.deleteTitle', [$xwiki.getXMLEncoded($attach.filename)])">$msg.get('core.viewers.attachments.delete')</a>
+            <a class="deletelink" href="$doc.getAttachmentURL(${attach.filename}, 'delattachment', "xredirect=${redirect}")"  title="$msg.get('core.viewers.attachments.deleteTitle', [$escapetool.xml($attach.filename)])">$msg.get('core.viewers.attachments.delete')</a>
             ## Dav Edit attachment link. We display the link hidden by default, and let the WebDAV JSX extension display it if
             ## the browser supports Dav Edit 
 	    #set($documentUrl=$doc.getExternalURL("download"))
@@ -42,8 +42,8 @@
 #end ## hasEdit
           <span class="version"><a href="$doc.getAttachmentURL(${attach.filename}, 'viewattachrev')" title="$msg.get('core.viewers.attachments.showHistory')">$attach.version</a></span>
           <div class="meta">
-          <span class="publisher">$msg.get('core.viewers.attachments.author', [$xwiki.getUserName($attach.author)])</span>
-          <span class="date">$msg.get('core.viewers.attachments.date', [$!xwiki.formatDate($attach.date)])</span>
+          <span class="publisher">$msg.get('core.viewers.attachments.author', [$!{xwiki.getUserName($attach.author)}])</span>
+          <span class="date">$msg.get('core.viewers.attachments.date', [$!{xwiki.formatDate($attach.date)}])</span>
           <span class="size">(#dynamicsize($attach.filesize))</span>
           </div>
           </div>
@@ -61,7 +61,7 @@
 #if($hasEdit || $hasAdmin)
       <form action="$doc.getURL("upload")" enctype="multipart/form-data" method="post" id="AddAttachment">
 <div>
-<input type="hidden" name="xredirect" value="${xwiki.getFormEncoded($redirect)}" />
+<input type="hidden" name="xredirect" value="$!redirect" />
 <fieldset id="attachform">
         <legend>$msg.get('core.viewers.attachments.upload.title')</legend>
         ## Temporarily disabled, until we fix attachment name handling
Index: web/standard/src/main/webapp/templates/attachments.vm
===================================================================
--- web/standard/src/main/webapp/templates/attachments.vm	(revision 28933)
+++ web/standard/src/main/webapp/templates/attachments.vm	(working copy)
@@ -2,6 +2,6 @@
 ### Attachments page in the "view" mode
 ###
 ###
-<div id="document-title"><h1>$msg.get('core.viewers.attachments.title', [$xwiki.getXMLEncoded($doc.displayTitle), $doc.getURL()])</h1></div>
+<div id="document-title"><h1>$msg.get('core.viewers.attachments.title', ["$!{escapetool.xml($doc.displayTitle)}", $doc.getURL()])</h1></div>
 #template("shortcuts.vm")
 #template("attachmentsinline.vm")
Index: web/standard/src/main/webapp/templates/attachwysiwyg.vm
===================================================================
--- web/standard/src/main/webapp/templates/attachwysiwyg.vm	(revision 28933)
+++ web/standard/src/main/webapp/templates/attachwysiwyg.vm	(working copy)
@@ -27,7 +27,7 @@
             </a>
           #end
         </td><td align="center"><a href="$doc.getAttachmentURL("${attach.filename}", "download")" onclick="document.forms[0].href.value='$attach.filename'; return false;" >$attach.filename</a></td>
-        <td align="center">$attach.version</td><td align="center">$xwiki.getLocalUserName($attach.author)</td>
+        <td align="center">$attach.version</td><td align="center">$!{escapetool.xml($xwiki.getLocalUserName($attach.author))}</td>
       </tr>
     #end
     #set( $counter = $counter + 1)
