1 files changed, 3 insertions, 1 deletions
diff --git a/boot.php b/boot.php
index 9dce8689e..2b608760c 100644
--- a/boot.php
+++ b/boot.php
@@ -190,7 +190,9 @@ function notags($string) {
 // The PHP built-in tag escape function has traditionally been buggy
 if(! function_exists('escape_tags')) {
 function escape_tags($string) {
-	return(str_replace(array("<",">","&"), array('&lt;','&gt;','&amp;'), $string));
+	return(str_replace(
+		array('&', '"', "'", '<', '>'), 
+		array('&amp;', '&quot;', '&apos;', '&lt;', '&gt;'), $string));
 }}
 
 if(! function_exists('login')) {