--- trunk/irc-logger.pl	2006/03/13 16:43:18	16
+++ trunk/irc-logger.pl	2006/03/13 17:07:40	18
@@ -123,8 +123,8 @@
 
 	my $sth = $dbh->prepare( $sql );
 	if ($args->{search}) {
-		warn "search for '$args->{search}' returned ", $sth->rows, " results\n";
 		$sth->execute( '%' . $args->{search} . '%' );
+		warn "search for '$args->{search}' returned ", $sth->rows, " results\n";
 	} else {
 		$sth->execute();
 	}
@@ -402,6 +402,9 @@
 	Headers        => { Server => 'irc-logger' },
 );
 
+my %escape = ('<'=>'&lt;', '>'=>'&gt;', '&'=>'&amp;', '"'=>'&quot;');
+my $escape_re  = join '|' => keys %escape;
+
 my $style = <<'_END_OF_STYLE_';
 p { margin: 0; padding: 0.1em; }
 .time, .channel { color: #808080; font-size: 60%; }
@@ -447,6 +450,7 @@
 				},
 				message_filter => sub {
 					my $m = shift || return;
+					$m =~ s/($escape_re)/$escape{$1}/gs;
 					$m =~ s#($RE{URI}{HTTP})#<a href="$1">$1</a>#gs;
 					return $m;
 				},