HTML escape description to prevent code injection onto page

[selectricity-live] / app / views / quickvote / _candidate_list.rhtml

diff --git a/app/views/quickvote/_candidate_list.rhtml b/app/views/quickvote/_candidate_list.rhtml
index 1176e9768d4afb7aa24b7c6d8a3646671226b574..f4f1c0628c06d91139300d38a0338cbfa3b02611 100644 (file)
--- a/app/views/quickvote/_candidate_list.rhtml
+++ b/app/views/quickvote/_candidate_list.rhtml
@@ -9,9 +9,10 @@
 <% end %>
 
 <%= form_remote_tag :update => 'candlist',
-                    :url => { :action => 'add_candidate' } %>
+                    :url => { :action => 'add_candidate' },
+                   :complete => "Field.focus('ajax_newcandidate')" %>
 <p>
   <%= text_field "ajax", "newcandidate", :size => 40 %>
-  <%= submit_tag "Add" %>
+  <%= submit_tag "Add(+)" %>
 </p>
 <%= end_form_tag %>