<% -%>
<div id="cand<%= @current_candidate.id %>">
-<p><strong><%= @current_candidate.name %></strong>
+<p><strong><%=h @current_candidate.name %></strong>
(<%= link_to_remote "Delete",
:complete => "Element.remove('cand#{@current_candidate.id}')",
:url => { :action => :delete_candidate,