diff -r f178182b1305 -r af4d8f75c5db web/box.py
--- a/web/box.py	Tue Jul 07 13:25:24 2009 +0200
+++ b/web/box.py	Tue Jul 07 13:26:44 2009 +0200
@@ -8,7 +8,7 @@
 __docformat__ = "restructuredtext en"
 _ = unicode
 
-from logilab.mtconverter import html_escape
+from logilab.mtconverter import xml_escape
 
 from cubicweb import Unauthorized, role as get_role, target as get_target
 from cubicweb.selectors import (one_line_rset,  primary_view,
@@ -74,7 +74,7 @@
         .format_actions method
         """
         if escape:
-            title = html_escape(title)
+            title = xml_escape(title)
         return self.box_action(self._action(title, path, **kwargs))
 
     def _action(self, title, path, **kwargs):