--- a/utils.py	Tue Jul 12 14:04:42 2011 +0200
+++ b/utils.py	Tue Jul 12 17:50:31 2011 +0200
@@ -383,7 +383,7 @@
             if skiphead:
                 for script in self.post_inlined_scripts:
                     w(u'<pre class="script">')
-                    w(script)
+                    w(xml_escape(script))
                     w(u'</pre>')
             else:
                 w(self.xhtml_safe_script_opening)

--- a/web/request.py	Tue Jul 12 14:04:42 2011 +0200
+++ b/web/request.py	Tue Jul 12 17:50:31 2011 +0200
@@ -625,7 +625,7 @@
         url = self.build_url('json', **extraparams)
         cbname = build_cb_uid(url[:50])
         # think to propagate pageid. XXX see https://www.cubicweb.org/ticket/1753121
-        jscode = 'function %s() { $("#%s").%s; }' % (
+        jscode = u'function %s() { $("#%s").%s; }' % (
             cbname, nodeid, js.loadxhtml(url, {'pageid': self.pageid},
                                          'get', replacemode))
         self.html_headers.add_post_inline_script(jscode)