Index: js/authcache.js
===================================================================
--- js/authcache.js	(revision 7948)
+++ js/authcache.js	(working copy)
@@ -172,6 +172,7 @@
       if(Authcache.isDebug) {
         Authcache.debug({'sent':jsonData,'received':data});
       }
+      
     },
 
     // Custom header to help prevent cross-site forgery requests
@@ -343,7 +344,7 @@
  * Display debug info, depending on phase
  */
 Authcache.debug = function(ajaxData) {
-
+  var debugInfo = "";
   if(!ajaxData) {
 
     legend = ($.cookie('drupal_user')) ? " (logged in: "+$.cookie('drupal_user')+')' : '';
@@ -395,7 +396,6 @@
       "<fieldset><legend><b>" + legend + "</b></legend>" + Authcache.debugFieldset(ajaxLink, ajaxData.sent) +
       Authcache.debugFieldset("Response:", ajaxData.received) +
       "</fieldset>";
-
     $("#authcachedebug").append(debugInfo);
     Authcache.debugTimer();
   }
@@ -427,12 +427,17 @@
 Authcache.debugFieldset = function(title, jsonData) {
   fieldset = '<div style="clear:both;"></div><fieldset style="float:left;min-width:240px;"><legend>'+title+'</legend>';
   for(key in jsonData) {
-    fieldset += "<b>"+key+"</b>: "+JSON.stringify(jsonData[key])+'<br>';
+    fieldset += "<b>"+key+"</b>: "+ xmlencode(JSON.stringify(jsonData[key])) +'<br>';
   }
   fieldset += '</fieldset><div style="clear:both;">';
   return fieldset;
 }
 
+function xmlencode(string) {
+    return string.replace(/\&/g,'&'+'amp;').replace(/</g,'&'+'lt;')
+        .replace(/>/g,'&'+'gt;').replace(/\'/g,'&'+'apos;').replace(/\"/g,'&'+'quot;');
+}
+
 /**
  * JSON to String
  * http://www.JSON.org/js.html