--- ecard.module.ori	2009-02-06 17:58:38.000000000 +0100
+++ ecard.module	2009-02-06 18:08:03.000000000 +0100
@@ -208,7 +208,7 @@ function ecard_form($form_state,$node) {
 			  );
 			  $form['view_message']['msg'] = array(
 				'#type' => 'markup',
-				'#value' => $_SESSION['message']
+				'#value' => filter_xss($_SESSION['message'])
 			);
 			unset ($_SESSION['message']);
 		}