### Eclipse Workspace Patch 1.0
#P drupal_test_7
Index: modules/field/modules/number/number.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/field/modules/number/number.module,v
retrieving revision 1.5
diff -u -r1.5 number.module
--- modules/field/modules/number/number.module	26 Mar 2009 13:31:25 -0000	1.5
+++ modules/field/modules/number/number.module	26 Mar 2009 23:46:59 -0000
@@ -183,8 +183,8 @@
   $output = number_format($value, $settings['scale'], $settings['decimal_separator'], $settings['thousand_separator']);
 
   if ($settings['prefix_suffix']) {
-    $prefixes = isset($instance['settings']['prefix']) ? explode('|', check_plain($instance['settings']['prefix'])) : array(0 => '');
-    $suffixes = isset($instance['settings']['suffix']) ? explode('|', check_plain($instance['settings']['suffix'])) : array(0 => '');
+    $prefixes = isset($instance['settings']['prefix']) ? array_map('field_filter_xss', explode('|', $instance['settings']['prefix'])) : array('');
+    $suffixes = isset($instance['settings']['suffix']) ? array_map('field_filter_xss', explode('|', check_plain($instance['settings']['suffix']))) : array('');
     $prefix = (count($prefixes) > 1) ? format_plural($value, $prefixes[0], $prefixes[1]) : $prefixes[0];
     $suffix = (count($suffixes) > 1) ? format_plural($value, $suffixes[0], $suffixes[1]) : $suffixes[0];
     $output = $prefix . $output . $suffix;
@@ -323,11 +323,11 @@
 
   if (!empty($instance['settings']['prefix'])) {
     $prefixes = explode('|', $instance['settings']['prefix']);
-    $element[$field_key]['#field_prefix'] = array_pop($prefixes);
+    $element[$field_key]['#field_prefix'] = field_filter_xss(array_pop($prefixes));
   }
   if (!empty($instance['settings']['suffix'])) {
     $suffixes = explode('|', $instance['settings']['suffix']);
-    $element[$field_key]['#field_suffix'] = array_pop($suffixes);
+    $element[$field_key]['#field_suffix'] = field_filter_xss(array_pop($suffixes));
   }
 
   // Make sure we don't wipe out element validation added elsewhere.