diff -Naur phptemplate.orig/phptemplate.engine phptemplate/phptemplate.engine
--- phptemplate.orig/phptemplate.engine	2006-12-30 14:59:11.000000000 -0600
+++ phptemplate/phptemplate.engine	2007-01-25 13:23:54.000000000 -0600
@@ -186,12 +186,12 @@
 
   // Construct page title
   if (drupal_get_title()) {
-    $head_title = array(strip_tags(drupal_get_title()), variable_get('site_name', 'Drupal'));
+    $head_title = array(strip_tags(drupal_get_title()), check_plain(variable_get('site_name', 'Drupal')));
   }
   else {
-    $head_title = array(variable_get('site_name', 'Drupal'));
+    $head_title = array(check_plain(variable_get('site_name', 'Drupal')));
     if (variable_get('site_slogan', '')) {
-      $head_title[] = variable_get('site_slogan', '');
+      $head_title[] = check_plain(variable_get('site_slogan', ''));
     }
   }