=== modified file 'payment/uc_payment/uc_payment.module'
--- payment/uc_payment/uc_payment.module	2009-09-21 14:13:04 +0000
+++ payment/uc_payment/uc_payment.module	2009-10-19 21:56:11 +0000
@@ -325,9 +325,22 @@
  * Callback Functions, Forms, and Tables
  ******************************************************************************/
 
-function uc_payment_get_totals() {
+/**
+ * Return a formatted list of line items for an order total preview.
+ *
+ * @param $return
+ *   TRUE or FALSE to specify whether or not to return the results instead of
+ *     printing them and exiting.
+ * @param $order
+ *   Optionally pass in a full order object to use instead of finding it in the
+ *     $_POST data.
+ * @return
+ *   The formatted HTML of the order total preview if $return is set to TRUE.
+ */
+function uc_payment_get_totals($return = FALSE, $order = NULL) {
   $output = '';
-  if (is_array($_POST)) {
+
+  if (empty($order) && is_array($_POST) && isset($_POST['order'])) {
     $order = unserialize($_POST['order']);
   }
 
@@ -350,7 +363,7 @@
         $context['revision'] = 'themed';
         $context['subject']['line_item'] = $line;
 
-        $output .= '<tr><td align="right"><b>'. $line['title'] .':</b></td>'
+        $output .= '<tr><td align="right"><b>'. filter_xss($line['title']) .':</b></td>'
                   .'<td align="right">'. uc_price($line['amount'], $context) .'</td></tr>';
 
         if ($line['summed']) {
@@ -367,6 +380,10 @@
               .'</td></tr></table>';
   }
 
+  if ($return) {
+    return $output;
+  }
+  
   print $output;
   exit();
 }
@@ -763,4 +780,3 @@
     }
   }
 }
-