As a further precaution, use wfOpenElement() and wfCloseElement()

diff --git a/includes/EditPage.php b/includes/EditPage.php
index f41e85c..c795140 100644 (file)
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -1429,7 +1429,7 @@ END
                        $attribs = array( 'id' => 'wpTextbox1', 'name' => 'wpTextbox1', 'cols' => $cols, 'rows' => $rows, 'readonly' => 'readonly' );
                        $wgOut->addHtml( '<hr />' );
                        $wgOut->addWikiText( wfMsg( $first ? 'blockedoriginalsource' : 'blockededitsource', $this->mTitle->getPrefixedText() ) );
-                       $wgOut->addHtml( wfElement( 'textarea', $attribs, $source ) );
+                       $wgOut->addHtml( wfOpenElement( 'textarea', $attribs ) . htmlspecialchars( $source ) . wfCloseElement( 'textarea' ) );
                }
        }