As Brion points out, this needs an htmlspecialchars.

diff --git a/includes/SpecialMovepage.php b/includes/SpecialMovepage.php
index c5b8066..1135c03 100644 (file)
--- a/includes/SpecialMovepage.php
+++ b/includes/SpecialMovepage.php
@@ -368,7 +368,8 @@ class MovePageForm {
                        $newPage = Title::makeTitleSafe( $newNs, $newPageName );
                        if( !$newPage ) {
                                $oldLink = $skin->makeKnownLinkObj( $oldPage );
-                               $extraOutput []= wfMsgHtml( 'movepage-page-unmoved', $oldLink, Title::makeName( $newNs, $newPageName ) );
+                               $extraOutput []= wfMsgHtml( 'movepage-page-unmoved', $oldLink,
+                                       htmlspecialchars(Title::makeName( $newNs, $newPageName )));
                                continue;
                        }