anchor.diff:          String cookie = (String) session.getAttribute(ServerConstants.ADMIN_SERVICE_COOKIE);
   
           String path = request.getParameter("path");
  -        String parentPath = RegistryUtils.getParentPath(path);
  -        String resourceName = RegistryUtils.getResourceName(path);
  +        String parentPath = Encode.forHtml(RegistryUtils.getParentPath(path));
  +        String resourceName = Encode.forHtml(RegistryUtils.getResourceName(path));
           String mediaType;
           String description;
           try {
  
positive.code:             }
          } catch (Exception e) {
              response.setStatus(500);
              %><%=e.getMessage()%><%
              return;
          }
      %>
  
negative.code:     <input type="hidden" id="uMediaType" name="mediaType" value="<%=mediaType%>"/>
      <input type="hidden" id="uDescription" name="description" value="<%=description%>"/>
      <input type="hidden" id="uResourceName" name="filename" value="<%=resourceName%>"/>
      <input type="hidden" id="uRedirect" name="redirect" value="resources/resource.jsp?region=region3&item=resource_browser_menu&path=<%=Encode.forHtml(path.replaceAll("&","%26"))%>&viewType=std"/>
      <%
          if ("application/wsdl+xml".equals(mediaType) || "application/x-xsd+xml".equals(mediaType) || "application/policy+xml".equals(mediaType)) {
              %><input type="hidden" id="uSymlinkLocation" name="symlinkLocation" value="<%=parentPath%>"/><%
  