anchor.diff:          }
       }
   
  -    url += mode + "/" + heatmap + "/";
  +    url += Util.encode(mode) + "/" + Util.encode(heatmap) + "/";
   
       if ("nodesByForeignSource".equals(heatmap)) {
           foreignSource = request.getParameter("foreignSource");
  -        url += foreignSource;
  +        url += Util.encode(foreignSource);
           title += " (Nodes by ForeignSource '" + foreignSource + "')";
       }
   
       if ("nodesByCategory".equals(heatmap)) {
           category = request.getParameter("category");
  -        url += category;
  +        url += Util.encode(category);
           title += " (Nodes by Category '" + category + "')";
       }
   
       if ("nodesByMonitoredService".equals(heatmap)) {
           monitoredService = request.getParameter("monitoredService");
  -        url += monitoredService;
  +        url += Util.encode(monitoredService);
           title += " (Nodes by Service '" +monitoredService + "')";
       }
   
  
positive.code:         <%
              if ("foreignSources".equals(heatmap) || "nodesByForeignSource".equals(heatmap)) {
          %>
          <a href="<%=request.getRequestURI()%>?mode=<%=mode%>&heatmap=categories">Categories</a> / <b>Foreign Sources</b> / <a href="<%=request.getRequestURI()%>?mode=<%=mode%>&heatmap=monitoredServices">Services</a>
          <%
              } else {
                  if ("categories".equals(heatmap) ||"nodesByCategory".equals(heatmap)) {
          %>
          <b>Categories</b> / <a href="<%=request.getRequestURI()%>?mode=<%=mode%>&heatmap=foreignSources">Foreign Sources</a> / <a href="<%=request.getRequestURI()%>?mode=<%=mode%>&heatmap=monitoredServices">Services</a>
          <%
                  } else {
          %>
          <a href="<%=request.getRequestURI()%>?mode=<%=mode%>&heatmap=categories">Categories</a> / <a href="<%=request.getRequestURI()%>?mode=<%=mode%>&heatmap=foreignSources">Foreign Sources</a> / <b>Services</b>
          <%
                  }
              }
  
negative.code: <%@ page import="org.opennms.web.api.Util" %>
  <%@ page import="org.opennms.core.utils.WebSecurityUtils" %><%--
  /*******************************************************************************
   * This file is part of OpenNMS(R).
   *
  