fix address value2html

src/element/editable-element.js

@@ -558,10 +558,10 @@ Makes editable any HTML element on the page. Applied as jQuery method.
         **/
         value: null,
         /**
-        Callback to perform custom displaying of value in element's text.
+        Callback to perform custom displaying of value in element's text.  
-        If <code>null</code>, default input's value2html() will be called.
+        If <code>null</code>, default input's value2html() will be called.  
-        If <code>false</code>, no displaying methods will be called, element's text will no change.
+        If <code>false</code>, no displaying methods will be called, element's text will no change.  
-        Runs under element's scope.
+        Runs under element's scope.  
         Second parameter __sourceData__ is passed for inputs with source (select, checklist).
         
         @property display 
@@ -570,7 +570,8 @@ Makes editable any HTML element on the page. Applied as jQuery method.
         @since 1.2.0
         @example
         display: function(value, sourceData) {
-            $(this).html('<b>'+value+'</b>');
+            var escapedValue = $('<div>').text(value).html();
+            $(this).html('<b>'+escapedValue+'</b>');
         }
         **/          
         display: null

src/inputs-ext/address/address.js

@@ -31,14 +31,16 @@ $(function(){
     $.extend(Address.prototype, {
          render: function() {
              Address.superclass.render.call(this);
-             
-            // this.$input.
          },
         
-        
+        //standard way to show value in element. Used only if display option not defined.
         value2html: function(value, element) {
-            var html = value.city + ', ' + value.street + ' st., bld. ' + value.building;
+            if(!value) {
-            $(element).text(html); 
+                $(element).empty();
+                return; 
+            }
+            var html = $('<div>').text(value.city).html() + ', ' + $('<div>').text(value.street).html() + ' st., bld. ' + $('<div>').text(value.building).html();
+            $(element).html(html); 
         },
         
         html2value: function(html) {