HTML Escape friend request message

htdocs/theme/default/templates/user/view.tpl

@@ -35,7 +35,7 @@
                 </div>
                 {if $relationship == 'pending'}
                     <div class="message">
-                        {str tag='whymakemeyourfriend' section='group'} {$message}
+                        {str tag='whymakemeyourfriend' section='group'} {$message|escape}
                         {$requestform}
                     </div>
                 {/if}