Index: flag.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/flag/Attic/flag.module,v
retrieving revision 1.11.2.65
diff -u -r1.11.2.65 flag.module
--- flag.module	22 Feb 2009 03:15:52 -0000	1.11.2.65
+++ flag.module	26 Feb 2009 16:43:53 -0000
@@ -1071,7 +1071,7 @@
 
   $variables['link_href'] = check_url(url($link['href'], $link));
   $variables['link_text'] = isset($link['title']) ? $link['title'] : strip_tags($flag->get_label($action . '_short', $content_id), '<em><strong><img>');
-  $variables['link_title'] = isset($link['attributes']['title']) ? $link['attributes']['title'] : strip_tags($flag->get_label($action . '_long', $content_id));
+  $variables['link_title'] = isset($link['attributes']['title']) ? check_plain($link['attributes']['title']) : check_plain(strip_tags($flag->get_label($action . '_long', $content_id)));
   $variables['flag_name_css'] = str_replace('_', '-', $flag->name);
   $variables['last_action'] = ($action == 'flag' ? 'unflagged' : 'flagged');
   $variables['flag_classes_array'] = array();