Index: modules/user.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/Attic/user.module,v
retrieving revision 1.612.2.10
diff -u -p -r1.612.2.10 user.module
--- modules/user.module	23 May 2006 09:39:47 -0000	1.612.2.10
+++ modules/user.module	2 Aug 2006 22:31:54 -0000
@@ -875,7 +875,7 @@ function user_login($msg = '') {
 
   // Display login form:
   if ($msg) {
-    $form['message'] = array('#value' => "<p>$msg</p>");
+    $form['message'] = array('#value' => '<p>'. check_plain($msg) .'</p>');
   }
   $form['name'] = array('#type' => 'textfield',
     '#title' => t('Username'),