Not all user-submitted text is filtered

The patch adds $form['start'] just before $form['question'] into multichoice.module

  $form['start'] = array('#type' => 'markup', '#value' => '<div class="multichoice_form">');
  $form['question'] = array('#type' => 'markup', '#value' => check_markup($node->body, $node->format));

   // Create form

So i think that a $form['stop'] before the call of <code>drupal_get_form is missing (otherwise <div class="multichoice_form"> is not closed)

  $form['stop'] = array('#type' => 'markup', '#value' => '</div>');

  return drupal_get_form('multichoice_render_question', $form);

Or maybe i'm missing something?

That $form['start'] and $form['stop'] stuff is kind of a hack -- anywhere the module's outputting HTML, it should ideally be in a theme function.. so:

$form['question'] = theme('multichoice_question', check_markup($node->body, $node->format);

or something...

However, we should primarily be concerned with making sure the check_markups are in place; cleaning up the display layer can follow-up in additional patches.

Btw, Sean, don't bother waiting for other reviews to fix security problems... just commit directly.

it's like there's a parameter missing in check_markup() call