add: texte = texte.replace('<', '&lt;'); 
context: function preview(evt){	var subject	 = document.forms['send-form'].elements['subject'].value;	var preview	 = window.open('about:blank','apercu','width=' + width + ',height=' + height + ',marginleft=2,topmargin=2,left=' + left + ',top=' + top + ',toolbar=0,location=0,directories=0,status=0,scrollbars=1,resizable=0,copyhistory=0,menuBar=0');	var rex_link = new RegExp("{LINKS}", "gi");		if( evt.target.id == 'preview1' )	{		var texte = document.forms['send-form'].elements['body_text'].value;		texte = texte.replace(rex_link, "http://www.example.org");		var boldSpan = new RegExp("(\\*\\w+\\*)", "g");		var italicSpan = new RegExp("(/\\w+/)", "g");		var underlineSpan = new RegExp("(_\\w+_)", "g");		texte = texte.replace(boldSpan, "<strong>$1</strong>");		texte = texte.replace(italicSpan, "<em>$1</em>");		texte = texte.replace(underlineSpan, "<u>$1</u>");				preview.document.writeln('<!DOCTYPE HTML PUBLIC "-\/\/W3C\/\/DTD HTML 4.01\/\/EN" "http:\/\/www.w3.org\/TR\/html4\/strict.dtd">');		preview.document.writeln('<html><head><title>' + subject + '<\/title><\/head>');		preview.document.writeln('<body><pre>' + texte + '<\/pre><\/body><\/html>');	}	else	{		var texte     = document.forms['send-form'].elements['body_html'].value;		var rex_img   = new RegExp("<([^<]+)\"cid:([^\\:*/?<\">|]+)\"([^>]*)?>", "gi");		var rex_title = new RegExp("<title>.*</title>", "i");		var sessid    = '';				for( var i = 0, m = document.forms.length; i < m; i++ )		{			if( document.forms[i].elements['sessid'] )			{				sessid = document.forms[i].elements['sessid'].value;				break;			}		}				texte = texte.replace(rex_link, '<a href="http://www.example.org/">Example</a>');		texte = texte.replace(rex_img, "<$1\"../options/show.php?file=$2&amp;sessid=" + sessid + "\"$3>");		texte = texte.replace(rex_title, '<title>' + subject + '</title>');				preview.document.write(texte);	}		preview.document.close();	preview.focus();}
meta: 7226	/local1/tlutelli/issta_data/temp/all_js/javascript/2006_temp/2006/7226/d62c70a2d095acb8f4a2e47fbf0a9db10fcd7dac/editor.js/clean/templates/admin/editor.js