Index: forms/widgets.py
===================================================================
--- forms/widgets.py	(revision 8230)
+++ forms/widgets.py	(working copy)
@@ -35,36 +35,36 @@
             media_attrs = media.__dict__
         else:
             media_attrs = kwargs
-            
+
         self._css = {}
         self._js = []
-        
+
         for name in MEDIA_TYPES:
             getattr(self, 'add_' + name)(media_attrs.get(name, None))
 
         # Any leftover attributes must be invalid.
         # if media_attrs != {}:
         #     raise TypeError, "'class Media' has invalid attribute(s): %s" % ','.join(media_attrs.keys())
-        
+
     def __unicode__(self):
         return self.render()
-        
+
     def render(self):
         return u'\n'.join(chain(*[getattr(self, 'render_' + name)() for name in MEDIA_TYPES]))
-        
+
     def render_js(self):
-        return [u'<script type="text/javascript" src="%s"></script>' % self.absolute_path(path) for path in self._js]
-        
+        return [mark_safe(u'<script type="text/javascript" src="%s"></script>' % conditional_escape(self.absolute_path(path))) for path in self._js]
+
     def render_css(self):
         # To keep rendering order consistent, we can't just iterate over items().
         # We need to sort the keys, and iterate over the sorted list.
         media = self._css.keys()
         media.sort()
         return chain(*[
-            [u'<link href="%s" type="text/css" media="%s" rel="stylesheet" />' % (self.absolute_path(path), medium) 
-                    for path in self._css[medium]] 
+            [mark_safe(u'<link href="%s" type="text/css" media="%s" rel="stylesheet" />' % (conditional_escape(self.absolute_path(path)), medium))
+                    for path in self._css[medium]]
                 for medium in media])
-        
+
     def absolute_path(self, path):
         if path.startswith(u'http://') or path.startswith(u'https://') or path.startswith(u'/'):
             return path
@@ -77,9 +77,9 @@
         raise KeyError('Unknown media type "%s"' % name)
 
     def add_js(self, data):
-        if data:    
+        if data:
             self._js.extend([path for path in data if path not in self._js])
-            
+
     def add_css(self, data):
         if data:
             for medium, paths in data.items():
@@ -99,8 +99,8 @@
             base = super(cls, self).media
         else:
             base = Media()
-        
-        # Get the media definition for this class    
+
+        # Get the media definition for this class
         definition = getattr(cls, 'Media', None)
         if definition:
             extend = getattr(definition, 'extend', True)
@@ -117,16 +117,16 @@
         else:
             return base
     return property(_media)
-    
+
 class MediaDefiningClass(type):
     "Metaclass for classes that can have media definitions"
-    def __new__(cls, name, bases, attrs):            
+    def __new__(cls, name, bases, attrs):
         new_class = super(MediaDefiningClass, cls).__new__(cls, name, bases,
                                                            attrs)
         if 'media' not in attrs:
             new_class.media = media_property(new_class)
         return new_class
-        
+
 class Widget(object):
     __metaclass__ = MediaDefiningClass
     is_hidden = False          # Determines whether this corresponds to an <input type="hidden">.
@@ -264,7 +264,7 @@
     def value_from_datadict(self, data, files, name):
         "File widgets take data from FILES, not POST"
         return files.get(name, None)
-    
+
     def _has_changed(self, initial, data):
         if data is None:
             return False
@@ -410,7 +410,7 @@
         if isinstance(data, MultiValueDict):
             return data.getlist(name)
         return data.get(name, None)
-    
+
     def _has_changed(self, initial, data):
         if initial is None:
             initial = []
@@ -527,7 +527,7 @@
                 label_for = u' for="%s"' % final_attrs['id']
             else:
                 label_for = ''
-                
+
             cb = CheckboxInput(final_attrs, check_test=lambda value: value in str_values)
             option_value = force_unicode(option_value)
             rendered_cb = cb.render(name, option_value)
@@ -601,7 +601,7 @@
 
     def value_from_datadict(self, data, files, name):
         return [widget.value_from_datadict(data, files, name + '_%s' % i) for i, widget in enumerate(self.widgets)]
-    
+
     def _has_changed(self, initial, data):
         if initial is None:
             initial = [u'' for x in range(0, len(data))]
@@ -637,7 +637,7 @@
             media = media + w.media
         return media
     media = property(_get_media)
-    
+
 class SplitDateTimeWidget(MultiWidget):
     """
     A Widget that splits datetime input into two <input type="text"> boxes.
@@ -650,4 +650,3 @@
         if value:
             return [value.date(), value.time().replace(microsecond=0)]
         return [None, None]
-
