html_escape on set_value

[eluser]royduin[/eluser]
Ok, I litty addition:
The problem is apparently the default value, not the returned value from set_value, that's likely escaped. Can someone confirm that the value returned from set_value is escaped?

OK:

Code:

<input type="text" name="name" value="<? echo set_value('name'); ?>" />

LIKE:

Code:

<input type="text" name="name" value=""><h1>It works!</h1>" />

Not OK (when the form is succesfully submited, but when you go back to the form and $name is the value pasted in):

Code:

<input type="text" name="name" value="<? echo set_value('name',$name); ?>" />

LIKE:

Code:

&lt;input type="text" name="name" value=""&gt;&lt;h1>It works!</h1>" />

Solution:

Code:

<input type="text" name="name" value="<? echo set_value('name',html_escape($name)); ?>" />

WILL BE:

Code:

<input type="text" name="name" value=""><h1>It works!</h1>" />