</if>
<form enctype="multipart/form-data" action="${actionURL}&do=opensession&sessiontype=comment" method="post">
-<input type="hidden" name="to_media" value="${to_media}">
+<input type="hidden" name="to_media" value="${utility.encodeHTML(to_media)}">
<h2>
${lang("posting.step01")}