added further crossite scripting prevention. Fixed setappointmentforad.jsp Sort of. Best I can do :P