closes #329

package.json

@@ -38,7 +38,8 @@
     "nodebb-plugin-markdown": "~0.1.0",
     "rss": "~0.2.0",
     "prompt": "~0.2.11",
-		"uglify-js": "~2.4.0"
+    "uglify-js": "~2.4.0",
+    "validator": "~1.5.1"
   },
   "bugs": {
     "url": "https://github.com/designcreateplay/NodeBB/issues"
@@ -46,20 +47,26 @@
   "engines": {
     "node": ">=0.8"
   },
-	"contributors": [{
+  "contributors": [
+    {
       "name": "Andrew Rodrigues",
       "email": "andrew@designcreateplay.com"
-	}, {
+    },
+    {
       "name": "Julian Lam",
       "email": "julian@designcreateplay.com"
-	}, {
+    },
+    {
       "name": "Barış Soner Uşaklı",
       "email": "baris@designcreateplay.com"
-	}, {
+    },
+    {
       "name": "Damian Bushong",
       "url": "https://github.com/damianb"
-	}, {
+    },
+    {
       "name": "Matt Smith",
       "url": "https://github.com/soimafreak"
-	}]
+    }
+  ]
 }

src/topics.js

@@ -12,7 +12,8 @@ schema = require('./schema.js'),
 	feed = require('./feed.js'),
 	favourites = require('./favourites.js'),
 	reds = require('reds'),
-	topicSearch = reds.createSearch('nodebbtopicsearch');
+	topicSearch = reds.createSearch('nodebbtopicsearch'),
+	validator = require('validator');
 
 
 (function(Topics) {
@@ -655,7 +656,7 @@ schema = require('./schema.js'),
 
 				var slug = tid + '/' + utils.slugify(title);
 				var timestamp = Date.now();
-
+				title = validator.sanitize(title).escape();
 				RDB.hmset('topic:' + tid, {
 					'tid': tid,
 					'uid': uid,