diff --git a/html/access.php b/html/access.php
index 8456f9bdc..6bc73d3b7 100644
--- a/html/access.php
+++ b/html/access.php
@@ -66,6 +66,7 @@ if ( isset($_REQUEST['save_todo_list'])) {
   $add_todo->save();
 }
 $todo=new Todo_List($cn);
+
 $array=$todo->load_all();
 echo '<div style="float:left;width:40%">';
 echo '<fieldset> <legend>Liste des tâches</legend>';
@@ -98,7 +99,7 @@ $nb++;
       $row['tl_date'].
       '</td>'.
       '<td>'.
-      $row['tl_title'].
+      htmlspecialchars($row['tl_title']).
       '</td>'.
       '<td>'.
       widget::button('mod','M','onClick="todo_list_show('.$row['tl_id'].')"').
diff --git a/include/class_todo_list.php b/include/class_todo_list.php
index ab2f7e50b..4d040e1b2 100644
--- a/include/class_todo_list.php
+++ b/include/class_todo_list.php
@@ -66,9 +66,12 @@ class Todo_List
   }
   public function check($p_idx,&$p_value) {
 	if ( strcmp ($p_idx, 'tl_id') == 0 ) { if ( strlen($p_value) > 6 || isNumber ($p_value) == false) return false;}
-	if ( strcmp ($p_idx, 'tl_date') == 0 ) { if ( strlen($p_value) > 12 || isDate ($p_value) == false) return false;}
-	if ( strcmp ($p_idx, 'tl_title') == 0 ) { $p_value=substr(htmlentities($p_value),0,120) ; return true;}
-	if ( strcmp ($p_idx, 'tl_desc') == 0 ) { $p_value=substr(htmlentities($p_value),0,400) ; return true;}
+	if ( strcmp ($p_idx, 'tl_date') == 0 ) { if ( strlen(trim($p_value)) ==0 ||strlen($p_value) > 12 || isDate ($p_value) == false) return false;}
+	if ( strcmp ($p_idx, 'tl_title') == 0 ) { 
+	  $p_value=substr($p_value,0,120) ;
+	  return true;
+	}
+	if ( strcmp ($p_idx, 'tl_desc') == 0 ) { $p_value=substr($p_value,0,400) ; return true;}
 	return true;
   }
   public function set_parameter($p_string,$p_value) {
@@ -83,6 +86,10 @@ class Todo_List
   }
   public function get_info() {    return var_export(self::$variable,true);  }
   public function verify() {
+    if ( isDate($this->tl_date) == false ) {
+      alert('Date est invalide');
+      return 1;
+    }
     return 0;
   }
   public function save() {