Index: neon/src/ne_207.c
--- neon/src/ne_207.c.orig	1970-03-04 07:27:31.000000000 +0100
+++ neon/src/ne_207.c	2004-04-16 18:10:50.000000000 +0200
@@ -320,12 +320,12 @@
 	if (ne_get_status(req)->code == 207) {
 	    if (!ne_xml_valid(p)) { 
 		/* The parse was invalid */
-		ne_set_error(sess, ne_xml_get_error(p));
+		ne_set_error(sess, "%s", ne_xml_get_error(p));
 		ret = NE_ERROR;
 	    } else if (ctx.is_error) {
 		/* If we've actually got any error information
 		 * from the 207, then set that as the error */
-		ne_set_error(sess, ctx.buf->data);
+		ne_set_error(sess, "%s", ctx.buf->data);
 		ret = NE_ERROR;
 	    }
 	} else if (ne_get_status(req)->klass != 2) {
Index: neon/src/ne_auth.c
--- neon/src/ne_auth.c.orig	1970-03-04 07:27:31.000000000 +0100
+++ neon/src/ne_auth.c	2004-04-16 18:10:50.000000000 +0200
@@ -1080,7 +1080,7 @@
     if (areq->auth_info_hdr != NULL && 
 	verify_response(areq, sess, areq->auth_info_hdr)) {
 	NE_DEBUG(NE_DBG_HTTPAUTH, "Response authentication invalid.\n");
-	ne_set_error(sess->sess, _(sess->spec->fail_msg));
+	ne_set_error(sess->sess, "%s", _(sess->spec->fail_msg));
 	ret = NE_ERROR;
     } else if (status->code == sess->spec->status_code && 
 	       areq->auth_hdr != NULL) {
Index: neon/src/ne_locks.c
--- neon/src/ne_locks.c.orig	1970-03-04 07:27:31.000000000 +0100
+++ neon/src/ne_locks.c	2004-04-16 18:10:50.000000000 +0200
@@ -734,7 +734,7 @@
 	}
 	else if (parse_failed) {
 	    ret = NE_ERROR;
-	    ne_set_error(sess, ne_xml_get_error(parser));
+	    ne_set_error(sess, "%s", ne_xml_get_error(parser));
 	}
 	else if (ne_get_status(req)->code == 207) {
 	    ret = NE_ERROR;
@@ -802,7 +802,7 @@
     if (ret == NE_OK && ne_get_status(req)->klass == 2) {
 	if (parse_failed) {
 	    ret = NE_ERROR;
-	    ne_set_error(sess, ne_xml_get_error(parser));
+	    ne_set_error(sess, "%s", ne_xml_get_error(parser));
 	}
 	else if (ne_get_status(req)->code == 207) {
 	    ret = NE_ERROR;
Index: neon/src/ne_props.c
--- neon/src/ne_props.c.orig	1970-03-04 07:27:31.000000000 +0100
+++ neon/src/ne_props.c	2004-04-16 18:10:50.000000000 +0200
@@ -142,7 +142,7 @@
     if (ret == NE_OK && ne_get_status(req)->klass != 2) {
 	ret = NE_ERROR;
     } else if (!ne_xml_valid(handler->parser)) {
-	ne_set_error(handler->sess, ne_xml_get_error(handler->parser));
+	ne_set_error(handler->sess, "%s", ne_xml_get_error(handler->parser));
 	ret = NE_ERROR;
     }
 
Index: neon/src/ne_xml.c
--- neon/src/ne_xml.c.orig	1970-03-04 07:27:31.000000000 +0100
+++ neon/src/ne_xml.c	2004-04-16 18:10:50.000000000 +0200
@@ -539,7 +539,7 @@
 
 void ne_xml_set_error(ne_xml_parser *p, const char *msg)
 {
-    ne_snprintf(p->error, ERR_SIZE, msg);
+    ne_snprintf(p->error, ERR_SIZE, "%s", msg);
 }
 
 #ifdef HAVE_LIBXML