Reflected XSS in Patient Display

This XSS reflection security risk was discovered during the January 2013 FlossHack event and credited to Kevin Jacobs:

https://mdrtbdemo.pih-emr.org/openmrs/module/mdrtb/mdrtbListPatients.form?name=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&identifier=&location=&enrolledOnOrAfter=&enrolledOnOrBefore=&enrollment=ever&displayMode=basic

Expected behavior: characters in the URL request should be escaped

Observed behavior: name parameter from URL is interpreted and rendered as HTML allowing for XSS reflection (note: Chrome will detect script matching script in the URL and block it, but an error can be seen in the console; other browsers will let it through)