Index: branches/RC/core/kernel/db/db_event_handler.php
===================================================================
diff -u -N -r11546 -r11647
--- branches/RC/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 11546)
+++ branches/RC/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 11647)
@@ -2392,17 +2392,23 @@
 				exit;
 			}
 
+			$limit = $this->Application->GetVar('limit');
+			if (!$limit) {
+				$limit = 20;
+			}
+
 			$object =& $event->getObject();
 			$sql = 'SELECT DISTINCT '.$field.'
-					FROM '.$object->TableName.'
-					WHERE '.$field.' LIKE '.$this->Conn->qstr($cur_value.'%').'
-					ORDER BY '.$field.'
-					LIMIT 0,20';
+						FROM '.$object->TableName.'
+						WHERE '.$field.' LIKE '.$this->Conn->qstr($cur_value.'%').'
+						ORDER BY '.$field.'
+						LIMIT 0,'.$limit;
+
 			$data = $this->Conn->GetCol($sql);
 
 			echo '<suggestions>';
 			foreach ($data as $item) {
-				echo '<item>'.$item.'</item>';
+				echo '<item>'.htmlspecialchars($item).'</item>';
 			}
 			echo '</suggestions>';