diff --git a/lib/galaxy/web/base/controller.py b/lib/galaxy/web/base/controller.py
index 7c138095f95..413dad0cfc0 100644
--- a/lib/galaxy/web/base/controller.py
+++ b/lib/galaxy/web/base/controller.py
@@ -204,6 +204,12 @@ class Sharable:
         return self.sharing( trans, id, **kwargs )
             
     # Abstract methods.
+    
+    @web.expose
+    @web.require_login( "modify Galaxy items" )
+    def set_slug_async( self, trans, id, new_slug ):
+        """ Set item slug asynchronously. """
+        pass
             
     @web.expose
     @web.require_login( "share Galaxy items" )
diff --git a/lib/galaxy/web/controllers/history.py b/lib/galaxy/web/controllers/history.py
index 18781a47311..f019f89a259 100644
--- a/lib/galaxy/web/controllers/history.py
+++ b/lib/galaxy/web/controllers/history.py
@@ -395,7 +395,16 @@ class HistoryController( BaseController, Sharable ):
             trans.sa_session.flush()
     
         return
-                    
+
+    @web.expose
+    @web.require_login( "modify Galaxy items" )
+    def set_slug_async( self, trans, id, new_slug ):
+        history = self.get_history( trans, id )
+        if history:
+            history.slug = new_slug
+            trans.sa_session.flush()
+        return
+                       
     @web.expose
     def name_autocomplete_data( self, trans, q=None, limit=None, timestamp=None ):
         """Return autocomplete data for history names"""
diff --git a/lib/galaxy/web/controllers/page.py b/lib/galaxy/web/controllers/page.py
index 90cb06a1b59..beae43ec5c6 100644
--- a/lib/galaxy/web/controllers/page.py
+++ b/lib/galaxy/web/controllers/page.py
@@ -540,6 +540,15 @@ class PageController( BaseController, Sharable ):
             trans.sa_session.flush()
         return
 
+    @web.expose
+    @web.require_login( "modify Galaxy items" )
+    def set_slug_async( self, trans, id, new_slug ):
+        page = self.get_page( trans, id )
+        if page:
+            page.slug = new_slug
+            trans.sa_session.flush()
+        return
+
     @web.expose
     @web.json
     @web.require_login( "use Galaxy pages" )
diff --git a/lib/galaxy/web/controllers/workflow.py b/lib/galaxy/web/controllers/workflow.py
index f5573581d24..e60b962be06 100644
--- a/lib/galaxy/web/controllers/workflow.py
+++ b/lib/galaxy/web/controllers/workflow.py
@@ -382,6 +382,15 @@ class WorkflowController( BaseController, Sharable ):
 
         return
         
+    @web.expose
+    @web.require_login( "modify Galaxy items" )
+    def set_slug_async( self, trans, id, new_slug ):
+        stored = get_stored_workflow( trans, id )
+        if stored:
+            stored.slug = new_slug
+            trans.sa_session.flush()
+        return
+        
     @web.expose
     @web.json
     @web.require_login( "use Galaxy workflows" )
diff --git a/static/images/pencil.png b/static/images/pencil.png
new file mode 100755
index 00000000000..dbab8f4067a
Binary files /dev/null and b/static/images/pencil.png differ
diff --git a/static/scripts/galaxy.base.js b/static/scripts/galaxy.base.js
index 5ab9f6ad6e1..15d8a173bd9 100644
--- a/static/scripts/galaxy.base.js
+++ b/static/scripts/galaxy.base.js
@@ -211,7 +211,7 @@ var replace_dbkey_select = function()
 //
 // Edit and save text asynchronously.
 // 
-function async_save_text(click_to_edit_elt, text_elt_id, save_url, text_parm_name, use_textarea, num_rows)
+function async_save_text(click_to_edit_elt, text_elt_id, save_url, text_parm_name, use_textarea, num_rows, on_start, on_finish)
 {
     $("#" + click_to_edit_elt).click( function() {
         var old_text = $("#" + text_elt_id).text()
@@ -236,13 +236,25 @@ function async_save_text(click_to_edit_elt, text_elt_id, save_url, text_parm_nam
                 $.ajax({
                     url: save_url,
                     data: ajax_data,
-                    error: function() { alert( "Text editing for elt " + text_elt_id + " failed" ) },
+                    error: function() { 
+                        alert( "Text editing for elt " + text_elt_id + " failed" );
+                        // TODO: call finish or no? For now, let's not because error occurred.
+                    },
                     success: function() {
+                        // Set new text and call finish method.
                         $("#" + text_elt_id).text( new_text );
+                        if (on_finish != null)
+                            on_finish(t);
                     }
                 });
             }
         });
+        
+        // Call onstart method if it exists.
+        if (on_start != null)
+            on_start(t);
+            
+        // Replace text with input object and focus & select.
         $("#" + text_elt_id).hide();
         t.insertAfter( $("#" + text_elt_id) );
         t.focus();
diff --git a/templates/dataset/display.mako b/templates/dataset/display.mako
index b9a406a685b..7087c6ef964 100644
--- a/templates/dataset/display.mako
+++ b/templates/dataset/display.mako
@@ -18,7 +18,7 @@
 </%def>
 
 <%def name="title()">
-    Galaxy | ${get_class_display_name( item.__class__ )} | ${get_item_name( item )}
+    Galaxy | ${get_class_display_name( item.__class__ )} | ${get_item_name( item ) | h}
 </%def>
 
 <%def name="render_item_links( data )">
@@ -43,7 +43,7 @@
     <div class="unified-panel-header" unselectable="on">
 		<div class="unified-panel-header-inner">
 				${get_class_display_name( item.__class__ )}
-			| ${get_item_name( item )}
+			| ${get_item_name( item ) | h}
 	    </div>
     </div>
     
@@ -72,11 +72,13 @@
             <div style="padding: 10px;">
                 <h4>Author</h4>
                 
-                <p>${item.history.user.username}</p>
+                <p>${item.history.user.username | h}</p>
                 
                 <div><img src="http://www.gravatar.com/avatar/${h.md5(item.history.user.email)}?s=150"></div>
 
-                ## Page meta. No page meta for datasets for now.
+                ## Page meta. 
+                
+                ## No links for datasets right now.
         
                 ## Tags.
                 <p>
diff --git a/templates/display_base.mako b/templates/display_base.mako
index 717f37a1c0e..86ffd4b313b 100644
--- a/templates/display_base.mako
+++ b/templates/display_base.mako
@@ -13,13 +13,13 @@
 <%namespace file="/display_common.mako" import="*" />
 
 <%def name="title()">
-    Galaxy | ${iff( item.published, "Published ", iff( item.importable , "Accessible ", iff( item.users_shared_with, "Shared ", "Private " ) ) ) + get_class_display_name( item.__class__ )} | ${get_item_name( item )}
+    Galaxy | ${iff( item.published, "Published ", iff( item.importable , "Accessible ", iff( item.users_shared_with, "Shared ", "Private " ) ) ) + get_class_display_name( item.__class__ )} | ${get_item_name( item ) | h}
 </%def>
 
 <%def name="init()">
 <%
 	self.has_left_panel=False
-	self.has_right_panel=item.published
+	self.has_right_panel=True
 	self.message_box_visible=False
 	self.active_view="user"
 	self.overlay_visible=False
@@ -152,7 +152,7 @@
             <div style="padding: 10px;">
                 <h4>Author</h4>
                 
-                <p>${item.user.username}</p>
+                <p>${item.user.username | h}</p>
                 
                 <div><img src="http://www.gravatar.com/avatar/${h.md5(item.user.email)}?s=150"></div>
                 
@@ -162,7 +162,7 @@
                 <h4>Related ${item_plural}</h4>
                 <p>
                     <a href="${href_to_all_items}">All published ${item_plural.lower()}</a><br>
-                    <a href="${href_to_user_items}">${item_plural} owned by ${item.user.username}</a>
+                    <a href="${href_to_user_items}">Published ${item_plural.lower()} by ${item.user.username | h}</a>
         
                 ## Tags.
                 <h4>Tags</strong></h4>
diff --git a/templates/display_common.mako b/templates/display_common.mako
index a452f085c03..34e72bdb333 100644
--- a/templates/display_common.mako
+++ b/templates/display_common.mako
@@ -1,6 +1,8 @@
 ##
 ## Utilities for sharing items and displaying shared items.
+## HACK: these should probably go in the web helper object.
 ##
+
 <%! from galaxy import model %>
 
 ## Get display name for a class.
diff --git a/templates/history/display.mako b/templates/history/display.mako
index 15dbe352e36..dfb203e052e 100644
--- a/templates/history/display.mako
+++ b/templates/history/display.mako
@@ -241,7 +241,7 @@
 
 <%def name="render_item( history, datasets )">
         <div id="history-name-area" class="historyLinks" style="color: gray; font-weight: bold; padding: 0px 0px 5px 0px">
-            <div id="history-name">${history.get_display_name()}</div>
+            <div id="history-name">${history.get_display_name() | h}</div>
         </div>
 
         %if history.deleted:
diff --git a/templates/root/history.mako b/templates/root/history.mako
index f31d0286f57..485de71e677 100644
--- a/templates/root/history.mako
+++ b/templates/root/history.mako
@@ -276,7 +276,7 @@ div.form-row {
     
 <div id="history-name-area" class="historyLinks" style="color: gray; font-weight: bold;">
     <div style="float: right"><a id="history-rename" title="Rename" class="icon-button edit" target="galaxy_main" href="${h.url_for( controller='history', action='rename' )}"></a></div>
-    <div id="history-name">${h.escape( history.get_display_name() )}</div>
+    <div id="history-name">${history.get_display_name() | h}</div>
 </div>
 
 %if history.deleted:
@@ -311,7 +311,7 @@ div.form-row {
        	        <label>Annotation / Notes:</label>
     		    <div style="float: right"><a id="history-annotate" title="Annotate" class="icon-button edit" target="galaxy_main" href="${h.url_for( controller='history', action='annotate_async' )}"></a></div>
     		    %if annotation:
-                        <div id="history-annotation">${h.escape(annotation)}</div>
+                        <div id="history-annotation">${annotation | h}</div>
                     %else:
                         <div id="history-annotation"></div>
                     %endif
diff --git a/templates/sharing_base.mako b/templates/sharing_base.mako
index c43b96445e7..ca51e20d0c3 100644
--- a/templates/sharing_base.mako
+++ b/templates/sharing_base.mako
@@ -15,6 +15,40 @@
     Sharing and Publishing ${get_class_display_name( item.__class__ )} '${get_item_name( item )}'
 </%def>
 
+<%def name="javascripts()">
+    ${parent.javascripts()}
+    <script type="text/javascript">
+    $(document).ready( function() 
+    {
+        //
+        // Set up slug-editing functionality.
+        //
+        var on_start = function( text_elt ) 
+        {
+            // Because text element is inside a URL, need to disable click so that clicking on element does not trigger URL.
+            $( text_elt ).click( function() {
+               return false; 
+            });
+            
+            // Allow only lowercase alphanumeric and '-' characters in slug.
+            text_elt.keyup(function(){
+                text_elt.val( $(this).val().replace(/\s+/g,'-').replace(/[^a-zA-Z0-9\-]/g,'').toLowerCase() )
+            });
+        };
+        
+        var on_finish = function( text_elt ) 
+        {
+            // Set URL to new value.
+            var item_url_obj = $('#item-url');
+            item_url_obj.attr( "href", item_url_obj.text() );
+        };
+        
+        <% controller_name = get_controller_name( item ) %>
+        async_save_text("edit-identifier", "item-identifier", "${h.url_for( controller=controller_name, action='set_slug_async', id=trans.security.encode_id( item.id ) )}", "new_slug", false, 0, on_start, on_finish); 
+    });
+    </script>
+</%def>
+
 <%def name="stylesheets()">
     ${parent.stylesheets()}
     <style>
@@ -77,9 +111,14 @@
                     This ${item_class_name_lc} <strong>${item_status}</strong>. 
                     <div>
                         <p>Anyone can view and import this ${item_class_name_lc} by visiting the following URL:
-                        <% url = h.url_for( action='display_by_username_and_slug', username=trans.get_user().username, slug=item.slug, qualified=True ) %>
+
                         <blockquote>
-                            <a href="${url}" target="_top">${url}</a>
+                            <% 
+                                url = h.url_for( action='display_by_username_and_slug', username=trans.get_user().username, slug=item.slug, qualified=True ) 
+                                url_parts = url.split("/")
+                            %>
+                            <a id="item-url" href="${url}" target="_top">${"/".join( url_parts[:-1] )}/<span id='item-identifier'>${url_parts[-1]}</span></a>
+                            <a href="#" id="edit-identifier"><img src="${h.url_for('/static/images/pencil.png')}"/></a>
                         </blockquote>
         
                         %if item.published:
diff --git a/templates/workflow/display.mako b/templates/workflow/display.mako
index d89e73c7799..66b32849d17 100644
--- a/templates/workflow/display.mako
+++ b/templates/workflow/display.mako
@@ -78,7 +78,7 @@
 </%def>
 
 <%def name="render_item( workflow, steps )">
-     <h2>${workflow.name}</h2>
+     <h2>${workflow.name | h}</h2>
         %for i, step in enumerate( steps ):    
             %if step.type == 'tool' or step.type is None:
               <% tool = app.toolbox.tools_by_id[step.tool_id] %>
diff --git a/templates/workflow/editor.mako b/templates/workflow/editor.mako
index 15a12307632..c1390cedab2 100644
--- a/templates/workflow/editor.mako
+++ b/templates/workflow/editor.mako
@@ -784,7 +784,7 @@
             <div id="workflow-name-area" class="form-row">
                 <label>Name:</label>
                 <div style="float: right"><a id="workflow-rename" title="Rename" class="icon-button edit" target="galaxy_main" href="${h.url_for( controller='workflow', action='rename_sync' )}"></a></div>
-                <div id="workflow-name">${h.escape( stored.name )}</div>
+                <div id="workflow-name">${stored.name | h}</div>
                 <div style="clear: both"></div>
             </div>
             ## Workflow tags.
@@ -809,7 +809,7 @@
                 <div id="workflow-annotation-area" class="form-row">
                     <label>Annotation / Notes:</label>
                     <div style="float: right"><a id="workflow-annotate" title="Annotate" class="icon-button edit" target="galaxy_main" href="${h.url_for( controller='workflow', action='annotate_async' )}"></a></div>
-                    <div id="workflow-annotation">${h.escape( annotation )}</div>
+                    <div id="workflow-annotation">${annotation | h}</div>
                     <div style="clear: both"></div>
                     <div class="toolParamHelp">Add an annotation or notes to a workflow; annotations are available when a workflow is viewed.</div>
                 </div>
diff --git a/templates/workflow/list.mako b/templates/workflow/list.mako
index 4113ac797a6..280c2d89b29 100644
--- a/templates/workflow/list.mako
+++ b/templates/workflow/list.mako
@@ -38,7 +38,7 @@
             <tr>
                 <td>
                     <div class="menubutton" style="float: left;" id="wf-${i}-popup">
-                    ${workflow.name}
+                    ${workflow.name | h}
                     </div>
                 </td>
                 <td>${len(workflow.latest_workflow.steps)}</td>
@@ -76,7 +76,7 @@
             <% workflow = association.stored_workflow %>
             <tr>
                 <td>
-                    <a class="menubutton" id="shared-${i}-popup" href="${h.url_for( action='run', id=trans.security.encode_id(workflow.id) )}">${workflow.name}</a>
+                    <a class="menubutton" id="shared-${i}-popup" href="${h.url_for( action='run', id=trans.security.encode_id(workflow.id) )}">${workflow.name | h}</a>
                 </td>
                 <td>${workflow.user.email}</td>
                 <td>${len(workflow.latest_workflow.steps)}</td>