diff -r d8156d18ac58 -r 97ae8e9d5e29 includes/clientside/static/autocomplete.js
--- a/includes/clientside/static/autocomplete.js	Thu Sep 27 15:55:37 2007 -0400
+++ b/includes/clientside/static/autocomplete.js	Sat Nov 03 07:43:35 2007 -0400
@@ -160,7 +160,24 @@
         thediv.id = id;
         unObj.onblur = function() { destroyUsernameDropdowns(); }
         
-        eval(ajax.responseText);
+        var response = String(ajax.responseText) + ' ';
+        if ( response.substr(0,1) != '{' )
+        {
+          new messagebox(MB_OK|MB_ICONSTOP, 'Invalid response', 'Invalid or unexpected JSON response from server:<pre>' + ajax.responseText + '</pre>');
+          return false;
+        }
+        
+        response = parseJSON(response);
+        var errorstring = false;
+        if ( response.mode == 'error' )
+        {
+          errorstring = response.error;
+        }
+        else
+        {
+          var userlist = response.users_real;
+        }
+        
         if(errorstring)
         {
           html = '<span style="color: #555; padding: 4px;">'+errorstring+'</span>';