Index: t3lib/tceforms/class.t3lib_tceforms_tree.php
===================================================================
--- t3lib/tceforms/class.t3lib_tceforms_tree.php	(revision 10368)
+++ t3lib/tceforms/class.t3lib_tceforms_tree.php	(working copy)
@@ -44,7 +44,7 @@
 
 	/**
 	 * Constructor which sets the tceForms.
-	 * 
+	 *
 	 * @param t3lib_TCEforms $tceForms
 	 *
 	 */
@@ -65,7 +65,7 @@
 	 * @return string The HTML code for the TCEform field
 	 */
 	public function renderField($table, $field, $row, &$PA, $config, $possibleSelectboxItems, $noMatchLabel) {
-		$valueArray = explode(',', $row[$field]);
+		$valueArray = explode(',', $PA['itemFormElValue']);
 		$selectedNodes = array();
 		if (count($valueArray)) {
 			foreach ($valueArray as $selectedValue) {
@@ -193,7 +193,7 @@
 
 		$formField = '
 			<div class="typo3-tceforms-tree">
-				<input type="hidden" name="' . $PA['itemFormElName'] . '" id="treeinput' . $id . '" value="' . $row[$field] . '" />
+				<input type="hidden" name="' . htmlspecialchars($PA['itemFormElName']) . '" id="treeinput' . $id . '" value="' . htmlspecialchars($PA['itemFormElValue']) . '" />
 			</div>
 			<div id="tree_' . $id . '">