You have to turn off Cross Site Scripting protection in the set value by adding the "false" argument to the end of the ->getColumnVal() method call where it is referenced in the HTML editor code. It will look like:
$RSname->getColumnVal("columnName",false)
If you have trouble finding the line to update, attach your update page and I can help with line numbers and a more specific code reference.