diff --git a/htdocs/lib/MessagePanel.js b/htdocs/lib/MessagePanel.js
index 4b8e4999..8845be8a 100644
--- a/htdocs/lib/MessagePanel.js
+++ b/htdocs/lib/MessagePanel.js
@@ -458,7 +458,7 @@ HfdlMessagePanel.prototype.pushMessage = function(msg) {
     // Append messsage if present
     if (msg.message) {
         $b.append($(
-            '<tr><td class="message" colspan="4">' + msg.message + '</td></tr>'
+            '<tr><td class="message" colspan="4">' + this.htmlEscape(msg.message) + '</td></tr>'
         ))
     }