diff --git a/file/js/be.bastelstu.Chat.litcoffee b/file/js/be.bastelstu.Chat.litcoffee
index 1b4726c..c4a4bbb 100644
--- a/file/js/be.bastelstu.Chat.litcoffee
+++ b/file/js/be.bastelstu.Chat.litcoffee
@@ -1088,7 +1088,7 @@ Open private channel
 					
 					avatar = $ userList.allTime[userID].avatar[16]
 					avatar = $('<span class="userAvatar framed" />').wrapInner avatar
-					avatar.append "<span>#{userList.allTime[userID].username}</span>"
+					avatar.append "<span>#{WCF.String.escapeHTML userList.allTime[userID].username}</span>"
 					
 					anchor.wrapInner avatar
 					anchor.prepend '<span class="icon icon16 icon-warning-sign notifyIcon"></span>'