diff --git a/src/gui/src/UI/UIPrompt.js b/src/gui/src/UI/UIPrompt.js
index e271d5521..bf284e47e 100644
--- a/src/gui/src/UI/UIPrompt.js
+++ b/src/gui/src/UI/UIPrompt.js
@@ -44,10 +44,10 @@ function UIPrompt (options) {
 
         let h = '';
         // message
-        h += `<div class="window-prompt-message">${options.message}</div>`;
+        h += `<div class="window-prompt-message">${html_encode(options.message)}</div>`;
         // prompt
         h += '<div class="window-alert-prompt" style="margin-top: 20px;">';
-        h += `<input type="text" class="prompt-input" placeholder="${options.placeholder ?? ''}" value="${options.defaultValue ?? options.value ?? ''}">`;
+        h += `<input type="text" class="prompt-input" placeholder="${html_encode(options.placeholder ?? '')}" value="${html_encode(options.defaultValue ?? options.value ?? '')}">`;
         h += '</div>';
         // buttons
         if ( options.buttons && options.buttons.length > 0 ) {