diff --git a/core/js/share.js b/core/js/share.js
index 2813570f718..372f3513799 100644
--- a/core/js/share.js
+++ b/core/js/share.js
@@ -348,7 +348,7 @@ OC.Share={
 				})
 				.data("ui-autocomplete")._renderItem = function( ul, item ) {
 					return $( "<li>" )
-						.append( "<a>" + item.displayname + "<br>" + item.email + "</a>" )
+						.append( "<a>" + escapeHTML(item.displayname) + "<br>" + escapeHTML(item.email) + "</a>" )
 						.appendTo( ul );
 				};
 			}