diff --git a/apps/files_versions/templates/history.php b/apps/files_versions/templates/history.php
index c450af66ad5..f7284439041 100644
--- a/apps/files_versions/templates/history.php
+++ b/apps/files_versions/templates/history.php
@@ -5,29 +5,29 @@
 if( isset( $_['message'] ) ) {
 
 
-	if( isset($_['path'] ) ) echo('<strong>File: '.$_['path'] ).'</strong><br>';
-	echo('<strong>'.$_['message'] ).'</strong><br>';
+	if( isset($_['path'] ) ) print_unescaped('<strong>File: '.OC_Util::sanitizeHTML($_['path'])).'</strong><br>';
+	print_unescaped('<strong>'.OC_Util::sanitizeHTML($_['message']) ).'</strong><br>';
 
 }else{
 
 	if( isset( $_['outcome_stat'] ) ) {
 
-		echo( '<div id="feedback-messages" class="'.$_['outcome_stat'].'"><h3>'.$_['outcome_msg'] ).'</h3></div><br>';
+		print_unescaped( '<div id="feedback-messages" class="'.OC_Util::sanitizeHTML($_['outcome_stat']).'"><h3>'.OC_Util::sanitizeHTML($_['outcome_msg']) ).'</h3></div><br>';
 
 	}
 
-	echo( '<strong>Versions of '.$_['path'] ).'</strong><br>';
-	echo('<p><em>'.$l->t('Revert a file to a previous version by clicking on its revert button').'</em></p><br />');
+	print_unescaped( '<strong>Versions of '.OC_Util::sanitizeHTML($_['path']) ).'</strong><br>';
+	print_unescaped('<p><em>'.OC_Util::sanitizeHTML($l->t('Revert a file to a previous version by clicking on its revert button')).'</em></p><br />');
 
 	foreach ( $_['versions'] as $v ) {
-		echo ' ';
-		echo OCP\Util::formatDate( doubleval($v['version']) );
-		echo ' <a href="'.OCP\Util::linkTo('files_versions', 'history.php',
-			array('path' => $_['path'], 'revert' => $v['version'])) .'" class="button">Revert</a><br /><br />';
+		p(' ');
+		p(OCP\Util::formatDate( doubleval($v['version'])));
+		print_unescaped(' <a href="'.OCP\Util::linkTo('files_versions', 'history.php',
+			array('path' => $_['path'], 'revert' => $v['version'])) .'" class="button">Revert</a><br /><br />');
 		if ( $v['cur'] ) {
-			echo '  (<b>Current</b>)';
+			print_unescaped('  (<b>Current</b>)');
 		}
-		echo '<br /><br />';
+		print_unescaped('<br /><br />');
 	}
 
 }