diff --git a/mod/quiz/locallib.php b/mod/quiz/locallib.php
index 65fe141387c..46298e4e243 100644
--- a/mod/quiz/locallib.php
+++ b/mod/quiz/locallib.php
@@ -2137,7 +2137,7 @@ function quiz_question_tostring($question, $showicon = false, $showquestiontext
     if ($showidnumber && $question->idnumber !== null && $question->idnumber !== '') {
         $result .= ' ' . html_writer::span(
                 html_writer::span(get_string('idnumber', 'question'), 'accesshide') .
-                ' ' . $question->idnumber, 'badge badge-primary');
+                ' ' . s($question->idnumber), 'badge badge-primary');
     }
 
     // Question tags.