diff --git a/lib/rsslib.php b/lib/rsslib.php
index bdcaf424cd9..21e6b60fac0 100644
--- a/lib/rsslib.php
+++ b/lib/rsslib.php
@@ -521,7 +521,7 @@ function rss_get_form($act='none', $url='', $rssid='', $preferredtitle='', $shar
     $returnstring .= '<input type="hidden" name="user" value="'. $USER->id .'" />'."\n";
     $returnstring .= '<input type="hidden" name="sesskey" value="'. sesskey() .'" />'."\n";
     $returnstring .= '<br /><input type="submit" value="';
-    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+getElementById('block_rss').elements['url'].value,'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
+    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+escape(getElementById('block_rss').elements['url'].value),'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
 
     if ($act == 'rssedit') {
         $returnstring .= $stredit;