diff --git a/blocks/login/block_login.php b/blocks/login/block_login.php
index a6c05553376..417d2139413 100644
--- a/blocks/login/block_login.php
+++ b/blocks/login/block_login.php
@@ -46,7 +46,7 @@ class block_login extends block_base {
             $this->content->text .= "\n".'<form class="loginform" id="login" method="post" action="'.$wwwroot.'/login/index.php">';
 
             $this->content->text .= '<div class="c1"><label for="login_username">'.get_string('username').'</label>: ';
-            $this->content->text .= '<input type="text" name="username" id="login_username" value="'.$username.'" /></div>';
+            $this->content->text .= '<input type="text" name="username" id="login_username" value="'.s($username).'" /></div>';
 
             $this->content->text .= '<div class="c1"><label for="login_password">'.get_string('password').'</label>: ';
             $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';