diff --git a/admin/tool/policy/classes/acceptances_table.php b/admin/tool/policy/classes/acceptances_table.php
index 05a9297ba6f..b12cae1fa7f 100644
--- a/admin/tool/policy/classes/acceptances_table.php
+++ b/admin/tool/policy/classes/acceptances_table.php
@@ -641,6 +641,6 @@ class acceptances_table extends \table_sql {
             }
             return ''; // User agreed by themselves.
         }
-        return null;
+        return parent::other_cols($column, $row);
     }
 }
\ No newline at end of file
diff --git a/lib/tablelib.php b/lib/tablelib.php
index e464d39e8be..be904c2d766 100644
--- a/lib/tablelib.php
+++ b/lib/tablelib.php
@@ -841,6 +841,12 @@ class flexible_table {
      * build_table which calls this method.
      */
     function other_cols($column, $row) {
+        if (isset($row->$column) && ($column === 'email' || $column === 'idnumber') &&
+                (!$this->is_downloading() || $this->export_class_instance()->supports_html())) {
+            // Columns email and idnumber may potentially contain malicious characters, escape them by default.
+            // This function will not be executed if the child class implements col_email() or col_idnumber().
+            return s($row->$column);
+        }
         return NULL;
     }
 
diff --git a/mod/assign/gradingtable.php b/mod/assign/gradingtable.php
index 926ef2881c2..82e2f2fdb0e 100644
--- a/mod/assign/gradingtable.php
+++ b/mod/assign/gradingtable.php
@@ -1472,7 +1472,7 @@ class assign_grading_table extends table_sql implements renderable {
     public function other_cols($colname, $row) {
         // For extra user fields the result is already in $row.
         if (empty($this->plugincache[$colname])) {
-            return $row->$colname;
+            return parent::other_cols($colname, $row);
         }
 
         // This must be a plugin field.
diff --git a/mod/feedback/classes/responses_table.php b/mod/feedback/classes/responses_table.php
index ea0b1eba52b..3d5c334a89a 100644
--- a/mod/feedback/classes/responses_table.php
+++ b/mod/feedback/classes/responses_table.php
@@ -200,7 +200,7 @@ class mod_feedback_responses_table extends table_sql {
             }
             return trim($printval);
         }
-        return $row->$column;
+        return parent::other_cols($column, $row);
     }
 
     /**
diff --git a/mod/quiz/report/overview/overview_table.php b/mod/quiz/report/overview/overview_table.php
index 936d36fc992..9a442a78fc6 100644
--- a/mod/quiz/report/overview/overview_table.php
+++ b/mod/quiz/report/overview/overview_table.php
@@ -273,7 +273,7 @@ class quiz_overview_table extends quiz_attempts_report_table {
      */
     public function other_cols($colname, $attempt) {
         if (!preg_match('/^qsgrade(\d+)$/', $colname, $matches)) {
-            return null;
+            return parent::other_cols($colname, $attempt);
         }
         $slot = $matches[1];
 
diff --git a/mod/quiz/report/responses/last_responses_table.php b/mod/quiz/report/responses/last_responses_table.php
index 831add7c1a5..b040279bf89 100644
--- a/mod/quiz/report/responses/last_responses_table.php
+++ b/mod/quiz/report/responses/last_responses_table.php
@@ -128,7 +128,7 @@ class quiz_last_responses_table extends quiz_attempts_report_table {
             return $this->data_col($matches[1], 'rightanswer', $attempt);
 
         } else {
-            return null;
+            return parent::other_cols($colname, $attempt);
         }
     }