diff --git a/lib/weblib.php b/lib/weblib.php
index 6fe4c59f445..4215cf18c70 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -388,6 +388,7 @@ class moodle_url {
         $str = '';
         foreach ($this->params as $key => $val){
             if (FALSE === array_search($key, $exclude)) {
+                $val = s($val);
                 $str.= "$tabindent<input type=\"hidden\" name=\"$key\" value=\"$val\" />\n";
             }
         }