diff --git a/admin/tool/installaddon/classes/installer.php b/admin/tool/installaddon/classes/installer.php
index 7353684eee6..adac7c1638f 100644
--- a/admin/tool/installaddon/classes/installer.php
+++ b/admin/tool/installaddon/classes/installer.php
@@ -68,7 +68,7 @@ class tool_installaddon_installer {
         $site = array(
             'fullname' => $this->get_site_fullname(),
             'url' => $this->get_site_url(),
-            'major_version' => $this->get_site_major_version(),
+            'majorversion' => $this->get_site_major_version(),
         );
 
         $site = $this->encode_site_information($site);
@@ -228,7 +228,7 @@ class tool_installaddon_installer {
     protected function get_site_fullname() {
         global $SITE;
 
-        return $SITE->fullname;
+        return strip_tags($SITE->fullname);
     }
 
     /**
diff --git a/admin/tool/installaddon/tests/installer_test.php b/admin/tool/installaddon/tests/installer_test.php
index f32bc193e6d..7f53cb17c2b 100644
--- a/admin/tool/installaddon/tests/installer_test.php
+++ b/admin/tool/installaddon/tests/installer_test.php
@@ -47,9 +47,9 @@ class tool_installaddon_installer_test extends advanced_testcase {
         $site = json_decode(base64_decode($site), true);
         $this->assertEquals('array', gettype($site));
         $this->assertEquals(3, count($site));
-        $this->assertSame($installer->get_site_fullname(), $site['fullname']);
-        $this->assertSame($installer->get_site_url(), $site['url']);
-        $this->assertSame($installer->get_site_major_version(), $site['major_version']);
+        $this->assertSame('Nasty site', $site['fullname']);
+        $this->assertSame('file:///etc/passwd', $site['url']);
+        $this->assertSame("2.5'; DROP TABLE mdl_user; --", $site['majorversion']);
     }
 
     public function test_extract_installfromzip_file() {
@@ -86,7 +86,7 @@ class tool_installaddon_installer_test extends advanced_testcase {
 class testable_tool_installaddon_installer extends tool_installaddon_installer {
 
     public function get_site_fullname() {
-        return '<h1 onmouseover="alert(\'Hello Moodle.org!\');">Nasty site</h1>';
+        return strip_tags('<h1 onmouseover="alert(\'Hello Moodle.org!\');">Nasty site</h1>');
     }
 
     public function get_site_url() {