diff --git a/admin/tool/mobile/classes/api.php b/admin/tool/mobile/classes/api.php
index d6c88c377e3..5fcd7f7879e 100644
--- a/admin/tool/mobile/classes/api.php
+++ b/admin/tool/mobile/classes/api.php
@@ -194,10 +194,10 @@ class api {
 
         // Check that we are receiving a moodle_url object, themes can override get_logo_url and may return incorrect values.
         if (($logourl = $OUTPUT->get_logo_url()) && $logourl instanceof moodle_url) {
-            $settings['logourl'] = $logourl->out(false);
+            $settings['logourl'] = clean_param($logourl->out(false), PARAM_URL);
         }
         if (($compactlogourl = $OUTPUT->get_compact_logo_url()) && $compactlogourl instanceof moodle_url) {
-            $settings['compactlogourl'] = $compactlogourl->out(false);
+            $settings['compactlogourl'] = clean_param($compactlogourl->out(false), PARAM_URL);
         }
 
         // Identity providers.