diff --git a/webservice/classes/token_table.php b/webservice/classes/token_table.php
index 9c91c64db54..ad6a54b6b84 100644
--- a/webservice/classes/token_table.php
+++ b/webservice/classes/token_table.php
@@ -151,7 +151,7 @@ class token_table extends \table_sql {
         $identity = [];
 
         foreach ($this->userextrafields as $userextrafield) {
-            $identity[] = $data->$userextrafield;
+            $identity[] = s($data->$userextrafield);
         }
 
         $userprofilurl = new \moodle_url('/user/profile.php', ['id' => $data->userid]);