diff --git a/mod/feedback/show_nonrespondents.php b/mod/feedback/show_nonrespondents.php
index 8f45cca3ab4..47a974b9ff3 100644
--- a/mod/feedback/show_nonrespondents.php
+++ b/mod/feedback/show_nonrespondents.php
@@ -267,7 +267,7 @@ if (!$students) {
         echo '<legend class="ftoggler">'.get_string('send_message', 'feedback').'</legend>';
         echo '<div>';
         echo '<label for="feedback_subject">'.get_string('subject', 'feedback').'&nbsp;</label>';
-        echo '<input type="text" id="feedback_subject" size="50" maxlength="255" name="subject" value="'.$subject.'" />';
+        echo '<input type="text" id="feedback_subject" size="50" maxlength="255" name="subject" value="'.s($subject).'" />';
         echo '</div>';
         print_textarea(true, 15, 25, 30, 10, "message", $message);
         print_string('formathtml');