diff --git a/libraries/TableSearch.class.php b/libraries/TableSearch.class.php
index 30d040b777..47dd5e2678 100644
--- a/libraries/TableSearch.class.php
+++ b/libraries/TableSearch.class.php
@@ -1031,7 +1031,7 @@ EOT;
             $html_output .= '<input type="hidden" name="criteriaColumnTypes[' . $i . ']"'
                 . ' id="types_' . $i . '" ';
             if (isset($_POST['criteriaColumnTypes'][$i])) {
-                $html_output .= 'value="' . $_POST['criteriaColumnTypes'][$i] . '" ';
+                $html_output .= 'value="' . htmlspecialchars($_POST['criteriaColumnTypes'][$i]) . '" ';
             }
             $html_output .= '/>';
             $html_output .= '<input type="hidden" name="criteriaColumnCollations['