diff --git a/js/functions.js b/js/functions.js
index e766bd8894..429d3e1143 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -4670,7 +4670,7 @@ AJAX.registerOnload('functions.js', function () {
     $('.logout').click(function() {
         var form = $(
             '<form method="POST" action="' + $(this).attr('href') + '" class="disableAjax">' +
-            '<input type="hidden" name="token" value="' + PMA_commonParams.get('token') + '"/>' +
+            '<input type="hidden" name="token" value="' + escapeHtml(PMA_commonParams.get('token')) + '"/>' +
             '</form>'
         );
         $('body').append(form);