diff --git a/ssh/list_auths.cgi b/ssh/list_auths.cgi
index e9c6066a..7bdfbef9 100755
--- a/ssh/list_auths.cgi
+++ b/ssh/list_auths.cgi
@@ -17,7 +17,7 @@ if (@auths) {
 	foreach $a (@auths) {
 		print &ui_columns_row([ 
 			"<a href='edit_auth.cgi?idx=$a->{'index'}'>".
-			  "$a->{'name'}</a>",
+			  "@{[&html_escape($a->{'name'})]}</a>",
 			"<tt>".substr($a->{'key'}, 0, 40)." ... ".
 			      substr($a->{'key'}, -40)."</tt>",
 			]);
diff --git a/ssh/list_hosts.cgi b/ssh/list_hosts.cgi
index 9de07948..f17779ab 100755
--- a/ssh/list_hosts.cgi
+++ b/ssh/list_hosts.cgi
@@ -11,7 +11,7 @@ foreach $h (@$hconf) {
 	if (lc($h->{'name'}) eq 'host') {
 		push(@links, "edit_host.cgi?idx=$i");
 		push(@icons, "images/host.gif");
-		push(@titles, $h->{'values'}->[0] eq '*' ? "<i>$text{'hosts_all'}</i>" : $h->{'values'}->[0]);
+		push(@titles, $h->{'values'}->[0] eq '*' ? "<i>$text{'hosts_all'}</i>" : &html_escape($h->{'values'}->[0]));
 		}
 	$i++;
 	}