diff --git a/htdocs/opensurvey/adminstuds_preview.php b/htdocs/opensurvey/adminstuds_preview.php
index 9307add0f94..13767fe086f 100644
--- a/htdocs/opensurvey/adminstuds_preview.php
+++ b/htdocs/opensurvey/adminstuds_preview.php
@@ -708,7 +708,7 @@ else
 	for ($i = 0; isset($toutsujet[$i]); $i++)
 	{
 		$tmp=explode('@',$toutsujet[$i]);
-		print '<td class="sujet">'.$tmp[0].'</td>'."\n";
+		print '<td class="sujet">'.htmlentities($tmp[0]).'</td>'."\n";
 	}
 
 	print '<td class="sujet"><a href="'.$_SERVER["PHP_SELF"].'?id='.$numsondage.'&ajoutsujet=1&backtourl='.urlencode($_SERVER["PHP_SELF"]).'">'.img_picto('',dol_buildpath('/opensurvey/img/add-16.png',1),'',1).'</a></td>'."\n";
diff --git a/htdocs/opensurvey/list.php b/htdocs/opensurvey/list.php
index b0502707669..1ecd93265de 100644
--- a/htdocs/opensurvey/list.php
+++ b/htdocs/opensurvey/list.php
@@ -117,11 +117,11 @@ while ($i < min($num,$limit))
 	print '<tr '.$bc[$var].'>';
 	print '<td>';
 	print '<a href="'.dol_buildpath('/opensurvey/adminstuds.php',1).'?id='.$obj->id_sondage.'">'.img_picto('','object_opensurvey').' '.$obj->id_sondage.'</a>';
-	print '</td><td>'.$obj->titre.'</td><td>';
+	print '</td><td>'.htmlentities($obj->titre).'</td><td>';
 	$type=($obj->format=='A' || $obj->format=='A+')?'classic':'date';
 	print img_picto('',dol_buildpath('/opensurvey/img/'.($type == 'classic'?'chart-32.png':'calendar-32.png'),1),'width="16"',1);
 	print ' '.$langs->trans($type=='classic'?"TypeClassic":"TypeDate");
-	print '</td><td>'.$obj->nom_admin.'</td>';
+	print '</td><td>'.htmlentities($obj->nom_admin).'</td>';
 
 	print '<td align="center">'.dol_print_date($db->jdate($obj->date_fin),'day');
 	if ($db->jdate($obj->date_fin) < time()) { print ' '.img_warning(); }