diff --git a/htdocs/install/fileconf.php b/htdocs/install/fileconf.php
index cfe42adc79f..0ca5805ba24 100644
--- a/htdocs/install/fileconf.php
+++ b/htdocs/install/fileconf.php
@@ -33,7 +33,7 @@ global $langs;
 
 $err = 0;
 
-$setuplang = GETPOST("selectlang", '', 3) ?GETPOST("selectlang", '', 3) : (isset($_GET["lang"]) ? $_GET["lang"] : 'auto');
+$setuplang = GETPOST("selectlang", '', 3) ? GETPOST("selectlang", '', 3) : (GETPOST('lang', 'alpha', 1) ? GETPOST('lang', 'alpha', 1) : 'auto');
 $langs->setDefaultLang($setuplang);
 
 $langs->loadLangs(array("install", "errors"));
diff --git a/htdocs/install/inc.php b/htdocs/install/inc.php
index 91ceae9eaaa..27a3fc01abd 100644
--- a/htdocs/install/inc.php
+++ b/htdocs/install/inc.php
@@ -518,7 +518,7 @@ function pFooter($nonext = 0, $setuplang = '', $jscheckfunction = '', $withpleas
 		}
 	}
 	if ($setuplang) {
-		print '<input type="hidden" name="selectlang" value="'.$setuplang.'">';
+		print '<input type="hidden" name="selectlang" value="'.dol_escape_htmltag($setuplang).'">';
 	}
 
 	print '</form>'."\n";