diff --git a/htdocs/core/lib/admin.lib.php b/htdocs/core/lib/admin.lib.php
index 272a4b2ffa2..88732bb8d66 100644
--- a/htdocs/core/lib/admin.lib.php
+++ b/htdocs/core/lib/admin.lib.php
@@ -481,7 +481,6 @@ function dolibarr_set_const($db, $name, $value, $type='chaine', $visible=0, $not
 
         //print "sql".$value."-".pg_escape_string($value)."-".$sql;exit;
         //print "xx".$db->escape($value);
-        //print $sql;exit;
         dol_syslog("admin.lib::dolibarr_set_const sql=".$sql, LOG_DEBUG);
         $resql=$db->query($sql);
     }
@@ -1036,7 +1035,7 @@ function form_constantes($tableau)
             print '<input type="hidden" name="action" value="update">';
             print '<input type="hidden" name="rowid" value="'.$obj->rowid.'">';
             print '<input type="hidden" name="constname" value="'.$const.'">';
-            print '<input type="hidden" name="constnote" value="'.nl2br($obj->note).'">';
+            print '<input type="hidden" name="constnote" value="'.nl2br(dol_escape_htmltag($obj->note)).'">';
 
             print $langs->trans("Desc".$const) != ("Desc".$const) ? $langs->trans("Desc".$const) : ($obj->note?$obj->note:$const);
 
@@ -1190,4 +1189,4 @@ function delDocumentModel($name, $type)
 	}
 }
 
-?>
\ No newline at end of file
+?>