diff --git a/aqt/reviewer.py b/aqt/reviewer.py
index e145c0171..430e3dbfe 100644
--- a/aqt/reviewer.py
+++ b/aqt/reviewer.py
@@ -472,11 +472,11 @@ Please run Tools>Empty Cards""")
         "Diff-corrects the typed-in answer."
         givenElems, correctElems = self.tokenizeComparison(given, correct)
         def good(s):
-            return "<span class=typeGood>"+s+"</span>"
+            return "<span class=typeGood>"+cgi.escape(s)+"</span>"
         def bad(s):
-            return "<span class=typeBad>"+s+"</span>"
+            return "<span class=typeBad>"+cgi.escape(s)+"</span>"
         def missed(s):
-            return "<span class=typeMissed>"+s+"</span>"
+            return "<span class=typeMissed>"+cgi.escape(s)+"</span>"
         if given == correct:
             res = good(given)
         else: