diff --git a/src/webim/operator/update.php b/src/webim/operator/update.php
index 6ff7efc0..91abdc2e 100644
--- a/src/webim/operator/update.php
+++ b/src/webim/operator/update.php
@@ -49,9 +49,9 @@ function thread_to_xml($thread) {
 
 	$result .= " canopen=\"true\"";
 	$result .= " state=\"$state\">";
-	$result .= "<name>".htmlspecialchars(get_user_name($thread['userName']))."</name>";
-	$result .= "<addr>".htmlspecialchars($thread['remote'])."</addr>";
-	$result .= "<agent>".htmlspecialchars($threadoperator)."</agent>";
+	$result .= "<name>".htmlspecialchars(htmlspecialchars(get_user_name($thread['userName'])))."</name>";
+	$result .= "<addr>".htmlspecialchars(htmlspecialchars($thread['remote']))."</addr>";
+	$result .= "<agent>".htmlspecialchars(htmlspecialchars($threadoperator))."</agent>";
 	$result .= "<time>".$thread['unix_timestamp(dtmcreated)']."000</time>";
 	$result .= "<modified>".$thread['unix_timestamp(dtmmodified)']."000</modified>";
 	$result .= "</thread>";
diff --git a/src/webim/view/chat_ajaxed.php b/src/webim/view/chat_ajaxed.php
index 0e4b4f90..a614648e 100644
--- a/src/webim/view/chat_ajaxed.php
+++ b/src/webim/view/chat_ajaxed.php
@@ -87,7 +87,7 @@ var threadParams = { servl:"/webim/thread.php",frequency:2,<?php if( $page['user
 				<tr>
 <?php if( $page['agent'] ) { ?>
 				<td class="text" nowrap>
-					<?php echo getstring("chat.window.chatting_with") ?> <b><a href="javascript:void(0)" onclick="return false;" title="<?php echo getstring("chat.window.chatting_with") ?> <?php echo $page['ct.user.name'] ?><?php echo $page['namePostfix'] ?>"><?php echo $page['ct.user.name'] ?></a></b><br>
+					<?php echo getstring("chat.window.chatting_with") ?> <b><a href="javascript:void(0)" onclick="return false;" title="<?php echo getstring("chat.window.chatting_with") ?> <?php echo htmlspecialchars($page['ct.user.name']) ?><?php echo $page['namePostfix'] ?>"><?php echo htmlspecialchars($page['ct.user.name']) ?></a></b><br>
 				</td>
 <?php } ?><?php if( $page['user'] && $page['canChangeName'] ) { ?>
 				<td class="text" nowrap>