diff --git a/app/calls/calls.php b/app/calls/calls.php
index 6bc671bc31..1820fd216c 100644
--- a/app/calls/calls.php
+++ b/app/calls/calls.php
@@ -127,7 +127,7 @@
 	}
 	if (!$is_included) {
 		echo "				<form method='get' action='' style='display: inline-block;'>\n";
-		echo "				<input type='text' class='txt' style='width: 150px' name='search' value='".$search."'>";
+		echo "				<input type='text' class='txt' style='width: 150px' name='search' value='".escape($search)."'>";
 		echo "				<input type='submit' class='btn' name='submit' value='".$text['button-search']."'>";
 		echo "				</form>\n";
 		if ($paging_controls_mini != '') {