diff --git a/app/conference_controls/conference_control_details.php b/app/conference_controls/conference_control_details.php
index 2a00ac7698..3643e37eb7 100644
--- a/app/conference_controls/conference_control_details.php
+++ b/app/conference_controls/conference_control_details.php
@@ -92,7 +92,7 @@
 	echo th_order_by('control_enabled', $text['label-control_enabled'], $order_by, $order);
 	echo "<td class='list_control_icons'>";
 	if (permission_exists('conference_control_detail_add')) {
-		echo "<a href='conference_control_detail_edit.php?conference_control_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo "<a href='conference_control_detail_edit.php?conference_control_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo "&nbsp;\n";
@@ -132,7 +132,7 @@
 	echo "		<td width='33.3%' align='center' nowrap='nowrap'>$paging_controls</td>\n";
 	echo "		<td class='list_control_icons'>";
 	if (permission_exists('conference_control_detail_add')) {
-		echo 		"<a href='conference_control_detail_edit.php?conference_control_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo 		"<a href='conference_control_detail_edit.php?conference_control_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo 		"&nbsp;";