diff --git a/app/calls_active/calls_active_inc.php b/app/calls_active/calls_active_inc.php
index 6eb0cdddb6..309248f5d8 100644
--- a/app/calls_active/calls_active_inc.php
+++ b/app/calls_active/calls_active_inc.php
@@ -202,8 +202,8 @@
 						echo "<td valign='top' class='".$row_style[$c]."'>".$domain_name."&nbsp;</td>\n";
 					}
 					echo "<td valign='top' class='".$row_style[$c]."'>".$tmp_number."&nbsp;</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."'>".$cid_name."&nbsp;</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."'>".$cid_num."&nbsp;</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."'>".escape($cid_name)."&nbsp;</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."'>".escape($cid_num)."&nbsp;</td>\n";
 					echo "<td valign='top' class='".$row_style[$c]."'>".$dest."&nbsp;</td>\n";
 					echo "<td valign='top' class='".$row_style[$c]."'>".((strlen($application) > 0) ? $application.":".$application_data : null)."&nbsp;</td>\n";
 					echo "<td valign='top' class='".$row_style[$c]."'>".$read_codec.":".$read_rate." / ".$write_codec.":".$write_rate."&nbsp;</td>\n";
diff --git a/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua b/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua
index 9ebde58893..154bb7baad 100644
--- a/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua
+++ b/resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua
@@ -57,6 +57,13 @@
 		return s
 	end
 
+-- escape shell arguments to prevent command injection
+
+        local function shell_esc(x)
+                return ("'"..x:gsub('\\', '\\\\')
+                       :gsub('\'', '\\\'').."'")
+        end
+
 -- set channel variables to lua variables
 	domain_uuid = env:getHeader("domain_uuid");
 	domain_name = env:getHeader("domain_name");
@@ -219,6 +226,8 @@
 	else
 		cmd = cmd .. "fax_prefix=false ";
 	end
+
+	cmd=shell_esc(cmd);
 	freeswitch.consoleLog("notice", "[fax] command: " .. cmd .. "\n");
 	result = api:execute("system", cmd);