diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php
index 68e12d4528..14be5d13be 100644
--- a/usr/local/www/diag_packet_capture.php
+++ b/usr/local/www/diag_packet_capture.php
@@ -309,7 +309,7 @@ include("fbegin.inc");
 		<tr>
 			<td width="17%" valign="top" class="vncellreq"><?=gettext("Port");?></td>
 			<td colspan="2" width="83%" class="vtable">
-				<input name="port" class="formfld unknown" id="port" size="5" value="<?=$port;?>" />
+				<input name="port" class="formfld unknown" id="port" size="5" value="<?=htmlspecialchars($port);?>" />
 				<br /><?=gettext("The port can be either the source or destination port. The packet capture will look for this port in either field.");?>
 				<br /><?=gettext("Leave blank if you do not want to filter by port.");?>
 			</td>
@@ -317,14 +317,14 @@ include("fbegin.inc");
 		<tr>
 			<td width="17%" valign="top" class="vncellreq"><?=gettext("Packet Length");?></td>
 			<td colspan="2" width="83%" class="vtable">
-				<input name="snaplen" class="formfld unknown" id="snaplen" size="5" value="<?=$snaplen;?>" />
+				<input name="snaplen" class="formfld unknown" id="snaplen" size="5" value="<?=htmlspecialchars($snaplen);?>" />
 				<br /><?=gettext("The Packet length is the number of bytes of each packet that will be captured. Default value is 0, which will capture the entire frame regardless of its size.");?>
 			</td>
 		</tr>
 		<tr>
 			<td width="17%" valign="top" class="vncellreq"><?=gettext("Count");?></td>
 			<td colspan="2" width="83%" class="vtable">
-				<input name="count" class="formfld unknown" id="count" size="5" value="<?=$count;?>" />
+				<input name="count" class="formfld unknown" id="count" size="5" value="<?=htmlspecialchars($count);?>" />
 				<br /><?=gettext("This is the number of packets the packet capture will grab. Default value is 100.") . "<br />" . gettext("Enter 0 (zero) for no count limit.");?>
 			</td>
 		</tr>