diff --git a/src/usr/local/www/guiconfig.inc b/src/usr/local/www/guiconfig.inc
index 1ba85c1d6f..d7fa7ba729 100644
--- a/src/usr/local/www/guiconfig.inc
+++ b/src/usr/local/www/guiconfig.inc
@@ -299,7 +299,7 @@ function sprint_info_box($msg, $class="alert-warning", $btnname = "close", $btnt
 	if (strpos($class, "alert-") !== 0) {
 		$class = 'alert-' . $class;
 	}
-
+	$msg = addslashes($msg);
 	$msg = '<div class="pull-left">' . $msg . '</div>';
 
 	if ($btnname === "close") {
diff --git a/src/usr/local/www/vpn_ipsec_mobile.php b/src/usr/local/www/vpn_ipsec_mobile.php
index 992ab681ab..9e0f8e21a5 100644
--- a/src/usr/local/www/vpn_ipsec_mobile.php
+++ b/src/usr/local/www/vpn_ipsec_mobile.php
@@ -240,10 +240,11 @@ if ($_POST['save']) {
 		if ($pconfig['enable']) {
 			$client['enable'] = true;
 		}
-
 		if (!empty($pconfig['user_source'])) {
 			$client['user_source'] = implode(",", $pconfig['user_source']);
+			$client['user_source'] = htmlentities($client['user_source'],ENT_COMPAT,'UTF-8');
 		}
+
 		$client['group_source'] = $pconfig['group_source'];
 
 		if ($pconfig['pool_enable']) {
@@ -291,7 +292,6 @@ if ($_POST['save']) {
 		if ($pconfig['login_banner_enable']) {
 			$client['login_banner'] = $pconfig['login_banner'];
 		}
-
 		$a_client = $client;
 
 		write_config(gettext("Saved IPsec Mobile Clients configuration."));