diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php
index 73fb7c48ec..36c4807fcd 100644
--- a/usr/local/www/diag_packet_capture.php
+++ b/usr/local/www/diag_packet_capture.php
@@ -307,7 +307,7 @@ include("fbegin.inc");
 		<tr>
 			<td width="17%" valign="top" class="vncellreq"><?=gettext("Port");?></td>
 			<td colspan="2" width="83%" class="vtable">
-			<input name="port" class="formfld unknown" id="port" size="5" value="<?=$port;?>" />
+			<input name="port" class="formfld unknown" id="port" size="5" value="<?=htmlspecialchars($port);?>" />
 			<br /><?=gettext("The port can be either the source or destination port. The packet capture will look for this port in either field.");?>
 			<br /><?=gettext("Leave blank if you do not want to filter by port.");?>
 			</td>
@@ -315,14 +315,14 @@ include("fbegin.inc");
 		<tr>
 			<td width="17%" valign="top" class="vncellreq"><?=gettext("Packet Length");?></td>
 			<td colspan="2" width="83%" class="vtable">
-			<input name="snaplen" class="formfld unknown" id="snaplen" size="5" value="<?=$snaplen;?>" />
+			<input name="snaplen" class="formfld unknown" id="snaplen" size="5" value="<?=htmlspecialchars($snaplen);?>" />
 			<br /><?=gettext("The Packet length is the number of bytes of each packet that will be captured. Default value is 0, which will capture the entire frame regardless of its size.");?>
 			</td>
 		</tr>
 		<tr>
 			<td width="17%" valign="top" class="vncellreq"><?=gettext("Count");?></td>
 			<td colspan="2" width="83%" class="vtable">
-			<input name="count" class="formfld unknown" id="count" size="5" value="<?=$count;?>" />
+			<input name="count" class="formfld unknown" id="count" size="5" value="<?=htmlspecialchars($count);?>" />
 			<br /><?=gettext("This is the number of packets the packet capture will grab. Default value is 100.") . "<br />" . gettext("Enter 0 (zero) for no count limit.");?>
 			</td>
 		</tr>