diff --git a/ui/ui/customer/activation.tpl b/ui/ui/customer/activation.tpl
index 4d02637b..da62ed44 100644
--- a/ui/ui/customer/activation.tpl
+++ b/ui/ui/customer/activation.tpl
@@ -19,11 +19,11 @@
                 <form method="post" role="form" action="{Text::url('voucher/activation-post')}">
                     <div class="form-group">
                         <div class="input-group">
-                            <input type="text" class="form-control" id="code" name="code" value="{$code}"
+                            <input type="text" class="form-control" id="code" name="code" value="{$code|escape:'html'}"
                                 placeholder="{Lang::T('Enter voucher code here')}">
                             <span class="input-group-btn">
                                 <a class="btn btn-default"
-                                    href="{$app_url}/scan/?back={urlencode(Text::url('voucher/activation&code='))}"><i
+                                    href="{$app_url|escape:'html'}/scan/?back={urlencode(Text::url('voucher/activation&code='))}"><i
                                         class="glyphicon glyphicon-qrcode"></i></a>
                             </span>
                         </div>
@@ -40,4 +40,4 @@
     </div>
 </div>
 
-{include file="customer/footer.tpl"}
\ No newline at end of file
+{include file="customer/footer.tpl"}