diff --git a/application/cmdbabstract.class.inc.php b/application/cmdbabstract.class.inc.php
index 6f6016a68..320ab80f4 100644
--- a/application/cmdbabstract.class.inc.php
+++ b/application/cmdbabstract.class.inc.php
@@ -4583,7 +4583,7 @@ EOF
 				}
 				$oP->add("<input type=\"hidden\" name=\"transaction_id\" value=\"".utils::GetNewTransactionId()."\">\n");
 				$oP->add("<input type=\"hidden\" name=\"operation\" value=\"$sCustomOperation\">\n");
-				$oP->add("<input type=\"hidden\" name=\"filter\" value=\"".$oFilter->Serialize()."\">\n");
+				$oP->add("<input type=\"hidden\" name=\"filter\" value=\"".rawurlencode($oFilter->Serialize())."\">\n");
 				$oP->add("<input type=\"hidden\" name=\"class\" value=\"$sClass\">\n");
 				foreach($aObjects as $oObj)
 				{
diff --git a/pages/UI.php b/pages/UI.php
index 2dacb52e9..1a4b43ccc 100644
--- a/pages/UI.php
+++ b/pages/UI.php
@@ -277,7 +277,7 @@ function DisplayMultipleSelectionForm($oP, $oFilter, $sNextOperation, $oChecker,
 		$oP->add("<form method=\"post\" action=\"./UI.php\">\n");
 		$oP->add("<input type=\"hidden\" name=\"operation\" value=\"$sNextOperation\">\n");
 		$oP->add("<input type=\"hidden\" name=\"class\" value=\"".$oFilter->GetClass()."\">\n");
-		$oP->add("<input type=\"hidden\" name=\"filter\" value=\"".$oFilter->Serialize()."\">\n");
+		$oP->add("<input type=\"hidden\" name=\"filter\" value=\"".rawurlencode($oFilter->Serialize())."\">\n");
 		$oP->add("<input type=\"hidden\" name=\"transaction_id\" value=\"".utils::GetNewTransactionId()."\">\n");
 		foreach($aExtraFormParams as $sName => $sValue)
 		{
diff --git a/pages/run_query.php b/pages/run_query.php
index 71e963842..2d9288c34 100644
--- a/pages/run_query.php
+++ b/pages/run_query.php
@@ -227,7 +227,7 @@ EOF
 		$oP->p('');
 		$oP->StartCollapsibleSection(Dict::S('UI:RunQuery:MoreInfo'), false, 'runQuery');
 		$oP->p(Dict::S('UI:RunQuery:DevelopedQuery').htmlentities($oFilter->ToOQL(), ENT_QUOTES, 'UTF-8'));
-		$oP->p(Dict::S('UI:RunQuery:SerializedFilter').$oFilter->serialize());
+		$oP->p(Dict::S('UI:RunQuery:SerializedFilter').htmlentities($oFilter->serialize(), ENT_QUOTES, 'UTF-8'));
 		$oP->EndCollapsibleSection();
 	}
 	elseif ($sSyntaxError)