diff --git a/setup/wizardsteps/WizStepDataAudit.php b/setup/wizardsteps/WizStepDataAudit.php
index 97b7ccd8d4..cb4aba4981 100644
--- a/setup/wizardsteps/WizStepDataAudit.php
+++ b/setup/wizardsteps/WizStepDataAudit.php
@@ -110,7 +110,7 @@ JS);
 		];
 		$aHiddenInputs = '';
 		foreach ($aParams as $sParamName) {
-			$sElements = $this->oWizard->GetParameter($sParamName, '[]');
+			$sElements = utils::HtmlEntities($this->oWizard->GetParameter($sParamName, '[]'));
 			$aHiddenInputs .= <<<INPUT
 	<input type="hidden" name="$sParamName" value="$sElements"/>
 INPUT;