Index: binary-improvements/webserver/js/log.js
===================================================================
--- binary-improvements/webserver/js/log.js	(revision 319)
+++ binary-improvements/webserver/js/log.js	(revision 320)
@@ -21,5 +21,5 @@
 				$("<td>" + data.entries [i].uptime + "</td>").addClass ("logcol_uptime").appendTo (row);
 				$("<td>" + data.entries [i].type + "</td>").addClass ("logcol_type").appendTo (row);
-				var msg = $("<td>" + data.entries [i].msg + "</td>").addClass ("logcol_msg").appendTo (row);
+				var msg = $("<td></td>").text(data.entries [i].msg).addClass ("logcol_msg").appendTo (row);
 				if (data.entries [i].trace.length > 0) {
 					msg.append ('<br><div class="trace"><span>' + data.entries [i].trace.replace (/\n/g, "</span><span>") + '</span></div><a class="tracebtn"></a>');
Index: binary-improvements/webserver/js/map.js
===================================================================
--- binary-improvements/webserver/js/map.js	(revision 319)
+++ binary-improvements/webserver/js/map.js	(revision 320)
@@ -210,5 +210,5 @@
 			} else {
 				marker = L.marker([val.position.x, val.position.z], {icon: playerIcon}).bindPopup(
-					"Player: " + val.name +
+					"Player: " + $("<div>").text(val.name).html() +
 					(HasPermission ("webapi.getplayerinventory") ?
 						"<br/><a class='inventoryButton' data-steamid='"+val.steamid+"'>Show inventory</a>"
Index: binary-improvements/webserver/js/players.js
===================================================================
--- binary-improvements/webserver/js/players.js	(revision 319)
+++ binary-improvements/webserver/js/players.js	(revision 320)
@@ -27,5 +27,9 @@
 		[ "entityid", "EntityID" ],
 		[ "ip", "IP" ],
-		[ "name", "Name" ],
+		[ "name", "Name",
+			function(text, data) {
+				return $("<div>").text(text).html();
+			}
+		],
 		[ "online", "Online", null,
 			function(text, data) {