diff --git a/src/my-addresses/my-addresses.js b/src/my-addresses/my-addresses.js
index e3b9503..1fd7041 100644
--- a/src/my-addresses/my-addresses.js
+++ b/src/my-addresses/my-addresses.js
@@ -38,15 +38,17 @@ document.addEventListener('DOMContentLoaded', () => {
 		$.extend({}, dataTableParams, {
 			columns: [
 				{ data: 'id' },
-				{ data: 'address', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm offset-lg-3 col-lg-6 font-weight-bold address" value="${data}" readonly="">`; }, width: '42%', class: 'text-center desktop' },
+				{ data: 'address', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm offset-lg-3 col-lg-6 font-weight-bold address" value="${escapeHtml(data)}" readonly="">`; }, width: '42%', class: 'text-center desktop' },
 				{ data: 'balance', render: (data) => { return humanAmountFormat(data); }, class: 'text-center' },
 				{ data: 'input_count', class: 'text-center desktop' },
 				{ data: 'address', render: (data) => {
 					let btns = '';
-					btns += `<a class="btn btn-danger btn-sm mr-1" href="#send/${data}"><i class="icon icon-compass visible-sr"></i><span class="hidden-sr">Send</span></a>`;
-					btns += `<button class="btn btn-info btn-sm mr-1 qr-code-btn" data-address="${data}"><i class="icon icon-download visible-sr"></i><span class="hidden-sr">Receive</span></button>`;
-					btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${data}"><i class="icon icon-svg visible-sr"></i><span class="hidden-sr">Explorer</span></a>`;
-					btns += `<a class="btn btn-success btn-sm mr-1" href="#transactions/${data}"><i class="icon icon-insert-template visible-sr"></i><span class="hidden-sr">Transactions</span></a>`;
+					const encodedAddress = encodeURIComponent(data);
+					const safeAddress = escapeHtml(data);
+					btns += `<a class="btn btn-danger btn-sm mr-1" href="#send/${encodedAddress}"><i class="icon icon-compass visible-sr"></i><span class="hidden-sr">Send</span></a>`;
+					btns += `<button class="btn btn-info btn-sm mr-1 qr-code-btn" data-address="${safeAddress}"><i class="icon icon-download visible-sr"></i><span class="hidden-sr">Receive</span></button>`;
+					btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${encodedAddress}"><i class="icon icon-svg visible-sr"></i><span class="hidden-sr">Explorer</span></a>`;
+					btns += `<a class="btn btn-success btn-sm mr-1" href="#transactions/${encodedAddress}"><i class="icon icon-insert-template visible-sr"></i><span class="hidden-sr">Transactions</span></a>`;
 					return btns;
 				}, class: 'text-right' },
 			],
diff --git a/src/transactions/transactions.js b/src/transactions/transactions.js
index 39105f0..e9f4f34 100644
--- a/src/transactions/transactions.js
+++ b/src/transactions/transactions.js
@@ -9,7 +9,7 @@ document.addEventListener('DOMContentLoaded', () => {
 			columns: [
 				{ data: 'id', className: 'dtr-control', render: (row, display, column) => {
 					let $html = '<div class="d-flex align-items-baseline">';
-					$html += `<div class="flex-fill">${column.id}</div>`;
+					$html += `<div class="flex-fill">${escapeHtml(column.id)}</div>`;
 					if (column.confirmations === '-') $html += `
 						<div class="flex-fill">
 							<div class="spinner-border spinner-border-sm" role="status">
@@ -21,7 +21,7 @@ document.addEventListener('DOMContentLoaded', () => {
 					return $html;
 				} },
 				{ data: 'timestamp', render: dateTimeFormat },
-				{ data: 'tx_id', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm" value="${data}" readonly="">`; }, width: '30%', class: 'text-center desktop' },
+				{ data: 'tx_id', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm" value="${escapeHtml(data)}" readonly="">`; }, width: '30%', class: 'text-center desktop' },
 				{ data: 'amount', render: (data) => {
 					let className = 'danger';
 					let text = 'Sended';
@@ -39,7 +39,7 @@ document.addEventListener('DOMContentLoaded', () => {
 				{ data: 'coinbase', className: 'none', render: (data) => { return data ? 'Yes' : 'No'; } },
 				{ data: 'tx_id', render: (data) => {
 					let btns = '';
-					btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${data}"><i class="icon icon-svg mr-1"></i>Explorer</a>`;
+					btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${encodeURIComponent(data)}"><i class="icon icon-svg mr-1"></i>Explorer</a>`;
 					return btns;
 				}, class: 'text-right desktop' },
 			],
diff --git a/src/utils.js b/src/utils.js
index 8755034..ed2f5e4 100644
--- a/src/utils.js
+++ b/src/utils.js
@@ -46,6 +46,15 @@ const formHandler = ($formName, callback) => {
 	});
 };
 
+const escapeHtml = (value) => {
+	return String(value)
+			.replace(/&/g, '&amp;')
+			.replace(/</g, '&lt;')
+			.replace(/>/g, '&gt;')
+			.replace(/"/g, '&quot;')
+			.replace(/'/g, '&#39;');
+};
+
 const dataTableParams = {
 	processing: true,
 	renderer: 'bootstrap',