diff --git a/html/dashboard/js/terminal.js b/html/dashboard/js/terminal.js
index ad48116..199bb74 100644
--- a/html/dashboard/js/terminal.js
+++ b/html/dashboard/js/terminal.js
@@ -48,7 +48,7 @@ var page = {
         </div>`;
         var obj = $(str);
         obj.attr('id', 'tab-'+idx);
-        obj.find('iframe').attr('src', 'http://'+location.hostname+':'+$('#terms').val());
+        obj.find('iframe').attr('src', 'http://'+location.hostname+':'+escape($('#terms').val()));
         $('#tab-content').append(obj);
         page.idx++;
     },
diff --git a/html/js/common.js b/html/js/common.js
index 54feee1..d575533 100644
--- a/html/js/common.js
+++ b/html/js/common.js
@@ -2,6 +2,13 @@ function arg(key) {
     var url = new URL(location.href);
     return decodeURIComponent(url.searchParams.get(key));
 }
+function escape(htmlStr) {
+    return htmlStr.replace(/&/g, "&amp;")
+          .replace(/</g, "&lt;")
+          .replace(/>/g, "&gt;")
+          .replace(/"/g, "&quot;")
+          .replace(/'/g, "&#39;");
+}
 var humanize = {
     bytes: function(n) {
         return humanize.humanate_bytes(n, 1024, ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'])