diff --git a/src/main/scala/gitbucket/core/controller/IndexController.scala b/src/main/scala/gitbucket/core/controller/IndexController.scala
index 528aebf..ed9042d 100644
--- a/src/main/scala/gitbucket/core/controller/IndexController.scala
+++ b/src/main/scala/gitbucket/core/controller/IndexController.scala
@@ -9,7 +9,7 @@
 import gitbucket.core.service._
 import gitbucket.core.util.Implicits._
 import gitbucket.core.util.SyntaxSugars._
-import gitbucket.core.util.{Keys, LDAPUtil, ReferrerAuthenticator, UsersAuthenticator}
+import gitbucket.core.util._
 import org.scalatra.Ok
 import org.scalatra.forms._
 
@@ -208,7 +208,7 @@
             }
             .map { t =>
               Map(
-                "label" -> s"<b>@${t.userName}</b> ${t.fullName}",
+                "label" -> s"<b>@${StringUtil.escapeHtml(t.userName)}</b> ${StringUtil.escapeHtml(t.fullName)}",
                 "value" -> t.userName
               )
             }