diff --git a/src/RoomsModel.cpp b/src/RoomsModel.cpp
index 80f13756df57d225d047a855ec7b4829ffc9ddc3..656a0debdd25974739d2c5c2bee1ab0095fbbcd7 100644
--- a/src/RoomsModel.cpp
+++ b/src/RoomsModel.cpp
@@ -77,7 +77,7 @@ RoomsModel::data(const QModelIndex &index, int role) const
                         return QString::fromStdString(
                           roomInfos.at(roomids[index.row()]).avatar_url);
                 case Roles::RoomID:
-                        return roomids[index.row()];
+                        return roomids[index.row()].toHtmlEscaped();
                 }
         }
         return {};
diff --git a/src/timeline/Reaction.h b/src/timeline/Reaction.h
index 47dac6172b28f627ea038d7c24b5e724244c1c4d..788e9ced393b70da8e8d15fa5bd66f495a44816d 100644
--- a/src/timeline/Reaction.h
+++ b/src/timeline/Reaction.h
@@ -16,8 +16,8 @@ struct Reaction
         Q_PROPERTY(int count READ count)
 
 public:
-        QString key() const { return key_; }
-        QString users() const { return users_; }
+        QString key() const { return key_.toHtmlEscaped(); }
+        QString users() const { return users_.toHtmlEscaped(); }
         QString selfReactedEvent() const { return selfReactedEvent_; }
         int count() const { return count_; }