diff --git a/Core/App/AppController.php b/Core/App/AppController.php
index 83c42b7241..0dd563c518 100644
--- a/Core/App/AppController.php
+++ b/Core/App/AppController.php
@@ -287,7 +287,7 @@ private function userAuth()
         }
 
         $this->ipWarning();
-        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => $nick]);
+        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => htmlspecialchars($nick)]);
         return false;
     }