diff --git a/modules/admin-core/luasrc/view/sysauth.htm b/modules/admin-core/luasrc/view/sysauth.htm
index 42f13fa1fe..9c8e20c584 100644
--- a/modules/admin-core/luasrc/view/sysauth.htm
+++ b/modules/admin-core/luasrc/view/sysauth.htm
@@ -15,7 +15,7 @@ $Id$
 <%+header%>
 <% luci.i18n.loadc("sysauth") %>
 
-<form method="post" action="<%=luci.http.getenv("REQUEST_URI")%>">
+<form method="post" action="<%=pcdata(luci.http.getenv("REQUEST_URI"))%>">
 	<div class="cbi-map">
 		<h2><a id="content" name="content"><%:sysauth_head%></a></h2>
 		<div class="cbi-map-descr">