3 files changed, 4 insertions, 4 deletions
diff --git a/template/default/token/confirmemail.html.tmpl b/template/default/token/confirmemail.html.tmpl
index e34a93e63..4d4102968 100644
--- a/template/default/token/confirmemail.html.tmpl
+++ b/template/default/token/confirmemail.html.tmpl
@@ -27,7 +27,7 @@
 </p>
 
 <form method="post" action="token.cgi">
-  <input type="hidden" name="t" value=[% token %]>
+  <input type="hidden" name="t" value=[% token FILTER html %]>
   <input type="hidden" name="a" value="chgem">
   <table>
     <tr>
diff --git a/template/default/token/emailchangenew.txt.tmpl b/template/default/token/emailchangenew.txt.tmpl
index 9a0a1e8d7..5a5ae2535 100644
--- a/template/default/token/emailchangenew.txt.tmpl
+++ b/template/default/token/emailchangenew.txt.tmpl
@@ -27,10 +27,10 @@ for the [% oldemailaddress %] account to your address.
 
 To confirm the change, visit the following link:
 
-[% Param('urlbase') %]token.cgi?a=cfmem&t=[% token %]
+[% Param('urlbase') %]token.cgi?a=cfmem&t=[% token FILTER html %]
 
 If you are not the person who made this request, or you wish to cancel
 this request, visit the following link:
 
-[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token %]
+[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token FILTER html %]
 
diff --git a/template/default/token/emailchangeold.txt.tmpl b/template/default/token/emailchangeold.txt.tmpl
index 661f8f1d4..82ecf1dfc 100644
--- a/template/default/token/emailchangeold.txt.tmpl
+++ b/template/default/token/emailchangeold.txt.tmpl
@@ -31,5 +31,5 @@ for your account to [% newemailaddress %].
 If you are not the person who made this request, or you wish to cancel
 this request, visit the following link:
 
-[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token %]
+[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token FILTER html %]