diff --git a/code/UserDefinedForm.php b/code/UserDefinedForm.php
index <HASH>..<HASH> 100755
--- a/code/UserDefinedForm.php
+++ b/code/UserDefinedForm.php
@@ -407,7 +407,7 @@ class UserDefinedForm_Controller extends Page_Controller {
 				
 				// set the values passed by the url to the field
 				$request = $this->getRequest();
-				$value = $request->getVar($field->name);
+				$value = Convert::raw2att($request->getVar($field->name));
 				if(isset($value)) $field->value = $value;
 				
 				$fields->push($field);
MINOR - Added escaping for values passed by url params