diff --git a/Kwf_js/Menu/Index.js b/Kwf_js/Menu/Index.js
index <HASH>..<HASH> 100644
--- a/Kwf_js/Menu/Index.js
+++ b/Kwf_js/Menu/Index.js
@@ -191,7 +191,7 @@ Kwf.Menu.Index = Ext2.extend(Ext2.Toolbar,
         if (result.fullname && result.userSelfControllerUrl) {
             this.userToolbar.add({
                 id: 'currentUser',
-                text: result.fullname,
+                text: Ext2.util.Format.htmlEncode(result.fullname),
                 cls: 'x2-btn-text-icon',
                 icon: '/assets/silkicons/user.png',
                 disabled: !result.userId,
escape username in backend to prevent xss vulnerability