   createSubDomain: ->
     {domains, domainName} = @subDomainEntryForm.inputs
     {createButton}        = @subDomainEntryForm.buttons
-    domainName            = domainName.getValue()
+
+    domainName = domainName.getValue()
 
     # Check given subdomain
     unless subDomainPattern.test domainName
       createButton.hideLoader()
       return notifyUser "#{domainName} is an invalid subdomain."
 
-    domainName = "#{domainName}.#{domains.getValue()}"
+    domainName =
+      Encoder.XSSEncode "#{domainName}.#{domains.getValue()}"
+
     domainType = 'subdomain'
     regYears   = 0
 

      tagName  : 'p'
      cssClass : 'success'
      partial  : """
        Your subdomain <strong>#{domainName.getValue()}</strong> has been added.
        You can dismiss this panel and point your new domain to one of your VMs
        on the right.
      """

    {message}             = @newDomainEntryForm
    {createButton}        = @newDomainEntryForm.buttons
    {domains, domainName} = @newDomainEntryForm.inputs
    {getDomainInfo, getDomainSuggestions} = KD.remote.api.JDomain

    domainName =
      Encoder.XSSEncode "#{domainName.getValue()}.#{domains.getValue()}"

    @newDomainEntryForm.domainListView?.unsetClass 'in'

