     {message}             = @newDomainEntryForm
     {createButton}        = @newDomainEntryForm.buttons
     {domains, domainName} = @newDomainEntryForm.inputs
-    domainName            = "#{domainName.getValue()}.#{domains.getValue()}"
     {getDomainInfo, getDomainSuggestions} = KD.remote.api.JDomain
+
+    domainName =
+      Encoder.XSSEncode "#{domainName.getValue()}.#{domains.getValue()}"
 
     @newDomainEntryForm.domainListView?.unsetClass 'in'
 

    , callback

  showSuccess:(domain) ->

    {domainName} = @subDomainEntryForm.inputs
    @emit 'DomainSaved', domain
    @successNote?.destroy()


  createSubDomain: ->
    {domains, domainName} = @subDomainEntryForm.inputs
    {createButton}        = @subDomainEntryForm.buttons

    domainName = domainName.getValue()

    # Check given subdomain
    unless subDomainPattern.test domainName
      createButton.hideLoader()
      return notifyUser "#{domainName} is an invalid subdomain."

    domainName =
      Encoder.XSSEncode "#{domainName}.#{domains.getValue()}"

    domainType = 'subdomain'
    regYears   = 0

