diff --git a/source/Styles/xb3/jst/port_forwarding_add.jst b/source/Styles/xb3/jst/port_forwarding_add.jst
index de23cee..a576bfe 100644
--- a/source/Styles/xb3/jst/port_forwarding_add.jst
+++ b/source/Styles/xb3/jst/port_forwarding_add.jst
@@ -599,7 +599,7 @@ $('#device').click(function(){
 			$hostNums = "2";
 		}*/
 		for ($i=1; $i <= $hostNums; $i++) { 
-                        $HostName  = getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".HostName");
+                        $HostName  = htmlspecialchars(getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".HostName"), ENT_QUOTES, 'UTF-8');
                         $IPAddress = getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".IPAddress");
                         $Active    = getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".Active");
 			$IPv6Addr = "EMPTY";
diff --git a/tests/port_forwarding_add_jst_xss_test.sh b/tests/port_forwarding_add_jst_xss_test.sh
new file mode 100644
index 0000000..ca4e43f
--- /dev/null
+++ b/tests/port_forwarding_add_jst_xss_test.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+if sed -n '602p' source/Styles/xb3/jst/port_forwarding_add.jst | grep -q "ENT_QUOTES"; then
+    echo "PASS: HostName uses ENT_QUOTES"
+else
+    echo "FAIL: HostName does not use ENT_QUOTES"
+    exit 1
+fi