diff --git a/tests/test_app/TestApp/Template/Error/error400.ctp b/tests/test_app/TestApp/Template/Error/error400.ctp
index 8623e63e910..c2dc3326112 100644
--- a/tests/test_app/TestApp/Template/Error/error400.ctp
+++ b/tests/test_app/TestApp/Template/Error/error400.ctp
@@ -14,7 +14,7 @@
  */
 use Cake\Core\Configure;
 ?>
-<h2><?= $message ?></h2>
+<h2><?= h($message) ?></h2>
 <p class="error">
 	<strong><?= __d('cake', 'Error'); ?>: </strong>
 	<?= sprintf(
diff --git a/tests/test_app/TestApp/Template/Error/error500.ctp b/tests/test_app/TestApp/Template/Error/error500.ctp
index 535cb03c22c..b3c01e1d1a6 100644
--- a/tests/test_app/TestApp/Template/Error/error500.ctp
+++ b/tests/test_app/TestApp/Template/Error/error500.ctp
@@ -14,7 +14,7 @@
  */
 use Cake\Core\Configure;
 ?>
-<h2><?= $message; ?></h2>
+<h2><?= h($message) ?></h2>
 <p class="error">
 	<strong><?= __d('cake', 'Error'); ?>: </strong>
 	<?= __d('cake', 'An Internal Error Has Occurred.'); ?>