diff --git a/pom.xml b/pom.xml
index 7498ae6e..7e5167a5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,6 +78,21 @@
       <artifactId>apache-httpcomponents-client-4-api</artifactId>
       <version>4.5.5-3.0</version>
     </dependency>
+    <dependency>
+      <groupId>org.owasp.esapi</groupId>
+      <artifactId>esapi</artifactId>
+      <version>2.2.0.0</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-api</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.httpcomponents</groupId>
+          <artifactId>httpclient</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
diff --git a/src/main/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCause.java b/src/main/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCause.java
index 94cecf8e..af49e861 100644
--- a/src/main/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCause.java
+++ b/src/main/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCause.java
@@ -1,8 +1,12 @@
 package stashpullrequestbuilder.stashpullrequestbuilder;
 
 import hudson.model.Cause;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Map;
 import java.util.TreeMap;
+import org.owasp.esapi.Encoder;
+import org.owasp.esapi.reference.DefaultEncoder;
 
 /** Created by Nathan McCarthy */
 public class StashCause extends Cause {
@@ -123,18 +127,38 @@ public Map<String, String> getEnvironmentVariables() {
 
   @Override
   public String getShortDescription() {
-    return "<a href=\""
-        + stashHost
-        + "/projects/"
-        + this.getDestinationRepositoryOwner()
-        + "/repos/"
-        + this.getDestinationRepositoryName()
-        + "/pull-requests/"
-        + this.getPullRequestId()
-        + "\" >PR #"
-        + this.getPullRequestId()
-        + " "
-        + this.getPullRequestTitle()
-        + " </a>";
+    return "<a href='" + getEscapedUrl() + "'>" + getEscapedDescription() + " </a>";
+  }
+
+  String getEscapedUrl() {
+    return getEncoder().encodeForHTMLAttribute(getPrUrl().toASCIIString());
+  }
+
+  String getEscapedDescription() {
+    return getEncoder()
+        .encodeForHTML("PR #" + this.getPullRequestId() + " " + this.getPullRequestTitle());
+  }
+
+  URI getPrUrl() {
+    try {
+      return new URI(stashHost)
+          .resolve(
+              new URI(
+                  null,
+                  null,
+                  "/projects/"
+                      + this.getDestinationRepositoryOwner()
+                      + "/repos/"
+                      + this.getDestinationRepositoryName()
+                      + "/pull-requests/"
+                      + this.getPullRequestId(),
+                  null));
+    } catch (URISyntaxException e) {
+      throw new IllegalStateException(e);
+    }
+  }
+
+  private static Encoder getEncoder() {
+    return DefaultEncoder.getInstance();
   }
 }
diff --git a/src/main/resources/ESAPI.properties b/src/main/resources/ESAPI.properties
new file mode 100644
index 00000000..387509ef
--- /dev/null
+++ b/src/main/resources/ESAPI.properties
@@ -0,0 +1 @@
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
\ No newline at end of file
diff --git a/src/test/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCauseTest.java b/src/test/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCauseTest.java
new file mode 100644
index 00000000..f7de8d28
--- /dev/null
+++ b/src/test/java/stashpullrequestbuilder/stashpullrequestbuilder/StashCauseTest.java
@@ -0,0 +1,119 @@
+package stashpullrequestbuilder.stashpullrequestbuilder;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.object.HasToString.hasToString;
+import static org.junit.Assert.assertThat;
+
+import org.junit.Test;
+
+public class StashCauseTest {
+
+  @Test
+  public void short_description_doesnt_allow_injection() {
+
+    StashCause stashCause =
+        new StashCause(
+            "",
+            "",
+            "",
+            "",
+            "",
+            PULL_REQUEST_ID,
+            OWNER,
+            DESTINATION_REPOSITORY_NAME,
+            PULL_REQUEST_TITLE,
+            "",
+            "",
+            "",
+            "",
+            null);
+
+    assertThat(
+        stashCause.getShortDescription(),
+        is(
+            "<a href='&#x2f;projects&#x2f;owner&#x25;3C&#x25;3E&amp;&#x27;&#x25;22&#x2f;repos&#x2f;name&#x25;3C&#x25;3E&amp;&#x27;&#x25;22&#x2f;pull-requests&#x2f;id&#x25;3C&#x25;3E&amp;&#x27;&#x25;22'>"
+                + "PR &#x23;id&lt;&gt;&amp;&#x27;&quot; title&lt;&gt;&amp;&#x27;&quot; </a>"));
+  }
+
+  @Test
+  public void will_produce_valid_PR_url() {
+
+    StashCause stashCause =
+        new StashCause(
+            "https://stash.host",
+            "",
+            "",
+            "",
+            "",
+            PULL_REQUEST_ID,
+            OWNER,
+            DESTINATION_REPOSITORY_NAME,
+            PULL_REQUEST_TITLE,
+            "",
+            "",
+            "",
+            "",
+            null);
+
+    assertThat(
+        stashCause.getPrUrl(),
+        hasToString(
+            "https://stash.host/projects/owner%3C%3E&'%22/repos/name%3C%3E&'%22/pull-requests/id%3C%3E&'%22"));
+  }
+
+  @Test
+  public void will_escape_PR_url() {
+
+    StashCause stashCause =
+        new StashCause(
+            "https://stash.host",
+            "",
+            "",
+            "",
+            "",
+            PULL_REQUEST_ID,
+            OWNER,
+            DESTINATION_REPOSITORY_NAME,
+            PULL_REQUEST_TITLE,
+            "",
+            "",
+            "",
+            "",
+            null);
+
+    assertThat(
+        stashCause.getEscapedUrl(),
+        is(
+            "https&#x3a;&#x2f;&#x2f;stash.host&#x2f;projects&#x2f;owner&#x25;3C&#x25;3E&amp;&#x27;&#x25;22&#x2f;repos&#x2f;name&#x25;3C&#x25;3E&amp;&#x27;&#x25;22&#x2f;pull-requests&#x2f;id&#x25;3C&#x25;3E&amp;&#x27;&#x25;22"));
+  }
+
+  @Test
+  public void will_escape_PR_description() {
+
+    StashCause stashCause =
+        new StashCause(
+            "https://stash.host",
+            "",
+            "",
+            "",
+            "",
+            PULL_REQUEST_ID,
+            OWNER,
+            DESTINATION_REPOSITORY_NAME,
+            PULL_REQUEST_TITLE,
+            "",
+            "",
+            "",
+            "",
+            null);
+
+    assertThat(
+        stashCause.getEscapedDescription(),
+        is("PR &#x23;id&lt;&gt;&amp;&#x27;&quot; title&lt;&gt;&amp;&#x27;&quot;"));
+  }
+
+  public static final String OWNER = "owner<>&'\"";
+  public static final String DESTINATION_REPOSITORY_NAME = "name<>&'\"";
+  public static final String PULL_REQUEST_ID = "id<>&'\"";
+  public static final String PULL_REQUEST_TITLE = "title<>&'\"";
+}