diff --git a/lib/split/dashboard/helpers.rb b/lib/split/dashboard/helpers.rb
index c54525f7..f51418c3 100644
--- a/lib/split/dashboard/helpers.rb
+++ b/lib/split/dashboard/helpers.rb
@@ -1,5 +1,9 @@
 module Split
   module DashboardHelpers
+    def h(text)
+      Rack::Utils.escape_html(text)
+    end
+
     def url(*path_parts)
       [ path_prefix, path_parts ].join("/").squeeze('/')
     end
diff --git a/lib/split/dashboard/views/_experiment.erb b/lib/split/dashboard/views/_experiment.erb
index 8409fc2d..c35d9935 100644
--- a/lib/split/dashboard/views/_experiment.erb
+++ b/lib/split/dashboard/views/_experiment.erb
@@ -71,7 +71,7 @@
             <% end %>
           <% else %>
             <form action="<%= url experiment.name %>" method='post' onclick="return confirmWinner()">
-              <input type='hidden' name='alternative' value='<%= alternative.name %>'>
+              <input type='hidden' name='alternative' value='<%= h alternative.name %>'>
               <input type="submit" value="Use this" class="green">
             </form>
           <% end %>