diff --git a/workflow/engine/skinEngine/base/error404.php b/workflow/engine/skinEngine/base/error404.php
index 5972ede39..14fd643ea 100644
--- a/workflow/engine/skinEngine/base/error404.php
+++ b/workflow/engine/skinEngine/base/error404.php
@@ -84,8 +84,8 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
                 <!-- Page links -->
                 <ul id="textInfo">
                     <li>You might try retyping the URL and trying again.</li>
-                    <li>Or we could take you back to the <a href="<?php echo $urlHome; ?>">home page.</a></li>
-                    <li>Or you could start again from the <a href="<?php echo $urlLogin; ?>">login page.</a></li>
+                    <li>Or we could take you back to the <a href="<?php echo htmlspecialchars($urlHome); ?>">home page.</a></li>
+                    <li>Or you could start again from the <a href="<?php echo htmlspecialchars($urlLogin); ?>">login page.</a></li>
                 </ul>
                 <!-- End page links -->
             </div>
@@ -125,4 +125,4 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
 
   </div>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/workflow/engine/skinEngine/neoclassic/error404.php b/workflow/engine/skinEngine/neoclassic/error404.php
index 79a4ec960..7ba1f4082 100644
--- a/workflow/engine/skinEngine/neoclassic/error404.php
+++ b/workflow/engine/skinEngine/neoclassic/error404.php
@@ -85,8 +85,8 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
                 <!-- Page links -->
                 <ul id="textInfo">
                     <li>You might try retyping the URL and trying again.</li>
-                    <li>Or we could take you back to the <a href="<?php echo $urlHome; ?>">home page.</a></li>
-                    <li>Or you could start again from the <a href="<?php echo $urlLogin; ?>">login page.</a></li>
+                    <li>Or we could take you back to the <a href="<?php echo htmlspecialchars($urlHome); ?>">home page.</a></li>
+                    <li>Or you could start again from the <a href="<?php echo htmlspecialchars($urlLogin); ?>">login page.</a></li>
                 </ul>
                 <!-- End page links -->
             </div>
@@ -126,4 +126,4 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
 
   </div>
 </body>
-</html>
\ No newline at end of file
+</html>