--- a/gwt-client/src/main/java/org/dive4elements/river/client/client/ui/TableDataPanel.java	Thu Jul 26 15:58:08 2018 +0200
+++ b/gwt-client/src/main/java/org/dive4elements/river/client/client/ui/TableDataPanel.java	Thu Jul 26 16:31:35 2018 +0200
@@ -20,6 +20,7 @@
 
 import com.google.gwt.core.client.GWT;
 import com.google.gwt.i18n.client.NumberFormat;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
 import com.google.gwt.user.client.rpc.AsyncCallback;
 import com.smartgwt.client.data.Record;
 import com.smartgwt.client.types.ListGridFieldType;
@@ -209,17 +210,19 @@
             for (int j = 0; j < sItem.length; j++) {
                 // See above, display 'as is' from server, but keep value
                 // in machine-usable way (float), to allow numeric sorting.
-                r.setAttribute(displayField[j], sItem[j]);
-                // r.setAttribute(String.valueOf(j), sItem[j]);
+                String item = sItem[j];
+                String encodedText = SafeHtmlUtils.htmlEscapeAllowEntities(item);
+                
+                r.setAttribute(displayField[j], encodedText);
                 if (fields[j].getType() == ListGridFieldType.TEXT) {
-                    r.setAttribute(String.valueOf(j), sItem[j]);
+                    r.setAttribute(String.valueOf(j), item);
                 } else {
                     try {
-                        final Float valueFloatSortable = (float) nf.parse(sItem[j]);
+                        final Float valueFloatSortable = (float) nf.parse(item);
                         r.setAttribute(String.valueOf(j), valueFloatSortable);
                     }
                     catch (final NumberFormatException nfe) {
-                        r.setAttribute(String.valueOf(j), sItem[j]);
+                        r.setAttribute(String.valueOf(j), item);
                     }
                 }