--- a/artifacts/src/main/java/org/dive4elements/river/artifacts/common/AbstractCalculationExportableResult.java	Thu Jul 26 15:58:08 2018 +0200
+++ b/artifacts/src/main/java/org/dive4elements/river/artifacts/common/AbstractCalculationExportableResult.java	Thu Jul 26 16:31:35 2018 +0200
@@ -13,6 +13,8 @@
 
 import org.dive4elements.river.artifacts.sinfo.util.RiverInfo;
 
+import com.lowagie.text.html.HtmlEncoder;
+
 import net.sf.jasperreports.engine.JRException;
 
 /**
@@ -72,7 +74,13 @@
         for (final ResultRow row : rows) {
 
             final String[] formattedRow = formatPDFRow(exportContext, row);
-            source.addData(formattedRow);
+
+            final String[] encodedRow = new String[formattedRow.length];
+            for (int i = 0; i < encodedRow.length; i++) {
+                encodedRow[i] = HtmlEncoder.encode(formattedRow[i]);
+            }
+
+            source.addData(encodedRow);
         }
     }
 }
\ No newline at end of file

--- a/gwt-client/src/main/java/org/dive4elements/river/client/client/ui/TableDataPanel.java	Thu Jul 26 15:58:08 2018 +0200
+++ b/gwt-client/src/main/java/org/dive4elements/river/client/client/ui/TableDataPanel.java	Thu Jul 26 16:31:35 2018 +0200
@@ -20,6 +20,7 @@
 
 import com.google.gwt.core.client.GWT;
 import com.google.gwt.i18n.client.NumberFormat;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
 import com.google.gwt.user.client.rpc.AsyncCallback;
 import com.smartgwt.client.data.Record;
 import com.smartgwt.client.types.ListGridFieldType;
@@ -209,17 +210,19 @@
             for (int j = 0; j < sItem.length; j++) {
                 // See above, display 'as is' from server, but keep value
                 // in machine-usable way (float), to allow numeric sorting.
-                r.setAttribute(displayField[j], sItem[j]);
-                // r.setAttribute(String.valueOf(j), sItem[j]);
+                String item = sItem[j];
+                String encodedText = SafeHtmlUtils.htmlEscapeAllowEntities(item);
+                
+                r.setAttribute(displayField[j], encodedText);
                 if (fields[j].getType() == ListGridFieldType.TEXT) {
-                    r.setAttribute(String.valueOf(j), sItem[j]);
+                    r.setAttribute(String.valueOf(j), item);
                 } else {
                     try {
-                        final Float valueFloatSortable = (float) nf.parse(sItem[j]);
+                        final Float valueFloatSortable = (float) nf.parse(item);
                         r.setAttribute(String.valueOf(j), valueFloatSortable);
                     }
                     catch (final NumberFormatException nfe) {
-                        r.setAttribute(String.valueOf(j), sItem[j]);
+                        r.setAttribute(String.valueOf(j), item);
                     }
                 }