diff --git a/inc/dropdown.class.php b/inc/dropdown.class.php
index a7d5672bf9a..b31a64430c7 100644
--- a/inc/dropdown.class.php
+++ b/inc/dropdown.class.php
@@ -1930,7 +1930,7 @@ static function showFromArray($name, array $elements, $options = []) {
                $output .= "</optgroup>";
             } else {
                if (!isset($param['used'][$key])) {
-                  $output .= "<option value='".$key."'";
+                  $output .= "<option value='".Html::entities_deep($key)."'";
                   // Do not use in_array : trouble with 0 and empty value
                   foreach ($param['values'] as $value) {
                      if (strcmp($key, $value)===0) {