diff --git a/mod/forum/lib.php b/mod/forum/lib.php
index bff5f6694e0..7beb067b570 100644
--- a/mod/forum/lib.php
+++ b/mod/forum/lib.php
@@ -2817,7 +2817,7 @@ function forum_search_form($course, $search='') {
     $output .= '<form action="'.$CFG->wwwroot.'/mod/forum/search.php" style="display:inline">';
     $output .= '<fieldset class="invisiblefieldset">';
     $output .= helpbutton('search', get_string('search'), 'moodle', true, false, '', true);
-    $output .= '<input name="search" type="text" size="18" value="'.$search.'" alt="search" />';
+    $output .= '<input name="search" type="text" size="18" value="'.s($search).'" alt="search" />';
     $output .= '<input value="'.get_string('searchforums', 'forum').'" type="submit" />';
     $output .= '<input name="id" type="hidden" value="'.$course->id.'" />';
     $output .= '</fieldset>';