diff --git a/html/pages/device/notes.inc.php b/html/pages/device/notes.inc.php
index 94f3372cc..39e034ff1 100644
--- a/html/pages/device/notes.inc.php
+++ b/html/pages/device/notes.inc.php
@@ -21,7 +21,7 @@ $data = dbFetchRow("SELECT `notes` FROM `devices` WHERE device_id = ?", array(
     <div class="form-group">
         <div class="col-sm-10">
             <textarea class="form-control" rows="6" name="notes" id="device-notes"><?php
-echo $data['notes']; ?></textarea>
+echo htmlentities($data['notes']); ?></textarea>
         </div>
     </div>
     <div class="form-group">