diff --git a/assets/js/ticket.js b/assets/js/ticket.js
index 41f61ec..4a05c51 100644
--- a/assets/js/ticket.js
+++ b/assets/js/ticket.js
@@ -1269,7 +1269,7 @@ function showReplyForm(commentId, userName) {
     const replyFormHtml = `
         <div class="reply-form-container" data-parent-id="${commentId}">
             <div class="reply-header">
-                <span>Replying to <span class="replying-to">@${userName}</span></span>
+                <span>Replying to <span class="replying-to">@${lt.escHtml(userName)}</span></span>
                 <button type="button" class="close-reply-btn" data-action="close-reply">CANCEL</button>
             </div>
             <textarea id="replyText" placeholder="Write your reply..."></textarea>