diff --git a/includes/html/pages/api-access.inc.php b/includes/html/pages/api-access.inc.php
index 8e3f34c341..1a6898fb1d 100644
--- a/includes/html/pages/api-access.inc.php
+++ b/includes/html/pages/api-access.inc.php
@@ -59,7 +59,7 @@ if (Auth::user()->hasGlobalAdmin()) {
                 <select class="form-control" id="user_id" name="user_id">
     <?php
     foreach ($userlist = User::all() as $user) {
-        echo '<option value="' . $user->user_id . '">' . $user->username . ' (' . $user->auth_type . ')</option>';
+        echo '<option value="' . $user->user_id . '">' . htmlentities($user->username) . ' (' . htmlentities($user->auth_type) . ')</option>';
     } ?>
                 </select>
               </div>