diff --git a/core/modules/serializers.js b/core/modules/serializers.js
index 47788e2d5..e044d4bb0 100644
--- a/core/modules/serializers.js
+++ b/core/modules/serializers.js
@@ -113,7 +113,7 @@ exports["application/x-tiddler-html-div"] = function(tiddler) {
 	pullField("title");
 	// Output the fields
 	for(f=0; f<fields.length; f++) {
-		result.push(" " + fields[f] + "=\"" + tiddler.getFieldString(fields[f]) + "\"");
+		result.push(" " + fields[f] + "=\"" + $tw.utils.htmlEncode(tiddler.getFieldString(fields[f])) + "\"");
 	}
 	result.push(">\n<pre>");
 	result.push($tw.utils.htmlEncode(tiddler.fields.text));