diff --git a/src/fonteditor/widget/ProjectViewer.js b/src/fonteditor/widget/ProjectViewer.js
index cdc58f1..61ad558 100644
--- a/src/fonteditor/widget/ProjectViewer.js
+++ b/src/fonteditor/widget/ProjectViewer.js
@@ -6,7 +6,7 @@
 define(
     function (require) {
         var i18n = require('../i18n/i18n');
-
+        var string = require('common/string');
         /**
          * 项目列表查看器
          *
@@ -73,8 +73,8 @@ define(
         ProjectViewer.prototype.show = function (projects, selectedId) {
             var str = '';
             (projects || []).forEach(function (proj) {
-                str += '<dl data-id="' + proj.id + '">'
-                    +       '<dt>' + proj.name + '</dt>'
+                str += '<dl data-id="' + string.encodeHTML(proj.id) + '">'
+                    +       '<dt>' + string.encodeHTML(proj.name) + '</dt>'
                     +       '<dd>'
                     +           (proj.config && proj.config.sync
                                   ? ('<span data-action="sync" title="'
diff --git a/src/fonteditor/widget/glyfviewer/render.js b/src/fonteditor/widget/glyfviewer/render.js
index 98c2d0d..be47231 100644
--- a/src/fonteditor/widget/glyfviewer/render.js
+++ b/src/fonteditor/widget/glyfviewer/render.js
@@ -45,7 +45,7 @@ define(
                     unicode: (glyf.unicode || []).map(function (u) {
                         return '$' + u.toString(16).toUpperCase();
                     }).join(','),
-                    name: glyf.name,
+                    name: string.encodeHTML(glyf.name || ''),
                     fillColor: opt.color ? 'style="fill:' + opt.color + '"' : ''
                 };