diff --git a/admin-dev/themes/default/template/controllers/customers/helpers/list/list_header.tpl b/admin-dev/themes/default/template/controllers/customers/helpers/list/list_header.tpl
index 39fec4f95..59c39e4e9 100644
--- a/admin-dev/themes/default/template/controllers/customers/helpers/list/list_header.tpl
+++ b/admin-dev/themes/default/template/controllers/customers/helpers/list/list_header.tpl
@@ -35,7 +35,7 @@
 {/block}
 {block name=leadin}
 	{if isset($delete_customer) && $delete_customer}
-		<form action="{$REQUEST_URI}" method="post">
+		<form action="{$REQUEST_URI|escape:'htmlall':'UTF-8'}" method="post">
 			<div class="warn">
 				<h2>{l s='How do you want to delete these customer(s)?'}</h2>
 				<p>{l s='There are two ways of deleting a customer. Please choose your preferred method.'}</p>
@@ -52,10 +52,10 @@
 				{foreach $POST as $key => $value}
 					{if is_array($value)}
 						{foreach $value as $val}
-							<input type="hidden" name="{$key}[]" value="{$val}" />
+							<input type="hidden" name="{$key|escape:'htmlall':'UTF-8'}[]" value="{$val|escape:'htmlall':'UTF-8'}" />
 						{/foreach}
 					{else}
-						<input type="hidden" name="{$key}" value="{$value}" />
+						<input type="hidden" name="{$key|escape:'htmlall':'UTF-8'}" value="{$value|escape:'htmlall':'UTF-8'}" />
 					{/if}
 				{/foreach}
 				<br /><input type="submit" class="button" value="{l s='Delete'}" />