diff --git a/admin/reports_gen.php b/admin/reports_gen.php
index 2026e3f..2d2f2ba 100644
--- a/admin/reports_gen.php
+++ b/admin/reports_gen.php
@@ -111,9 +111,9 @@ case 'dialog_gen':
 		echo "<td class=\"input\"><select name=\"$ok\" id=\"$ok\">";
 		foreach($o['values'] as $k=>$v) {
 			$sel = ($report['option'][$ok] == $k) ? 'selected=\"selected\"' : '';
-			echo "<option value=\"$k\" $sel>$v</option>";
+			echo "<option value=\"$k\" $sel>".htmlspecialchars($v)."</option>";
 		}
-		echo "</select></td></tr>";
+		echo "</select></td></tr>\n";
 	}
 	/* Find all the years */
 	$q = mysql_query("SELECT DISTINCT year FROM config WHERE year>1000 ORDER BY year DESC");
@@ -124,7 +124,7 @@ case 'dialog_gen':
 		$sel = ($config['FAIRYEAR'] == $y) ? 'selected="selected"' : '';
 		echo "<option value=\"$y\" $sel>$y</option>";
 	}
-	echo "</select></td></tr>";
+	echo "</select></td></tr>\n";
 	?>
 	</table>
 	</div>