Index: src/report/report-system/html-style-info.scm
===================================================================
--- src/report/report-system/html-style-info.scm	(revision 20751)
+++ src/report/report-system/html-style-info.scm	(working copy)
@@ -277,8 +277,21 @@
 ;;  default renderers for some data types.  
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
+(define (gnc:escape-html-entities datum)
+  ;; Convert string datum to escape HTML special characters < > and &
+  ;; i.e. convert them to &lt; &gt; and &amp; respectively.
+  ;; Maybe there's a way to do this in one go... (but order is important)
+
+  ;; The regex for '&' is a bit ugly because we must ensure _not_ to
+  ;; replace the '&' in "&nbsp;".  Guile doesn't support Negative Lookahead, so
+  ;; our regex has to work around this limitation.
+  (set! datum (regexp-substitute/global #f "&(nbsp[^;]|nbs[^p]|nb[^s]|n[^b]|[^n]|$)" datum 'pre "&amp;" 1 'post))
+  (set! datum (regexp-substitute/global #f "<" datum 'pre "&lt;" 'post))
+  (regexp-substitute/global #f ">" datum 'pre "&gt;" 'post))
+
 (define (gnc:default-html-string-renderer datum params)
-  datum)
+  ;; Escape html entities in text data
+  (gnc:escape-html-entities datum))
 
 (define (gnc:default-html-gnc-numeric-renderer datum params)
   (xaccPrintAmount datum (gnc-default-print-info #f)))
