diff --git a/templates/force-aup-tpl.php b/templates/force-aup-tpl.php
index fd35ae06..e15dfafd 100644
--- a/templates/force-aup-tpl.php
+++ b/templates/force-aup-tpl.php
@@ -31,7 +31,7 @@
         }
 ?>
 
-        <input type="hidden" name="StateId" value="<?php echo $_REQUEST['StateId']; ?>">
+        <input type="hidden" name="StateId" value="<?php echo htmlspecialchars($_REQUEST['StateId']); ?>">
 
         <div class="form-group">
             <button type="submit" class="btn btn-lg btn-primary btn-block">