diff --git a/coffee/chosen.jquery.coffee b/coffee/chosen.jquery.coffee
index 004e0441d6d..83336af4716 100644
--- a/coffee/chosen.jquery.coffee
+++ b/coffee/chosen.jquery.coffee
@@ -43,7 +43,7 @@ class Chosen extends AbstractChosen
if @is_multiple
@container.html '
'
else
- @container.html '' + @default_text + '
'
+ @container.html '' + this.escape_html(@default_text) + '
'
@form_field_jq.hide().after @container
@dropdown = @container.find('div.chosen-drop').first()
@@ -403,7 +403,10 @@ class Chosen extends AbstractChosen
@selected_item.addClass("chosen-single-with-deselect")
get_search_text: ->
- $('').text($.trim(@search_field.val())).html()
+ this.escape_html $.trim(@search_field.val())
+
+ escape_html: (text) ->
+ $('').text(text).html()
winnow_results_set_highlight: ->
selected_results = if not @is_multiple then @search_results.find(".result-selected.active-result") else []
diff --git a/coffee/chosen.proto.coffee b/coffee/chosen.proto.coffee
index e5b1185d674..f15030e4465 100644
--- a/coffee/chosen.proto.coffee
+++ b/coffee/chosen.proto.coffee
@@ -393,7 +393,10 @@ class @Chosen extends AbstractChosen
@selected_item.addClassName("chosen-single-with-deselect")
get_search_text: ->
- @search_field.value.strip().escapeHTML()
+ this.escape_html @search_field.value.strip()
+
+ escape_html: (text) ->
+ text.escapeHTML()
winnow_results_set_highlight: ->
if not @is_multiple
diff --git a/coffee/lib/abstract-chosen.coffee b/coffee/lib/abstract-chosen.coffee
index 6b1c3d51eb0..7b215e1c62e 100644
--- a/coffee/lib/abstract-chosen.coffee
+++ b/coffee/lib/abstract-chosen.coffee
@@ -45,6 +45,8 @@ class AbstractChosen
else
@default_text = @options.placeholder_text_single || @options.placeholder_text || AbstractChosen.default_single_text
+ @default_text = this.escape_html(@default_text)
+
@results_none_found = @form_field.getAttribute("data-no_results_text") || @options.no_results_text || AbstractChosen.default_no_result_text
choice_label: (item) ->