diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java b/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
index ae3eaa8c9..daf2e922d 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/service/SourceService.java
@@ -30,9 +30,7 @@
  */
 package org.owasp.webgoat.service;
 
-import javax.servlet.http.HttpSession;
-import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
-import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.owasp.webgoat.lessons.AbstractLesson;
 import org.owasp.webgoat.session.Course;
 import org.owasp.webgoat.session.WebSession;
@@ -40,6 +38,11 @@ import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 
+import javax.servlet.http.HttpSession;
+
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+
 /**
  *
  * @author rlawson
@@ -61,10 +64,7 @@ public class SourceService extends BaseService {
         if (source == null) {
             source = "No source listing found";
         }
-        return source;
-        //SourceListing sl = new SourceListing();
-        //sl.setSource(source);
-        //return sl;
+        return StringEscapeUtils.escapeHtml4(source);
     }
 
     /**