diff --git a/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties
index 864ae5afb..877a3774c 100644
--- a/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties
+++ b/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties
@@ -31,7 +31,7 @@ xxe.blind.output=Contents of the file is: {0}
 xxe.hints.simple.xxe.1=Try submitting the form and see what happens
 xxe.hints.simple.xxe.2=XXE stands for XML External Entity attack
 xxe.hints.simple.xxe.3=Try to include your own DTD
-xxe.hints.simple.xxe.4=Try to include a doctype (<!DOCTYPE...) in the xml
+xxe.hints.simple.xxe.4=Try to include a doctype "(&lt;!DOCTYPE...)" in the xml
 
 xxe.hints.content.type.xxe.1=Take a look at the content type
 xxe.hints.content.type.xxe.2=Does the endpoint only accept json messages?
\ No newline at end of file