diff --git a/kernel/model/blockinfo.go b/kernel/model/blockinfo.go
index 5b3ac3cc4..44c9111d4 100644
--- a/kernel/model/blockinfo.go
+++ b/kernel/model/blockinfo.go
@@ -366,6 +366,7 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
 			name = util.EscapeHTML(box.Name) + util.EscapeHTML(hPath)
 		} else if ast.NodeAttributeView == parent.Type {
 			name = treenode.GetAttributeViewName(parent.AttributeViewID)
+			name = util.EscapeHTML(name)
 		} else {
 			if "" == name {
 				if ast.NodeListItem == parent.Type {
@@ -373,6 +374,7 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
 				} else {
 					name = gulu.Str.SubStr(renderBlockText(parent, excludeTypes), maxNameLen)
 				}
+				name = util.EscapeHTML(name)
 			}
 			if ast.NodeHeading == parent.Type {
 				headingLevel = parent.HeadingLevel
@@ -389,6 +391,7 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
 		if ast.NodeListItem == parent.Type {
 			if "" == name {
 				name = gulu.Str.SubStr(renderBlockText(fc, excludeTypes), maxNameLen)
+				name = util.EscapeHTML(name)
 			}
 		}
 
diff --git a/kernel/util/misc.go b/kernel/util/misc.go
index b15015c95..6ef47299f 100644
--- a/kernel/util/misc.go
+++ b/kernel/util/misc.go
@@ -42,11 +42,26 @@ func RemoveElem[T any](s []T, index int) []T {
 	return append(s[:index], s[index+1:]...)
 }
 
-func EscapeHTML(s string) string {
-	if ContainsSubStr(s, []string{"&", "'", "<", ">", """, "
"}) {
-		return s
+func EscapeHTML(s string) (ret string) {
+	ret = s
+	if "" == strings.TrimSpace(ret) {
+		return
 	}
-	return html.EscapeString(s)
+
+	ret = strings.ReplaceAll(ret, "&", "__@amp__")
+	ret = strings.ReplaceAll(ret, "'", "__@39__")
+	ret = strings.ReplaceAll(ret, "<", "__@lt__")
+	ret = strings.ReplaceAll(ret, ">", "__@gt__")
+	ret = strings.ReplaceAll(ret, """, "__@34__")
+	ret = strings.ReplaceAll(ret, "
", "__@13__")
+	ret = html.EscapeString(ret)
+	ret = strings.ReplaceAll(ret, "__@amp__", "&")
+	ret = strings.ReplaceAll(ret, "__@39__", "'")
+	ret = strings.ReplaceAll(ret, "__@lt__", "<")
+	ret = strings.ReplaceAll(ret, "__@gt__", ">")
+	ret = strings.ReplaceAll(ret, "__@34__", """)
+	ret = strings.ReplaceAll(ret, "__@13__", "
")
+	return
 }
 
 func Reverse(s string) string {