diff --git a/resources/views/admin/users.blade.php b/resources/views/admin/users.blade.php
index 841a2cc..84a59d2 100644
--- a/resources/views/admin/users.blade.php
+++ b/resources/views/admin/users.blade.php
@@ -240,6 +240,10 @@
         const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
         let usersData = [];
 
+        function esc(s) {
+            return String(s).replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+        }
+
         document.addEventListener('DOMContentLoaded', loadUsers);
 
         async function loadUsers() {
@@ -285,11 +289,11 @@
             tbody.innerHTML = usersData.length ? usersData.map((u, i) => `
                 <tr>
                     <td class="text-xs font-bold opacity-30">${i + 1}</td>
-                    <td><div class="font-bold">${u.name}</div></td>
-                    <td class="text-sm opacity-70">${u.email}</td>
+                    <td><div class="font-bold">${esc(u.name)}</div></td>
+                    <td class="text-sm opacity-70">${esc(u.email)}</td>
                     <td>
                         <span class="badge badge-sm ${roleBadge[u.role] || 'badge-neutral'} badge-outline capitalize">
-                            ${roleLabels[u.role] || u.role}
+                            ${esc(roleLabels[u.role] || u.role)}
                         </span>
                     </td>
                     <td class="text-center">