diff --git a/source/src/main/webapp/js/pages/CampaignList.js b/source/src/main/webapp/js/pages/CampaignList.js
index 327aab254..58fb0a3fc 100644
--- a/source/src/main/webapp/js/pages/CampaignList.js
+++ b/source/src/main/webapp/js/pages/CampaignList.js
@@ -156,19 +156,19 @@ function aoColumnsFunc(tableId) {
             "mRender": function (data, type, obj) {
                 var hasPermissions = $("#" + tableId).attr("hasPermissions");
 
-                var editTestcampaign = '<button id="editTestcampaign" onclick="editEntryClick(\'' + obj["campaign"] + '\');"\n\
+                var editTestcampaign = '<button id="editTestcampaign" onclick="editEntryClick(\'' + escapeHtml(obj["campaign"]) + '\');"\n\
                                         class="editCampaign btn btn-default btn-xs margin-right5" \n\
                                         name="editTestcampaign" title="' + doc.getDocLabel("page_testcampaign", "button_edit") + '" type="button">\n\
                                         <span class="glyphicon glyphicon-pencil"></span></button>';
-                var removeTestcampaign = '<button id="removeTestcampaign" onclick="removeEntryClick(\'' + obj["campaign"] + '\');"\n\
+                var removeTestcampaign = '<button id="removeTestcampaign" onclick="removeEntryClick(\'' + escapeHtml(obj["campaign"]) + '\');"\n\
                                         class="removeTestcampaign btn btn-default btn-xs margin-right25" \n\
                                         name="removeTestcampaign" title="' + doc.getDocLabel("page_testcampaign", "button_remove") + '" type="button">\n\
                                         <span class="glyphicon glyphicon-trash"></span></button>';
-                var viewTestcampaign = '<button id="viewTestcampaign" onclick="viewEntryClick(\'' + obj["campaign"] + '\');"\n\
+                var viewTestcampaign = '<button id="viewTestcampaign" onclick="viewEntryClick(\'' + escapeHtml(obj["campaign"]) + '\');"\n\
                                         class="viewTestcampaign btn btn-default btn-xs margin-right5" \n\
                                         name="viewTestcampaign" title="' + doc.getDocLabel("page_testcampaign", "button_testcaselist") + '" type="button">\n\
                                         <span class="glyphicon glyphicon-list"></span></button>';
-                var viewStatcampaign = '<button id="viewStatcampaign" onclick="viewStatEntryClick(\'' + obj["campaign"] + '\');"\n\
+                var viewStatcampaign = '<button id="viewStatcampaign" onclick="viewStatEntryClick(\'' + escapeHtml(obj["campaign"]) + '\');"\n\
                                         class="viewStatcampaign btn btn-default btn-xs margin-right5" \n\
                                         name="viewStatcampaign" title="' + doc.getDocLabel("page_testcampaign", "button_taglist") + '" type="button">\n\
                                         <span class="glyphicon glyphicon-stats"></span></button>';
diff --git a/source/src/main/webapp/js/pages/Homepage.js b/source/src/main/webapp/js/pages/Homepage.js
index a6941c2d3..ba201bb6d 100644
--- a/source/src/main/webapp/js/pages/Homepage.js
+++ b/source/src/main/webapp/js/pages/Homepage.js
@@ -730,7 +730,7 @@ function loadLastTagResultList() {
         for (var index = 0; index < tagList.length; index++) {
             let tagName = tagList[index];
             //TODO find a way to remove the use for resendTag
-            var requestToServlet = "ReadTestCaseExecutionByTag?Tag=" + tagName + "&" + "outputReport=totalStatsCharts" + "&" + "outputReport=resendTag" + "&" + "sEcho=" + index;
+            var requestToServlet = "ReadTestCaseExecutionByTag?Tag=" + encodeURIComponent(tagName) + "&" + "outputReport=totalStatsCharts" + "&" + "outputReport=resendTag" + "&" + "sEcho=" + index;
             var jqxhr = $.get(requestToServlet, null, "json");
 
             $.when(jqxhr).then(function (data) {
diff --git a/source/src/main/webapp/js/pages/ReportingExecutionByTag.js b/source/src/main/webapp/js/pages/ReportingExecutionByTag.js
index acf5b34dc..251de04f2 100644
--- a/source/src/main/webapp/js/pages/ReportingExecutionByTag.js
+++ b/source/src/main/webapp/js/pages/ReportingExecutionByTag.js
@@ -368,7 +368,7 @@ function loadReportingData(selectTag) {
         fullL = "fullList=" + !isRefreshAutoHide;
     }
 
-    var param = "?Tag=" + selectTag + "&" + statusFilter.serialize() + "&" + countryFilter.serialize() + "&" + params.serialize() + "&" + paramsLabel.serialize() + fullL;
+    var param = "?Tag=" + encodeURIComponent(selectTag) + "&" + statusFilter.serialize() + "&" + countryFilter.serialize() + "&" + params.serialize() + "&" + paramsLabel.serialize() + fullL;
 
     //Retrieve data for charts and draw them
     var jqxhr = $.get("ReadTestCaseExecutionByTag" + param, null, "json");
@@ -735,7 +735,7 @@ function filterCountryBrowserReport(selectTag, splitFilterSettings) {
     var statusFilter = $("#statusFilter input");
     var countryFilter = $("#countryFilter input");
     var params = $("#splitFilter input");
-    var requestToServlet = "ReadTestCaseExecutionByTag?Tag=" + selectTag + "&" + statusFilter.serialize() + "&" + countryFilter.serialize() + "&" + params.serialize() + "&" + "outputReport=statsChart";
+    var requestToServlet = "ReadTestCaseExecutionByTag?Tag=" + encodeURIComponent(selectTag) + "&" + statusFilter.serialize() + "&" + countryFilter.serialize() + "&" + params.serialize() + "&" + "outputReport=statsChart";
     var jqxhr = $.get(requestToServlet, null, "json");
 
     $.when(jqxhr).then(function (data) {
@@ -749,7 +749,7 @@ function filterLabelReport(selectTag) {
     var statusFilter = $("#statusFilter input");
     var countryFilter = $("#countryFilter input");
     var params = $("#splitLabelFilter input");
-    var requestToServlet = "ReadTestCaseExecutionByTag?Tag=" + selectTag + "&" + statusFilter.serialize() + "&" + countryFilter.serialize() + "&" + params.serialize() + "&" + "outputReport=labelStat";
+    var requestToServlet = "ReadTestCaseExecutionByTag?Tag=" + encodeURIComponent(selectTag) + "&" + statusFilter.serialize() + "&" + countryFilter.serialize() + "&" + params.serialize() + "&" + "outputReport=labelStat";
     var jqxhr = $.get(requestToServlet, null, "json");
 
     $.when(jqxhr).then(function (data) {
diff --git a/source/src/main/webapp/js/pages/RunTest.js b/source/src/main/webapp/js/pages/RunTest.js
index 3258eb646..5ddc09983 100644
--- a/source/src/main/webapp/js/pages/RunTest.js
+++ b/source/src/main/webapp/js/pages/RunTest.js
@@ -656,7 +656,7 @@ function handleAddToQueueResponse(data, doRedirect) {
         data.message = data.message + "<br><a href='TestCaseExecution.jsp?executionQueueId=" + data.queueList[0].queueId + "'><button class='btn btn-primary' id='goToExecution'>Open Execution</button></a>";
     }
     if (data.nbExe > 1) {
-        data.message = data.message + "<br><a href='ReportingExecutionByTag.jsp?Tag=" + data.tag + "'><button class='btn btn-primary' id='goToTagReport'>Report by Tag</button></a>"
+        data.message = data.message + "<br><a href='ReportingExecutionByTag.jsp?Tag=" + encodeURIComponent(data.tag) + "'><button class='btn btn-primary' id='goToTagReport'>Report by Tag</button></a>"
     }
     var rc = getAlertType(data.messageType);
     if ((rc === "success") && (data.nbExe === 0)) {
@@ -667,7 +667,7 @@ function handleAddToQueueResponse(data, doRedirect) {
         window.location.href = "TestCaseExecution.jsp?executionQueueId=" + data.queueList[0].queueId;
     }
     if ((data.nbExe > 1) && doRedirect) {
-        window.location.href = "ReportingExecutionByTag.jsp?Tag=" + data.tag;
+        window.location.href = "ReportingExecutionByTag.jsp?Tag=" + encodeURIComponent(data.tag);
     }
 }
 
diff --git a/source/src/main/webapp/js/pages/TestCaseExecutionList.js b/source/src/main/webapp/js/pages/TestCaseExecutionList.js
index a1d8edb7d..84c02c415 100644
--- a/source/src/main/webapp/js/pages/TestCaseExecutionList.js
+++ b/source/src/main/webapp/js/pages/TestCaseExecutionList.js
@@ -129,7 +129,7 @@ function aoColumnsFunc() {
                                     <span class="glyphicon glyphicon-filter"></span>\n\
                                     </a>';
                 var tag = '<a id="tagExec' + (obj["id"]) + '" class="btn btn-primary btn-xs marginRight5"\n\
-                                    data-toggle="tooltip" title="' + doc.getDocLabel("page_executiondetail", "see_execution_tag") + '" href="./ReportingExecutionByTag.jsp?Tag=' + obj["tag"] + '">\n\
+                                    data-toggle="tooltip" title="' + doc.getDocLabel("page_executiondetail", "see_execution_tag") + '" href="./ReportingExecutionByTag.jsp?Tag=' + encodeURIComponent(obj["tag"]) + '">\n\
                                     <span class="glyphicon glyphicon-tag"></span>\n\
                                     </a>';
 
diff --git a/source/src/main/webapp/js/pages/TestCaseExecutionQueueList.js b/source/src/main/webapp/js/pages/TestCaseExecutionQueueList.js
index b99d7c9f9..9de92c501 100644
--- a/source/src/main/webapp/js/pages/TestCaseExecutionQueueList.js
+++ b/source/src/main/webapp/js/pages/TestCaseExecutionQueueList.js
@@ -586,7 +586,7 @@ function aoColumnsFunc(tableId) {
                 if (isEmpty(obj["tag"])) {
                     return "";
                 } else {
-                    return '<a href="ReportingExecutionByTag.jsp?Tag=' + obj["tag"] + '">' + obj["tag"] + '</a>';
+                    return '<a href="ReportingExecutionByTag.jsp?Tag=' + encodeURIComponent(obj["tag"]) + '">' + obj["tag"] + '</a>';
                 }
             }
         },
diff --git a/source/src/main/webapp/js/transversalobject/Campaign.js b/source/src/main/webapp/js/transversalobject/Campaign.js
index 735ef40c2..a3a26f328 100644
--- a/source/src/main/webapp/js/transversalobject/Campaign.js
+++ b/source/src/main/webapp/js/transversalobject/Campaign.js
@@ -219,7 +219,7 @@ function viewEntryClick(param) {
     showLoader("#testcampaignList");
 
 
-    var jqxhr = $.getJSON("ReadCampaign?testcases=true&", "campaign=" + param);
+    var jqxhr = $.getJSON("ReadCampaign?testcases=true&", "campaign=" + encodeURIComponent(param));
     $.when(jqxhr).then(function (data) {
         var obj = data["contentTable"];
 
@@ -264,7 +264,7 @@ function viewStatEntryClick(param) {
     showLoader("#testcampaignList");
 
 
-    var jqxhr = $.getJSON("ReadCampaign?tags=true&", "campaign=" + param);
+    var jqxhr = $.getJSON("ReadCampaign?tags=true&", "campaign=" + encodeURIComponent(param));
     $.when(jqxhr).then(function (data) {
         var obj = data["contentTable"];
 
@@ -329,7 +329,7 @@ function editEntryClick(param) {
 
     showLoader("#testcampaignList");
 
-    var jqxhr = $.getJSON("ReadCampaign?parameters=true&labels=true&eventHooks=true&scheduledEntries=true", "campaign=" + param);
+    var jqxhr = $.getJSON("ReadCampaign?parameters=true&labels=true&eventHooks=true&scheduledEntries=true", "campaign=" + encodeURIComponent(param));
     $.when(jqxhr).then(function (data) {
         var obj = data["contentTable"];
         var parameters = [];
diff --git a/source/src/main/webapp/js/transversalobject/TestCaseSimpleExecution.js b/source/src/main/webapp/js/transversalobject/TestCaseSimpleExecution.js
index 44601f952..0e2fb1a73 100644
--- a/source/src/main/webapp/js/transversalobject/TestCaseSimpleExecution.js
+++ b/source/src/main/webapp/js/transversalobject/TestCaseSimpleExecution.js
@@ -226,7 +226,7 @@ function handleAddToQueueResponse(data, doRedirect) {
         data.message = data.message + "<br><a href='TestCaseExecution.jsp?executionQueueId=" + data.queueList[0].queueId + "'><button class='btn btn-primary' id='goToExecution'>Open Execution</button></a>";
     }
     if (data.nbExe > 1) {
-        data.message = data.message + "<br><a href='ReportingExecutionByTag.jsp?Tag=" + data.tag + "'><button class='btn btn-primary' id='goToTagReport'>Report by Tag</button></a>"
+        data.message = data.message + "<br><a href='ReportingExecutionByTag.jsp?Tag=" + encodeURIComponent(data.tag) + "'><button class='btn btn-primary' id='goToTagReport'>Report by Tag</button></a>"
     }
 
     if ((data.nbExe === 1) && doRedirect) {