diff --git a/CHANGELOG b/CHANGELOG
index ff42524f63..f943e041f8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Escape external string (issue9394)
 * Keep context in sessionStorage
 * Use existing context for get_preferences
 * Escape external strings (issue9351)
diff --git a/src/board.js b/src/board.js
index 3ffe6a965e..532312f2f9 100644
--- a/src/board.js
+++ b/src/board.js
@@ -137,9 +137,9 @@
                         params);
 
                 if (attributes.string) {
-                    this.title.html(attributes.string);
+                    this.title.text(attributes.string);
                 } else {
-                    this.title.html(this.action.name);
+                    this.title.text(this.action.name);
                 }
                 this.screen.switch_view().done(function() {
                     this.body.append(this.screen.screen_container.el);
diff --git a/src/tab.js b/src/tab.js
index 96a15dde2f..b4b6030033 100644
--- a/src/tab.js
+++ b/src/tab.js
@@ -406,7 +406,7 @@
             role: 'tabpanel',
             'class': 'tab-pane',
             id: tab.id
-        }).html(tab.el)
+        }).append(tab.el)
         .appendTo(tabcontent);
         tab_link.tab('show');
         tabs.trigger('ready');
@@ -1358,7 +1358,7 @@
             }.bind(this));
             this.create_tabcontent();
             this.set_name(this.name);
-            this.title.html(this.name_el.text());
+            this.title.text(this.name_el.text());
         },
         compare: function(attributes) {
             if (!attributes) {
@@ -1398,7 +1398,7 @@
             this.set_name(wizard.name);
             wizard.tab = this;
             this.create_tabcontent();
-            this.title.html(this.name_el.text());
+            this.title.text(this.name_el.text());
             this.el.append(wizard.form);
         },
         create_toolbar: function() {
diff --git a/src/view/form.js b/src/view/form.js
index 20bd587b35..20f453b641 100644
--- a/src/view/form.js
+++ b/src/view/form.js
@@ -780,7 +780,7 @@ function eval_pyson(value){
                 .append(img)
                 .text(text))
                 .appendTo(this.nav);
-            pane.html(tab).appendTo(this.panes);
+            pane.append(tab).appendTo(this.panes);
             if (!this.selected) {
                 // Can not use .tab('show')
                 page.addClass('active');
diff --git a/src/view/tree.js b/src/view/tree.js
index 6ad23d146e..995221c448 100644
--- a/src/view/tree.js
+++ b/src/view/tree.js
@@ -1337,7 +1337,7 @@
                             if (item.length) {
                                 prefix.render(this.record, item);
                             } else {
-                                prefix_el.html(prefix.render(this.record));
+                                prefix_el.empty().append(prefix.render(this.record));
                             }
                         }
                     }
@@ -1346,7 +1346,7 @@
                     if (item.length) {
                         column.render(this.record, item);
                     } else {
-                        widget.html(column.render(this.record));
+                        widget.empty().append(column.render(this.record));
                     }
                     if (column.suffixes) {
                         for (var k = 0; k < column.suffixes.length; k++) {
@@ -1356,7 +1356,7 @@
                             if (item.length) {
                                 suffix.render(this.record, item);
                             } else {
-                                suffix_el.html(suffix.render(this.record));
+                                suffix_el.empty().append(suffix.render(this.record));
                             }
                         }
                     }
@@ -1693,7 +1693,7 @@
             this.tree.columns.forEach(function(col, idx) {
                 var td = this._get_column_td(idx);
                 var static_el = this.get_static_el(td);
-                static_el.html(col.render(this.record)).show();
+                static_el.empty().append(col.render(this.record)).show();
                 this.get_editable_el(td)
                     .empty()
                     .data('widget', null)
diff --git a/src/window.js b/src/window.js
index c27a2f2a64..4a832ce25e 100644
--- a/src/window.js
+++ b/src/window.js
@@ -1092,7 +1092,7 @@
             for(var i=0; i<this.encodings.length; i++) {
                 jQuery('<option/>', {
                     'val': this.encodings[i]
-                }).html(this.encodings[i]).appendTo(this.el_csv_encoding);
+                }).append(this.encodings[i]).appendTo(this.el_csv_encoding);
             }
 
             var enc = 'utf-8';
@@ -1194,7 +1194,7 @@
             var field = el_field.attr('field');
             var node = jQuery('<li/>', {
                 'field': field,
-            }).html(el_field.attr('name')).click(function(e) {
+            }).text(el_field.attr('name')).click(function(e) {
                 if (e.ctrlKey) {
                     node.toggleClass('bg-primary');
                 } else {
@@ -1218,7 +1218,7 @@
                 var node = jQuery('<li/>', {
                     'field': parent_node[field].field,
                     'name': parent_node[field].name
-                }).html(name).click(function(e) {
+                }).text(name).click(function(e) {
                     if(e.ctrlKey) {
                         node.toggleClass('bg-primary');
                     } else {
@@ -1342,7 +1342,7 @@
             }
             var node = jQuery('<li/>', {
                 'field': field
-            }).html(name).click(function(){
+            }).text(name).click(function(){
                 node.addClass('bg-primary')
                     .siblings().removeClass('bg-primary');
             }).appendTo(this.fields_selected);
@@ -1484,10 +1484,10 @@
                 'id': 'input-records',
             }).append(jQuery('<option/>', {
                 'val': true,
-            }).html(Sao.i18n.gettext("Selected Records")))
+            }).text(Sao.i18n.gettext("Selected Records")))
                 .append(jQuery('<option/>', {
                     'val': false,
-                }).html(Sao.i18n.gettext("Listed Records")));
+                }).text(Sao.i18n.gettext("Listed Records")));
 
             this.ignore_search_limit = jQuery('<input/>', {
                 'type': 'checkbox',
@@ -1560,7 +1560,7 @@
                 var path = parent_node[name].path;
                 var node = jQuery('<li/>', {
                     'path': path
-                }).html(parent_node[name].string).click(function(e) {
+                }).text(parent_node[name].string).click(function(e) {
                     if(e.ctrlKey) {
                         node.toggleClass('bg-primary');
                     } else {
@@ -1811,7 +1811,7 @@
             }
             var node = jQuery('<li/>', {
                 'path': name,
-            }).html(long_string).click(function(e) {
+            }).text(long_string).click(function(e) {
                 if(e.ctrlKey) {
                     node.toggleClass('bg-primary');
                 } else {