diff --git a/public/app/features/templating/templateSrv.js b/public/app/features/templating/templateSrv.js
index 9a59510c6a4..267454dbecb 100644
--- a/public/app/features/templating/templateSrv.js
+++ b/public/app/features/templating/templateSrv.js
@@ -79,6 +79,7 @@ function (angular, _) {
     this.highlightVariablesAsHtml = function(str) {
       if (!str || !_.isString(str)) { return str; }
 
+      str = _.escape(str);
       this._regex.lastIndex = 0;
       return str.replace(this._regex, function(match, g1, g2) {
         if (self._values[g1 || g2]) {
diff --git a/public/app/panels/graph/legend.js b/public/app/panels/graph/legend.js
index 8604dff4f08..b3e1a998ccb 100644
--- a/public/app/panels/graph/legend.js
+++ b/public/app/panels/graph/legend.js
@@ -151,7 +151,7 @@ function (angular, _, $) {
             html += '</div>';
 
             html += '<div class="graph-legend-alias">';
-            html += '<a>' + series.label + '</a>';
+            html += '<a>' + _.escape(series.label) + '</a>';
             html += '</div>';
 
             if (panel.legend.values) {