diff --git a/.gitignore b/.gitignore
index 3d5163b..22e3ec9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /vendor/
 .env
+.idea/
diff --git a/public/file-repository.php b/public/file-repository.php
index fb09898..7ebc769 100644
--- a/public/file-repository.php
+++ b/public/file-repository.php
@@ -38,6 +38,10 @@ try {
         $storagePath = $_ENV['FILE_STORAGE_PATH'];
     }
 
+    array_walk_recursive($_GET, function (&$input) {
+        $input = htmlspecialchars($input, ENT_NOQUOTES, 'UTF-8', false);
+    });
+
     $badgeLabel = $_GET['label'] ?? 'Profile views';
     $badgeMessageBackgroundFill = $_GET['color'] ?? 'blue';
     $badgeStyle = $_GET['style'] ?? 'flat';
diff --git a/public/pdo-repository.php b/public/pdo-repository.php
index 895c0de..4d22555 100644
--- a/public/pdo-repository.php
+++ b/public/pdo-repository.php
@@ -42,6 +42,10 @@ try {
 
     $httpUserAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
 
+    array_walk_recursive($_GET, function (&$input) {
+        $input = htmlspecialchars($input, ENT_NOQUOTES, 'UTF-8', false);
+    });
+
     $badgeLabel = $_GET['label'] ?? 'Profile views';
     $badgeMessageBackgroundFill = $_GET['color'] ?? 'blue';
     $badgeStyle = $_GET['style'] ?? 'flat';