diff --git a/config.js b/config.js
index 30e2835..485ddf8 100644
--- a/config.js
+++ b/config.js
@@ -15,6 +15,11 @@ function tabulate(list) {
 }
 
 
+String.prototype.escapeHtml = function () {
+  return this.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+}
+
+
 function template(tmpl, data) {
   var brag = tmpl.replace(/\$([_A-Za-z.]+)/g, function (str, p1) {
     var dict = data;
@@ -24,6 +29,8 @@ function template(tmpl, data) {
         dict = tabulate(dict);
       } else {
         dict = dict[v.replace("_"," ")];
+        if (typeof dict == typeof "")
+          dict = dict.escapeHtml();
       }
       return null;
     });
diff --git a/main.js b/main.js
index cf11fc2..87ad0ec 100644
--- a/main.js
+++ b/main.js
@@ -974,7 +974,7 @@ function quit() {
 
 function LoadCharacter() {
   var result = true;
-  var name = window.location.href.split('#')[1];
+  var name = unescape(window.location.href.split('#')[1]);
   var sheet = loadSheet(name);
 
   if (!sheet) {
diff --git a/newguy.js b/newguy.js
index c4338a0..aeb80ef 100644
--- a/newguy.js
+++ b/newguy.js
@@ -207,7 +207,7 @@ function sold() {
 
   addToRoster(newguy);
 
-  window.location.href = "main.html#" + newguy.Traits.Name;
+  window.location.href = "main.html#" + escape(newguy.Traits.Name);
 }
 
 function cancel() {
diff --git a/roster.js b/roster.js
index 9db41b1..d488484 100644
--- a/roster.js
+++ b/roster.js
@@ -18,7 +18,7 @@ function load() {
     
     var br = brag(c);
     roster.append(br);
-    br.find("a.go").attr("href", "main.html#" + name);
+    br.find("a.go").attr("href", "main.html#" + escape(name));
     
     br.find("a.x").click(function () {
       if (confirm("Terminate " + Pick(["faithful","noble","loyal","brave"])+