diff --git a/data/web/mobileconfig.php b/data/web/mobileconfig.php
index 7c0ead7f5..2765d14f2 100644
--- a/data/web/mobileconfig.php
+++ b/data/web/mobileconfig.php
@@ -52,7 +52,7 @@ if (isset($_GET['app_password'])) {
   else
       $platform = $_SERVER['HTTP_USER_AGENT'];
 
-  $password = password_generate();
+  $password = htmlspecialchars(password_generate(), ENT_NOQUOTES);
 
   $attr = array(
       'app_name' => $platform,