diff --git a/lib/galaxy/jobs/actions/post.py b/lib/galaxy/jobs/actions/post.py
index eff28baf095..da867d47aa6 100644
--- a/lib/galaxy/jobs/actions/post.py
+++ b/lib/galaxy/jobs/actions/post.py
@@ -8,6 +8,9 @@ import logging
 import socket
 from galaxy.util import send_mail
 from galaxy.util.json import dumps
+from galaxy import eggs
+eggs.require( "MarkupSafe" )
+from markupsafe import escape
 
 log = logging.getLogger( __name__ )
 
@@ -50,7 +53,7 @@ class DefaultJobAction(object):
     @classmethod
     def get_short_str(cls, pja):
         if pja.action_arguments:
-            return "%s -> %s" % (pja.action_type, pja.action_arguments)
+            return "%s -> %s" % (pja.action_type, escape(pja.action_arguments))
         else:
             return "%s" % pja.action_type
 
@@ -91,7 +94,7 @@ class EmailAction(DefaultJobAction):
     @classmethod
     def get_short_str(cls, pja):
         if pja.action_arguments and 'host' in pja.action_arguments:
-            return "Email the current user from server %s when this job is complete." % pja.action_arguments['host']
+            return "Email the current user from server %s when this job is complete." % escape(pja.action_arguments['host'])
         else:
             return "Email the current user when this job is complete."
 
@@ -127,7 +130,8 @@ class ChangeDatatypeAction(DefaultJobAction):
 
     @classmethod
     def get_short_str(cls, pja):
-        return "Set the datatype of output '%s' to '%s'" % (pja.output_name, pja.action_arguments['newtype'])
+        return "Set the datatype of output '%s' to '%s'" % (escape(pja.output_name),
+                                                            escape(pja.action_arguments['newtype']))
 
 
 class RenameDatasetAction(DefaultJobAction):
@@ -235,7 +239,8 @@ class RenameDatasetAction(DefaultJobAction):
     def get_short_str(cls, pja):
         # Prevent renaming a dataset to the empty string.
         if pja.action_arguments and pja.action_arguments.get('newname', ''):
-            return "Rename output '%s' to '%s'." % (pja.output_name, pja.action_arguments['newname'])
+            return "Rename output '%s' to '%s'." % (escape(pja.output_name),
+                                                    escape(pja.action_arguments['newname']))
         else:
             return "Rename action used without a new name specified.  Output name will be unchanged."
 
@@ -260,7 +265,7 @@ class HideDatasetAction(DefaultJobAction):
 
     @classmethod
     def get_short_str(cls, pja):
-        return "Hide output '%s'." % pja.output_name
+        return "Hide output '%s'." % escape(pja.output_name)
 
 
 class DeleteDatasetAction(DefaultJobAction):
@@ -336,7 +341,7 @@ class ColumnSetAction(DefaultJobAction):
 
     @classmethod
     def get_short_str(cls, pja):
-        return "Set the following metadata values:<br/>" + "<br/>".join(['%s : %s' % (k, v) for k, v in pja.action_arguments.iteritems()])
+        return "Set the following metadata values:<br/>" + "<br/>".join(['%s : %s' % (escape(k), escape(v)) for k, v in pja.action_arguments.iteritems()])
 
 
 class SetMetadataAction(DefaultJobAction):
@@ -455,7 +460,8 @@ class TagDatasetAction(DefaultJobAction):
     @classmethod
     def get_short_str(cls, pja):
         if pja.action_arguments and pja.action_arguments.get('tags', ''):
-            return "Add tag(s) '%s' to '%s'." % (pja.action_arguments['tags'], pja.output_name)
+            return "Add tag(s) '%s' to '%s'." % (escape(pja.action_arguments['tags']),
+                                                 escape(pja.output_name))
         else:
             return "Tag addition action used without a tag specified.  No tag will be added."
 
diff --git a/templates/webapps/galaxy/workflow/run.mako b/templates/webapps/galaxy/workflow/run.mako
index 8d780be2f94..4e60faad487 100644
--- a/templates/webapps/galaxy/workflow/run.mako
+++ b/templates/webapps/galaxy/workflow/run.mako
@@ -583,9 +583,10 @@ if wf_parms:
                     <%
                     pja_ss_all = []
                     for pja_ss in [ActionBox.get_short_str(pja) for pja in step.post_job_actions]:
-                        pja_ss = h.escape( pja_ss )
                         for rematch in re.findall('\$\{.+?\}', pja_ss):
-                            pja_ss = pja_ss.replace(rematch, '<span style="background-color:%s" class="wfpspan wf_parm__%s pja_wfp">%s</span>' % (wf_parms[rematch[2:-1]], rematch[2:-1], rematch[2:-1]))
+                            pja_ss = pja_ss.replace(rematch, '<span style="background-color:%s" class="wfpspan wf_parm__%s pja_wfp">%s</span>' % (wf_parms[rematch[2:-1]],
+                                                                                                                                                  rematch[2:-1],
+                                                                                                                                                  rematch[2:-1]))
                         pja_ss_all.append(pja_ss)
                     %>
                     ${'<br/>'.join(pja_ss_all)}