diff --git a/lib/galaxy/webapps/community/controllers/repository.py b/lib/galaxy/webapps/community/controllers/repository.py
index 383ae3d4ea8..227c77ebad2 100644
--- a/lib/galaxy/webapps/community/controllers/repository.py
+++ b/lib/galaxy/webapps/community/controllers/repository.py
@@ -20,6 +20,8 @@ from common import *
 from galaxy import eggs
 eggs.require('mercurial')
 from mercurial import hg, ui, patch, commands
+eggs.require('markupsafe')
+from markupsafe import escape as escape_html
 
 log = logging.getLogger( __name__ )
 
@@ -105,7 +107,7 @@ class ValidCategoryGrid( CategoryGrid ):
 class RepositoryGrid( grids.Grid ):
     class NameColumn( grids.TextColumn ):
         def get_value( self, trans, grid, repository ):
-            return repository.name
+            return escape_html( repository.name )
     class MetadataRevisionColumn( grids.GridColumn ):
         def __init__( self, col_name ):
             grids.GridColumn.__init__( self, col_name )
@@ -137,10 +139,10 @@ class RepositoryGrid( grids.Grid ):
             grids.GridColumn.__init__( self, col_name )
         def get_value( self, trans, grid, repository ):
             """Display the repository tip revision label."""
-            return repository.revision
+            return escape_html( repository.revision )
     class DescriptionColumn( grids.TextColumn ):
         def get_value( self, trans, grid, repository ):
-            return repository.description
+            return escape_html( repository.description )
     class CategoryColumn( grids.TextColumn ):
         def get_value( self, trans, grid, repository ):
             rval = '<ul>'
@@ -161,7 +163,7 @@ class RepositoryGrid( grids.Grid ):
     class UserColumn( grids.TextColumn ):
         def get_value( self, trans, grid, repository ):
             if repository.user:
-                return repository.user.username
+                return escape_html( repository.user.username )
             return 'no user'
     class EmailColumn( grids.TextColumn ):
         def filter( self, trans, user, query, column_filter ):
diff --git a/templates/webapps/community/common/common.mako b/templates/webapps/community/common/common.mako
index 3bc4a211763..5deee082607 100644
--- a/templates/webapps/community/common/common.mako
+++ b/templates/webapps/community/common/common.mako
@@ -1,5 +1,7 @@
 <%def name="escape_html_add_breaks( value )">
     <%
+        from galaxy import eggs
+        eggs.require('markupsafe')
         import markupsafe
         value = str( markupsafe.escape( value ) ).replace( '\n', '<br/>' )
     %>
diff --git a/test/base/twilltestcase.py b/test/base/twilltestcase.py
index 57f67a30104..67d8bdd717a 100644
--- a/test/base/twilltestcase.py
+++ b/test/base/twilltestcase.py
@@ -746,9 +746,9 @@ class TwillTestCase( unittest.TestCase ):
         temp_local = tempfile.NamedTemporaryFile( suffix='.sam', prefix='local_bam_converted_to_sam_' )
         fd, temp_temp = tempfile.mkstemp( suffix='.sam', prefix='history_bam_converted_to_sam_' )
         os.close( fd )
-        p = subprocess.Popen( args="samtools view -h %s -o %s" % ( local_name, temp_local.name ), shell=True )
+        p = subprocess.Popen( args='samtools view -h -o "%s" "%s"' % ( temp_local.name, local_name  ), shell=True )
         assert not p.wait(), 'Converting local (test-data) bam to sam failed'
-        p = subprocess.Popen( args="samtools view -h %s -o %s" % ( temp_name, temp_temp ), shell=True )
+        p = subprocess.Popen( args='samtools view -h -o "%s" "%s"' % ( temp_temp, temp_name  ), shell=True )
         assert not p.wait(), 'Converting history bam to sam failed'
         os.remove( temp_name )
         return temp_local, temp_temp