diff --git a/login.go b/login.go
index 8329600..a93df7c 100644
--- a/login.go
+++ b/login.go
@@ -2,9 +2,11 @@ package main
 
 import (
 	"fmt"
+	"html"
 	"html/template"
 	"log"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"github.com/go-ldap/ldap/v3"
@@ -55,16 +57,23 @@ func tryLogin(w http.ResponseWriter, r *http.Request) {
 		cnt := "<ul>"
 		for _, e := range entries {
 			for i, v := range e.Values {
+				safeName := html.EscapeString(e.Name)
+				safeVal := html.EscapeString(v)
+				elemID := fmt.Sprintf("mailAlias-%d", i)
 				if e.Name == "userPassword" || e.Name == "krbPrincipalKey" {
-					cnt += "<li><strong>" + e.Name + ":</strong> <em>[...]</em></li>"
+					cnt += "<li><strong>" + safeName + ":</strong> <em>[...]</em></li>"
 				} else if e.Name == "mailAlias" && len(strings.SplitN(v, "@", 2)[0]) == 10 {
-					cnt += "<li id='" + fmt.Sprintf("mailAlias-%d", i) + "'><strong>" + e.Name + ":</strong> " + v + `<button type="button" class="mx-1 btn btn-sm btn-danger" onclick="fetch('/api/v1/aliases/` + v + `', {'method': 'delete', 'headers': {'Authorization': 'Bearer ` + apiToken + `'}}).then((res) => { if (res.ok) document.getElementById('` + fmt.Sprintf("mailAlias-%d", i) + `').remove(); });">Supprimer</a></li>`
+					safeURL := url.PathEscape(v)
+					safeToken := html.EscapeString(apiToken)
+					safeElemID := html.EscapeString(elemID)
+					cnt += `<li id="` + safeElemID + `"><strong>` + safeName + `:</strong> ` + safeVal +
+						`<button type="button" class="mx-1 btn btn-sm btn-danger" data-alias="` + safeURL + `" data-token="` + safeToken + `" data-elem="` + safeElemID + `" onclick="(function(b){fetch('/api/v1/aliases/'+b.dataset.alias,{'method':'delete','headers':{'Authorization':'Bearer '+b.dataset.token}}).then(function(r){if(r.ok)document.getElementById(b.dataset.elem).remove();})})(this)">Supprimer</button></li>`
 				} else {
-					cnt += "<li><strong>" + e.Name + ":</strong> " + v + "</li>"
+					cnt += "<li><strong>" + safeName + ":</strong> " + safeVal + "</li>"
 				}
 			}
 		}
-		displayTmpl(w, "message.html", map[string]interface{}{"details": template.HTML(`Login ok<br><br>Here are the information we have about you:` + cnt + "</ul><p>To use our Addy.io compatible API, use the following token: <code>" + apiToken + "</code></p>")})
+		displayTmpl(w, "message.html", map[string]interface{}{"details": template.HTML(`Login ok<br><br>Here are the information we have about you:` + cnt + "</ul><p>To use our Addy.io compatible API, use the following token: <code>" + html.EscapeString(apiToken) + "</code></p>")})
 	}
 }