diff --git a/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHandler.java b/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHandler.java
index 0c0c502829..5e34d72456 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHandler.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHandler.java
@@ -10,17 +10,13 @@ import net.i2p.util.Log;
 
 /**
  * Handler to deal with form submissions from the tunnel config form and act
- * upon the values.  Holy crap, this is UUUUGLY
+ * upon the values.
  *
  */
 public class ConfigTunnelsHandler extends FormHandler {
-    private Map _settings;
+
     private boolean _shouldSave;
     
-    public ConfigTunnelsHandler() {
-        _shouldSave = false;
-    }
-    
     @Override
     protected void processForm() {
         if (_shouldSave) {
@@ -35,8 +31,6 @@ public class ConfigTunnelsHandler extends FormHandler {
             _shouldSave = true; 
     }
     
-    public void setSettings(Map settings) { _settings = new HashMap(settings); }
-    
     /**
      * The user made changes to the network config and wants to save them, so
      * lets go ahead and do so.
@@ -143,6 +137,7 @@ public class ConfigTunnelsHandler extends FormHandler {
                 addFormError(_("Error saving the configuration (applied but not saved) - please see the error logs."));
         }
     }
+
     private static final int getInt(Object val) { 
         if (val == null) return 0;
         String str = null;
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHelper.java
index 5146d7b0d9..c5467242c3 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/ConfigTunnelsHelper.java
@@ -4,6 +4,7 @@ import java.util.Iterator;
 import java.util.Properties;
 import java.util.Set;
 
+import net.i2p.data.DataHelper;
 import net.i2p.data.Destination;
 import net.i2p.router.TunnelPoolSettings;
 
@@ -46,7 +47,7 @@ public class ConfigTunnelsHelper extends HelperBase {
                 name = dest.calculateHash().toBase64().substring(0,6);
         
             String prefix = dest.calculateHash().toBase64().substring(0,4);
-            renderForm(buf, cur, prefix, _("Client tunnels for {0}", _(name)), in, out);
+            renderForm(buf, cur, prefix, _("Client tunnels for {0}", DataHelper.escapeHTML(_(name))), in, out);
             cur++;
         }
         
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/SummaryHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/SummaryHelper.java
index e2f2ea0af1..c60ded0110 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/SummaryHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/SummaryHelper.java
@@ -433,9 +433,9 @@ public class SummaryHelper extends HelperBase {
                 buf.append("</td><td align=\"left\"><b><a href=\"tunnels#").append(h.toBase64().substring(0,4));
                 buf.append("\" target=\"_top\" title=\"").append(_("Show tunnels")).append("\">");
                 if (name.length() < 18)
-                    buf.append(name);
+                    buf.append(DataHelper.escapeHTML(name));
                 else
-                    buf.append(name.substring(0,15)).append("&hellip;");
+                    buf.append(DataHelper.escapeHTML(name.substring(0,15))).append("&hellip;");
                 buf.append("</a></b></td>\n");
                 LeaseSet ls = _context.netDb().lookupLeaseSetLocally(h);
                 if (ls != null && _context.tunnelManager().getOutboundClientTunnelCount(h) > 0) {
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/TunnelRenderer.java b/apps/routerconsole/java/src/net/i2p/router/web/TunnelRenderer.java
index b9f02e5dfb..1b2b7b2302 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/TunnelRenderer.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/TunnelRenderer.java
@@ -57,7 +57,7 @@ public class TunnelRenderer {
             if (name == null)
                 name = client.toBase64().substring(0,4);
             out.write("<h2><a name=\"" + client.toBase64().substring(0,4)
-                      + "\" ></a>" + _("Client tunnels for") + ' ' + _(name));
+                      + "\" ></a>" + _("Client tunnels for") + ' ' + DataHelper.escapeHTML(_(name)));
             if (isLocal)
                 out.write(" (<a href=\"/configtunnels#" + client.toBase64().substring(0,4) +"\">" + _("configure") + "</a>)</h2>\n");
             else