--- loncom/auth/lonroles.pm	2022/02/24 13:09:39	1.361
+++ loncom/auth/lonroles.pm	2022/02/24 15:06:48	1.362
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # User Roles Screen
 #
-# $Id: lonroles.pm,v 1.361 2022/02/24 13:09:39 raeburn Exp $
+# $Id: lonroles.pm,v 1.362 2022/02/24 15:06:48 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -181,7 +181,8 @@ ENDREDIR
 
 sub finish_loading_course {
     my ($r,$msg,$url) = @_;
-    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.$url.'">'.&mt('Continue').'</a></div>';
+    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.
+               &HTML::Entities::encode($url,'"<>&').'">'.&mt('Continue').'</a></div>';
     my $end_page = &Apache::loncommon::end_page();
     my $js_url = &js_escape($url);
     $r->print(<<END);