diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
index 0fb172153..b4cd45882 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
@@ -50,10 +50,13 @@ public XSSInImgTagAttribute() {
     public ResponseEntity<String> getVulnerablePayloadLevel1(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
 
-        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
+        String vulnerablePayloadWithPlaceHolder = "<img src=\"%s\" width=\"400\" height=\"300\"/>";
 
         return new ResponseEntity<>(
-                String.format(vulnerablePayloadWithPlaceHolder, imageLocation), HttpStatus.OK);
+                String.format(
+                        vulnerablePayloadWithPlaceHolder,
+                        StringEscapeUtils.escapeHtml4(imageLocation)),
+                HttpStatus.OK);
     }
 
     // Adding Untrusted Data into Src tag between quotes is beneficial but not