diff --git a/www/class/centreon-clapi/centreonAPI.class.php b/www/class/centreon-clapi/centreonAPI.class.php
index d808732f132..24f404eba8c 100644
--- a/www/class/centreon-clapi/centreonAPI.class.php
+++ b/www/class/centreon-clapi/centreonAPI.class.php
@@ -716,7 +716,7 @@ public function initXML()
      */
     public function launchAction($exit = true)
     {
-        $action = strtoupper($this->action);
+        $action = htmlspecialchars(strtoupper($this->action), ENT_QUOTES, 'UTF-8');
 
         /**
          * Debug
@@ -803,9 +803,13 @@ public function import($filename)
                 $i++;
                 $tab = preg_split('/;/', $string);
                 if (strlen(trim($string)) != 0 && !preg_match('/^\{OBJECT_TYPE\}/', $string)) {
-                    $this->object = trim($tab[0]);
-                    $this->action = trim($tab[1]);
-                    $this->variables = trim(substr($string, strlen($tab[0] . ";" . $tab[1] . ";")));
+                    $this->object = htmlspecialchars(trim($tab[0]), ENT_QUOTES, 'UTF-8');
+                    $this->action = htmlspecialchars(trim($tab[1]), ENT_QUOTES, 'UTF-8');
+                    $this->variables = htmlspecialchars(
+                        trim(substr($string, strlen($tab[0] . ";" . $tab[1] . ";"))),
+                        ENT_QUOTES,
+                        'UTF-8'
+                    );
                     if ($this->debug == 1) {
                         print "Object : " . $this->object . "\n";
                         print "Action : " . $this->action . "\n";
@@ -830,7 +834,7 @@ public function import($filename)
 
     public function launchActionForImport()
     {
-        $action = strtoupper($this->action);
+        $action = htmlspecialchars(strtoupper($this->action), ENT_QUOTES, 'UTF-8');
         /**
          * Debug
          */