diff --git a/inc/template.php b/inc/template.php
index 76d4d4bbe3e836a0f375dbc763a62e7574e38d20..040d99d3263c8d2dd1c7976ac638cb302fc5bd49 100644
--- a/inc/template.php
+++ b/inc/template.php
@@ -1170,7 +1170,7 @@ function tpl_mediaFileList(){
     echo '<div class="panelHeader">'.NL;
     echo '<h3>';
     $tabTitle = ($NS) ? $NS : '['.$lang['mediaroot'].']';
-    printf($lang['media_' . $opened_tab], '<strong>'.$tabTitle.'</strong>');
+    printf($lang['media_' . $opened_tab], '<strong>'.hsc($tabTitle).'</strong>');
     echo '</h3>'.NL;
     if ($opened_tab === 'search' || $opened_tab === 'files') {
         media_tab_files_options();
diff --git a/lib/exe/ajax.php b/lib/exe/ajax.php
index 3d158424458c2ce1d98fbfcf2d453699b189f134..945091f3475a9dc711ac4d96dc40baa5b6e739cb 100644
--- a/lib/exe/ajax.php
+++ b/lib/exe/ajax.php
@@ -13,7 +13,6 @@ session_write_close();
 
 header('Content-Type: text/html; charset=utf-8');
 
-
 //call the requested function
 if(isset($_POST['call'])){
     $call = $_POST['call'];
@@ -204,7 +203,7 @@ function ajax_medialist(){
     global $conf;
     global $NS;
 
-    $NS = $_POST['ns'];
+    $NS = cleanID($_POST['ns']);
     if ($_POST['do'] == 'media') {
         tpl_mediaFileList();
     } else {