diff --git a/app/Views/login.php b/app/Views/login.php
index 81cf94f20..7de14b47a 100644
--- a/app/Views/login.php
+++ b/app/Views/login.php
@@ -32,7 +32,7 @@ $request = Services::request();
         ? 'flatly'
         : $config['theme']);
     ?>
-    <link rel="stylesheet" href="resources/bootswatch5/<?= "$theme" ?>/bootstrap.min.css">
+    <link rel="stylesheet" href="resources/bootswatch5/<?= esc("$theme") ?>/bootstrap.min.css">
     <link rel="stylesheet" href="css/login.css">
     <meta name="theme-color" content="#2c3e50">
 </head>
diff --git a/app/Views/partial/datepicker_locale.php b/app/Views/partial/datepicker_locale.php
index ae897359f..6895c8093 100644
--- a/app/Views/partial/datepicker_locale.php
+++ b/app/Views/partial/datepicker_locale.php
@@ -25,7 +25,7 @@ var pickerconfig = function(config) {
     }, <?php echo isset($config) ?>);
 };
 
-$.fn.datetimepicker.dates['<?= $config['language'] ?>'] = {
+$.fn.datetimepicker.dates['<?= esc($config['language']) ?>'] = {
     days: [
         "<?= lang('Calendar.sunday') ?>",
         "<?= lang('Calendar.monday') ?>",