diff --git a/code/modules/world_topic/adminmsg.dm b/code/modules/world_topic/adminmsg.dm
index e3582b0ae46..5ad8f535e47 100644
--- a/code/modules/world_topic/adminmsg.dm
+++ b/code/modules/world_topic/adminmsg.dm
@@ -19,8 +19,9 @@
 	if(!C)
 		return json_encode(list("error" = "No client with that name on server"))
 
-	var/message =	"<font color='red'>Discord PM from <b><a href='?discord_msg=1'>[input["sender"]]</a></b>: [input["msg"]]</font>"
-	var/amessage =  "<font color='blue'>Discord PM from <a href='?discord_msg=1'>[input["sender"]]</a> to <b>[key_name_admin(C)]</b>: [input["msg"]]</font>"
+	var/sanitized = sanitize(input["msg"])
+	var/message =	"<font color='red'>Discord PM from <b><a href='?discord_msg=1'>[input["sender"]]</a></b>: [sanitized]</font>"
+	var/amessage =  "<font color='blue'>Discord PM from <a href='?discord_msg=1'>[input["sender"]]</a> to <b>[key_name_admin(C)]</b>: [sanitized]</font>"
 
 	// THESE TWO VARS DO VERY DIFFERENT THINGS. DO NOT ATTEMPT TO COMBINE THEM
 	C.received_discord_pm = world.time