diff --git a/scripturefilter.inc b/scripturefilter.inc
index 7c54d2f..ccb7bfc 100644
--- a/scripturefilter.inc
+++ b/scripturefilter.inc
@@ -85,22 +85,22 @@ function scripturizeLinkReference($reference='',$volume='',$book='',$verse='',$t
         // note: the ESV could actually support a mouseover reference
         // we could pull it directly from their site and include it in the $title text
         // http://www.gnpcb.org/esv/share/services/api/ for more info
-             $link = 'http://www.gnpcb.org/esv/search/?go=Go&q=';
+             $link = htmlspecialchars('http://www.gnpcb.org/esv/search/?go=Go&q=');
              $title = 'English Standard Version Bible';
              $link = sprintf('<a href="%s%s" title="%s">%s</a>',$link,htmlentities(urlencode(trim("$volume $book $verse"))),$title,trim($reference));
              break;
         case 'NET':
-             $link = 'http://net.bible.org/passage.php?passage=';
+             $link = htmlspecialchars('http://net.bible.org/passage.php?passage=');
              $title = 'New English Translation';
              $link = sprintf('<a href="%s%s" title="%s">%s</a>',$link,htmlentities(urlencode(trim("$volume $book $verse"))),$title,trim($reference));
              break;
 	case 'TNIV':
-             $link = 'http://www.tniv.info/bible/passagesearch.php?passage_request=';
+             $link = htmlspecialchars('http://www.tniv.info/bible/passagesearch.php?passage_request=');
              $title = 'Today\'s New International Version';
              $link = sprintf('<a href="%s%s" title="%s">%s</a>',$link,htmlentities(urlencode(trim("$volume $book $verse"))),$title,trim($reference));
 	     break;
         default:
-             $link = "http://biblegateway.com/cgi-bin/bible?language=english&version=$translation&passage=";
+             $link = htmlspecialchars("http://biblegateway.com/cgi-bin/bible?language=english&version=$translation&passage=");
              $title = 'Bible Gateway';
              $link = sprintf('<a href="%s%s" title="%s">%s</a>',$link,htmlentities(urlencode(trim("$volume $book $verse"))),$title,trim($reference));
              break;