diff --git a/certificate.pages.inc b/certificate.pages.inc
index 397fd3c..5e99344 100644
--- a/certificate.pages.inc
+++ b/certificate.pages.inc
@@ -210,7 +210,15 @@ function theme_certificate_certificate($variables) {
     if (module_exists('purl')) {
       purl_disable(TRUE);
     }
-    $body = token_replace($body, $types);
+
+    // clear out un-replaced tokens and use a custom callback
+    // so we can have html tags in tokens
+    $options = array();
+    $options['clear'] = TRUE;
+    $options['sanitize'] = FALSE;
+    $options['callback'] = '_certificate_sanitize_tokens';
+
+    $body = token_replace($body, $types, $options);
   }
 
   $format = $field_items[0]['format'];
@@ -249,3 +257,12 @@ function certificate_print_pdf_wrapper($filename, $html, $orientation) {
 
   exit;
 }
+
+/**
++ * Call filter_xss on each of the items in the replacements array.
++ */
+function _certificate_sanitize_tokens(&$replacements) {
+  foreach ($replacements as $token => &$replacement) {
+    $replacement = filter_xss($replacement);
+  }
+}
\ No newline at end of file