diff --git a/src/core/render/tpl.js b/src/core/render/tpl.js
index 64ba925..2b58622 100644
--- a/src/core/render/tpl.js
+++ b/src/core/render/tpl.js
@@ -1,4 +1,5 @@
 import {isMobile} from '../util/env'
+import {escapeString} from '../util/core'
 /**
  * Render github corner
  * @param  {Object} data
@@ -30,6 +31,9 @@ export function corner(data, cornerExternalLinkTarge) {
  * Render main content
  */
 export function main(config) {
+
+  const name = config.name? escapeString(config.name):''
+
   const aside =
     '<button class="sidebar-toggle" aria-label="Menu">' +
     '<div class="sidebar-toggle-button">' +
@@ -39,9 +43,9 @@ export function main(config) {
     '<aside class="sidebar">' +
     (config.name ?
       `<h1 class="app-name"><a class="app-name-link" data-nosearch>${
-        config.logo ?
-          `<img alt=${config.name} src=${config.logo}>` :
-          config.name
+        config.logo ? 
+           `<img alt="${name}" src=${config.logo}>` :
+          name
       }</a></h1>` :
       '') +
     '<div class="sidebar-nav"><!--sidebar--></div>' +
diff --git a/src/core/util/core.js b/src/core/util/core.js
index a94472d..c538e22 100644
--- a/src/core/util/core.js
+++ b/src/core/util/core.js
@@ -56,3 +56,19 @@ export function noop() {}
 export function isFn(obj) {
   return typeof obj === 'function'
 }
+
+/**
+ * escape String
+ */
+export function escapeString(string) {
+  const entityMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    '\'': '&#39;',
+    '/': '&#x2F;'
+  }
+
+  return String(string).replace(/[&<>"'/]/g, s => entityMap[s])
+}
\ No newline at end of file