diff -r aff75b69db92 -r 2c48c091b6a2 entities/lib.py
--- a/entities/lib.py	Tue Jul 02 17:09:04 2013 +0200
+++ b/entities/lib.py	Mon Jan 13 13:47:47 2014 +0100
@@ -1,4 +1,4 @@
-# copyright 2003-2011 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
+# copyright 2003-2013 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
 # contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
 #
 # This file is part of CubicWeb.
@@ -15,14 +15,15 @@
 #
 # You should have received a copy of the GNU Lesser General Public License along
 # with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
-"""entity classes for optional library entities
+"""entity classes for optional library entities"""
 
-"""
 __docformat__ = "restructuredtext en"
 
 from urlparse import urlsplit, urlunsplit
 from datetime import datetime
 
+from logilab.mtconverter import xml_escape
+
 from cubicweb import UnknownProperty
 from cubicweb.entity import _marker
 from cubicweb.entities import AnyEntity, fetch_config
@@ -81,7 +82,10 @@
                         format='text/html'):
         """overriden to return displayable address when necessary"""
         if attr == 'address':
-            return self.display_address()
+            address = self.display_address()
+            if format == 'text/html':
+                address = xml_escape(address)
+            return address
         return super(EmailAddress, self).printable_value(attr, value, attrtype, format)