diff --git a/radicale/web/internal_data/fn.js b/radicale/web/internal_data/fn.js
index a9a73a7e..af13ad0a 100644
--- a/radicale/web/internal_data/fn.js
+++ b/radicale/web/internal_data/fn.js
@@ -395,7 +395,7 @@ function create_edit_collection(user, password, collection, create, callback) {
         calendar_color = escape_xml(collection.color + (collection.color ? "ff" : ""));
         calendar_description = escape_xml(collection.description);
         resourcetype = '<CS:subscribed />';
-        calendar_source = collection.source;
+        calendar_source = escape_xml(collection.source);
     } else {
         calendar_color = escape_xml(collection.color + (collection.color ? "ff" : ""));
         calendar_description = escape_xml(collection.description);