diff --git a/app/templates/admin/article_form.html b/app/templates/admin/article_form.html
index c2f729b..6077a4c 100644
--- a/app/templates/admin/article_form.html
+++ b/app/templates/admin/article_form.html
@@ -350,7 +350,13 @@ function uploadImage(file, isPaste = false) {
 }
 
 // 参考来源管理
-let references = {% if references %}[{% for ref in references %}{"id": {{ ref.id }}, "title": "{{ ref.title }}", "url": "{{ ref.url or '' }}", "description": "{{ ref.description or '' }}"}{% if not loop.last %}, {% endif %}{% endfor %}]{% else %}[]{% endif %};
+let references = {% if references %}[
+    {% for ref in references %}
+    {"id": {{ ref.id }}, "title": "{{ ref.title | e }}", "url": "{{ ref.url or '' | e }}", "description": "{{ ref.description or '' | e }}"}
+    {% if not loop.last %},
+    {% endif %}
+    {% endfor %}
+]{% else %}[]{% endif %};
 
 function addReference() {
     references.push({id: null, title: '', url: '', description: ''});
@@ -425,7 +431,7 @@ function deleteAttachment(id) {
 
 {% block content %}
 <form method="POST" class="article-form">
-    <input type="hidden" id="references-json" name="references" value="{{ references | tojson | safe if references else '[]' }}">
+    <input type="hidden" id="references-json" name="references" value="[{% for ref in references %}{"id": {{ ref.id }}, "title": "{{ ref.title | e }}", "url": "{{ ref.url or '' | e }}", "description": "{{ ref.description or '' | e }}"}{% if not loop.last %}, {% endif %}{% endfor %}]">
     
     <div class="form-row">
         <div class="form-group flex-grow">