diff --git a/server/handlers.go b/server/handlers.go
index 61791cf..6415edd 100644
--- a/server/handlers.go
+++ b/server/handlers.go
@@ -133,7 +133,8 @@ func (s *Server) previewHandler(w http.ResponseWriter, r *http.Request) {
 		}
 
 		if strings.HasPrefix(contentType, "text/x-markdown") || strings.HasPrefix(contentType, "text/markdown") {
-			output := blackfriday.MarkdownCommon(data)
+			escapedData := html.EscapeString(string(data))
+			output := blackfriday.MarkdownCommon([]byte(escapedData))
 			content = html_template.HTML(output)
 		} else if strings.HasPrefix(contentType, "text/plain") {
 			content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", html.EscapeString(string(data))))