diff --git a/wp-admin/templates.php b/wp-admin/templates.php
index 29edad7a0a..f98ce895f3 100644
--- a/wp-admin/templates.php
+++ b/wp-admin/templates.php
@@ -98,7 +98,7 @@ if ( $recents ) :
 <?php
 echo '<ol>';
 foreach ($recents as $recent) :
-	echo "<li><a href='templates.php?file=$recent'>" . get_file_description(basename($recent)) . "</a></li>";
+	echo "<li><a href='templates.php?file=" . wp_specialchars($recent, true) . "'>" . get_file_description(basename($recent)) . "</a></li>";
 endforeach;
 echo '</ol>';
 endif;