diff --git a/code/controllers/ReportAdmin.php b/code/controllers/ReportAdmin.php
index 55b128a8..05fb82c3 100644
--- a/code/controllers/ReportAdmin.php
+++ b/code/controllers/ReportAdmin.php
@@ -164,7 +164,13 @@ class ReportAdmin extends LeftAndMain implements PermissionProvider {
 				'title' => _t('ReportAdmin.ReportTitle', 'Title'),
 			));
 			$columns->setFieldFormatting(array(
-				'title' => '<a href=\"$Link\" class=\"cms-panel-link\">$value</a>'
+				'title' => function($value, &$item) {
+					return sprintf(
+						'<a href=\"%s\" class=\"cms-panel-link\">%s</a>',
+						Convert::raw2xml($item->Link),
+						Convert::raw2xml($value)
+					);
+				}
 			));
 			$gridField->addExtraClass('all-reports-gridfield');
 			$fields->push($gridField);
diff --git a/code/reports/Report.php b/code/reports/Report.php
index a76b93b4..85b1f03a 100644
--- a/code/reports/Report.php
+++ b/code/reports/Report.php
@@ -282,8 +282,13 @@ class SS_Report extends ViewableData {
 			if(isset($info['casting'])) $fieldCasting[$source] = $info['casting'];
 
 			if(isset($info['link']) && $info['link']) {
-				$link = singleton('CMSPageEditController')->Link('show');
-				$fieldFormatting[$source] = '<a href=\"' . $link . '/$ID\">$value</a>';
+				$fieldFormatting[$source] = function($value, &$item) {
+					return sprintf(
+						'<a href=\"%s\">%s</a>',
+						Controller::join_links(singleton('CMSPageEditController')->Link('show'), $item->ID),
+						Convert::raw2xml($value)
+					);
+				};
 			}
 
 			$displayFields[$source] = isset($info['title']) ? $info['title'] : $source;