diff --git a/common/modules/options.jsm b/common/modules/options.jsm
index 775099ba..3672f7eb 100644
--- a/common/modules/options.jsm
+++ b/common/modules/options.jsm
@@ -749,12 +749,14 @@ var Options = Module("options", {
                     opt.set(opt.globalValue, Option.SCOPE_GLOBAL, true);
             }, window);
 
+            function escape(str) str.replace(/[<&]/g, function (m) ({ "&": "&amp;", "<": "&lt;" })[m]);
+
             services["dactyl:"].pages["options.dtd"] = function () [null,
                 util.makeDTD(
                     iter(([["option", o.name, "default"].join("."),
-                           o.type === "string" ? o.defaultValue.replace(/'/g, "''") :
-                           o.value === true    ? "on"  :
-                           o.value === false   ? "off" : o.stringDefaultValue]
+                           escape(o.type === "string" ? o.defaultValue.replace(/'/g, "''") :
+                                  o.value === true    ? "on"  :
+                                  o.value === false   ? "off" : o.stringDefaultValue)]
                           for (o in self)),
 
                          ([["option", o.name, "type"].join("."), o.type] for (o in self)),
diff --git a/common/modules/util.jsm b/common/modules/util.jsm
index a61eddaa..daee67aa 100644
--- a/common/modules/util.jsm
+++ b/common/modules/util.jsm
@@ -975,9 +975,9 @@ var Util = Module("Util", XPCOM([Ci.nsIObserver, Ci.nsISupportsWeakReference]),
     },
 
     makeDTD: function makeDTD(obj) unescape(encodeURI(iter(obj)
-          .map(function ([k, v]) ["<!ENTITY ", k, ' "', String.replace(v == null ? "null" : v, /[&"<%]/g,
-                                                                       function (m) ({ '"': "&quot;", "&": "&amp;", "<": "&lt;", "%": "&#x25;" })[m]),
-                                  '">'].join(""))
+          .map(function ([k, v]) ["<!ENTITY ", k, " '", String.replace(v == null ? "null" : v, /['%]/g,
+                                                                       function (m) ({ "'": "&apos;", "%": "&#x25;" })[m]),
+                                  "'>"].join(""))
           .join("\n"))),
 
     map: deprecated("iter.map", function map(obj, fn, self) iter(obj).map(fn, self).toArray()),