Escape tags to fix issue #182

contact_list.js

      */
     function createDisplayNameParagraph(displayName) {
         var p = document.createElement('p');
-        p.innerHTML = displayName;
+        p.innerText = displayName;
 
         return p;
     }
         var contactName = $('#contactlist #' + resourceJid + '>p');
 
         if (contactName && displayName && displayName.length > 0)
-            contactName.html(displayName);
+            contactName.text(displayName);
     });
 
     my.setClickable = function(resourceJid, isClickable) {