diff --git a/addons/base_import/controllers.py b/addons/base_import/controllers.py
index 9a49384900f..84b645f149f 100644
--- a/addons/base_import/controllers.py
+++ b/addons/base_import/controllers.py
@@ -1,4 +1,5 @@
 # -*- coding: utf-8 -*-
+import cgi
 import json
 
 from openerp.http import Controller, route
@@ -15,4 +16,4 @@ class ImportController(Controller):
         }, req.context)
 
         return 'window.top.%s(%s)' % (
-            jsonp, json.dumps({'result': written}))
+            cgi.escape(jsonp), json.dumps({'result': written}))