diff --git a/addons/im_chat/im_chat.py b/addons/im_chat/im_chat.py
index 689432e4157..07292c8b7f9 100644
--- a/addons/im_chat/im_chat.py
+++ b/addons/im_chat/im_chat.py
@@ -296,13 +296,26 @@ class im_chat_shortcode(osv.Model):
         'description' : fields.char('Description'),
     }
 
+    def _sanitize_shorcode(self, substitution):
+        """ Sanitize the shortcode substitution :
+                 - HTML substitution : only allow the img tag (smiley)
+                 - escape other substitutions to avoid XSS
+        """
+        is_img_tag = re.match(r'''^<img\s+src=('|")([^'"]*)\1\s*/?>$''', substitution, re.M|re.I)
+        if is_img_tag:
+            return substitution
+        return cgi.escape(substitution)
+
     def create(self, cr, uid, values, context=None):
         if values.get('substitution'):
-            values['substitution'] = tools.html_sanitize(values['substitution']).strip()
-        if not values.get('substitution'):
-            raise UserError(_("Substitution contains only forbidden characters. Please fill it with something else."))
+            values['substitution'] = self._sanitize_shorcode(values['substitution'])
         return super(im_chat_shortcode, self).create(cr, uid, values, context=context)
 
+    def write(self, cr, uid, ids, values, context=None):
+        if values.get('substitution'):
+            values['substitution'] = self._sanitize_shorcode(values['substitution'])
+        return super(im_chat_shortcode, self).write(cr, uid, ids, values, context=context)
+
     def replace_shortcode(self, cr, uid, message, context=None):
         ids = self.search(cr, uid, [], context=context)
         for shortcode in self.browse(cr, uid, ids, context=context):