diff --git a/web-ui/investor-app.html b/web-ui/investor-app.html
index a69c582..c501be0 100644
--- a/web-ui/investor-app.html
+++ b/web-ui/investor-app.html
@@ -732,14 +732,14 @@ function renderMdSafe(text){
       const parts=body.trim().split('|');const code=parts[0].trim().replace(/\D/g,'');const period=(parts[1]||'day').trim().toLowerCase();
       if(!code)return m;
       const ph=`\x00CHART${charts.length}\x00`;
-      charts.push(`<span class="iv-chart-link" onclick="loadKStock('${code}','${code}','${period}')">📈 ${code} · ${period} 차트 보기</span>`);
+      charts.push(`<span class="iv-chart-link" onclick="loadKStock('${escAttr(code)}','${escAttr(code)}','${escAttr(period)}')">📈 ${escHtml(code)} · ${escHtml(period)} 차트 보기</span>`);
       return ph;
     })
     .replace(/```tradingview\s*\n([^`]+?)\n```/g,(m,body)=>{
       const parts=body.trim().split('|');const sym=parts[0].trim().toUpperCase();const iv=(parts[1]||'D').trim().toUpperCase();
       if(!sym)return m;
       const ph=`\x00CHART${charts.length}\x00`;
-      charts.push(`<span class="iv-chart-link" onclick="loadTV('${sym}','${iv}','${sym}')">📈 ${sym} · ${iv} 차트 보기</span>`);
+      charts.push(`<span class="iv-chart-link" onclick="loadTV('${escAttr(sym)}','${escAttr(iv)}','${escAttr(sym)}')">📈 ${escHtml(sym)} · ${escHtml(iv)} 차트 보기</span>`);
       return ph;
     });
   // HTML escape