diff --git a/src/Builder.php b/src/Builder.php
index b2ff8f3..ea04375 100644
--- a/src/Builder.php
+++ b/src/Builder.php
@@ -66,6 +66,9 @@ class Builder
             $value = collect($value)->implode('|');
         }
 
-        return "<apps:property name='{$key}' value='{$value}'/>";
+        return vsprintf("<apps:property name='%s' value='%s'/>", [
+            $key,
+            htmlentities($value),
+        ]);
     }
 }