diff --git a/lib/mailer.ts b/lib/mailer.ts
index 09acd77..f03013f 100644
--- a/lib/mailer.ts
+++ b/lib/mailer.ts
@@ -1,6 +1,15 @@
 import nodemailer from "nodemailer";
 import { queueEmail } from "./email-queue";
 
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
 // Port 587 = STARTTLS, Port 465 = SSL/TLS
 const transporter = nodemailer.createTransport({
   host: process.env.SMTP_HOST,
@@ -228,7 +237,7 @@ export async function sendeFlyerBenachrichtigung(
       Ein Interessent hat den MBO FamilyGuard Flyer angefordert.
     </p>
     <table style="width:100%;border-collapse:collapse">
-      <tr><td style="padding:6px 0;color:#94a3b8;width:120px">E-Mail</td><td style="padding:6px 0"><a href="mailto:${data.email}" style="color:#60a5fa">${data.email}</a></td></tr>
+      <tr><td style="padding:6px 0;color:#94a3b8;width:120px">E-Mail</td><td style="padding:6px 0"><a href="mailto:${escapeHtml(data.email)}" style="color:#60a5fa">${escapeHtml(data.email)}</a></td></tr>
     </table>
   </div>
   <div style="padding:12px 24px;background:#111925;border-top:1px solid rgba(255,255,255,0.1)">