diff --git a/src/main/java/com/samskivert/mustache/Escapers.java b/src/main/java/com/samskivert/mustache/Escapers.java
index a380b67..b8a8a1e 100644
--- a/src/main/java/com/samskivert/mustache/Escapers.java
+++ b/src/main/java/com/samskivert/mustache/Escapers.java
@@ -15,7 +15,9 @@ public class Escapers
         { "'",  "'" },
         { "\"", """ },
         { "<",  "&lt;" },
-        { ">",  "&gt;" }
+        { ">",  "&gt;" },
+        { "`",  "&#x60;" },
+        { "=",  "&#x3D;" }
     });
 
     /** An escaper that does no escaping. */
diff --git a/src/test/java/com/samskivert/mustache/SharedTests.java b/src/test/java/com/samskivert/mustache/SharedTests.java
index 645aebe..6106934 100644
--- a/src/test/java/com/samskivert/mustache/SharedTests.java
+++ b/src/test/java/com/samskivert/mustache/SharedTests.java
@@ -283,10 +283,11 @@ public abstract class SharedTests extends GWTTestCase
     }
 
     @Test public void testEscapeHTML () {
-        check("&lt;b&gt;", Mustache.compiler().compile("{{a}}").
-              execute(context("a", "<b>")));
+        check("&lt;b&gt;", Mustache.compiler().compile("{{a}}").execute(context("a", "<b>")));
         check("<b>", Mustache.compiler().escapeHTML(false).compile("{{a}}").
               execute(context("a", "<b>")));
+        // ensure that some potential XSS enablers are escaped
+        check("&#x60;&#x3D;", Mustache.compiler().compile("{{a}}").execute(context("a", "`=")));
     }
 
     @Test public void testUserDefinedEscaping() {