diff --git webservice/rest/locallib.php webservice/rest/locallib.php
index 3fe38ea..e6a5636 100644
--- webservice/rest/locallib.php
+++ webservice/rest/locallib.php
@@ -138,9 +138,9 @@ class webservice_rest_server extends webservice_base_server {
         } else {
             $error = '<?xml version="1.0" encoding="UTF-8" ?>'."\n";
             $error .= '<EXCEPTION class="'.get_class($ex).'">'."\n";
-            $error .= '<MESSAGE>'.htmlentities($ex->getMessage(), ENT_COMPAT, 'UTF-8').'</MESSAGE>'."\n";
+            $error .= '<MESSAGE>'.htmlspecialchars($ex->getMessage(), ENT_COMPAT, 'UTF-8').'</MESSAGE>'."\n";
             if (debugging() and isset($ex->debuginfo)) {
-                $error .= '<DEBUGINFO>'.htmlentities($ex->debuginfo, ENT_COMPAT, 'UTF-8').'</DEBUGINFO>'."\n";
+                $error .= '<DEBUGINFO>'.htmlspecialchars($ex->debuginfo, ENT_COMPAT, 'UTF-8').'</DEBUGINFO>'."\n";
             }
             $error .= '</EXCEPTION>'."\n";
         }
@@ -182,7 +182,7 @@ class webservice_rest_server extends webservice_base_server {
             if (is_null($returns)) {
                 return '<VALUE null="null"/>'."\n";
             } else {
-                return '<VALUE>'.htmlentities($returns, ENT_COMPAT, 'UTF-8').'</VALUE>'."\n";
+                return '<VALUE>'.htmlspecialchars($returns, ENT_COMPAT, 'UTF-8').'</VALUE>'."\n";
             }
 
         } else if ($desc instanceof external_multiple_structure) {
@@ -221,4 +221,4 @@ class webservice_rest_test_client implements webservice_test_client_interface {
     public function simpletest($serverurl, $function, $params) {
         return download_file_content($serverurl.'&wsfunction='.$function, null, $params);
     }
-}
\ No newline at end of file
+}