diff --git a/gcode_viewer/js/prettygcode.js b/gcode_viewer/js/prettygcode.js
index 3c854dbd5..3dd97e42c 100644
--- a/gcode_viewer/js/prettygcode.js
+++ b/gcode_viewer/js/prettygcode.js
@@ -845,7 +845,7 @@ $(function () {
 
         //util function
         urlParam = function (name) {
-            var results = new RegExp('[\?&]' + name + '=([^&#]*)').exec(window.location.href);
+            var results = new RegExp('[?&]' + name + '=([^&#]*)').exec(window.location.href);
             if (results == null) {
                 return null;
             }
diff --git a/gcode_viewer/js/slider-shim.js b/gcode_viewer/js/slider-shim.js
index a17d7b1bf..dbc3ccdc7 100644
--- a/gcode_viewer/js/slider-shim.js
+++ b/gcode_viewer/js/slider-shim.js
@@ -29,11 +29,20 @@
                     value: 0,
                 }, typeof optsOrCmd === 'object' ? optsOrCmd : {});
 
-                // Build the DOM
+                // Build the DOM. opts.id is HTML-attribute-escaped before
+                // interpolation so a future caller passing a tainted id can't
+                // break out of the attribute (CodeQL: js/html-constructed-from-input).
+                function escapeAttr(s) {
+                    return String(s).replace(/&/g, '&')
+                                    .replace(/"/g, '"')
+                                    .replace(/'/g, ''')
+                                    .replace(/</g, '&lt;')
+                                    .replace(/>/g, '&gt;');
+                }
                 var isVertical = opts.orientation === 'vertical';
                 var trackHtml =
                     '<div class="slider' + (isVertical ? ' slider-vertical' : '') + '"' +
-                    (opts.id ? ' id="' + opts.id + '"' : '') + '>' +
+                    (opts.id ? ' id="' + escapeAttr(opts.id) + '"' : '') + '>' +
                     '<div class="slider-track"><div class="slider-selection"></div></div>' +
                     '<div class="slider-handle round">0</div>' +
                     '</div>';