diff --git a/res/values/strings.xml b/res/values/strings.xml
index d3d392b..8a98aba 100644
--- a/res/values/strings.xml
+++ b/res/values/strings.xml
@@ -1134,7 +1134,7 @@
     <!-- Bluetooth settings. Title of the advanced bluetooth settings screen [CHAR LIMIT=30]-->
     <string name="bluetooth_advanced_titlebar">Advanced Bluetooth</string>
     <!-- Bluetooth settings. Text displayed when Bluetooth is off and device list is empty [CHAR LIMIT=50]-->
-    <string name="bluetooth_empty_list_bluetooth_off">To see devices, turn Bluetooth on.</string>
+    <string name="bluetooth_empty_list_bluetooth_off">When Bluetooth is turned on, your device can communicate with other nearby Bluetooth devices.</string>
 
 
     <!-- Bluetooth settings.  The title of the screen to pick which profiles to connect to on the device.  For example, headphones may have both A2DP and headset, this allows the user to choose which one he wants to connect to. -->
diff --git a/src/com/android/settings/bluetooth/BluetoothPairingDialog.java b/src/com/android/settings/bluetooth/BluetoothPairingDialog.java
index 9b2a3e8..d6f27ef 100755
--- a/src/com/android/settings/bluetooth/BluetoothPairingDialog.java
+++ b/src/com/android/settings/bluetooth/BluetoothPairingDialog.java
@@ -207,8 +207,8 @@
                 return null;
         }
 
-        // Format the message string, then parse HTML style tags
-        String messageText = getString(messageId1, deviceName);
+        // HTML escape deviceName, Format the message string, then parse HTML style tags
+        String messageText = getString(messageId1, Html.escapeHtml(deviceName));
         messageView.setText(Html.fromHtml(messageText));
         messageView2.setText(messageId2);
         mPairingView.setInputType(InputType.TYPE_CLASS_NUMBER);
@@ -220,7 +220,8 @@
 
     private View createView(CachedBluetoothDeviceManager deviceManager) {
         View view = getLayoutInflater().inflate(R.layout.bluetooth_pin_confirm, null);
-        String name = deviceManager.getName(mDevice);
+	// Escape device name to avoid HTML injection.
+        String name = Html.escapeHtml(deviceManager.getName(mDevice));
         TextView messageView = (TextView) view.findViewById(R.id.message);
 
         String messageText; // formatted string containing HTML style tags