diff --git a/WebKit/scripts/controller/Timeline.js b/WebKit/scripts/controller/Timeline.js
index 49e11a0..6d0d67c 100644
--- a/WebKit/scripts/controller/Timeline.js
+++ b/WebKit/scripts/controller/Timeline.js
@@ -59,6 +59,9 @@ function(Core, Paths, HostApp, URI) {
                     if (li) {
                         this.body.removeChild(li);
                     }
+                } else if (status.type == "https://tent.io/types/post/repost/v0.1.0") {
+
+                    //debug(status)
                 }
 
             }
@@ -71,7 +74,14 @@ function(Core, Paths, HostApp, URI) {
 
         var those = this;
         var url = URI(Paths.mkApiRootPath("/posts"));
-        url.addSearch("post_types", "https://tent.io/types/post/status/v0.1.0,https://tent.io/types/post/delete/v0.1.0");
+
+        var post_types = [
+            "https://tent.io/types/post/repost/v0.1.0",
+            "https://tent.io/types/post/status/v0.1.0",
+            "https://tent.io/types/post/delete/v0.1.0"
+        ];
+        url.addSearch("post_types", post_types.join(","));
+
         url.addSearch("limit", this.max_length);
         if(this.since_id) {
             url.addSearch("since_id", this.since_id);
diff --git a/WebKit/scripts/helper/Core.js b/WebKit/scripts/helper/Core.js
index d00246a..5ca50d7 100644
--- a/WebKit/scripts/helper/Core.js
+++ b/WebKit/scripts/helper/Core.js
@@ -211,7 +211,7 @@ function(jQuery, Paths, URI, HostApp, Followings) {
         
         template.in_reply.parentNode.className = "hidden";
 
-        var text = status.content.text.replace(/\n/g, "<br>");
+        var text = status.content.text.escapeHTML().replace(/\n/g, "<br>");
         var entities = [status.entity];
         status.mentions.map(function (mention) {
             entities.push(mention.entity)
diff --git a/WebKit/scripts/main.js b/WebKit/scripts/main.js
index 6cb9092..c4d285c 100644
--- a/WebKit/scripts/main.js
+++ b/WebKit/scripts/main.js
@@ -55,6 +55,21 @@ String.prototype.endsWith = function(suffix) {
     return this.match(suffix+"$") == suffix;
 };
 
+var entityMap = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': '&quot;',
+    "'": '&#39;',
+    "/": '&#x2F;'
+};
+
+String.prototype.escapeHTML = function() {
+    return String(this).replace(/[&<>"'\/]/g, function (s) {
+        return entityMap[s];
+    });
+}
+
 var console = {
     log: function(s) {
         if (OS_TYPE == "mac") {