diff --git includes/common.inc includes/common.inc
index 063174e..d427238 100644
--- includes/common.inc
+++ includes/common.inc
@@ -4606,6 +4606,9 @@ function drupal_common_theme() {
     'username' => array(
       'arguments' => array('object' => NULL),
     ),
+    'username_plain' => array(
+      'arguments' => array('object' => NULL),
+    ),
     'progress_bar' => array(
       'arguments' => array('percent' => NULL, 'message' => NULL),
     ),
diff --git includes/theme.inc includes/theme.inc
index 9c646a0..dffb4c4 100644
--- includes/theme.inc
+++ includes/theme.inc
@@ -1905,6 +1905,35 @@ function theme_username($object) {
 }
 
 /**
+ * Preprocess an account object for generating a username without any markup.
+ *
+ * @see theme_username_plain()
+ */
+function template_process_username_plain(&$variables) {
+  if (empty($variables['object']->name)) {
+    $variables['object']->name = variable_get('anonymous', t('Anonymous'));
+  }
+  $variables['object']->safe_name = check_plain($variables['object']->name);
+}
+
+/**
+ * Format a username without any tags or markup (e.g. for us in an attribute).
+ *
+ * @param $object
+ *   The user object to format, usually returned from user_load()
+ *   after processing.  The object key 'safe_name' is safe to use with no
+ *   additional processing.
+ * @return
+ *   A safe string containing only the username.
+ *
+ * @see template_process_username_plain()
+ * @see theme_username()
+ */
+function theme_username_plain($object) {
+  return $object->safe_name;
+}
+
+/**
  * Return a themed progress bar.
  *
  * @param $percent
diff --git modules/toolbar/toolbar.module modules/toolbar/toolbar.module
index 15fe2b0..f370bcc 100644
--- modules/toolbar/toolbar.module
+++ modules/toolbar/toolbar.module
@@ -85,7 +85,7 @@ function toolbar_build() {
     '#theme' => 'links',
     '#links' => array(
       'account' => array(
-        'title' => t('Hello <strong>@username</strong>', array('@username' => $user->name)),
+        'title' => t('Hello <strong>!username</strong>', array('!username' => theme('username_plain', $user))),
         'href' => 'user',
         'html' => TRUE,
       ),
diff --git modules/user/user.pages.inc modules/user/user.pages.inc
index 716036c..73f93e4 100644
--- modules/user/user.pages.inc
+++ modules/user/user.pages.inc
@@ -179,7 +179,7 @@ function user_logout() {
  * to your theme directory, and edit it as instructed in that file's comments.
  */
 function user_view($account) {
-  drupal_set_title($account->name);
+  drupal_set_title(theme('username_plain', $account), PASS_THROUGH);
   // Retrieve all profile fields and attach to $account->content.
   user_build_content($account);