diff --git a/app/assets/javascripts/discourse/components/poster-name.js.es6 b/app/assets/javascripts/discourse/components/poster-name.js.es6
index 6e80d1cfe7b..ebeaacc3454 100644
--- a/app/assets/javascripts/discourse/components/poster-name.js.es6
+++ b/app/assets/javascripts/discourse/components/poster-name.js.es6
@@ -29,6 +29,7 @@ var PosterNameComponent = Em.Component.extend({
 
       // Are we showing full names?
       if (name && (name !== username) && this.get('displayNameOnPosts')) {
+        name = Handlebars.Utils.escapeExpression(name);
         buffer.push("<span class='full-name'><a href='#'>" + name + "</a></span>");
       }
 
diff --git a/app/controllers/embed_controller.rb b/app/controllers/embed_controller.rb
index 8a6ee04b977..263d2cfaf42 100644
--- a/app/controllers/embed_controller.rb
+++ b/app/controllers/embed_controller.rb
@@ -18,7 +18,6 @@ class EmbedController < ApplicationController
                                   limit: SiteSetting.embed_post_limit,
                                   exclude_first: true,
                                   exclude_deleted_users: true)
-      @topic_view.posts.reject! {|p| p.user.blank?}
 
       @second_post_url = "#{@topic_view.topic.url}/2" if @topic_view
       @posts_left = 0