diff --git a/common.php b/common.php
index 38a2c4d05..5bab616f7 100644
--- a/common.php
+++ b/common.php
@@ -252,7 +252,7 @@ if (isset($_REQUEST['PHPSESSID']) && $_REQUEST['PHPSESSID'] != session_id())
 $qstr = '';
 
 if (isset($_REQUEST['sca']))  {
-    $sca = trim($_REQUEST['sca']);
+    $sca = clean_xss_tags(trim($_REQUEST['sca']));
     if ($sca)
         $qstr .= '&sca=' . urlencode($sca);
 } else {
diff --git a/lib/common.lib.php b/lib/common.lib.php
index df4a783dc..cefddb0aa 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -2653,6 +2653,14 @@ function get_search_string($stx)
     return $stx;
 }
 
+// XSS 관련 태그 제거
+function clean_xss_tags($str)
+{
+    $str = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+
+    return $str;
+}
+
 // unescape nl 얻기
 function conv_unescape_nl($str)
 {