diff --git a/bskylink/src/html/linkRedirectContents.ts b/bskylink/src/html/linkRedirectContents.ts
index f1bcdbb91e..bc87aef9de 100644
--- a/bskylink/src/html/linkRedirectContents.ts
+++ b/bskylink/src/html/linkRedirectContents.ts
@@ -1,10 +1,20 @@
import escapeHTML from 'escape-html'
export function linkRedirectContents(link: string): string {
+ // Encode characters that could break out of the single-quoted URL in meta refresh.
+ // HTML entity escaping (') is insufficient because the browser decodes entities
+ // before the meta refresh parser processes the URL, allowing apostrophes to
+ // prematurely terminate the URL string.
+ //
+ // Example: "They're" with HTML escaping becomes "They're" in HTML, but after
+ // the browser decodes the content attribute, the meta refresh parser sees "They're"
+ // and interprets the apostrophe as the closing quote, truncating the URL to "They".
+ const safeLink = link.replace(/'/g, '%27')
+
return `
-
+