diff --git a/scripts/pi-hole/php/func.php b/scripts/pi-hole/php/func.php
index c2e42b48..12e41061 100644
--- a/scripts/pi-hole/php/func.php
+++ b/scripts/pi-hole/php/func.php
@@ -34,7 +34,7 @@ function validDomain($domain_name, &$message = NULL)
 function validDomainWildcard($domain_name)
 {
 	// There has to be either no or at most one "*" at the beginning of a line
-	$validChars = preg_match("/^((\*.)?[_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i", $domain_name);
+	$validChars = preg_match("/^((\*\.)?[_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i", $domain_name);
 	$lengthCheck = preg_match("/^.{1,253}$/", $domain_name);
 	$labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name);
 	return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label
diff --git a/scripts/pi-hole/php/groups.php b/scripts/pi-hole/php/groups.php
index 838dbf83..49a8d51c 100644
--- a/scripts/pi-hole/php/groups.php
+++ b/scripts/pi-hole/php/groups.php
@@ -546,6 +546,9 @@ if ($_POST['action'] == 'get_groups') {
                     $res['domain'] = $utf8_domain.' ('.$res['domain'].')';
                 }
             }
+            // Prevent domain and comment fields from returning any arbitary javascript code which could be executed on the browser.
+            $res['domain'] = htmlentities($res['domain']);
+            $res['comment'] = htmlentities($res['comment']);
             array_push($data, $res);
         }