diff --git a/readme-vars.yml b/readme-vars.yml
index 4ebd797..4c988e4 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -113,6 +113,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "31.10.23:", desc: "Further sanitize sed replace." }
   - { date: "07.06.23:", desc: "Add mariadb-client for bookstack-system-cli support." }
   - { date: "25.05.23:", desc: "Rebase to Alpine 3.18, deprecate armhf." }
   - { date: "13.04.23:", desc: "Move ssl.conf include to default.conf." }
diff --git a/root/etc/s6-overlay/s6-rc.d/init-bookstack-config/run b/root/etc/s6-overlay/s6-rc.d/init-bookstack-config/run
index 1b683e6..6c1b78d 100755
--- a/root/etc/s6-overlay/s6-rc.d/init-bookstack-config/run
+++ b/root/etc/s6-overlay/s6-rc.d/init-bookstack-config/run
@@ -86,9 +86,12 @@ if [[ -n "${DB_HOST}" ]]; then
 
     sed -i -E "s/^[#]?DB_HOST=.*/DB_HOST='${DB_HOST}'/g" /config/www/.env
     sed -i -E "s/^[#]?DB_PORT=.*/DB_PORT='${DB_PORT}'/g" /config/www/.env
-    sed -i -E "s/^[#]?DB_DATABASE=.*/DB_DATABASE='${DB_DATABASE}'/g" /config/www/.env
-    sed -i -E "s/^[#]?DB_USERNAME=.*/DB_USERNAME='${DB_USER}'/g" /config/www/.env
-    sed -i -E "s/^[#]?DB_PASSWORD=.*/DB_PASSWORD='${DB_PASS//&/\\&}'/g" /config/www/.env
+    SED_DB_DATABASE=$(sed -e 's|[&\\/]|\\&|g; s|$|\\|; $s|\\$||' <<<"${DB_DATABASE}")
+    sed -i -E "s/^[#]?DB_DATABASE=.*/DB_DATABASE='${SED_DB_DATABASE}'/g" /config/www/.env
+    SED_DB_USER=$(sed -e 's|[&\\/]|\\&|g; s|$|\\|; $s|\\$||' <<<"${DB_USER}")
+    sed -i -E "s/^[#]?DB_USERNAME=.*/DB_USERNAME='${SED_DB_USER}'/g" /config/www/.env
+    SED_DB_PASS=$(sed -e 's|[&\\/]|\\&|g; s|$|\\|; $s|\\$||' <<<"${DB_PASS}")
+    sed -i -E "s/^[#]?DB_PASSWORD=.*/DB_PASSWORD='${SED_DB_PASS}'/g" /config/www/.env
 fi
 
 # set appurl