diff --git a/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml b/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
index 4eb0b192..e5638ece 100644
--- a/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
+++ b/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
@@ -964,22 +964,55 @@
     <script type="text/javascript">
         var callId = @(Model.Call.CallId);
 
-        var newCallForm = $('#fb-template').formRender({
-            dataType: 'json',
-            formData: '@Html.Raw(Model.Call.CallFormData)',
-            notify: {
-                error: function(message) {
-
-                },
-                success: function(message) {
-                    $('input, textarea, select', '.rendered-form').attr('readonly', true).attr('disabled', true)
-                },
-                warning: function(message) {
+        var callFormData = @Html.Raw(Newtonsoft.Json.JsonConvert.SerializeObject(Model.Call.CallFormData ?? string.Empty, new Newtonsoft.Json.JsonSerializerSettings { StringEscapeHandling = Newtonsoft.Json.StringEscapeHandling.EscapeHtml }));
 
+        // CallFormData is API-writable free text; older/external clients stored plain text
+        // (e.g. "Submitted ...") which formRender's JSON.parse can't handle. Only render the
+        // form for valid formBuilder data, otherwise show the raw text read-only.
+        var callFormFields = null;
+        try {
+            callFormFields = JSON.parse(callFormData);
+        } catch (e) { }
+
+        if (Array.isArray(callFormFields)) {
+            // form-render inserts label/option/description content as HTML and its sanitizer is a
+            // no-op unless DOMPurify is loaded (it isn't). CallFormData is API-writable, so escape
+            // the HTML-rendered props and show them as plain text.
+            var escapeHtml = function (value) {
+                return typeof value === 'string'
+                    ? value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;')
+                    : value;
+            };
+            callFormFields.forEach(function (field) {
+                if (!field || typeof field !== 'object') return;
+                field.label = escapeHtml(field.label);
+                field.description = escapeHtml(field.description);
+                if (Array.isArray(field.values)) {
+                    field.values.forEach(function (option) {
+                        if (option && typeof option === 'object') option.label = escapeHtml(option.label);
+                    });
+                }
+            });
+
+            var newCallForm = $('#fb-template').formRender({
+                dataType: 'json',
+                formData: JSON.stringify(callFormFields),
+                notify: {
+                    error: function(message) {
+
+                    },
+                    success: function(message) {
+                        $('input, textarea, select, button', '#fb-template .rendered-form').attr('readonly', true).attr('disabled', true)
+                    },
+                    warning: function(message) {
+
+                    }
                 }
-            }
 
-        });
+            });
+        } else if (callFormData) {
+            $('#fb-template').text(callFormData);
+        }
     </script>
 
     <script src="~/js/app/common/signalr/resgrid.common.signalr.js" type="text/javascript"></script>