diff --git a/web/cgi-bin/horas/popup.pl b/web/cgi-bin/horas/popup.pl
index be67bf8d7d..ab6d4574d0 100755
--- a/web/cgi-bin/horas/popup.pl
+++ b/web/cgi-bin/horas/popup.pl
@@ -87,7 +87,7 @@ package main;
 
 $popup = strictparam('popup');
 
-if ($popup !~ /^[\$\&][\w ]+$/) {
+if ($popup !~ /^[\$\&][\&\w ]+$/) {
   print $q->header(
     -type => 'text/plain',
     -status => '400 Bad request',