diff --git a/resources/static/dialog/controllers/dialog.js b/resources/static/dialog/controllers/dialog.js
index 0e369ee4f6e5488eaf344b2782996cc28a98c72a..febe54823f867781fe1a55648028af1ab1f80b33 100644
--- a/resources/static/dialog/controllers/dialog.js
+++ b/resources/static/dialog/controllers/dialog.js
@@ -127,7 +127,7 @@ BrowserID.Modules.Dialog = (function() {
       // rely upon the RP to do that. In particular we must guard against
       // these strings containing <script> tags. We will populate a new
       // object ("params") with suitably type-checked properties.
-      params = {};
+      var params = {};
       params.hostname = user.getHostname();
 
       // verify params