4 files changed, 34 insertions, 22 deletions
diff --git a/modules/notification/views/comment_published.html.php b/modules/notification/views/comment_published.html.php
index 23588c72..ff2ba0bc 100644
--- a/modules/notification/views/comment_published.html.php
+++ b/modules/notification/views/comment_published.html.php
@@ -1,30 +1,34 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <html>
   <head>
-    <title><?= $subject ?> </title>
+    <title><?= p::clean($subject) ?> </title>
   </head>
   <body>
-    <h2><?= $subject ?></h2>
+    <h2><?= p::clean($subject) ?></h2>
     <table>
       <tr>
         <td><?= t("Comment:") ?></td>
-        <td><?= $comment->text ?></td>
+        <td><?= p::clean($comment->text) ?></td>
       </tr>
       <tr>
         <td><?= t("Author Name:") ?></td>
-        <td><?= $comment->author_name() ?></td>
+        <td><?= p::clean($comment->author_name()) ?></td>
       </tr>
       <tr>
         <td><?= t("Author Email:") ?></td>
-        <td><?= $comment->author_email() ?></td>
+        <td><?= p::clean($comment->author_email()) ?></td>
       </tr>
       <tr>
         <td><?= t("Author URL:") ?></td>
-        <td><?= $comment->author_url() ?></td>
+        <td><?= p::clean($comment->author_url()) ?></td>
       </tr>
       <tr>
         <td><?= t("Url:") ?></td>
-        <td><a href="<?= $comment->item()->url(array(), true) ?>#comments"><?= $comment->item()->url(array(), true) ?>#comments</a></td>
+        <td>
+          <a href="<?= $comment->item()->url(array(), true) ?>#comments">
+            <?= $comment->item()->url(array(), true) ?>#comments
+          </a>
+        </td>
       </tr>
     </table>
   </body>
diff --git a/modules/notification/views/item_added.html.php b/modules/notification/views/item_added.html.php
index b67b9f38..32857c08 100644
--- a/modules/notification/views/item_added.html.php
+++ b/modules/notification/views/item_added.html.php
@@ -1,23 +1,27 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <html>
   <head>
-    <title><?= $subject ?> </title>
+    <title><?= p::clean($subject) ?> </title>
   </head>
   <body>
-    <h2><?= $subject ?></h2>
+    <h2><?= p::clean($subject) ?></h2>
     <table>
       <tr>
         <td><?= t("Title:") ?></td>
-        <td><?= $item->title ?></td>
+        <td><?= p::clean($item->title) ?></td>
       </tr>
       <tr>
         <td><?= t("Url:") ?></td>
-        <td><a href="<?= $item->url(array(), true) ?>"><?= $item->url(array(), true) ?></a></td>
+        <td>
+          <a href="<?= $item->url(array(), true) ?>">
+            <?= $item->url(array(), true) ?>
+          </a>
+        </td>
       </tr>
       <? if ($item->description): ?>
       <tr>
         <td><?= t("Description:") ?></td>
-        <td><?= $item->description ?></td>
+        <td><?= p::clean($item->description) ?></td>
       </tr>
       <? endif ?>
     </table>
diff --git a/modules/notification/views/item_deleted.html.php b/modules/notification/views/item_deleted.html.php
index ac9ab594..2d6d5738 100644
--- a/modules/notification/views/item_deleted.html.php
+++ b/modules/notification/views/item_deleted.html.php
@@ -1,20 +1,24 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <html>
   <head>
-    <title><?= $subject ?> </title>
+    <title><?= p::clean($subject) ?> </title>
   </head>
   <body>
-    <h2><?= $subject ?></h2>
+    <h2><?= p::clean($subject) ?></h2>
     <table>
       <tr>
         <td colspan="2">
           <?= t("To view the changed album %title use the link below.",
-              array("title" => $item->parent()->title)) ?>
+              array("title" => p::clean($item->parent()->title))) ?>
         </td>
       </tr>
       <tr>
         <td><?= t("Url:") ?></td>
-        <td><a href="<?= $item->parent()->url(array(), true) ?>"><?= $item->parent()->url(array(), true) ?></a></td>
+        <td>
+          <a href="<?= $item->parent()->url(array(), true) ?>">
+            <?= $item->parent()->url(array(), true) ?>
+          </a>
+        </td>
       </tr>
     </table>
   </body>
diff --git a/modules/notification/views/item_updated.html.php b/modules/notification/views/item_updated.html.php
index cba522e8..0620c50c 100644
--- a/modules/notification/views/item_updated.html.php
+++ b/modules/notification/views/item_updated.html.php
@@ -1,18 +1,18 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <html>
   <head>
-    <title><?= $subject ?> </title>
+    <title><?= p::clean($subject) ?> </title>
   </head>
   <body>
-    <h2> <?= $subject ?> </h2>
+    <h2> <?= p::clean($subject) ?> </h2>
     <table>
       <tr>
         <? if ($old->title != $new->title): ?>
         <td><?= t("New Title:") ?></td>
-        <td><?= $new->title ?></td>
+        <td><?= p::clean($new->title) ?></td>
         <? else: ?>
         <td><?= t("Title:") ?></td>
-        <td><?= $new->title ?></td>
+        <td><?= p::clean($new->title) ?></td>
         <? endif ?>
       </tr>
       <tr>
@@ -22,12 +22,12 @@
       <? if ($old->description != $new->description): ?>
       <tr>
         <td><?= t("New Description:") ?></td>
-        <td><?= $new->description ?></td>
+        <td><?= p::clean($new->description) ?></td>
       </tr>
       <? elseif (!empty($new->description)): ?>
       <tr>
         <td><?= t("Description:") ?></td>
-        <td><?= $new->description ?></td>
+        <td><?= p::clean($new->description) ?></td>
       </tr>
       <? endif ?>
     </table>