diff --git a/src/ajax.php b/src/ajax.php
index d0744f8..1479c28 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -188,7 +188,7 @@ elseif(isset($_GET['editNote']))
 	$db->dq("UPDATE {$db->prefix}todolist SET note=? WHERE id=$id", $note);
 	$t = array();
 	$t['total'] = 1;
-	$t['list'][] = array('id'=>$id, 'note'=>nl2br(htmlarray($note)), 'noteText'=>(string)$note);
+	$t['list'][] = array('id'=>$id, 'note'=>nl2br(escapeTags($note)), 'noteText'=>(string)$note);
 	echo json_encode($t);
 	exit;
 }
@@ -474,13 +474,13 @@ function prepareTaskRow($r, $tz)
 	$dCreated = timestampToDatetime($r['d_created'], $tz);
 	return array(
 		'id' => $r['id'],
-		'title' => htmlarray($r['title']),
+		'title' => escapeTags($r['title']),
 		'date' => htmlarray($dCreated),
 		'dateInline' => htmlarray(sprintf($lang->get('taskdate_inline'), $dCreated)),
 		'dateCompleted' => htmlarray(timestampToDatetime($r['d_completed'], $tz)),
 		'compl' => (int)$r['compl'],
 		'prio' => $r['prio'],
-		'note' => nl2br(htmlarray($r['note'])),
+		'note' => nl2br(escapeTags($r['note'])),
 		'noteText' => (string)$r['note'],
 		'ow' => (int)$r['ow'],
 		'tags' => htmlarray($r['tags']),
diff --git a/src/common.php b/src/common.php
index 4fb48fc..3c6e9e1 100644
--- a/src/common.php
+++ b/src/common.php
@@ -151,4 +151,16 @@ function url_dir($url)
 	return '/';
 }
 
+function escapeTags($s)
+{
+	$c1 = chr(1);
+	$c2 = chr(2);
+	$s = preg_replace("~<b>([\s\S]*?)</b>~i", "${c1}b${c2}\$1${c1}/b${c2}", $s);
+	$s = preg_replace("~<i>([\s\S]*?)</i>~i", "${c1}i${c2}\$1${c1}/i${c2}", $s);	
+	$s = preg_replace("~<u>([\s\S]*?)</u>~i", "${c1}u${c2}\$1${c1}/u${c2}", $s);
+	$s = preg_replace("~<s>([\s\S]*?)</s>~i", "${c1}s${c2}\$1${c1}/s${c2}", $s);
+	$s = str_replace(array($c1, $c2), array('<','>'), htmlspecialchars($s));
+	return $s;
+}
+
 ?>
\ No newline at end of file
diff --git a/src/feed.php b/src/feed.php
index 53f907b..b32f92d 100644
--- a/src/feed.php
+++ b/src/feed.php
@@ -37,8 +37,10 @@ while($r = $q->fetch_assoc($q))
 		$a[] = $lang->get('due'). ": ".formatDate3(Config::get('dateformat'), (int)$ad[0], (int)$ad[1], (int)$ad[2], $lang);
 	}
 	if($r['tags'] != '') $a[] = $lang->get('tags'). ": ". str_replace(',', ', ', $r['tags']);
-	$r['_descr'] = nl2br($r['note']). ($a && $r['note']!='' ? "<br><br>" : "").  implode("<br>", $a);
-	$data[] = htmlarray($r);
+	$r['title'] = strip_tags($r['title']);
+	$r['note'] = escapeTags($r['note']);
+	$r['_descr'] = nl2br($r['note']). ($a && $r['note']!='' ? "<br/><br/>" : "").  implode("<br/>", htmlarray($a));
+	$data[] = $r;
 }
 
 printRss($listData, $data);
@@ -58,10 +60,10 @@ function printRss($listData, $data)
 		$d = gmdate('r', $v['d_created']);
 		$guid = $listData['id'].'-'.$v['id'].'-'.$v['d_created'];
 
-		$s .= "<item>\n<title>$v[title]</title>\n".
+		$s .= "<item>\n<title><![CDATA[". str_replace("]]>", "]]]]><![CDATA[>", $v['title']). "]]></title>\n".
 			"<link>$link</link>\n".
 			"<pubDate>$d</pubDate>\n".
-			"<description>$v[_descr]</description>\n".
+			"<description><![CDATA[". $v['_descr']. "]]></description>\n".
 			"<guid isPermaLink=\"false\">$guid</guid>\n".
 			"</item>\n";
 	}