diff --git a/src/ajax.php b/src/ajax.php
index c6181e7..0dc7420 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -809,12 +809,12 @@ function myExceptionHandler($e)
 	{
 		if(-1 == $e->getCode()) {
 			//thrown in myErrorHandler
-			die2($e->getMessage()."\n". $e->getTraceAsString(), $e->getMessage());
+			logAndDie($e->getMessage()."\n". $e->getTraceAsString(), $e->getMessage());
 		}
-		die2('Exception: \''. $e->getMessage() .'\' in '. $e->getFile() .':'. $e->getLine());
+		logAndDie('Exception: \''. $e->getMessage() .'\' in '. $e->getFile() .':'. $e->getLine());
 	}
 	catch(Exception $e) {
-		die2('Exception in ExceptionHandler: \''. $e->getMessage() .'\' in '. $e->getFile() .':'. $e->getLine());
+		logAndDie('Exception in ExceptionHandler: \''. $e->getMessage() .'\' in '. $e->getFile() .':'. $e->getLine());
 	}
 	exit;
 }
diff --git a/src/includes/class.lang.php b/src/includes/class.lang.php
index 6f0d28e..879b791 100644
--- a/src/includes/class.lang.php
+++ b/src/includes/class.lang.php
@@ -36,7 +36,7 @@ class Lang
 			$lang->loadDefaultStrings();
 		}
 		else if ( $die == 1 ) {
-			die("Language file not found ($code.json)");
+			die("Language file not found (". htmlspecialchars($code). ".json)");
 		}
 	}
 
@@ -68,7 +68,7 @@ class Lang
 	function loadDefaultStrings()
 	{
 		if ( ! self::langExists($this->default) ) {
-			die("Default language file not found ({$this->default}.json)");
+			die("Default language file not found (". htmlspecialchars($this->default). ".json)");
 		}
 		$defStr = file_get_contents($this->langDir(). "{$this->default}.json");
 		$this->strings = json_decode($defStr, true);
diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index 88fdd61..2754747 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -2297,8 +2297,8 @@ function hideList(listId)
 function flashError(str, details)
 {
 	if (details === undefined) details = '';
-	$("#msg>.msg-text").text(str)
-	$("#msg>.msg-details").text(details);
+	$("#msg>.msg-text").text(dehtml(str))
+	$("#msg>.msg-details").text(dehtml(details));
 	$("#loading").hide();
 	$("#msg").addClass('mtt-error').effect("highlight", {color:_mtt.theme.msgFlashColor}, 700);
 }
@@ -2306,8 +2306,8 @@ function flashError(str, details)
 function flashInfo(str, details)
 {
 	if (details === undefined) details = '';
-	$("#msg>.msg-text").text(str)
-	$("#msg>.msg-details").text(details);
+	$("#msg>.msg-text").text(dehtml(str))
+	$("#msg>.msg-details").text(dehtml(details));
 	$("#loading").hide();
 	$("#msg").addClass('mtt-info').effect("highlight", {color:_mtt.theme.msgFlashColor}, 700);
 }
diff --git a/src/init.php b/src/init.php
index e174da4..443fe49 100644
--- a/src/init.php
+++ b/src/init.php
@@ -39,7 +39,7 @@ if(Config::get('db') == 'mysql')
 		$db->connect(Config::get('mysql.host'), Config::get('mysql.user'), Config::get('mysql.password'), Config::get('mysql.db'));
 	}
 	catch(Exception $e) {
-		die2("Failed to connect to mysql database: ". $e->getMessage());
+		logAndDie("Failed to connect to mysql database: ". $e->getMessage());
 	}
 	$db->dq("SET NAMES utf8");
 }
@@ -253,10 +253,10 @@ function jsonExit($data)
 	exit;
 }
 
-function die2($userText, $errText = null)
+function logAndDie($userText, $errText = null)
 {
 	$errText === null ? error_log($userText) : error_log($errText);
-	echo $userText;
+	echo htmlspecialchars($userText);
 	exit(1);
 }
 
diff --git a/src/mytinytodo_lang.php b/src/mytinytodo_lang.php
index b32c2df..0bdf0ef 100644
--- a/src/mytinytodo_lang.php
+++ b/src/mytinytodo_lang.php
@@ -260,7 +260,7 @@ class DefaultLang
 	function loadLangHeader($langFile)
 	{
 		if (!file_exists($langFile)) {
-			die("file does not exist: $langFile");
+			die("file does not exist: ". htmlspecialchars($langFile));
 		}
 		$contents = file_get_contents($langFile);