Notes, escaping
Proper escaping (not using that URL)
Removing TODO