Use notifIt instead alerts; add protection against JS injection