htmlspecialchars isn't required for the javascript, only the \r?\n escape
because we are using javascript to populate the messages list we need to make sure all special chars are escaped or line feeds will cause problems
Implement new messages class Support legacy $_SESSION['message_*'] New function messages::add($message, $mood, $delay) to simplify adding messages updated core/users/user_edit.php to demonstrate includes space->tab corrections