diff --git a/lib/weblib.php b/lib/weblib.php
index 1c7c60b5b72..ca4bbbf0073 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -146,6 +146,7 @@ function addslashes_js($var) {
     if (is_string($var)) {
         $var = str_replace('\\', '\\\\', $var);
         $var = str_replace(array('\'', '"', "\n", "\r", "\0"), array('\\\'', '\\"', '\\n', '\\r', '\\0'), $var);
+        $var = str_replace('</', '<\/', $var);   // XHTML compliance
     } else if (is_array($var)) {
         $var = array_map('addslashes_js', $var);
     } else if (is_object($var)) {
diff --git a/message/lib.php b/message/lib.php
index f5498f4bf2e..6c278acb962 100644
--- a/message/lib.php
+++ b/message/lib.php
@@ -203,7 +203,7 @@ function message_print_contacts() {
     echo '<br />';
 
     $autorefresh = '<p align="center" class="note">'.get_string('pagerefreshes', 'message', $CFG->message_contacts_refresh).'</p>';
-    $autorefresh = addslashes($autorefresh); // js escaping
+    $autorefresh = addslashes_js($autorefresh); // js escaping
 
     // gracefully degrade JS autorefresh
     echo '<script type="text/javascript">
diff --git a/message/refresh.php b/message/refresh.php
index 1c20c828181..daa3a81c389 100644
--- a/message/refresh.php
+++ b/message/refresh.php
@@ -40,7 +40,7 @@
     echo '  parent.messages.document.write("<html><head><title> <\/title>");'."\n";
     echo '  parent.messages.document.write("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" />");'."\n";
     echo '  parent.messages.document.write("<base target=\"_blank\" />");'."\n";
-    echo '  parent.messages.document.write("'.addslashes($stylesheetshtml).'");'."\n";
+    echo '  parent.messages.document.write("'.addslashes_js($stylesheetshtml).'");'."\n";
     echo '  parent.messages.document.write("<\/head><body class=\"message course-1\" id=\"message-messages\"><div style=\"display: none\" id=\"messagestarted\">&nbsp;<\/div>");'."\n";
     echo '}'."\n";
 
@@ -55,14 +55,11 @@
             $options = new object();
             $options->para = false;
             $options->newlines = true;
-            $printmessage = format_text($message->message, $message->format, $options, 0);
-            $printmessage = str_replace("\r", ' ', $printmessage);
-            $printmessage = str_replace("\n", ' ', $printmessage);
+            $printmessage = format_text($message->message, $message->format, $options);
             $printmessage = '<div class="message other"><span class="author">'.s($userfullname).'</span> '.
                 '<span class="time">['.$time.']</span>: '.
                 '<span class="content">'.$printmessage.'</span></div>';
-            $printmessage = addslashes($printmessage);                 // So Javascript can write it
-            $printmessage = str_replace('</', '<\/', $printmessage);   // XHTML compliance
+            $printmessage = addslashes_js($printmessage);  // So Javascript can write it
             echo "parent.messages.document.write('".$printmessage."');\n";
 
             /// Move the entry to the other table
diff --git a/message/send.php b/message/send.php
index b7cb47b3196..4da717a3e0e 100644
--- a/message/send.php
+++ b/message/send.php
@@ -65,16 +65,13 @@
         $options = NULL;
         $options->para = false;
         $options->newlines = true;
-        $message = format_text($message, $format, $options, 0);
+        $message = format_text($message, $format, $options);
 
-        $message = str_replace("\r", ' ', $message);
-        $message = str_replace("\n", ' ', $message);
         $time = userdate(time(), get_string('strftimedaytime'));
         $message = '<div class="message me"><span class="author">'.fullname($USER).'</span> '.
                    '<span class="time">['.$time.']</span>: '.
                    '<span class="content">'.$message.'</span></div>';
-        $message = addslashes($message);                 // So Javascript can write it
-        $message = str_replace('</', '<\/', $message);   // XHTML compliance
+        $message = addslashes_js($message);  // So Javascript can write it
 
     /// Then write it to our own message screen immediately
         echo "\n<script type=\"text/javascript\">\n<!--\n";
diff --git a/mod/chat/gui_header_js/jsupdate.php b/mod/chat/gui_header_js/jsupdate.php
index 4ad59485111..5b15a73413a 100644
--- a/mod/chat/gui_header_js/jsupdate.php
+++ b/mod/chat/gui_header_js/jsupdate.php
@@ -80,7 +80,7 @@
     /// required stylesheets
     $stylesheetshtml = '';
     foreach ($CFG->stylesheets as $stylesheet) {
-        $stylesheetshtml .= '<link rel=\\"stylesheet\\" type=\\"text/css\\" href=\\"'.$stylesheet.'\\" />';
+        $stylesheetshtml .= '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'" />';
     }
 
     // use ob to be able to send Content-Length headers
@@ -102,7 +102,7 @@
             parent.msg.document.write("<html><head>");
             parent.msg.document.write("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" />");
             parent.msg.document.write("<base target=\"_blank\" />");
-            parent.msg.document.write("<?php echo $stylesheetshtml ?>");
+            parent.msg.document.write("<?php echo addslashes_js($stylesheetshtml) ?>");
             parent.msg.document.write("<\/head><body class=\"mod-chat-gui_header_js course-<?php echo $chatuser->course ?>\" id=\"mod-chat-gui_header_js-jsupdate\"><div style=\"display: none\" id=\"msgStarted\">&nbsp;<\/div>");
         }
         <?php
@@ -121,7 +121,7 @@
                      $refreshusers = true;
                 }
                 $us[$message->userid] = $timenow - $message->timestamp;
-                echo "parent.msg.document.write('".addslashes($formatmessage->html)."\\n');\n";
+                echo "parent.msg.document.write('".addslashes_js($formatmessage->html)."\\n');\n";
              }
         }
 
diff --git a/mod/chat/gui_header_js/jsupdated.php b/mod/chat/gui_header_js/jsupdated.php
index d8da3a1db43..a9ce81c7292 100644
--- a/mod/chat/gui_header_js/jsupdated.php
+++ b/mod/chat/gui_header_js/jsupdated.php
@@ -73,7 +73,7 @@
     /// required stylesheets
     $stylesheetshtml = '';
     foreach ($CFG->stylesheets as $stylesheet) {
-        $stylesheetshtml .= '<link rel=\\"stylesheet\\" type=\\"text/css\\" href=\\"'.$stylesheet.'\\" />';
+        $stylesheetshtml .= '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'" />';
     }
 
 ?>
@@ -90,7 +90,7 @@
             parent.msg.document.write("<html><head>");
             parent.msg.document.write("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" />");
             parent.msg.document.write("<base target=\"_blank\" />");
-            parent.msg.document.write("<?php echo $stylesheetshtml ?>");
+            parent.msg.document.write("<?php echo addslashes_js($stylesheetshtml) ?>");
             parent.msg.document.write("</head><body class=\"mod-chat-gui_header_js course-<?php echo $chatuser->course ?>\" id=\"mod-chat-gui_header_js-jsupdate\"><div style=\"display: none\" id=\"msgStarted\">&nbsp;</div>");
         }
         //]]>
@@ -174,7 +174,7 @@
                     $refreshusers = true;
                 }
                 $us[$message->userid] = $timenow - $message->timestamp;
-                echo "parent.msg.document.write('".addslashes($formatmessage->html )."\\n');\n";
+                echo "parent.msg.document.write('".addslashes_js($formatmessage->html )."\\n');\n";
 
             }
             // from the last message printed...
diff --git a/mod/quiz/view.php b/mod/quiz/view.php
index 61871d14eb7..818697a9cf7 100644
--- a/mod/quiz/view.php
+++ b/mod/quiz/view.php
@@ -383,7 +383,7 @@
 <!--
 document.write('<input type="button" value="<?php echo $buttontext ?>" onclick="javascript: <?php
                 if ($strconfirmstartattempt) {
-                    echo "if (confirm(\\'".addslashes($strconfirmstartattempt)."\\'))";
+                    echo "if (confirm(\\'".addslashes_js($strconfirmstartattempt)."\\'))";
                 }
 ?> window.open(\'<?php echo $attempturl ?>\', \'<?php echo $window ?>\', \'<?php echo $windowoptions ?>\'); " />');
 // -->