diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index e6fc71043d9..1e0f68872ab 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -9112,7 +9112,7 @@ WHERE m.useridto = :userid AND p.name='popup'";
                 $smallmessage = get_string('unreadnewnotification', 'message');
             }
             if (!empty($smallmessage)) {
-                $strmessages .= '<div id="usermessage">'.$smallmessage.'</div>';
+                $strmessages .= '<div id="usermessage">'.s($smallmessage).'</div>';
             }
         }
 
diff --git a/message/lib.php b/message/lib.php
index e034c412836..280542aba8f 100644
--- a/message/lib.php
+++ b/message/lib.php
@@ -1879,9 +1879,9 @@ function message_format_message($message, $format='', $keywords='', $class='othe
 
     //if supplied display small messages as fullmessage may contain boilerplate text that shouldnt appear in the messaging UI
     if (!empty($message->smallmessage)) {
-        $messagetext = format_text($message->smallmessage, FORMAT_MOODLE, $options);
+        $messagetext = format_text(s($message->smallmessage), FORMAT_MOODLE, $options);
     } else {
-        $messagetext = format_text($message->fullmessage, $message->fullmessageformat, $options);
+        $messagetext = format_text(s($message->fullmessage), $message->fullmessageformat, $options);
     }
 
     $messagetext .= message_format_contexturl($message);
@@ -1945,7 +1945,7 @@ function message_post_message($userfrom, $userto, $message, $format) {
     }
 
     $eventdata->fullmessageformat = $format;
-    $eventdata->smallmessage     = strip_tags($message);//strip just in case there are is any html that would break the popup notification
+    $eventdata->smallmessage     = $message;//store the message unfiltered. Clean up on output.
 
     $s = new stdClass();
     $s->sitename = $SITE->shortname;
diff --git a/message/output/jabber/message_output_jabber.php b/message/output/jabber/message_output_jabber.php
index 945d790f895..8969277b482 100644
--- a/message/output/jabber/message_output_jabber.php
+++ b/message/output/jabber/message_output_jabber.php
@@ -59,6 +59,7 @@ class message_output_jabber extends message_output {
             }
             $jabberaddress = $jabberaddresses[$eventdata->userto->id];
 
+            //calling s() on smallmessage causes Jabber to display things like &lt; Jabber != a browser
             $jabbermessage = fullname($eventdata->userfrom).': '.$eventdata->smallmessage;
 
             if (!empty($eventdata->contexturl)) {