diff --git a/js/base.php b/js/base.php
index e6b184f..41d229e 100644
--- a/js/base.php
+++ b/js/base.php
@@ -294,6 +294,9 @@ const toast = {
 		div.id = id;
 		div.className = 'toast-container';
 		div.setAttribute('onclick', 'this.remove()');
+		text = text.replaceAll('&','&amp;').replaceAll('<','&lt;').replaceAll('>','&gt;');
+		text = html2text(text);
+		text = text.replaceAll('&','&amp;').replaceAll('<','&lt;').replaceAll('>','&gt;');
 		div.innerHTML = '<div class="toast '+type+'"><p style="margin: auto 0 !important;font-size: 1.2em;line-height: 1.8em;">'+
 			'<i style="margin-right: 1em;font-size: 1.2em;position:relative;top:.1em" class="fa fa-'+fa+'"></i>'+capitalize(text)+'</p></div>';
 		if (document.getElementById('toast-container') !== null)