/* global module, require */
const URLHelper = require('../util/url-helper');
module.exports = function formatNoteToHtml(noteText) {
	'use strict';
	if (!noteText) {
		return '';
	}
	if (typeof noteText !== 'string') {
		throw 'invalid-args';
	}
	const safeString = noteText.replace(/</g, '&lt;').replace(/>/g, '&gt;');
	return URLHelper.formatLinks(safeString);
};

@@ -69,16 +69,44 @@
 helper')
+,%0A%09_ = require('underscore')
 ;%0Amodule
@@ -291,59 +291,25 @@
 g = 
-noteText.replace(/%3C/g, '&lt;').replace(/%3E/g, '&gt;'
+_.escape(noteText
 );%0A%09

use _.escape instead of hand-coding html escape