anchor.diff:  	if(!linkless)
   		output = navbar
   	if(target_ckey)
  -		var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_ckey]'")
  +		var/target_sql_ckey = sanitizeSQL(target_ckey)
  +		var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]'")
   		if(!query_get_notes.Execute())
   			var/err = query_get_notes.ErrorMsg()
   			log_game("SQL ERROR obtaining ckey, notetext, adminckey, last_editor, server from notes table. Error : \[[err]\]\n")
  
positive.code: 		var/search
  		output += "<center><a href='?_src_=holder;addnoteempty=1'>\[Add Note\]</a></center>"
  		output += ruler
  		switch(index)
  			if(1)
  				search = "^."
  
negative.code: 	if(!server)
  		if (config && config.server_name)
  			server = config.server_name
  	server = sanitizeSQL(server)
  	var/DBQuery/query_noteadd = dbcon.NewQuery("INSERT INTO [format_table_name("notes")] (ckey, timestamp, notetext, adminckey, server) VALUES ('[target_sql_ckey]', '[timestamp]', '[notetext]', '[admin_sql_ckey]', '[server]')")
  	if(!query_noteadd.Execute())
  		var/err = query_noteadd.ErrorMsg()
  