- don't encode apostrophes - only encode quotes in attributes - encode control characters (as in PR #465)
The note is not visible to the blocked user.