diff --git a/skin/admin.phps b/skin/admin.phps
index 97b75c8..2ed9660 100644
--- a/skin/admin.phps
+++ b/skin/admin.phps
@@ -134,14 +134,14 @@ HTML;
 
 function uploads_item($ctx, $id, $direct_url, $note_en, $note_ru, $markdown, $name, $size) {
 $fix_nl_re = '/(\r)?\n/';
-$as_note_ru = preg_replace($fix_nl_re, '\n', addslashes($note_ru));
-$as_note_en = preg_replace($fix_nl_re, '\n', addslashes($note_en));
+$as_note_ru = jsonEncode(preg_replace($fix_nl_re, '\n', addslashes($note_ru)));
+$as_note_en = jsonEncode(preg_replace($fix_nl_re, '\n', addslashes($note_en)));
 return <<<HTML
 <div class="blog-upload-item">
     <div class="blog-upload-item-actions">
         <a href="javascript:void(0)" onclick="var mdel = ge('upload{$id}_md'); mdel.style.display = (mdel.style.display === 'none' ? 'block' : 'none')">{$ctx->lang('blog_upload_show_md')}</a>
-        | <a href="javascript:void(0)" onclick="BlogUploadList.submitNoteEdit('/admin/uploads/edit_note/{$id}/?lang=ru&token={$ctx->csrf('editupl'.$id)}', prompt('Note (Ru):', '{$as_note_ru}'))">Edit note Ru</a>
-        | <a href="javascript:void(0)" onclick="BlogUploadList.submitNoteEdit('/admin/uploads/edit_note/{$id}/?lang=en&token={$ctx->csrf('editupl'.$id)}', prompt('Note (En):', '{$as_note_en}'))">Edit note En</a>
+        | <a href="javascript:void(0)" onclick='BlogUploadList.submitNoteEdit("/admin/uploads/edit_note/{$id}/?lang=ru&token={$ctx->csrf('editupl'.$id)}", prompt("Note (Ru):", {$as_note_ru}))'>Edit note Ru</a>
+        | <a href="javascript:void(0)" onclick='BlogUploadList.submitNoteEdit("/admin/uploads/edit_note/{$id}/?lang=en&token={$ctx->csrf('editupl'.$id)}", prompt("Note (En):", {$as_note_en}))'>Edit note En</a>
         | <a href="/admin/uploads/delete/{$id}/?token={$ctx->csrf('delupl'.$id)}" onclick="return confirm('{$ctx->lang('blog_upload_delete_confirmation')}')">{$ctx->lang('blog_upload_delete')}</a>
     </div>
     <div class="blog-upload-item-name"><a href="{$direct_url}">{$name}</a></div>
