diff --git a/classes/local/outagelib.php b/classes/local/outagelib.php
index 35565d3..48374d6 100644
--- a/classes/local/outagelib.php
+++ b/classes/local/outagelib.php
@@ -284,7 +284,7 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
         require_once($CFG->dirroot.'/lib/classes/ip_utils.php');
     }
     // Put access key as a cookie if given. This stops the need to put it as a url param on every request.
-    $urlaccesskey = optional_param('accesskey', null, PARAM_TEXT);
+    $urlaccesskey = optional_param('accesskey', null, PARAM_ALPHANUM);
     $isphpunit = defined('PHPUNIT_TEST');
 
     if (!empty($urlaccesskey) && !$isphpunit) {
@@ -328,7 +328,7 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
         }
 
         if ({{USEACCESSKEY}} && $accesskeyblocked) {
-            echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: '. $useraccesskey .' -->';
+            echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: ' . htmlspecialchars($useraccesskey ?? '', ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
         }
 
         if (!$isphpunit) {
diff --git a/classes/output/renderer.php b/classes/output/renderer.php
index 4fce37b..35288ca 100644
--- a/classes/output/renderer.php
+++ b/classes/output/renderer.php
@@ -187,8 +187,8 @@ class renderer extends plugin_renderer_base {
         $outagehtml = html_writer::div(
             html_writer::tag(
                 'blockquote',
-                html_writer::div(html_writer::tag('b', $outage->get_title(), ['data-id' => $outage->id])) .
-                             html_writer::div(html_writer::tag('i', $outage->get_description())) .
+                html_writer::div(html_writer::tag('b', format_string($outage->get_title()), ['data-id' => $outage->id])) .
+                             html_writer::div(html_writer::tag('i', format_text($outage->get_description(), FORMAT_HTML))) .
                              html_writer::div(
                                  html_writer::tag('b', get_string('tableheaderwarnbefore', 'auth_outage') . ': ') .
                                  format_time($outage->get_warning_duration())
diff --git a/preview.php b/preview.php
index f2c2508..5627e1f 100644
--- a/preview.php
+++ b/preview.php
@@ -31,6 +31,8 @@ use auth_outage\local\controllers\maintenance_static_page;
 // @codingStandardsIgnoreStart
 require_once(__DIR__.'/../../config.php');
 // @codingStandardsIgnoreEnd
+require_once($CFG->libdir . '/adminlib.php');
+admin_externalpage_setup('auth_outage_manage');
 $id = optional_param('id', null, PARAM_INT);
 $outage = is_null($id) ? outagedb::get_next_starting() : outagedb::get_by_id($id);
 if (is_null($outage)) {
diff --git a/views/info/content.php b/views/info/content.php
index 0f44cce..fafdf38 100644
--- a/views/info/content.php
+++ b/views/info/content.php
@@ -39,7 +39,7 @@ defined('MOODLE_INTERNAL') || die();
         <b><?php echo get_string('infountil', 'auth_outage'); ?></b>
         <?php echo userdate($viewbag['outage']->stoptime, get_string('datetimeformat', 'auth_outage')); ?>
     </div>
-    <div class="auth_outage_info_description"><?php echo $viewbag['outage']->get_description(); ?></div>
+    <div class="auth_outage_info_description"><?php echo format_text($viewbag['outage']->get_description(), FORMAT_HTML); ?></div>
 
     <?php if ($viewbag['admin']) : ?>
         <?php