diff --git a/code/modules/admin/sql_notes.dm b/code/modules/admin/sql_notes.dm
index 54af84cb2b9..6659e7e804b 100644
--- a/code/modules/admin/sql_notes.dm
+++ b/code/modules/admin/sql_notes.dm
@@ -32,6 +32,7 @@
 	if(!server)
 		if (config && config.server_name)
 			server = config.server_name
+	server = sanitizeSQL(server)
 	var/DBQuery/query_noteadd = dbcon.NewQuery("INSERT INTO [format_table_name("notes")] (ckey, timestamp, notetext, adminckey, server) VALUES ('[target_sql_ckey]', '[timestamp]', '[notetext]', '[admin_sql_ckey]', '[server]')")
 	if(!query_noteadd.Execute())
 		var/err = query_noteadd.ErrorMsg()
@@ -51,7 +52,8 @@
 		return
 	if(!note_id)
 		return
-	var/DBQuery/query_find_note_del = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = '[note_id]'")
+	note_id = text2num(note_id)
+	var/DBQuery/query_find_note_del = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]")
 	if(!query_find_note_del.Execute())
 		var/err = query_find_note_del.ErrorMsg()
 		log_game("SQL ERROR obtaining ckey, notetext, adminckey from notes table. Error : \[[err]\]\n")
@@ -60,7 +62,7 @@
 		ckey = query_find_note_del.item[1]
 		notetext = query_find_note_del.item[2]
 		adminckey = query_find_note_del.item[3]
-	var/DBQuery/query_del_note = dbcon.NewQuery("DELETE FROM [format_table_name("notes")] WHERE id = '[note_id]'")
+	var/DBQuery/query_del_note = dbcon.NewQuery("DELETE FROM [format_table_name("notes")] WHERE id = [note_id]")
 	if(!query_del_note.Execute())
 		var/err = query_del_note.ErrorMsg()
 		log_game("SQL ERROR removing note from table. Error : \[[err]\]\n")
@@ -75,9 +77,10 @@
 		return
 	if(!note_id)
 		return
+	note_id = text2num(note_id)
 	var/target_ckey
 	var/sql_ckey = sanitizeSQL(usr.ckey)
-	var/DBQuery/query_find_note_edit = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = '[note_id]'")
+	var/DBQuery/query_find_note_edit = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]")
 	if(!query_find_note_edit.Execute())
 		var/err = query_find_note_edit.ErrorMsg()
 		log_game("SQL ERROR obtaining notetext from notes table. Error : \[[err]\]\n")
@@ -89,16 +92,17 @@
 		var/new_note = input("Input new note", "New Note", "[old_note]") as message
 		if(!new_note)
 			return
+		new_note = sanitizeSQL(new_note)
 		var/edit_text = "Edited by [sql_ckey] on [SQLtime()] from<br>[old_note]<br>to<br>[new_note]<hr>"
 		edit_text = sanitizeSQL(edit_text)
-		var/DBQuery/query_update_note = dbcon.NewQuery("UPDATE [format_table_name("notes")] SET notetext = '[new_note]', last_editor = '[sql_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE (id = '[note_id]')")
+		var/DBQuery/query_update_note = dbcon.NewQuery("UPDATE [format_table_name("notes")] SET notetext = '[new_note]', last_editor = '[sql_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE id = [note_id]")
 		if(!query_update_note.Execute())
 			var/err = query_update_note.ErrorMsg()
 			log_game("SQL ERROR editing note. Error : \[[err]\]\n")
 			return
 		log_admin("[key_name(usr)] has edited [target_ckey]'s note made by [adminckey] from [old_note] to [new_note]")
 		message_admins("[key_name_admin(usr)] has edited [target_ckey]'s note made by [adminckey] from<br>[old_note]<br>to<br>[new_note]")
-	show_note(target_ckey)
+		show_note(target_ckey)
 
 /proc/show_note(target_ckey, index, linkless = 0)
 	var/output
@@ -115,7 +119,8 @@
 	if(!linkless)
 		output = navbar
 	if(target_ckey)
-		var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_ckey]'")
+		var/target_sql_ckey = sanitizeSQL(target_ckey)
+		var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]'")
 		if(!query_get_notes.Execute())
 			var/err = query_get_notes.ErrorMsg()
 			log_game("SQL ERROR obtaining ckey, notetext, adminckey, last_editor, server from notes table. Error : \[[err]\]\n")
@@ -142,6 +147,7 @@
 		var/search
 		output += "<center><a href='?_src_=holder;addnoteempty=1'>\[Add Note\]</a></center>"
 		output += ruler
+		index = sanitizeSQL(index)
 		switch(index)
 			if(1)
 				search = "^."
@@ -193,7 +199,6 @@
 			timestamp = query_convert_time.item[1]
 		if(ckey && notetext && timestamp && adminckey && server)
 			add_note(ckey, notetext, timestamp, adminckey, 0, server)
-		else
 	notesfile.cd = "/"
 	notesfile.dir.Remove(ckey)