diff --git a/DeskHub-Webseite/staff/ticket_create.php b/DeskHub-Webseite/staff/ticket_create.php
index 48f53788..21236998 100644
--- a/DeskHub-Webseite/staff/ticket_create.php
+++ b/DeskHub-Webseite/staff/ticket_create.php
@@ -291,7 +291,7 @@ require __DIR__ . '/_header.php';
         <button type="button" onclick="document.execCommand('insertUnorderedList')">•</button>
         <button type="button" onclick="document.execCommand('insertOrderedList')">1.</button>
       </div>
-      <div class="richtext-editable" id="msg-editor" contenteditable="true"><?= $_POST['message'] ?? '' ?></div>
+      <div class="richtext-editable" id="msg-editor" contenteditable="true"><?= sanitize_staff_html((string) ($_POST['message'] ?? '')) ?></div>
     </div>
     <input type="hidden" name="message" id="msg-hidden">
   </div>
@@ -342,7 +342,7 @@ require __DIR__ . '/_header.php';
         <button type="button" onclick="document.execCommand('underline')"><u>U</u></button>
         <button type="button" onclick="document.execCommand('insertUnorderedList')">•</button>
       </div>
-      <div class="richtext-editable" id="note-editor" contenteditable="true" style="min-height:80px; border-color:var(--accent)"><?= $_POST['internal_note'] ?? '' ?></div>
+      <div class="richtext-editable" id="note-editor" contenteditable="true" style="min-height:80px; border-color:var(--accent)"><?= sanitize_staff_html((string) ($_POST['internal_note'] ?? '')) ?></div>
     </div>
     <input type="hidden" name="internal_note" id="note-hidden">
   </div>