[SECURITY] Missing escaping for sys_notes