@@ -443,11 +443,9 @@ public function recovery_mode_notice() {
 			$msg = __( "<strong>RECOVERY MODE ENABLED:</strong> CSS output for the Add Admin CSS plugin is disabled on this page view.", 'add-admin-css' );
 		}
 
-		echo <<<HTML
-			<div class="notice notice-error">
-				<p>{$msg}</p>
-			</div>
-HTML;
+		echo '<div class="notice notice-error">' . "\n";
+		echo "\t<p>" . wp_kses( $msg, array( 'code' => array(), 'strong' => array() ) ). "</p>\n";
+		echo '</div>' . "\n";
 	}
 
 	/**
@@ -625,11 +623,9 @@ public function add_css() {
 		$css = trim( apply_filters( 'c2c_add_admin_css', $css ) );
 
 		if ( $css ) {
-			echo "
-			<style>
-			$css
-			</style>
-			";
+			echo "<style>\n";
+			echo esc_html( $css ) . "\n";
+			echo "</style>\n";
 		}
 	}
 
 
@@ -378,11 +378,9 @@ public function test_add_css_to_head_with_just_css( $expected = false ) {
 		ob_end_clean();
 
 		if ( false === $expected ) {
-			$expected = "
-			<style>
-			{$css}
-			</style>
-			";
+			$expected = "<style>
+{$css}
+</style>\n";
 		}
 
 		$this->assertEquals( $expected, $out );
@@ -612,9 +610,9 @@ public function test_recovery_mode_notice_when_css_disabled_by_query_param_by_ad
 
 		$this->test_can_show_css_with_true_query_param_by_admin();
 
-		$expected = "			<div class=\"notice notice-error\">
-				<p><strong>RECOVERY MODE ENABLED:</strong> CSS output for the Add Admin CSS plugin is disabled on this page view.</p>
-			</div>";
+		$expected = "<div class=\"notice notice-error\">
+	<p><strong>RECOVERY MODE ENABLED:</strong> CSS output for the Add Admin CSS plugin is disabled on this page view.</p>
+</div>\n";
 
 		$this->assertEquals( $expected, $this->get_action_output( 'admin_notices' ) );
 	}
@@ -737,9 +735,9 @@ public function test_recovery_mode_via_constant_disables_add_css() {
 	public function test_recovery_mode_notice_when_css_disabled_by_constant() {
 		$this->fake_current_screen();
 
-		$expected = "			<div class=\"notice notice-error\">
-				<p><strong>RECOVERY MODE ENABLED:</strong> CSS output for the Add Admin CSS plugin is currently disabled for the entire admin area via use of the <code>C2C_ADD_ADMIN_CSS_DISABLED</code> constant.</p>
-			</div>";
+		$expected = "<div class=\"notice notice-error\">
+	<p><strong>RECOVERY MODE ENABLED:</strong> CSS output for the Add Admin CSS plugin is currently disabled for the entire admin area via use of the <code>C2C_ADD_ADMIN_CSS_DISABLED</code> constant.</p>
+</div>\n";
 
 		$this->assertEquals( $expected, $this->get_action_output( 'admin_notices' ) );
 	}