diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index c4c308ef..ace0ebc1 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -2010,8 +2010,8 @@ var fileman = (function () {
 			deleter();
 		}
 
-		modal.confirm('===== DANGER =====\nDELETE these ' + vps.length + ' items?\n\n' + uricom_adec(vps).join('\n'), function () {
-			modal.confirm('Last chance! Delete?', deleter, null);
+		modal.confirm('<h6 style="color:#900">DANGER</h6>\n<b>DELETE these ' + vps.length + ' items?</b><ul>' + uricom_adec(vps, true).join('') + '</ul>', function () {
+			modal.confirm('<b>Last chance!</b> Delete?', deleter, null);
 		}, null);
 	};
 
@@ -2110,7 +2110,7 @@ var fileman = (function () {
 			paster();
 		}
 
-		modal.confirm('paste these ' + req.length + ' items here?\n\n' + uricom_adec(req).join('\n'), function () {
+		modal.confirm('paste these ' + req.length + ' items here?<ul>' + uricom_adec(req, true).join('') + '</ul>', function () {
 			paster();
 			jwrite('fman_clip', []);
 		}, null);
diff --git a/copyparty/web/md.js b/copyparty/web/md.js
index e7c718e3..05713541 100644
--- a/copyparty/web/md.js
+++ b/copyparty/web/md.js
@@ -185,7 +185,7 @@ function md_plug_err(ex, js) {
     errbox.style.cssText = 'position:absolute;top:0;left:0;padding:1em .5em;background:#2b2b2b;color:#fc5'
     errbox.textContent = msg;
     errbox.onclick = function () {
-        modal.alert('<pre>' + ex.stack + '</pre>');
+        modal.alert('<pre>' + esc(ex.stack) + '</pre>');
     };
     if (o) {
         errbox.appendChild(o);
diff --git a/copyparty/web/ui.css b/copyparty/web/ui.css
index 8c833ced..727f3093 100644
--- a/copyparty/web/ui.css
+++ b/copyparty/web/ui.css
@@ -165,6 +165,16 @@ html.light #tt em {
         min-width: 30em;
     }
 }
+#modalc li {
+	margin: 1em 0;
+}
+#modalc h6 {
+	font-size: 1.3em;
+	border-bottom: 1px solid #999;
+	margin: 0;
+	padding: .3em;
+	text-align: center;
+}
 #modalb {
 	position: sticky;
 	text-align: right;
diff --git a/copyparty/web/up2k.js b/copyparty/web/up2k.js
index bec6679f..fa121c5e 100644
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -725,11 +725,11 @@ function up2k_init(subtle) {
                     match = false;
 
             if (match) {
-                var msg = ['directory iterator got stuck on the following {0} items; good chance your browser is about to spinlock:'.format(missing.length)];
+                var msg = ['directory iterator got stuck on the following {0} items; good chance your browser is about to spinlock:<ul>'.format(missing.length)];
                 for (var a = 0; a < Math.min(20, missing.length); a++)
-                    msg.push(missing[a]);
+                    msg.push('<li>' + esc(missing[a]) + '</li>');
 
-                return modal.alert(msg.join('\n-- '), function () {
+                return modal.alert(msg.join('') + '</ul>', function () {
                     read_dirs(rd, [], [], good, bad, spins);
                 });
             }
@@ -800,12 +800,12 @@ function up2k_init(subtle) {
             });
         }
 
-        var msg = ['{0} these {1} files?'.format(fsearch ? 'search' : 'upload', good_files.length)];
+        var msg = ['{0} these {1} files?<ul>'.format(fsearch ? 'search' : 'upload', good_files.length)];
         for (var a = 0, aa = Math.min(20, good_files.length); a < aa; a++)
-            msg.push(good_files[a][1]);
+            msg.push('<li>' + esc(good_files[a][1]) + '</li>');
 
         if (ask_up && !fsearch)
-            return modal.confirm(msg.join('\n'), function () { up_them(good_files); }, null);
+            return modal.confirm(msg.join('') + '</ul>', function () { up_them(good_files); }, null);
 
         up_them(good_files);
     }
diff --git a/copyparty/web/util.js b/copyparty/web/util.js
index 80696489..b24356d3 100644
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -353,10 +353,12 @@ function uricom_dec(txt) {
 }
 
 
-function uricom_adec(arr) {
+function uricom_adec(arr, li) {
     var ret = [];
-    for (var a = 0; a < arr.length; a++)
-        ret.push(uricom_dec(arr[a])[0]);
+    for (var a = 0; a < arr.length; a++) {
+        var txt = uricom_dec(arr[a])[0];
+        ret.push(li ? '<li>' + esc(txt) + '</li>' : txt);
+    }
 
     return ret;
 }