diff --git a/src/www_email.c b/src/www_email.c
index 20c3ae5..e52f44f 100644
--- a/src/www_email.c
+++ b/src/www_email.c
@@ -10,7 +10,7 @@
 extern struct bbs_config conf;
 
 int www_email_delete(struct user_record *user, int id) {
-	char buffer[256];
+	char buffer[PATH_MAX];
 	sqlite3 *db;
 	sqlite3_stmt *res;
 	int rc;
@@ -60,7 +60,7 @@ int www_email_delete(struct user_record *user, int id) {
 }
 
 int www_send_email(struct user_record *user, char *recipient, char *subject, char *ibody) {
-	char buffer[256];
+	char pathbuf[PATH_MAX];
 	sqlite3 *db;
 	sqlite3_stmt *res;
 	int rc;
@@ -74,10 +74,9 @@ int www_send_email(struct user_record *user, char *recipient, char *subject, cha
 	             "seen INTEGER);";
 	char *isql = "INSERT INTO email (sender, recipient, subject, body, date, seen) VALUES(?, ?, ?, ?, ?, 0)";
 	char *err_msg = 0;
-	char *body;
+	stralloc sa = EMPTY_STRALLOC;
+	char *body = NULL;
 	struct utsname name;
-	int i;
-	int pos;
 
 	if (recipient == NULL || subject == NULL || ibody == NULL) {
 		return 0;
@@ -89,25 +88,31 @@ int www_send_email(struct user_record *user, char *recipient, char *subject, cha
 
 	uname(&name);
 
-	snprintf(buffer, 256, "\r--- MagickaBBS v%d.%d%s (%s/%s)\r * Origin: %s \r", VERSION_MAJOR, VERSION_MINOR, VERSION_STR, name.sysname, name.machine, conf.default_tagline);
+	for (char *p = ibody; *p != '\0'; ++p)
+		if (*p != '\n')
+			stralloc_append1(&sa, *p);
 
-	body = (char *)malloz(strlen(ibody) + strlen(buffer) + 1);
-	pos = 0;
-	for (i = 0; i < strlen(ibody); i++) {
-		if (ibody[i] != '\n') {
-			body[pos] = ibody[i];
-			pos++;
-		}
-	}
+	stralloc_cats(&sa, "\r--- MagickaBBS v");
+	stralloc_cat_long(&sa, VERSION_MAJOR);
+	stralloc_append1(&sa, '.');
+	stralloc_cat_long(&sa, VERSION_MINOR);
+	stralloc_cats(&sa, VERSION_STR);
+	stralloc_cats(&sa, " (");
+	stralloc_cats(&sa, name.sysname);
+	stralloc_append1(&sa, '/');
+	stralloc_cats(&sa, name.machine);
+	stralloc_cats(&sa, ")\r");
+	stralloc_cats(&sa, " * Origin: ");
+	stralloc_cats(&sa, conf.default_tagline);
+	stralloc_cats(&sa, " \r");
+	stralloc_0(&sa);
+	body = sa.s;
 
-	strcat(body, buffer);
-
-	sprintf(buffer, "%s/email.sq3", conf.bbs_path);
-
-	rc = sqlite3_open(buffer, &db);
+	snprintf(pathbuf, sizeof pathbuf, "%s/email.sq3", conf.bbs_path);
+	rc = sqlite3_open(pathbuf, &db);
 	if (rc != SQLITE_OK) {
 		sqlite3_close(db);
-
+		free(body);
 		return 0;
 	}
 
@@ -116,27 +121,28 @@ int www_send_email(struct user_record *user, char *recipient, char *subject, cha
 	if (rc != SQLITE_OK) {
 		sqlite3_free(err_msg);
 		sqlite3_close(db);
-
+		free(body);
 		return 0;
 	}
 
 	rc = sqlite3_prepare_v2(db, isql, -1, &res, 0);
-
-	if (rc == SQLITE_OK) {
-		sqlite3_bind_text(res, 1, user->loginname, -1, 0);
-		sqlite3_bind_text(res, 2, recipient, -1, 0);
-		sqlite3_bind_text(res, 3, subject, -1, 0);
-		sqlite3_bind_text(res, 4, body, -1, 0);
-		sqlite3_bind_int(res, 5, time(NULL));
-	} else {
+	if (rc != SQLITE_OK) {
 		sqlite3_finalize(res);
 		sqlite3_close(db);
+		free(body);
 		return 0;
 	}
+	sqlite3_bind_text(res, 1, user->loginname, -1, 0);
+	sqlite3_bind_text(res, 2, recipient, -1, 0);
+	sqlite3_bind_text(res, 3, subject, -1, 0);
+	sqlite3_bind_text(res, 4, body, -1, 0);
+	sqlite3_bind_int(res, 5, time(NULL));
 	sqlite3_step(res);
 
 	sqlite3_finalize(res);
 	sqlite3_close(db);
+	free(body);
+
 	return 1;
 }
 
@@ -158,10 +164,9 @@ char *www_new_email() {
 }
 
 char *www_email_display(struct user_record *user, int email) {
-	char *page;
-	int max_len;
-	int len;
-	char buffer[4096];
+	stralloc page = EMPTY_STRALLOC;
+	char pathbuf[PATH_MAX];
+	char datebuf[32];
 	sqlite3 *db;
 	sqlite3_stmt *res;
 	int rc;
@@ -186,16 +191,10 @@ char *www_email_display(struct user_record *user, int email) {
 
 	char *update_seen_sql = "UPDATE email SET seen=1 WHERE id=?";
 
-	page = (char *)malloz(4096);
-	max_len = 4096;
-	len = 0;
-
-	sprintf(buffer, "%s/email.sq3", conf.bbs_path);
-
-	rc = sqlite3_open(buffer, &db);
+	snprintf(pathbuf, sizeof pathbuf, "%s/email.sq3", conf.bbs_path);
+	rc = sqlite3_open(pathbuf, &db);
 	if (rc != SQLITE_OK) {
 		sqlite3_close(db);
-		free(page);
 		return NULL;
 	}
 	sqlite3_busy_timeout(db, 5000);
@@ -203,282 +202,114 @@ char *www_email_display(struct user_record *user, int email) {
 	if (rc != SQLITE_OK) {
 		sqlite3_free(err_msg);
 		sqlite3_close(db);
-
 		return NULL;
 	}
 
 	rc = sqlite3_prepare_v2(db, email_show_sql, -1, &res, 0);
 
-	if (rc == SQLITE_OK) {
-		sqlite3_bind_text(res, 1, user->loginname, -1, 0);
-		sqlite3_bind_int(res, 2, email - 1);
-	} else {
+	if (rc != SQLITE_OK) {
 		sqlite3_finalize(res);
 		sqlite3_close(db);
-		free(page);
 		return NULL;
 	}
-	if (sqlite3_step(res) == SQLITE_ROW) {
-		id = sqlite3_column_int(res, 0);
-		from = strdup((char *)sqlite3_column_text(res, 1));
-		subject = strdup((char *)sqlite3_column_text(res, 2));
-		body = strdup((char *)sqlite3_column_text(res, 3));
-		date = (time_t)sqlite3_column_int(res, 4);
-		localtime_r(&date, &msg_date);
+	sqlite3_bind_text(res, 1, user->loginname, -1, 0);
+	sqlite3_bind_int(res, 2, email - 1);
 
-		sprintf(buffer, "<div class=\"content-header\"><h2>Your Email</h2></div>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<div class=\"email-view-header\">\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<div class=\"email-view-subject\">%s</div>\n", subject);
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<div class=\"email-view-from\">From: %s</div>\n", from);
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		if (conf.date_style == 1) {
-			sprintf(buffer, "<div class=\"email-view-date\">Date: %.2d:%.2d %.2d-%.2d-%.2d</div>\n", msg_date.tm_hour, msg_date.tm_min, msg_date.tm_mon + 1, msg_date.tm_mday, msg_date.tm_year - 100);
-		} else {
-			sprintf(buffer, "<div class=\"email-view-date\">Date: %.2d:%.2d %.2d-%.2d-%.2d</div>\n", msg_date.tm_hour, msg_date.tm_min, msg_date.tm_mday, msg_date.tm_mon + 1, msg_date.tm_year - 100);
-		}
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "</div>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-		sprintf(buffer, "<div id=\"msgbody\">\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		for (i = 0; i < strlen(body); i++) {
-			if (body[i] == '\r') {
-				sprintf(buffer, "<br />");
-			} else if (body[i] == '<') {
-				sprintf(buffer, "&lt;");
-			} else if (body[i] == '>') {
-				sprintf(buffer, "&gt;");
-			} else {
-				sprintf(buffer, "%c", body[i]);
-			}
-			if (len + strlen(buffer) > max_len - 1) {
-				max_len += 4096;
-				page = (char *)realloc(page, max_len);
-			}
-			strcat(page, buffer);
-			len += strlen(buffer);
-		}
-		sprintf(buffer, "</div>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<div class=\"email-reply-form\">\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-		sprintf(buffer, "<h3>Reply</h3>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<form action=\"%semail/\" method=\"POST\" enctype=\"application/x-www-form-urlencoded\">\n", conf.www_url);
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<input type=\"hidden\" name=\"recipient\" value=\"%s\" />\n", from);
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		if (strncasecmp(subject, "re:", 3) == 0) {
-			sprintf(buffer, "Subject : <input type=\"text\" name=\"subject\" value=\"%s\" /><br />\n", subject);
-		} else {
-			sprintf(buffer, "Subject : <input type=\"text\" name=\"subject\" value=\"RE: %s\" /><br />\n", subject);
-		}
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<textarea name=\"body\" wrap=\"hard\" rows=\"25\" cols=\"79\" id=\"replybody\">");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "%s said....\n\n", from);
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "> ");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		chars = 0;
-
-		for (i = 0; i < strlen(body); i++) {
-			if (body[i] == '\r') {
-				sprintf(buffer, "\n> ");
-				chars = 0;
-			} else if (chars == 78) {
-				sprintf(buffer, "\n> %c", body[i]);
-				chars = 1;
-			} else {
-				sprintf(buffer, "%c", body[i]);
-				chars++;
-			}
-			if (len + strlen(buffer) > max_len - 1) {
-				max_len += 4096;
-				page = (char *)realloc(page, max_len);
-			}
-			strcat(page, buffer);
-			len += strlen(buffer);
-		}
-
-		sprintf(buffer, "</textarea>\n<br />");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "<input type=\"submit\" name=\"submit\" value=\"Reply\" />\n<br />");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "</form>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		sprintf(buffer, "</div>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
-
-		free(from);
-		free(body);
-		free(subject);
-
-		sqlite3_finalize(res);
-
-		rc = sqlite3_prepare_v2(db, update_seen_sql, -1, &res, 0);
-
-		if (rc == SQLITE_OK) {
-			sqlite3_bind_int(res, 1, id);
-		} else {
-			sqlite3_finalize(res);
-			sqlite3_close(db);
-			free(page);
-			return NULL;
-		}
-
-		sqlite3_step(res);
-	} else {
-		sprintf(buffer, "<div class=\"content-header\"><h2>No Such Email</h2></div>\n");
-		if (len + strlen(buffer) > max_len - 1) {
-			max_len += 4096;
-			page = (char *)realloc(page, max_len);
-		}
-		strcat(page, buffer);
-		len += strlen(buffer);
+	if (sqlite3_step(res) != SQLITE_ROW) {
+		return strdup("<div class=\"content-header\"><h2>No Such Email</h2></div>\n");
 	}
+	id = sqlite3_column_int(res, 0);
+	from = (char *)sqlite3_column_text(res, 1);
+	subject = (char *)sqlite3_column_text(res, 2);
+	body = (char *)sqlite3_column_text(res, 3);
+	date = (time_t)sqlite3_column_int(res, 4);
+	localtime_r(&date, &msg_date);
 
+	stralloc_copys(&page, "<div class=\"content-header\"><h2>Your Email</h2></div>\n");
+	stralloc_cats(&page, "<div class=\"email-view-header\">\n");
+	stralloc_cats(&page, "<div class=\"email-view-subject\">");
+	stralloc_cats(&page, subject);
+	stralloc_cats(&page, "</div>\n");
+	stralloc_cats(&page, "<div class=\"email-view-from\">From: ");
+	stralloc_cats(&page, from);
+	stralloc_cats(&page, "</div>\n");
+	stralloc_cats(&page, "<div class=\"email-view-date\">Date: ");
+	if (conf.date_style == 1)
+		strftime(datebuf, sizeof datebuf, "%H:%M %m-%d-%y", &msg_date);
+	else
+		strftime(datebuf, sizeof datebuf, "%H:%M %d-%m-%y", &msg_date);
+	stralloc_cats(&page, datebuf);
+	stralloc_cats(&page, "</div>\n");
+	stralloc_cats(&page, "</div>\n");
+	stralloc_cats(&page, "<div id=\"msgbody\">\n");
+	for (char *p = body; *p != '\0'; ++p) {
+		switch (*p) {
+			case '\r': stralloc_cats(&page, "<br />"); break;
+			case '<': stralloc_cats(&page, "&lt;"); break;
+			case '>': stralloc_cats(&page, "&gt;"); break;
+			default: stralloc_append1(&page, *p); break;
+		}
+	}
+	stralloc_cats(&page, "</div>\n");
+	stralloc_cats(&page, "<div class=\"email-reply-form\">\n");
+	stralloc_cats(&page, "<h3>Reply</h3>\n");
+	stralloc_cats(&page, "<form action=\"");
+	stralloc_cats(&page, conf.www_url);
+	stralloc_cats(&page, "email/\" method=\"POST\" enctype=\"application/x-www-form-urlencoded\">\n");
+	stralloc_cats(&page, "<input type=\"hidden\" name=\"recipient\" value=\"");
+	stralloc_cats(&page, from);
+	stralloc_cats(&page, "\" />\n");
+	stralloc_cats(&page, "Subject : <input type=\"text\" name=\"subject\" value=\"");
+	if (strncasecmp(subject, "re:", 3) != 0)
+		stralloc_cats(&page, "RE: ");
+	stralloc_cats(&page, subject);
+	stralloc_cats(&page, "\" /><br />\n");
+	stralloc_cats(&page, "<textarea name=\"body\" wrap=\"hard\" rows=\"25\" cols=\"79\" id=\"replybody\">");
+	stralloc_cats(&page, from);
+	stralloc_cats(&page, " said....\n\n");
+	stralloc_cats(&page, "> ");
+	size_t column = 0;
+	for (char *p = body; *p != '\0'; ++p) {
+		if (*p == '\r') {
+			stralloc_cats(&page, "\n> ");
+			column = 0;
+			continue;
+		} else if (column >= 78) {
+			stralloc_cats(&page, "\n> ");
+			column = 0;
+		}
+		stralloc_append1(&page, *p);
+		++column;
+	}
+	stralloc_cats(&page, "</textarea>\n<br />");
+	stralloc_cats(&page, "<input type=\"submit\" name=\"submit\" value=\"Reply\" />\n<br />");
+	stralloc_cats(&page, "</form>\n");
+	stralloc_cats(&page, "</div>\n");
+	stralloc_0(&page);
+
+	sqlite3_finalize(res);
+	rc = sqlite3_prepare_v2(db, update_seen_sql, -1, &res, 0);
+	if (rc != SQLITE_OK) {
+		sqlite3_finalize(res);
+		sqlite3_close(db);
+		free(page.s);
+		return NULL;
+	}
+	sqlite3_bind_int(res, 1, id);
+	sqlite3_step(res);
 	sqlite3_finalize(res);
 	sqlite3_close(db);
 
-	return page;
+	return page.s;
 }
 
 char *www_email_summary(struct user_record *user) {
-	char *page;
-	int max_len;
-	int len;
-	char buffer[4096];
+	stralloc page = EMPTY_STRALLOC;
+	char pathbuf[PATH_MAX];
 	sqlite3 *db;
 	sqlite3_stmt *res;
 	int rc;
 	char *email_summary_sql = "SELECT id,sender,subject,seen,date FROM email WHERE recipient LIKE ?";
-	struct tm msg_date;
-	time_t date;
-	char *from;
-	char *subject;
-	int seen;
-	int id;
 	int msgid = 0;
 	char *err_msg = 0;
 	char *email_create_sql = "CREATE TABLE IF NOT EXISTS email ("
@@ -490,32 +321,10 @@ char *www_email_summary(struct user_record *user) {
 	                         "date INTEGER,"
 	                         "seen INTEGER);";
 
-	page = (char *)malloz(4096);
-	max_len = 4096;
-	len = 0;
-
-	sprintf(buffer, "<div class=\"content-header\"><h2>Your Email</h2></div>\n");
-	if (len + strlen(buffer) > max_len - 1) {
-		max_len += 4096;
-		page = (char *)realloc(page, max_len);
-	}
-	strcat(page, buffer);
-	len += strlen(buffer);
-
-	sprintf(buffer, "<div class=\"button\"><a href=\"%semail/new\">New Email</a></div>\n", conf.www_url);
-	if (len + strlen(buffer) > max_len - 1) {
-		max_len += 4096;
-		page = (char *)realloc(page, max_len);
-	}
-	strcat(page, buffer);
-	len += strlen(buffer);
-
-	sprintf(buffer, "%s/email.sq3", conf.bbs_path);
-
-	rc = sqlite3_open(buffer, &db);
+	snprintf(pathbuf, sizeof pathbuf, "%s/email.sq3", conf.bbs_path);
+	rc = sqlite3_open(pathbuf, &db);
 	if (rc != SQLITE_OK) {
 		sqlite3_close(db);
-		free(page);
 		return NULL;
 	}
 	sqlite3_busy_timeout(db, 5000);
@@ -523,68 +332,67 @@ char *www_email_summary(struct user_record *user) {
 	if (rc != SQLITE_OK) {
 		sqlite3_free(err_msg);
 		sqlite3_close(db);
-
 		return NULL;
 	}
 
 	rc = sqlite3_prepare_v2(db, email_summary_sql, -1, &res, 0);
-
-	if (rc == SQLITE_OK) {
-		sqlite3_bind_text(res, 1, user->loginname, -1, 0);
-	} else {
+	if (rc != SQLITE_OK) {
 		sqlite3_finalize(res);
 		sqlite3_close(db);
-		free(page);
 		return NULL;
 	}
+	sqlite3_bind_text(res, 1, user->loginname, -1, 0);
 
-	sprintf(buffer, "<div class=\"div-table\">\n");
-	if (len + strlen(buffer) > max_len - 1) {
-		max_len += 4096;
-		page = (char *)realloc(page, max_len);
-	}
-	strcat(page, buffer);
-	len += strlen(buffer);
+	stralloc_copys(&page, "<div class=\"content-header\"><h2>Your Email</h2></div>\n");
+	stralloc_cats(&page, "<div class=\"button\"><a href=\"");
+	stralloc_cats(&page, conf.www_url);
+	stralloc_cats(&page, "email/new\">New Email</a></div>\n");
+	stralloc_cats(&page, "<div class=\"div-table\">\n");
 
 	while (sqlite3_step(res) == SQLITE_ROW) {
-		id = sqlite3_column_int(res, 0);
-		from = strdup((char *)sqlite3_column_text(res, 1));
-		subject = strdup((char *)sqlite3_column_text(res, 2));
-		seen = sqlite3_column_int(res, 3);
-		date = (time_t)sqlite3_column_int(res, 4);
+		char datebuf[32];
+		++msgid;
+		int id = sqlite3_column_int(res, 0);
+		const char *from = (const char *)sqlite3_column_text(res, 1);
+		const char *subject = (const char *)sqlite3_column_text(res, 2);
+		int seen = sqlite3_column_int(res, 3);
+		struct tm msg_date;
+
+		time_t date = (time_t)sqlite3_column_int(res, 4);
 		localtime_r(&date, &msg_date);
-		if (seen == 0) {
-			sprintf(buffer, "<div class=\"email-summary\"><div class=\"email-id\">%d</div><div class=\"email-subject\"><a href=\"%semail/%d\">%s</a></div><div class=\"email-from\">%s</div><div class=\"email-date\">%.2d:%.2d %.2d-%.2d-%.2d</div><a href=\"%semail/delete/%d\"><div class=\"email-delete\"></div></a></div>\n", msgid + 1, conf.www_url, msgid + 1, subject, from, msg_date.tm_hour, msg_date.tm_min, msg_date.tm_mday, msg_date.tm_mon + 1, msg_date.tm_year - 100, conf.www_url, id);
-			if (len + strlen(buffer) > max_len - 1) {
-				max_len += 4096;
-				page = (char *)realloc(page, max_len);
-			}
-			strcat(page, buffer);
-			len += strlen(buffer);
-		} else {
-			sprintf(buffer, "<div class=\"email-summary-seen\"><div class=\"email-id\">%d</div><div class=\"email-subject\"><a href=\"%semail/%d\">%s</a></div><div class=\"email-from\">%s</div><div class=\"email-date\">%.2d:%.2d %.2d-%.2d-%.2d</div><a href=\"%semail/delete/%d\"><div class=\"email-delete\"></div></a></div>\n", msgid + 1, conf.www_url, msgid + 1, subject, from, msg_date.tm_hour, msg_date.tm_min, msg_date.tm_mday, msg_date.tm_mon + 1, msg_date.tm_year - 100, conf.www_url, id);
-			if (len + strlen(buffer) > max_len - 1) {
-				max_len += 4096;
-				page = (char *)realloc(page, max_len);
-			}
-			strcat(page, buffer);
-			len += strlen(buffer);
+		stralloc_cats(&page, "<div class=\"email-summary");
+		if (seen != 0) {
+			stralloc_cats(&page, "-seen");
 		}
-		free(from);
-		free(subject);
-		msgid++;
+		stralloc_cats(&page, "<div class=\"email-summary\"><div class=\"email-id\">");
+		stralloc_cat_long(&page, msgid);
+		stralloc_cats(&page, "</div><div class=\"email-subject\"><a href=\"");
+		stralloc_cats(&page, conf.www_url);
+		stralloc_cats(&page, "email/");
+		stralloc_cat_long(&page, msgid);
+		stralloc_cats(&page, "\">");
+		stralloc_cats(&page, subject);
+		stralloc_cats(&page, "</a></div><div class=\"email-from\">");
+		stralloc_cats(&page, from);
+		stralloc_cats(&page, "</div><div class=\"email-date\">");
+		if (conf.date_style == 1)
+			strftime(datebuf, sizeof datebuf, "%H:%M %m-%d-%y", &msg_date);
+		else
+			strftime(datebuf, sizeof datebuf, "%H:%M %d-%m-%y", &msg_date);
+		stralloc_cats(&page, datebuf);
+		stralloc_cats(&page, "</div><a href=\"");
+		stralloc_cats(&page, conf.www_url);
+		stralloc_cats(&page, "email/delete/");
+		stralloc_cat_long(&page, id);
+		stralloc_cats(&page, "\"><div class=\"email-delete\"></div></a></div>\n");
 	}
-	sprintf(buffer, "</div>\n");
-	if (len + strlen(buffer) > max_len - 1) {
-		max_len += 4096;
-		page = (char *)realloc(page, max_len);
-	}
-	strcat(page, buffer);
-	len += strlen(buffer);
+	stralloc_cats(&page, "</div>\n");
+	stralloc_0(&page);
 
 	sqlite3_finalize(res);
 	sqlite3_close(db);
-	return page;
+
+	return page.s;
 }
 
 #endif