diff --git a/www/notes/Database.php b/www/notes/Database.php
--- a/www/notes/Database.php
+++ b/www/notes/Database.php
@@ -4,6 +4,8 @@ class Database
 {
 
     private $pdo;
+    private $statement;
+
 
     function __construct(array $config)
     {
@@ -16,10 +18,28 @@ $this->pdo->exec("SET search_path TO notes");
     }
 
 
-    function query(string $query, mixed...$parameters)
+    function query(string $query, mixed ...$parameters)
     {
-        $statement = $this->pdo->prepare($query);
-        $statement->execute($parameters);
-        return $statement;
+        $this->statement = $this->pdo->prepare($query);
+        $this->statement->execute($parameters);
+        return $this;
+    }
+
+    function fetch()
+    {
+        $result = $this->statement->fetch();
+        if (!$result) {
+            abort();
+        }
+        return $result;
+    }
+
+    function fetchAll()
+    {
+        $result = $this->statement->fetchAll();
+        if (!$result) {
+            abort();
+        }
+        return $result;
     }
 }
\ No newline at end of file
diff --git a/www/notes/controllers/note-create.php b/www/notes/controllers/note-create.php
new file mode 100644
--- /dev/null
+++ b/www/notes/controllers/note-create.php
@@ -0,0 +1,28 @@
+<?php
+
+
+$title = "Create new Note";
+
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+
+    if (!array_key_exists('body', $_POST)) {
+        abort(Response::BAD_REQUEST);
+    }  
+
+    if (empty($_POST['body'])) {
+        return;
+    }
+
+    $db->query(
+        "INSERT INTO notes (body, user_id) VALUES (:body, :user_id)",
+        ...[
+            'body' => $_POST['body'],
+            'user_id' => $currentUserId
+        ]
+    );
+    header("Location: /notes");
+    die();
+}
+
+require "views/note-create.view.php";
diff --git a/www/notes/controllers/note.php b/www/notes/controllers/note.php
--- a/www/notes/controllers/note.php
+++ b/www/notes/controllers/note.php
@@ -9,20 +9,13 @@
 $title = "Note: {$_GET['id']}";
 
 
-
-
+// Fetch and check that it exists
 $note = $db->query('SELECT * FROM notes WHERE id = :id', ...[
     'id' => $_GET['id'],
 ])->fetch();
 
-// No note found
-if (!$note) {
-    abort();
-}
 
 // Note from another user
-if ($note['user_id'] !== $currentUserId) {
-    abort(Response::FORBIDDEN);
-}
+authorize($note['user_id'] === $currentUserId);
 
 require "views/note.view.php";
diff --git a/www/notes/functions.php b/www/notes/functions.php
--- a/www/notes/functions.php
+++ b/www/notes/functions.php
@@ -10,4 +10,11 @@ function abort(int $statusCode = Response::NOT_FOUND): void
 {
     http_response_code($statusCode);
     die();
+}
+
+function authorize(bool $condition, $statusCode = Response::FORBIDDEN): void
+{
+    if (!$condition) {
+        abort($statusCode);
+    }
 }
\ No newline at end of file
diff --git a/www/notes/index.php b/www/notes/index.php
--- a/www/notes/index.php
+++ b/www/notes/index.php
@@ -1,4 +1,5 @@
 <?php
+require "Response.php";
 require "functions.php";
 
 $config = require "config.php";
diff --git a/www/notes/router.php b/www/notes/router.php
--- a/www/notes/router.php
+++ b/www/notes/router.php
@@ -4,6 +4,7 @@
 
 $routes = [
     '/notes/note' => 'controllers/note.php',
+    '/notes/create' => 'controllers/note-create.php',
 ];
 
 
diff --git a/www/notes/views/index.view.php b/www/notes/views/index.view.php
--- a/www/notes/views/index.view.php
+++ b/www/notes/views/index.view.php
@@ -2,14 +2,14 @@ <?php require "partials/head.php" ?>
 <?php require "partials/nav.php" ?>
 <?php require "partials/bootstrap_head.php" ?>
 
-<h2 class="text-center">Hello, <?= $user['name'] ?></h2>
+<h2 class="text-center">Hello, <?= htmlspecialchars($user['name']) ?></h2>
 <p class="text-body-secondary mt-3 text-center">Here is a list of all your Notes, click on one to show more details</p>
 <div>
     <ul class="list-group">
         <?php foreach ($notes as $note): ?>
             <li class="list-group-item list-group-item-action">
-                <a class="link-primary text-decoration-none" href="note?id=<?= $note['id'] ?>">
-                    <?= $note['body'] ?>
+                <a class="link-primary text-decoration-none" href="note?id=<?= htmlspecialchars($note['id']) ?>">
+                    <?= htmlspecialchars($note['body']) ?>
                 </a>
             </li>
         <?php endforeach ?>
diff --git a/www/notes/views/note-create.view.php b/www/notes/views/note-create.view.php
new file mode 100644
--- /dev/null
+++ b/www/notes/views/note-create.view.php
@@ -0,0 +1,22 @@
+<?php require "partials/head.php" ?>
+<?php require "partials/nav.php" ?>
+<?php require "partials/bootstrap_head.php" ?>
+
+<h3 class="text-body-secondary mt-3 text-center fw-bold">Create a new Note</h3>
+<form method="POST">
+    <div class="row">
+        <div class="card-body p-4 fs-4 ">
+
+            <textarea name="body" class="form-control bg-body-secondary mt-3 shadow from-control-lg" rows="7"></textarea>
+
+        </div>
+    </div>
+    <div class="d-flex justify-content-center gap-4">
+        <button class="btn btn-primary mt-3 px-3" type="submit">Save</button>
+        <a href="/notes/" class="btn btn-primary mt-3 px-3">Cancel</a>
+    </div>
+
+</form>
+
+<?php require "partials/bootstrap_footer.php" ?>
+<?php require "partials/footer.php" ?>
\ No newline at end of file
diff --git a/www/notes/views/note.view.php b/www/notes/views/note.view.php
--- a/www/notes/views/note.view.php
+++ b/www/notes/views/note.view.php
@@ -6,13 +6,11 @@ <h3 class="text-body-secondary mt-3 text-center fw-bold">Here is the Note you selected:</h3>
 <div class="row">
     <div class="card mt-3 bg-body-secondary shadow">
         <div class="card-body p-4 fs-4 ">
-            <?= $note['body'] ?>
+            <?= htmlspecialchars($note['body']) ?>
         </div>
     </div>
 </div>
-<div class="d-flex justify-content-center">
-    <a href="/notes/" class="btn btn-primary mt-3 px-3">Go Back to Homepage</a>
-</div>
+
 
 
 
diff --git a/www/notes/views/partials/nav.php b/www/notes/views/partials/nav.php
--- a/www/notes/views/partials/nav.php
+++ b/www/notes/views/partials/nav.php
@@ -1,16 +1,18 @@
+<?php
+$page = $_SERVER['REQUEST_URI'];
+?>
+
 <header class="d-flex flex-wrap justify-content-center py-3 mb-4 border-bottom">
     <a href="/notes/" class="d-flex align-items-center mb-3 mb-md-0 me-md-auto link-body-emphasis text-decoration-none ps-4">
         <span class="fs-4">Notes App</span>
     </a>
 
-    <!-- <ul class="nav nav-pills">
-        <li class="nav-item"><a href="/notes/" class="nav-link active" aria-current="page">Home</a></li>
-        <li class="nav-item"><a href="#" class="nav-link">Features</a></li>
-        <li class="nav-item"><a href="#" class="nav-link">Pricing</a></li>
-        <li class="nav-item"><a href="#" class="nav-link">FAQs</a></li>
-        <li class="nav-item"><a href="#" class="nav-link">About</a></li>
-    </ul> -->
-
-
-
+    <ul class="nav nav-pills mx-4">
+        <li class="nav-item">
+            <a href="/notes/" class="nav-link <?= $page === '/notes/' ? 'active' : '' ?>">Your Notes</a>
+        </li>
+        <li class="nav-item">
+            <a href="/notes/create" class="nav-link <?= $page === '/notes/create' ? 'active' : '' ?>"">New Note</a>
+        </li>
+    </ul>
 </header>
\ No newline at end of file