Thread: [Web-erp-svn] SF.net SVN: web-erp:[4950] trunk (Page 25)

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Revision: 4950
          http://web-erp.svn.sourceforge.net/web-erp/?rev=4950&view=rev
Author:   daintree
Date:     2012-02-22 06:26:38 +0000 (Wed, 22 Feb 2012)
Log Message:
-----------
fully qualify htmlspecialchars() function

Modified Paths:
--------------
    trunk/AddCustomerTypeNotes.php
    trunk/AuditTrail.php
    trunk/BOMExtendedQty.php
    trunk/BOMIndented.php
    trunk/BOMIndentedReverse.php
    trunk/BOMInquiry.php
    trunk/BOMListing.php
    trunk/BOMs.php
    trunk/BackupDatabase.php
    trunk/BankReconciliation.php
    trunk/COGSGLPostings.php
    trunk/CompanyPreferences.php
    trunk/ConfirmDispatch_Invoice.php
    trunk/ContractBOM.php
    trunk/ContractCosting.php
    trunk/ContractOtherReqts.php
    trunk/Contracts.php
    trunk/CounterSales.php
    trunk/CreditStatus.php
    trunk/Credit_Invoice.php
    trunk/Currencies.php
    trunk/CustEDISetup.php
    trunk/CustLoginSetup.php
    trunk/CustWhereAlloc.php
    trunk/CustomerAllocations.php
    trunk/CustomerBranches.php
    trunk/CustomerInquiry.php
    trunk/CustomerReceipt.php
    trunk/CustomerTransInquiry.php
    trunk/CustomerTypes.php
    trunk/Customers.php
    trunk/DailyBankTransactions.php
    trunk/DebtorsAtPeriodEnd.php
    trunk/DiscountCategories.php
    trunk/DiscountMatrix.php
    trunk/EDIMessageFormat.php
    trunk/EmailCustTrans.php
    trunk/ExchangeRateTrend.php
    trunk/FTP_RadioBeacon.php
    trunk/Factors.php
    trunk/FixedAssetCategories.php
    trunk/FixedAssetDepreciation.php
    trunk/FixedAssetItems.php
    trunk/FixedAssetLocations.php
    trunk/FixedAssetRegister.php
    trunk/FixedAssetTransfer.php
    trunk/FormDesigner.php
    trunk/FreightCosts.php
    trunk/GLAccountCSV.php
    trunk/GLAccountInquiry.php
    trunk/GLAccountReport.php
    trunk/GLAccounts.php
    trunk/GLBalanceSheet.php
    trunk/GLBudgets.php
    trunk/GLJournal.php
    trunk/GLProfit_Loss.php
    trunk/GLTagProfit_Loss.php
    trunk/GLTags.php
    trunk/GLTrialBalance.php
    trunk/GLTrialBalance_csv.php
    trunk/GeocodeSetup.php
    trunk/GoodsReceived.php
    trunk/InventoryPlanning.php
    trunk/InventoryPlanningPrefSupplier.php
    trunk/InventoryQuantities.php
    trunk/InventoryValuation.php
    trunk/Labels.php
    trunk/Locations.php
    trunk/MRP.php
    trunk/MRPCalendar.php
    trunk/MRPCreateDemands.php
    trunk/MRPDemandTypes.php
    trunk/MRPDemands.php
    trunk/MRPPlannedPurchaseOrders.php
    trunk/MRPPlannedWorkOrders.php
    trunk/MRPReport.php
    trunk/MRPReschedules.php
    trunk/MRPShortages.php
    trunk/OffersReceived.php
    trunk/OutstandingGRNs.php
    trunk/PDFBankingSummary.php
    trunk/PDFChequeListing.php
    trunk/PDFCustTransListing.php
    trunk/PDFCustomerList.php
    trunk/PDFDIFOT.php
    trunk/PDFDeliveryDifferences.php
    trunk/PDFLowGP.php
    trunk/PDFOrderStatus.php
    trunk/PDFOrdersInvoiced.php
    trunk/PDFPeriodStockTransListing.php
    trunk/PDFPickingList.php
    trunk/PDFPriceList.php
    trunk/PDFPrintLabel.php
    trunk/PDFRemittanceAdvice.php
    trunk/PDFStockCheckComparison.php
    trunk/PDFStockLocTransfer.php
    trunk/PDFStockTransfer.php
    trunk/PDFSuppTransListing.php
    trunk/POReport.php
    trunk/PO_AuthorisationLevels.php
    trunk/PO_AuthoriseMyOrders.php
    trunk/PO_Header.php
    trunk/PO_Items.php
    trunk/PO_PDFPurchOrder.php
    trunk/PO_SelectOSPurchOrder.php
    trunk/PO_SelectPurchOrder.php
    trunk/PageSecurity.php
    trunk/PaymentMethods.php
    trunk/PaymentTerms.php
    trunk/Payments.php
    trunk/PcAssignCashToTab.php
    trunk/PcAuthorizeExpenses.php
    trunk/PcClaimExpensesFromTab.php
    trunk/PcExpenses.php
    trunk/PcExpensesTypeTab.php
    trunk/PcReportTab.php
    trunk/PcTabs.php
    trunk/PcTypeTabs.php
    trunk/Prices.php
    trunk/PricesBasedOnMarkUp.php
    trunk/PricesByCost.php
    trunk/Prices_Customer.php
    trunk/PrintCustStatements.php
    trunk/PrintCustTrans.php
    trunk/PrintCustTransPortrait.php
    trunk/PurchData.php
    trunk/RecurringSalesOrders.php
    trunk/ReorderLevel.php
    trunk/ReorderLevelLocation.php
    trunk/ReprintGRN.php
    trunk/ReverseGRN.php
    trunk/SMTPServer.php
    trunk/SalesAnalReptCols.php
    trunk/SalesAnalRepts.php
    trunk/SalesByTypePeriodInquiry.php
    trunk/SalesCategories.php
    trunk/SalesCategoryPeriodInquiry.php
    trunk/SalesGLPostings.php
    trunk/SalesGraph.php
    trunk/SalesInquiry.php
    trunk/SalesPeople.php
    trunk/SalesTopItemsInquiry.php
    trunk/SalesTypes.php
    trunk/SecurityTokens.php
    trunk/SelectCompletedOrder.php
    trunk/SelectContract.php
    trunk/SelectCreditItems.php
    trunk/SelectCustomer.php
    trunk/SelectGLAccount.php
    trunk/SelectOrderItems.php
    trunk/SelectProduct.php
    trunk/SelectRecurringSalesOrder.php
    trunk/SelectSalesOrder.php
    trunk/SelectSupplier.php
    trunk/SelectWorkOrder.php
    trunk/ShipmentCosting.php
    trunk/Shipments.php
    trunk/Shippers.php
    trunk/Shipt_Select.php
    trunk/SpecialOrder.php
    trunk/StockAdjustments.php
    trunk/StockCategories.php
    trunk/StockCheck.php
    trunk/StockCostUpdate.php
    trunk/StockCounts.php
    trunk/StockDispatch.php
    trunk/StockLocMovements.php
    trunk/StockLocStatus.php
    trunk/StockLocTransfer.php
    trunk/StockLocTransferReceive.php
    trunk/StockMovements.php
    trunk/StockQuantityByDate.php
    trunk/StockReorderLevel.php
    trunk/StockSerialItemResearch.php
    trunk/StockStatus.php
    trunk/StockTransfers.php
    trunk/StockUsage.php
    trunk/Stocks.php
    trunk/SuppContractChgs.php
    trunk/SuppCreditGRNs.php
    trunk/SuppFixedAssetChgs.php
    trunk/SuppInvGRNs.php
    trunk/SuppLoginSetup.php
    trunk/SuppPaymentRun.php
    trunk/SuppPriceList.php
    trunk/SuppShiptChgs.php
    trunk/SuppTransGLAnalysis.php
    trunk/SupplierAllocations.php
    trunk/SupplierBalsAtPeriodEnd.php
    trunk/SupplierContacts.php
    trunk/SupplierCredit.php
    trunk/SupplierInquiry.php
    trunk/SupplierInvoice.php
    trunk/SupplierTenders.php
    trunk/SupplierTransInquiry.php
    trunk/SupplierTypes.php
    trunk/Suppliers.php
    trunk/SystemParameters.php
    trunk/Tax.php
    trunk/TaxAuthorities.php
    trunk/TaxAuthorityRates.php
    trunk/TaxCategories.php
    trunk/TaxGroups.php
    trunk/TaxProvinces.php
    trunk/TopItems.php
    trunk/UnitsOfMeasure.php
    trunk/UpgradeDatabase.php
    trunk/UserSettings.php
    trunk/WOSerialNos.php
    trunk/WWW_Access.php
    trunk/WWW_Users.php
    trunk/WhereUsedInquiry.php
    trunk/WorkCentres.php
    trunk/WorkOrderCosting.php
    trunk/WorkOrderEntry.php
    trunk/WorkOrderIssue.php
    trunk/WorkOrderReceive.php
    trunk/Z_BottomUpCosts.php
    trunk/Z_ChangeBranchCode.php
    trunk/Z_ChangeCustomerCode.php
    trunk/Z_ChangeStockCategory.php
    trunk/Z_ChangeStockCode.php
    trunk/Z_CheckDebtorsControl.php
    trunk/Z_CreateCompanyTemplateFile.php
    trunk/Z_DataExport.php
    trunk/Z_DeleteSalesTransActions.php
    trunk/Z_ImportChartOfAccounts.php
    trunk/Z_ImportGLAccountGroups.php
    trunk/Z_ImportGLAccountSections.php
    trunk/Z_ImportPartCodes.php
    trunk/Z_MakeNewCompany.php
    trunk/Z_ReApplyCostToSA.php
    trunk/Z_RePostGLFromPeriod.php
    trunk/Z_ReverseSuppPaymentRun.php
    trunk/Z_UpdateChartDetailsBFwd.php
    trunk/Z_Upgrade3.10.php
    trunk/Z_Upgrade_3.04-3.05.php
    trunk/Z_Upgrade_3.05-3.06.php
    trunk/Z_Upgrade_3.07-3.08.php
    trunk/Z_Upgrade_3.08-3.09.php
    trunk/Z_Upgrade_3.09-3.10.php
    trunk/Z_Upgrade_3.10-3.11.php
    trunk/Z_Upgrade_3.11-4.00.php
    trunk/Z_poAddLanguage.php
    trunk/Z_poEditLangHeader.php
    trunk/Z_poEditLangModule.php
    trunk/Z_poEditLangRemaining.php
    trunk/Z_poRebuildDefault.php
    trunk/config.distrib.php
    trunk/doc/Change.log
    trunk/doc/Manual/ManualContents.php
    trunk/doc/Manual/ManualGettingStarted.html
    trunk/includes/InputSerialItems.php
    trunk/includes/InputSerialItemsExisting.php
    trunk/includes/InputSerialItemsKeyed.php
    trunk/includes/InputSerialItemsSequential.php
    trunk/includes/OutputSerialItems.php
    trunk/includes/session.inc
    trunk/includes/tcpdf/config/tcpdf_config.php
    trunk/includes/tcpdf/config/tcpdf_config_alt.php
    trunk/locale/zh_CN.utf8/Manual/ManualContents.php
    trunk/locale/zh_CN.utf8/Manual/ManualGettingStarted.html
    trunk/locale/zh_HK.utf8/Manual/ManualContents.php
    trunk/locale/zh_HK.utf8/Manual/ManualGettingStarted.html

Modified: trunk/AddCustomerTypeNotes.php
===================================================================

--- trunk/AddCustomerTypeNotes.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/AddCustomerTypeNotes.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -147,7 +147,7 @@
 }
 if (isset($Id)) {
 	echo '<div class="centre">
-			<a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?DebtorType=' . $DebtorType . '">' . _('Review all notes for this Customer Type') .'</a>
+			<a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?DebtorType=' . $DebtorType . '">' . _('Review all notes for this Customer Type') .'</a>
 		</div>';
 }
 

Modified: trunk/AuditTrail.php
===================================================================
--- trunk/AuditTrail.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/AuditTrail.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -34,7 +34,7 @@
 // Get list of users
 $UserResult = DB_query("SELECT userid FROM www_users",$db);
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 echo '<table class="selection">';
 

Modified: trunk/BOMExtendedQty.php
===================================================================
--- trunk/BOMExtendedQty.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BOMExtendedQty.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -262,7 +262,7 @@
 
 	echo '<br />
 		<br />
-		<form action=' . htmlspecialchars($_SERVER['PHP_SELF']) . ' method="post">
+		<form action=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . ' method="post">
 		<table class="selection">
 		<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />
 		<tr>

Modified: trunk/BOMIndented.php
===================================================================
--- trunk/BOMIndented.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BOMIndented.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -247,7 +247,7 @@
 
 	echo '<br />
 			<br />
-			<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">
+			<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">
 			<table class="selection">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<tr>

Modified: trunk/BOMIndentedReverse.php
===================================================================
--- trunk/BOMIndentedReverse.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BOMIndentedReverse.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -235,7 +235,7 @@
 		_('Search') . '" alt="" />' . ' ' . $title.'</p><br />';
 	echo '<br />
 		<br />
-		<form action=' . htmlspecialchars($_SERVER['PHP_SELF']) . ' method="post">
+		<form action=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . ' method="post">
 		<table class="selection">
 		<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />
 		<tr>

Modified: trunk/BOMInquiry.php
===================================================================
--- trunk/BOMInquiry.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BOMInquiry.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -13,7 +13,7 @@
 }
 
 if (!isset($_POST['StockID'])) {
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">
 		<b>
 		<br />
 		</b>

Modified: trunk/BOMListing.php
===================================================================
--- trunk/BOMListing.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BOMListing.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -112,7 +112,7 @@
 
 	/*if $FromCriteria is not set then show a form to allow input	*/
 
-		echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="POST">
+		echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="POST">
 			<table class="selection">';
 		echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 

Modified: trunk/BOMs.php
===================================================================
--- trunk/BOMs.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BOMs.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -113,7 +113,7 @@
 				$DrillID='';
 			} else {
 				$DrillText = '<a href="%s&Select=%s">' . _('Drill Down');
-				$DrillLink = htmlspecialchars($_SERVER['PHP_SELF']) . '?';
+				$DrillLink = htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?';
 				$DrillID=$myrow['component'];
 			}
 			if ($ParentMBflag!='M' AND $ParentMBflag!='G'){
@@ -160,12 +160,12 @@
 					ConvertSQLDate($myrow['effectiveto']),
 					$AutoIssue,
 					$QuantityOnHand,
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$Parent,
 					$myrow['component'],
 					$DrillLink,
 					$DrillID,
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$Parent,
 					$myrow['component'],
 					$UltimateParent);
@@ -418,7 +418,7 @@
 			break;
 	}
 
-	echo '<br /><div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Select a Different BOM') . '</a></div><br />';
+	echo '<br /><div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Select a Different BOM') . '</a></div><br />';
 	echo '<table class="selection">';
 	// Display Manufatured Parent Items
 	$sql = "SELECT bom.parent,
@@ -437,7 +437,7 @@
 	if( DB_num_rows($result) > 0 ) {
 	 echo '<tr><td><div class="centre">'._('Manufactured parent items').' : ';
 	 while ($myrow = DB_fetch_array($result)){
-	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
+	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
 			$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
 			$ix++;
 	 } //end while loop
@@ -460,7 +460,7 @@
 		echo (($reqnl)?'<br />':'').'<tr><td><div class="centre">'._('Assembly parent items').' : ';
 	 	$ix = 0;
 	 	while ($myrow = DB_fetch_array($result)){
-	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
+	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
 			$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
 			$ix++;
 	 	} //end while loop
@@ -482,7 +482,7 @@
 		echo (($reqnl)?'<br />':'').'<tr><td><div class="centre">'._('Kit sets').' : ';
 	 	$ix = 0;
 	 	while ($myrow = DB_fetch_array($result)){
-	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
+	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
 			$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
 			$ix++;
 	 	} //end while loop
@@ -504,7 +504,7 @@
 		echo (($reqnl)?'<br />':'').'<tr><td><div class="centre">'._('Phantom').' : ';
 	 	$ix = 0;
 	 	while ($myrow = DB_fetch_array($result)){
-	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
+	 	   echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
 			$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
 			$ix++;
 	 	} //end while loop
@@ -564,7 +564,7 @@
 
 	if (! isset($_GET['delete'])) {
 
-		echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?Select=' . $SelectedParent .'">';
+		echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select=' . $SelectedParent .'">';
 		echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 		if (isset($_GET['SelectedComponent']) and $InputError !=1) {
@@ -830,7 +830,7 @@
 if (!isset($SelectedParent)) {
 
 	echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/magnifier.png" title="' . _('Search') . '" alt="" />' . ' ' . $title . '</p>';
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">' .
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">' .
 	'<div class="page_help_text">'. _('Select a manufactured part') . ' (' . _('or Assembly or Kit part') . ') ' . _('to maintain the bill of material for using the options below') .  '<br /><font size="1">' . _('Parts must be defined in the stock item entry') . '/' . _('modification screen as manufactured') . ', ' . _('kits or assemblies to be available for construction of a bill of material') .'</div>'. '</font>
      <br />
      <table class="selection" cellpadding="3" colspan="4">

Modified: trunk/BackupDatabase.php
===================================================================
--- trunk/BackupDatabase.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BackupDatabase.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -44,7 +44,7 @@
 		prnMsg(_('Once you have downloaded the database backup file to your local machine you should use the link below to delete it - backup files can consume a lot of space on your hosting account and will accumulate if not deleted - they also contain sensitive information which would otherwise be available for others to download!'),'info');
 		echo '<br />
 			<br />
-			<a href="'. htmlspecialchars($_SERVER['PHP_SELF']) . '?BackupFile=' .$BackupFile  .'">' . _('Delete the backup file off the server') . '</a>';
+			<a href="'. htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?BackupFile=' .$BackupFile  .'">' . _('Delete the backup file off the server') . '</a>';
 	} else {
 		prnMsg(_('There was some problem producing a backup using mysqldump. Normally this relates to a permissions issue - the web-server user must have permission to write to the companies directory'),'error');
 	}

Modified: trunk/BankReconciliation.php
===================================================================
--- trunk/BankReconciliation.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/BankReconciliation.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -8,7 +8,7 @@
 
 include('includes/header.inc');
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/money_add.png" title="' . _('Search') . '" alt="" />' . ' ' . $title.'</p><br />';
 

Modified: trunk/COGSGLPostings.php
===================================================================
--- trunk/COGSGLPostings.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/COGSGLPostings.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -111,9 +111,9 @@
 					$myrow['stkcat'],
 					$myrow['salestype'],
 					$myrow['accountname'],
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$myrow['id'],
-					htmlspecialchars($_SERVER['PHP_SELF']). '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'). '?',
 					$myrow['id']);
 		}//end while
 		echo '</table>';
@@ -210,9 +210,9 @@
 				$myrow['stkcat'],
 				$myrow['salestype'],
 				$myrow['accountname'],
-				htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+				htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 				$myrow['id'],
-				htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+				htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 				$myrow['id']);
 	
 		}//END WHILE LIST LOOP
@@ -222,12 +222,12 @@
 //end of ifs and buts!
 
 if (isset($SelectedCOGSPostingID)) {
-	echo '<div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) .'">' . _('Show all cost of sales posting records') . '</a></div>';
+	echo '<div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .'">' . _('Show all cost of sales posting records') . '</a></div>';
 }
 
 echo '<br />';
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 if (isset($SelectedCOGSPostingID)) {

Modified: trunk/CompanyPreferences.php
===================================================================
--- trunk/CompanyPreferences.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CompanyPreferences.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -153,7 +153,7 @@
 	echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/maintenance.png" title="' . _('Search') .
 		'" alt="" />' . ' ' . $title.'</p><br />';
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 echo '<table class="selection">';
 

Modified: trunk/ConfirmDispatch_Invoice.php
===================================================================
--- trunk/ConfirmDispatch_Invoice.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/ConfirmDispatch_Invoice.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -266,7 +266,7 @@
 			</table>
 			<br />';
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier . '" method="post">';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier . '" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 /***************************************************************

Modified: trunk/ContractBOM.php
===================================================================
--- trunk/ContractBOM.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/ContractBOM.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -215,7 +215,7 @@
 
 /* This is where the order as selected should be displayed  reflecting any deletions or insertions*/
 
-echo '<form name="ContractBOMForm" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '" method="post">';
+echo '<form name="ContractBOMForm" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 if (count($_SESSION['Contract'.$identifier]->ContractBOM)>0){
@@ -263,7 +263,7 @@
 			  <td>' . $ContractComponent->UOM . '</td>
 			  <td class="number">' . locale_number_format($ContractComponent->ItemCost,$_SESSION['CompanyRecord']['decimalplaces']) . '</td>
 			  <td class="number">' . $DisplayLineTotal . '</td>
-			  <td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '&Delete=' . $ContractComponent->ComponentID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this item from the contract BOM?') . '\');">' . _('Delete') . '</a></td></tr>';
+			  <td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '&Delete=' . $ContractComponent->ComponentID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this item from the contract BOM?') . '\');">' . _('Delete') . '</a></td></tr>';
 		$TotalCost += $LineTotal;
 	}
 

Modified: trunk/ContractCosting.php
===================================================================
--- trunk/ContractCosting.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/ContractCosting.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -432,7 +432,7 @@
 
 if ($_SESSION['Contract'.$identifier]->Status ==2){//the contract is an order being processed now
 
-	echo '<form  method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?SelectedContract=' . $_SESSION['Contract'.$identifier]->ContractRef . '&identifier=' . $identifier . '">';
+	echo '<form  method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?SelectedContract=' . $_SESSION['Contract'.$identifier]->ContractRef . '&identifier=' . $identifier . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<br />
 		<div class="centre">

Modified: trunk/ContractOtherReqts.php
===================================================================
--- trunk/ContractOtherReqts.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/ContractOtherReqts.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -75,7 +75,7 @@
 
 /* This is where the other requirement as entered/modified should be displayed reflecting any deletions or insertions*/
 
-echo '<form name="ContractReqtsForm" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '" method="post">';
+echo '<form name="ContractReqtsForm" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/contract.png" title="' . _('Contract Other Requirements') . '" alt="" />  ' . _('Contract Other Requirements') . ' - ' . $_SESSION['Contract'.$identifier]->CustomerName.'</p>';
 
@@ -116,7 +116,7 @@
 			  <td><input type="text" class="number" name="Qty' . $ContractReqtID . '" size="11" value="' . locale_number_format($ContractComponent->Quantity,'Variable')  . '" /></td>
 			  <td><input type="text" class="number" name="CostPerUnit' . $ContractReqtID . '" size="11" value="' . locale_number_format($ContractComponent->CostPerUnit,$_SESSION['CompanyRecord']['decimalplaces']) . '" /></td>
 			  <td class="number">' . $DisplayLineTotal . '</td>
-			  <td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '&amp;Delete=' . $ContractReqtID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this contract requirement?') . '\');">' . _('Delete') . '</a></td>
+			  <td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '&amp;Delete=' . $ContractReqtID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this contract requirement?') . '\');">' . _('Delete') . '</a></td>
 			  </tr>';
 		$TotalCost += $LineTotal;
 	}

Modified: trunk/Contracts.php
===================================================================
--- trunk/Contracts.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/Contracts.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -746,7 +746,7 @@
 
 	echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/contract.png" title="' .
 		_('Contract') . '" alt="" />' . ' ' . _('Contract: Select Customer') . '</p>';
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier=' . $identifier .'" name="CustomerSelection" method="post">';
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier=' . $identifier .'" name="CustomerSelection" method="post">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	echo '<table cellpadding="3" colspan="4" class="selection">
@@ -814,7 +814,7 @@
 //end if RequireCustomerSelection
 } else { /*A customer is already selected so get into the contract setup proper */
 
-	echo '<form name="ContractEntry" enctype="multipart/form-data" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier=' . $identifier . '" method="post">';
+	echo '<form name="ContractEntry" enctype="multipart/form-data" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier=' . $identifier . '" method="post">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	echo '<p class="page_title_text">

Modified: trunk/CounterSales.php
===================================================================
--- trunk/CounterSales.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CounterSales.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -212,7 +212,7 @@
 
 	echo '<br /><br />';
 	prnMsg(_('This sale has been cancelled as requested'),'success');
-	echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Start a new Counter Sale') . '</a>';
+	echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Start a new Counter Sale') . '</a>';
 	include('includes/footer.inc');
 	exit;
 
@@ -361,7 +361,7 @@
 
 /* Always do the stuff below */
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier . '" name="SelectParts" method="post">';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier . '" name="SelectParts" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 //Get The exchange rate used for GPPercent calculations on adding or amending items
@@ -819,7 +819,7 @@
 		$_SESSION['Items'.$identifier]->TaxGLCodes=$TaxGLCodes;
 		echo '<td class="number">' . locale_number_format($TaxLineTotal ,$_SESSION['Items'.$identifier]->CurrDecimalPlaces) . '</td>';
 		echo '<td class="number">' . locale_number_format($SubTotal + $TaxLineTotal ,$_SESSION['Items'.$identifier]->CurrDecimalPlaces) . '</td>';
-		echo '<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier . '&Delete=' . $OrderLine->LineNumber . '" onclick="return confirm(\'' . _('Are You Sure?') . '\');">' . _('Delete') . '</a></td></tr>';
+		echo '<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier . '&Delete=' . $OrderLine->LineNumber . '" onclick="return confirm(\'' . _('Are You Sure?') . '\');">' . _('Delete') . '</a></td></tr>';
 
 		if ($_SESSION['AllowOrderLineItemNarrative'] == 1){
 			echo $RowStarter;
@@ -1980,7 +1980,7 @@
 		} else {
 			echo '<img src="'.$rootpath.'/css/'.$theme.'/images/printer.png" title="' . _('Print') . '" alt="" />' . ' ' . '<a target="_blank" href="'.$rootpath.'/PrintCustTransPortrait.php?FromTransNo='.$InvoiceNo.'&InvOrCredit=Invoice&PrintPDF=True">'. _('Print this invoice'). ' (' . _('Portrait') . ')</a><br /><br />';
 		}
-		echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Start a new Counter Sale') . '</a></div>';
+		echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Start a new Counter Sale') . '</a></div>';
 
 	}
 	// There were input errors so don't process nuffin
@@ -2197,7 +2197,7 @@
 
 		if (isset($SearchResult)) {
 			$j = 1;
-			echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?' . SID .'identifier='.$identifier . '" method="post" name="orderform">';
+			echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?' . SID .'identifier='.$identifier . '" method="post" name="orderform">';
 			echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 			echo '<table class="table1">';
 			echo '<tr>

Modified: trunk/CreditStatus.php
===================================================================
--- trunk/CreditStatus.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CreditStatus.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -177,9 +177,9 @@
 			$myrow['reasoncode'],
 			$myrow['reasondescription'],
 			$DissallowText,
-			htmlspecialchars($_SERVER['PHP_SELF']),
+			htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'),
 			$myrow['reasoncode'],
-			htmlspecialchars($_SERVER['PHP_SELF']),
+			htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'),
 			$myrow['reasoncode']);
 	
 	} //END WHILE LIST LOOP
@@ -189,13 +189,13 @@
 
 if (isset($SelectedReason)) {
 	echo '<div class="centre">
-			<a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Show Defined Credit Status Codes') . '</a>
+			<a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Show Defined Credit Status Codes') . '</a>
 		</div>';
 }
 
 if (!isset($_GET['delete'])) {
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	if (isset($SelectedReason) and ($InputError!=1)) {

Modified: trunk/Credit_Invoice.php
===================================================================
--- trunk/Credit_Invoice.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/Credit_Invoice.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -256,7 +256,7 @@
 
 if (!isset($_POST['ProcessCredit'])) {
 
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) .'" method="post">';
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .'" method="post">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 
@@ -378,7 +378,7 @@
 
 		echo '<td class="number">' . $DisplayTaxAmount . '</td>
 			<td class="number">' . $DisplayGrossLineTotal . '</td>
-			<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?Delete=' . $LnItm->LineNumber . '"  onclick="return confirm(\'' . _('Are you sure you wish to delete this item from the credit?') . '\');">' . _('Delete') . '</a></td></tr>';
+			<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Delete=' . $LnItm->LineNumber . '"  onclick="return confirm(\'' . _('Are you sure you wish to delete this item from the credit?') . '\');">' . _('Delete') . '</a></td></tr>';
 
 		echo '<tr' . $RowStarter . '><td colspan="12"><textarea tabindex="' . $j .'"  name="Narrative_' . $LnItm->LineNumber . '" cols="100%" rows="1">' . $LnItm->Narrative . '</textarea><br /><hr></td></tr>';
 		$j++;

Modified: trunk/Currencies.php
===================================================================
--- trunk/Currencies.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/Currencies.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -267,10 +267,10 @@
 					locale_number_format($myrow['decimalplaces'],0),
 					locale_number_format($myrow['rate'],6),
 					locale_number_format(GetCurrencyRate($myrow['currabrev'],$CurrencyRatesArray),6),
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$myrow['currabrev'],
 					_('Edit'),
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$myrow['currabrev'],
 					_('Delete'),
 					$rootpath,
@@ -301,14 +301,14 @@
 
 
 if (isset($SelectedCurrency)) {
-	echo '<div class="centre"><a href="' .htmlspecialchars($_SERVER['PHP_SELF'])  . '">'._('Show all currency definitions').'</a></div>';
+	echo '<div class="centre"><a href="' .htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8')  . '">'._('Show all currency definitions').'</a></div>';
 }
 
 echo '<br />';
 
 if (!isset($_GET['delete'])) {
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	if (isset($SelectedCurrency) AND $SelectedCurrency!='') {

Modified: trunk/CustEDISetup.php
===================================================================
--- trunk/CustEDISetup.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustEDISetup.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -69,7 +69,7 @@
 	}
 }
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 echo '<br /><table class="selection">';
 

Modified: trunk/CustLoginSetup.php
===================================================================
--- trunk/CustLoginSetup.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustLoginSetup.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -123,7 +123,7 @@
 
 }
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 echo '<table class="selection">

Modified: trunk/CustWhereAlloc.php
===================================================================
--- trunk/CustWhereAlloc.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustWhereAlloc.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -6,7 +6,7 @@
 $title = _('Customer How Paid Inquiry');
 include('includes/header.inc');
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 echo '<p class="page_title_text">

Modified: trunk/CustomerAllocations.php
===================================================================
--- trunk/CustomerAllocations.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustomerAllocations.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -336,7 +336,7 @@
 
 if (isset($_POST['AllocTrans'])) {
 	// Page called with trans number
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">';
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<input type="hidden" name="AllocTrans" value="' . $_POST['AllocTrans'] . '" />';
 
@@ -488,7 +488,7 @@
 				<td class="number">' . locale_number_format($myrow['total'],$myrow['currdecimalplaces']) . '</td>
 				<td class="number">' . locale_number_format($myrow['total']-$myrow['alloc'],$myrow['currdecimalplaces']) . '</td>
 				<td>' . $myrow['currcode'] . '</td>';
-		echo '<td><a href=' . htmlspecialchars($_SERVER['PHP_SELF']). '?AllocTrans=' . $myrow['id'] . '>' . _('Allocate') . '</a></td></tr>';
+		echo '<td><a href=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'). '?AllocTrans=' . $myrow['id'] . '>' . _('Allocate') . '</a></td></tr>';
 	}
 	echo '</table><p>';
 } else {
@@ -529,7 +529,7 @@
 	$k=0;
 	while ($myrow = DB_fetch_array($result)) {
 		
-		$AllocateLink = '<a href=' . htmlspecialchars($_SERVER['PHP_SELF']). '?AllocTrans=' . $myrow['id'] . '>' . _('Allocate') . '</a>';
+		$AllocateLink = '<a href=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'). '?AllocTrans=' . $myrow['id'] . '>' . _('Allocate') . '</a>';
 
 		if ( $CurrentDebtor != $myrow['debtorno'] ) {
 			if ( $CurrentTransaction > 1 ) {

Modified: trunk/CustomerBranches.php
===================================================================
--- trunk/CustomerBranches.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustomerBranches.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -409,11 +409,11 @@
 				$myrow[8],
 				$myrow[9],
 				($myrow[11]?_('No'):_('Yes')),
-				htmlspecialchars($_SERVER['PHP_SELF']),
+				htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'),
 				$DebtorNo,
 				urlencode($myrow[1]),
 				_('Edit'),
-				htmlspecialchars($_SERVER['PHP_SELF']),
+				htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'),
 				$DebtorNo,
 				urlencode($myrow[1]),
 				_('Delete Branch'));
@@ -463,7 +463,7 @@
 }
 
 if (!isset($_GET['delete'])) {
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) .'">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .'">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	if (isset($SelectedBranch)) {
@@ -539,7 +539,7 @@
 		echo '<p Class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/customer.png" title="' . _('Customer') . '" alt="" />
                  ' . ' ' . _('Change Details for Branch'). ' '. $SelectedBranch . '</p>';
 		if (isset($SelectedBranch)) {
-			echo '<div class="centre"><a href=' . htmlspecialchars($_SERVER['PHP_SELF']) . '?DebtorNo=' . $DebtorNo. '>' . _('Show all branches defined for'). ' '. $DebtorNo . '</a></div>';
+			echo '<div class="centre"><a href=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?DebtorNo=' . $DebtorNo. '>' . _('Show all branches defined for'). ' '. $DebtorNo . '</a></div>';
 		}
 		echo '<br />
 			<table class="selection">

Modified: trunk/CustomerInquiry.php
===================================================================
--- trunk/CustomerInquiry.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustomerInquiry.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -152,7 +152,7 @@
 
 echo '<br />
 	<div class="centre">
-		<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">
+		<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">
 		<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />'
 		. _('Show all transactions after') . ': <input tabindex="1" type="text" class="date" alt="' .$_SESSION['DefaultDateFormat']. '" id="datepicker" name="TransAfterDate" value="' . $_POST['TransAfterDate'] . '" maxlength="10" size="12" />
 		<input tabindex="2" type="submit" name="Refresh Inquiry" value="' . _('Refresh Inquiry') . '" />

Modified: trunk/CustomerReceipt.php
===================================================================
--- trunk/CustomerReceipt.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustomerReceipt.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -729,7 +729,7 @@
 /*set up the form whatever */
 
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?Type='.$_GET['Type'] . '" method="post" name="form1">';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Type='.$_GET['Type'] . '" method="post" name="form1">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 /*show the batch header details and the entries in the batch so far */
@@ -918,7 +918,7 @@
 				<td>' . stripslashes($ReceiptItem->CustomerName) . '</td>
 				<td>'.$ReceiptItem->GLCode.' - '.$myrow['accountname'].'</td>
 				<td>'.$ReceiptItem->Narrative . '</td>
-				<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?Delete=' . $ReceiptItem->ID . '&Type=' . $_GET['Type']. '">' . _('Delete') . '</a></td>
+				<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Delete=' . $ReceiptItem->ID . '&Type=' . $_GET['Type']. '">' . _('Delete') . '</a></td>
 			</tr>';
 		$BatchTotal= $BatchTotal + $ReceiptItem->Amount;
 	}

Modified: trunk/CustomerTransInquiry.php
===================================================================
--- trunk/CustomerTransInquiry.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustomerTransInquiry.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -12,7 +12,7 @@
 echo '<div class="page_help_text">' . _('Choose which type of transaction to report on.') . '</div>
 	<br />';
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 echo '<table class="selection">

Modified: trunk/CustomerTypes.php
===================================================================
--- trunk/CustomerTypes.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/CustomerTypes.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -204,9 +204,9 @@
 		</tr>',
 		$myrow[0],
 		$myrow[1],
-		htmlspecialchars($_SERVER['PHP_SELF']) . '?', 
+		htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?', 
 		$myrow[0],
-		htmlspecialchars($_SERVER['PHP_SELF']) . '?', 
+		htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?', 
 		$myrow[0]);
 	}
 	//END WHILE LIST LOOP
@@ -216,11 +216,11 @@
 //end of ifs and buts!
 if (isset($SelectedType)) {
 
-	echo '<div class="centre"><p><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Show All Types Defined') . '</a></div><p>';
+	echo '<div class="centre"><p><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Show All Types Defined') . '</a></div><p>';
 }
 if (! isset($_GET['delete'])) {
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) .  '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .  '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<p><table class="selection">'; //Main table
 

Modified: trunk/Customers.php
===================================================================
--- trunk/Customers.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/Customers.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -420,11 +420,11 @@
 	}
 
 	if ($SetupErrors>0) {
-		echo '<br /><div class="centre"><a href="'.htmlspecialchars($_SERVER['PHP_SELF']) .'" >'._('Click here to continue').'</a></div>';
+		echo '<br /><div class="centre"><a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .'" >'._('Click here to continue').'</a></div>';
 		include('includes/footer.inc');
 		exit;
 	}
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	echo '<input type="hidden" name="New" value="Yes" />';
@@ -618,7 +618,7 @@
 
 //DebtorNo exists - either passed when calling the form or from the form itself
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<table class="selection">
 			<tr><td valign="top"><table class="selection">';
@@ -1069,7 +1069,7 @@
 					$myrow['notes'],
 					$myrow['contid'],
 					$myrow['debtorno'],
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$myrow['contid'],
 					$myrow['debtorno']);
 		}

Modified: trunk/DailyBankTransactions.php
===================================================================
--- trunk/DailyBankTransactions.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/DailyBankTransactions.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -12,7 +12,7 @@
 	 </p>';
 
 if (!isset($_POST['Show'])) {
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method=post>';
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method=post>';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	echo '<table class="selection">';
@@ -139,7 +139,7 @@
 		echo '</table>';
 	} //end if no bank trans in the range to show
 	
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method=post>';
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method=post>';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<br /><div class="centre"><input type="submit" name="Return" value="' . _('Select Another Date'). '" /></div>';
 	echo '</form>';

Modified: trunk/DebtorsAtPeriodEnd.php
===================================================================
--- trunk/DebtorsAtPeriodEnd.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/DebtorsAtPeriodEnd.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -129,7 +129,7 @@
 
 	/*if $FromCriteria is not set then show a form to allow input	*/
 
-		echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">
+		echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">
 				<table class="selection">';
 		echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 

Modified: trunk/DiscountCategories.php
===================================================================
--- trunk/DiscountCategories.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/DiscountCategories.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -65,7 +65,7 @@
 }
 
 if (isset($_POST['selectchoice'])) {
-	echo '<form name="update" method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form name="update" method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	$sql = "SELECT DISTINCT discountcategory FROM stockmaster WHERE discountcategory <>''";
@@ -91,7 +91,7 @@
 			<br />';
 	}
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<input type="hidden" name="ChooseOption" value="'.$_POST['ChooseOption'].'" />';
 	echo '<input type="hidden" name="selectchoice" value="'.$_POST['selectchoice'].'" />';
@@ -212,7 +212,7 @@
 				echo '<tr class="OddTableRows">';
 				$k=1;
 			}
-			$DeleteURL = htmlspecialchars($_SERVER['PHP_SELF']) . '?Delete=yes&StockID=' . $myrow['stockid'] . '&DiscountCategory=' . $myrow['discountcategory'];
+			$DeleteURL = htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Delete=yes&StockID=' . $myrow['stockid'] . '&DiscountCategory=' . $myrow['discountcategory'];
 
 			printf('<td>%s</td>
 					<td>%s - %s</td>
@@ -235,7 +235,7 @@
 }
 
 if (!isset($_POST['selectchoice'])) {
-	echo '<form method="post" name="choose" action="' . htmlspecialchars($_SERVER['PHP_SELF']) .  '">';
+	echo '<form method="post" name="choose" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .  '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<table class="selection">';
 	echo '<tr><td>'._('Update discount category for').'</td>';

Modified: trunk/DiscountMatrix.php
===================================================================
--- trunk/DiscountMatrix.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/DiscountMatrix.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -81,7 +81,7 @@
 	echo '<br />';
 }
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 
@@ -173,7 +173,7 @@
 		echo '<tr class="OddTableRows">';
 		$k=1;
 	}
-	$DeleteURL = htmlspecialchars($_SERVER['PHP_SELF']) . '?Delete=yes&SalesType=' . $myrow['salestype'] . '&DiscountCategory=' . $myrow['discountcategory'] . '&QuantityBreak=' . $myrow['quantitybreak'];
+	$DeleteURL = htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Delete=yes&SalesType=' . $myrow['salestype'] . '&DiscountCategory=' . $myrow['discountcategory'] . '&QuantityBreak=' . $myrow['quantitybreak'];
 
 	printf('<td>%s</td>
 			<td>%s</td>

Modified: trunk/EDIMessageFormat.php
===================================================================
--- trunk/EDIMessageFormat.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/EDIMessageFormat.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -97,7 +97,7 @@
 	prnMsg($msg,'success');
 }
 
-echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 echo '<p><table border="0" width="100%">
@@ -153,9 +153,9 @@
 				$myrow[1],
 				$myrow[2],
 				$myrow[3],
-				htmlspecialchars($_SERVER['PHP_SELF']) . '?' . SID,
+				htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?' . SID,
 				$myrow[0],
-				htmlspecialchars($_SERVER['PHP_SELF']) . '?' . SID,
+				htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?' . SID,
 				$myrow[0]);
 
 	} //END WHILE LIST LOOP
@@ -189,7 +189,7 @@
 	$_POST['SequenceNo']  = $myrow['sequenceno'];
 	$_POST['LineText']  = $myrow['linetext'];
 
-	echo '<div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?MessageType=INVOIC&PartnerCode=' . $myrow['partnercode'] . '">' . _('Review Message Lines') . '</a></div>';
+	echo '<div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?MessageType=INVOIC&PartnerCode=' . $myrow['partnercode'] . '">' . _('Review Message Lines') . '</a></div>';
 
 	echo '<input type="hidden" name="SelectedMessageLine" value="' . $SelectedMessageLine . '" />';
 	echo '<input type="hidden" name="MessageType" value="' . $myrow['messagetype'] . '" />';

Modified: trunk/EmailCustTrans.php
===================================================================
--- trunk/EmailCustTrans.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/EmailCustTrans.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -35,7 +35,7 @@
 include ('includes/header.inc');
 
 
-echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method=post>';
+echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method=post>';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 echo '<input type="hidden" name="TransNo" value="' . $_GET['FromTransNo'] . '" />';

Modified: trunk/ExchangeRateTrend.php
===================================================================
--- trunk/ExchangeRateTrend.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/ExchangeRateTrend.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -21,7 +21,7 @@
 // SHOW OUR MAIN INPUT FORM
 // ************************
 
-	echo '<form method="post" name="update" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" name="update" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<div class="centre"><p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/money_add.png" title="' .
 		_('View Currency Trend') . '" alt="" />' . ' ' . _('View Currency Trend') . '</p>';

Modified: trunk/FTP_RadioBeacon.php
===================================================================
--- trunk/FTP_RadioBeacon.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/FTP_RadioBeacon.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -71,7 +71,7 @@
 		$k=1;
 	}
 
-	$FTPDispatchNote = htmlspecialchars($_SERVER['PHP_SELF']) . '?OrderNo=' . $myrow['orderno'];
+	$FTPDispatchNote = htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?OrderNo=' . $myrow['orderno'];
 	$FormatedDelDate = ConvertSQLDate($myrow['deliverydate']);
 	$FormatedOrderDate = ConvertSQLDate($myrow['orddate']);
 	$FormatedOrderValue = locale_number_format($myrow['ordervalue'],2);

Modified: trunk/Factors.php
===================================================================
--- trunk/Factors.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/Factors.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -197,7 +197,7 @@
 if (isset($_POST['Amend']) or isset($_POST['Create'])) {
 	// its a new factor being added
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<input type="hidden" name="FactorID" value="' . $FactorID .'" />
 		<table class="selection">
@@ -272,7 +272,7 @@
 
 if (empty($FactorID) AND !isset($_POST['Create']) AND !isset($_POST['Amend'])) {
 
-	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+	echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 	echo '<input type="hidden" name="New" value="No" />';

Modified: trunk/FixedAssetCategories.php
===================================================================
--- trunk/FixedAssetCategories.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/FixedAssetCategories.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -192,9 +192,9 @@
 					$myrow['depnact'],
 					$myrow['disposalact'],
 					$myrow['accumdepnact'],
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$myrow['categoryid'],
-					htmlspecialchars($_SERVER['PHP_SELF']) . '?',
+					htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
 					$myrow['categoryid']);
 	}
 	//END WHILE LIST LOOP
@@ -204,10 +204,10 @@
 //end of ifs and buts!
 
 if (isset($SelectedCategory)) {
-	echo '<br /><div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">' ._('Show All Fixed Asset Categories') . '</a></div>';
+	echo '<br /><div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' ._('Show All Fixed Asset Categories') . '</a></div>';
 }
 
-echo '<form name="CategoryForm" method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
+echo '<form name="CategoryForm" method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 
 if (isset($SelectedCategory) and !isset($_POST['submit'])) {

Modified: trunk/FixedAssetDepreciation.php
===================================================================
--- trunk/FixedAssetDepreciation.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/FixedAssetDepreciation.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -267,7 +267,7 @@
 	/*And post the journal too */
 	include ('includes/GLPostings.inc');
 } else {
-	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post" name="form">';
+	echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post" name="form">';
 	echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 	echo '<p />
 		<table class="selection" width="30%">

Modified: trunk/FixedAssetItems.php
===================================================================
--- trunk/FixedAssetItems.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/FixedAssetItems.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -380,7 +380,7 @@
 } /* end if delete asset */
 $result = DB_Txn_Commit($db);
 
-echo '<form name="AssetForm" enctype="multipart/form-data" method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">
+echo '<form name="AssetForm" enctype="multipart/form-data" method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">
 	<table class="selection">';
 echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
 

Modified: trunk/FixedAssetLocations.php
===================================================================
--- trunk/FixedAssetLocations.php	2012-02-22 06:06:03 UTC (rev 4949)
+++ trunk/FixedAssetLocations.php	2012-02-22 06:26:38 UTC (rev 4950)
@@ -56,7 +56,7 @@
 					WH...
 
[truncated message content]

Thread: [Web-erp-svn] SF.net SVN: web-erp:[4950] trunk (Page 25)

Accounting & Best Practice Business Administration System

web-erp-svn