From ca6417995023067a09453c88759b59f975e64e71 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 6 Jun 2013 15:27:14 +0200
Subject: [PATCH 01/44] // W3C

---
 .../controllers/access/helpers/form/form.tpl  |  6 +--
 .../employees/helpers/form/form.tpl           |  2 +-
 .../information/helpers/view/view.tpl         |  2 +-
 .../template/controllers/orders/form.tpl      | 38 +++++++++----------
 .../controllers/orders/helpers/view/view.tpl  |  2 +-
 .../controllers/products/informations.tpl     |  2 +-
 .../template/controllers/products/prices.tpl  |  4 +-
 .../template/controllers/shop/tree.tpl        |  2 +-
 .../templates/front/payment_execution.tpl     |  4 +-
 .../bankwire/views/templates/hook/payment.tpl |  2 +-
 .../views/templates/hook/payment_return.tpl   |  4 +-
 .../blockbestsellers-home.tpl                 |  4 +-
 modules/blockbestsellers/blockbestsellers.tpl |  6 +--
 modules/blockcart/blockcart-json.tpl          |  2 +-
 modules/blockcart/blockcart.tpl               | 14 +++----
 modules/blockcms/blockcms.tpl                 | 14 +++----
 .../blockmanufacturer/blockmanufacturer.tpl   |  6 +--
 modules/blockmyaccount/blockmyaccount.tpl     | 16 ++++----
 .../blockmyaccountfooter.tpl                  | 14 +++----
 modules/blocknewproducts/blocknewproducts.tpl |  6 +--
 .../views/templates/hook/blocknewsletter.tpl  |  2 +-
 modules/blockpaymentlogo/blockpaymentlogo.tpl |  2 +-
 .../blockpermanentlinks-footer.tpl            |  8 ++--
 .../blockpermanentlinks-header.tpl            |  4 +-
 .../blockpermanentlinks.tpl                   |  4 +-
 modules/blocksearch/blocksearch-top.tpl       |  4 +-
 modules/blocksearch/blocksearch.tpl           |  2 +-
 modules/blockspecials/blockspecials.tpl       |  6 +--
 modules/blockstore/blockstore.tpl             |  6 +--
 modules/blocksupplier/blocksupplier.tpl       |  6 +--
 modules/blocktags/blocktags.tpl               |  2 +-
 modules/blocktopmenu/blocktopmenu.tpl         |  2 +-
 modules/blockuserinfo/blockuserinfo.tpl       | 10 ++---
 modules/blockwishlist/blockwishlist-ajax.tpl  |  4 +-
 modules/blockwishlist/blockwishlist.tpl       |  4 +-
 modules/blockwishlist/managewishlist.tpl      |  8 ++--
 modules/blockwishlist/view.tpl                | 10 ++---
 .../views/templates/front/mywishlist.tpl      |  4 +-
 .../views/templates/front/validation.tpl      |  2 +-
 .../views/templates/hook/confirmation.tpl     |  2 +-
 .../views/templates/hook/payment.tpl          |  2 +-
 .../templates/front/payment_execution.tpl     |  4 +-
 .../cheque/views/templates/hook/payment.tpl   |  2 +-
 .../views/templates/hook/payment_return.tpl   |  4 +-
 modules/editorial/editorial.tpl               |  2 +-
 .../front/favoriteproducts-account.tpl        |  2 +-
 .../hook/favoriteproducts-header.tpl          |  4 +-
 modules/homefeatured/homefeatured.tpl         |  2 +-
 .../loyalty/views/templates/front/loyalty.tpl |  8 ++--
 .../views/templates/hook/my-account.tpl       |  2 +-
 .../templates/front/mailalerts-account.tpl    | 10 ++---
 .../views/templates/hook/my-account.tpl       |  2 +-
 modules/productcomments/productcomments.tpl   |  2 +-
 modules/productscategory/productscategory.tpl |  4 +-
 .../views/templates/front/program.tpl         | 12 +++---
 .../views/templates/hook/my-account.tpl       |  2 +-
 .../views/templates/hook/shopping-cart.tpl    |  2 +-
 modules/sendtoafriend/sendtoafriend-extra.tpl |  2 +-
 modules/sendtoafriend/sendtoafriend.tpl       |  2 +-
 themes/default/404.tpl                        |  2 +-
 themes/default/address.tpl                    | 30 +++++++--------
 themes/default/addresses.tpl                  | 12 +++---
 themes/default/authentication.tpl             | 12 +++---
 themes/default/category.tpl                   |  4 +-
 themes/default/discount.tpl                   |  4 +-
 themes/default/guest-tracking.tpl             |  4 +-
 themes/default/history.tpl                    | 16 ++++----
 themes/default/identity.tpl                   |  6 +--
 themes/default/mobile/404.tpl                 |  2 +-
 themes/default/mobile/address.tpl             |  2 +-
 themes/default/mobile/addresses.tpl           |  6 +--
 .../default/mobile/authentication-choice.tpl  |  6 +--
 .../mobile/authentication-create-account.tpl  |  2 +-
 .../default/mobile/category-product-list.tpl  |  2 +-
 themes/default/mobile/discount.tpl            |  2 +-
 themes/default/mobile/footer.tpl              |  4 +-
 themes/default/mobile/header.tpl              |  6 +--
 themes/default/mobile/history.tpl             |  6 +--
 themes/default/mobile/identity.tpl            |  4 +-
 themes/default/mobile/manufacturer.tpl        |  2 +-
 themes/default/mobile/my-account.tpl          | 14 +++----
 themes/default/mobile/order-address.tpl       | 18 ++++-----
 themes/default/mobile/order-carrier.tpl       |  6 +--
 .../mobile/order-detail-product-li.tpl        |  4 +-
 themes/default/mobile/order-detail.tpl        | 10 ++---
 themes/default/mobile/order-follow.tpl        | 10 ++---
 themes/default/mobile/order-opc-address.tpl   |  2 +-
 themes/default/mobile/order-opc-carrier.tpl   |  2 +-
 themes/default/mobile/order-opc.tpl           | 10 ++---
 themes/default/mobile/order-payment.tpl       |  8 ++--
 themes/default/mobile/order-slip.tpl          |  6 +--
 themes/default/mobile/pages-list.tpl          | 10 ++---
 themes/default/mobile/pagination.tpl          |  6 +--
 themes/default/mobile/password.tpl            |  2 +-
 .../default/mobile/product-desc-features.tpl  |  4 +-
 themes/default/mobile/product-images.tpl      |  4 +-
 themes/default/mobile/product.tpl             |  4 +-
 .../mobile/shopping-cart-gift-line.tpl        |  2 +-
 .../mobile/shopping-cart-product-line.tpl     |  8 ++--
 themes/default/mobile/shopping-cart.tpl       | 10 ++---
 themes/default/mobile/sitemap.tpl             | 26 ++++++-------
 themes/default/mobile/supplier.tpl            |  2 +-
 .../blockbestsellers-home.tpl                 |  4 +-
 .../blockbestsellers/blockbestsellers.tpl     |  6 +--
 .../default/modules/blockcart/blockcart.tpl   | 14 +++----
 themes/default/modules/blockcms/blockcms.tpl  | 14 +++----
 .../blockmanufacturer/blockmanufacturer.tpl   |  6 +--
 .../modules/blockmyaccount/blockmyaccount.tpl | 16 ++++----
 .../blockmyaccountfooter.tpl                  | 14 +++----
 .../blocknewproducts/blocknewproducts.tpl     |  6 +--
 .../blocknewsletter/blocknewsletter.tpl       |  2 +-
 .../modules/blocksearch/blocksearch.tpl       |  2 +-
 .../modules/blocksocial/blockspecials.tpl     |  6 +--
 .../modules/blockspecials/blockspecials.tpl   |  6 +--
 .../default/modules/blockstore/blockstore.tpl |  6 +--
 .../modules/blocksupplier/blocksupplier.tpl   |  6 +--
 .../default/modules/blocktags/blocktags.tpl   |  2 +-
 .../modules/blockwishlist/blockwishlist.tpl   |  4 +-
 .../modules/homefeatured/homefeatured.tpl     |  2 +-
 .../productcomments/productcomments.tpl       |  2 +-
 themes/default/my-account.tpl                 | 14 +++----
 .../default/order-address-multishipping.tpl   | 12 +++---
 themes/default/order-address-product-line.tpl |  8 ++--
 themes/default/order-address.tpl              | 18 ++++-----
 themes/default/order-carrier.tpl              | 10 ++---
 themes/default/order-confirmation.tpl         |  8 ++--
 themes/default/order-detail.tpl               | 12 +++---
 themes/default/order-follow.tpl               | 12 +++---
 themes/default/order-opc-new-account.tpl      |  4 +-
 themes/default/order-opc.tpl                  | 10 ++---
 themes/default/order-payment.tpl              |  8 ++--
 themes/default/order-return.tpl               |  6 +--
 themes/default/order-slip.tpl                 | 10 ++---
 themes/default/order-steps.tpl                |  8 ++--
 themes/default/pagination.tpl                 | 22 +++++------
 themes/default/password.tpl                   |  4 +-
 themes/default/product-compare.tpl            |  2 +-
 themes/default/product-list.tpl               |  6 +--
 themes/default/product.tpl                    | 20 +++++-----
 themes/default/products-comparison.tpl        |  6 +--
 themes/default/scenes.tpl                     |  2 +-
 themes/default/shopping-cart-product-line.tpl |  8 ++--
 themes/default/shopping-cart.tpl              |  8 ++--
 themes/default/sitemap.tpl                    | 28 +++++++-------
 144 files changed, 489 insertions(+), 489 deletions(-)

diff --git a/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
index ef97458aa..3036068fd 100644
--- a/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
@@ -52,7 +52,7 @@
 				checked = enabled ? 'checked': '';
 				$(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').attr('checked', checked);
 				$.ajax({
-					url: "{$link->getAdminLink('AdminAccess')}",
+					url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
 					cache: false,
 					data : {
 						ajaxMode : '1',
@@ -85,7 +85,7 @@
 			perfect_access_js_gestion(this, perm, id_tab, tabsize, tabnumber, table);
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')}",
+				url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
 				cache: false,
 				data : {
 					ajaxMode : '1',
@@ -134,7 +134,7 @@
 				});
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')}",
+				url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
 				cache: false,
 				data : {
 					ajaxMode: '1',
diff --git a/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl
index 395e949d0..38830a614 100644
--- a/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl
@@ -60,7 +60,7 @@
 			ifSuperAdmin($(this));
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminEmployees')}",
+				url: "{$link->getAdminLink('AdminEmployees')|escape:'html'}",
 				cache: false,
 				data : {
 					ajax : '1',
diff --git a/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl b/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl
index 782c4b834..91375363a 100644
--- a/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl
+++ b/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl
@@ -32,7 +32,7 @@
 		{
 			$.ajax({
 				type: 'GET',
-				url: '{$link->getAdminLink('AdminInformation')}',
+				url: '{$link->getAdminLink('AdminInformation')|escape:'html'}',
 				data: {
 					'action': 'checkFiles',
 					'ajax': 1
diff --git a/admin-dev/themes/default/template/controllers/orders/form.tpl b/admin-dev/themes/default/template/controllers/orders/form.tpl
index 280faff39..334cf4c9b 100755
--- a/admin-dev/themes/default/template/controllers/orders/form.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/form.tpl
@@ -28,7 +28,7 @@
 	var changed_shipping_price = false;
 	var shipping_price_selected_carrier = '';
 	var current_index = '{$current}&token={$token}';
-	var admin_cart_link = '{$link->getAdminLink('AdminCarts')}';
+	var admin_cart_link = '{$link->getAdminLink('AdminCarts')|escape:'html'}';
 	var cart_quantity = new Array();
 	var currencies = new Array();
 	var id_currency = '';
@@ -100,7 +100,7 @@
 		$('#show_old_carts').click();
 		$('#payment_module_name').change();
 		$.ajaxSetup({ type:"post" });
-		$("#voucher").autocomplete('{$link->getAdminLink('AdminCartRules')}', {
+		$("#voucher").autocomplete('{$link->getAdminLink('AdminCartRules')|escape:'html'}', {
 					minChars: 3,
 					max: 15,
 					width: 250,
@@ -157,7 +157,7 @@
 				free_shipping = 1;
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')}",
+				url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -217,7 +217,7 @@
 			e.preventDefault();
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')}",
+				url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -254,7 +254,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -288,7 +288,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -324,7 +324,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -351,7 +351,7 @@
 		$('#id_cart').val(id_cart);
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -378,7 +378,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -401,7 +401,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -426,7 +426,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url : "{$link->getAdminLink('AdminOrders')}",
+			url : "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -468,7 +468,7 @@
 		$('#new_address').attr('href', address_link.replace(/id_customer=[0-9]+/, 'id_customer='+id_customer));
 		$.ajax({
 			type:"POST",
-			url : "{$link->getAdminLink('AdminCarts')}",
+			url : "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -534,7 +534,7 @@
 		$('#products_part').show();
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')}",
+			url: "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -766,7 +766,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -822,7 +822,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -845,7 +845,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -868,7 +868,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -899,7 +899,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')}",
+			url: "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -957,7 +957,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
diff --git a/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl b/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
index 01e70bc85..e1e546126 100755
--- a/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
@@ -27,7 +27,7 @@
 
 {block name="override_tpl"}
 	<script type="text/javascript">
-	var admin_order_tab_link = "{$link->getAdminLink('AdminOrders')}";
+	var admin_order_tab_link = "{$link->getAdminLink('AdminOrders')|escape:'html'}";
 	var id_order = {$order->id};
 	var id_lang = {$current_id_lang};
 	var id_currency = {$order->id_currency};
diff --git a/admin-dev/themes/default/template/controllers/products/informations.tpl b/admin-dev/themes/default/template/controllers/products/informations.tpl
index 267568cd2..4f291484b 100644
--- a/admin-dev/themes/default/template/controllers/products/informations.tpl
+++ b/admin-dev/themes/default/template/controllers/products/informations.tpl
@@ -43,7 +43,7 @@
 				$('document').ready( function() {
 					$(".check_product_name")
 						.autocomplete(
-							'{$link->getAdminLink('AdminProducts', true)}', {
+							'{$link->getAdminLink('AdminProducts', true)|escape:'html'}', {
 								minChars: 3,
 								max: 10,
 								width: $(".check_product_name").width(),
diff --git a/admin-dev/themes/default/template/controllers/products/prices.tpl b/admin-dev/themes/default/template/controllers/products/prices.tpl
index d993bb770..8ff16424f 100644
--- a/admin-dev/themes/default/template/controllers/products/prices.tpl
+++ b/admin-dev/themes/default/template/controllers/products/prices.tpl
@@ -25,7 +25,7 @@
 
 <script type="text/javascript">
 var Customer = new Object();
-var product_url = '{$link->getAdminLink('AdminProducts', true)}';
+var product_url = '{$link->getAdminLink('AdminProducts', true)|escape:'html'}';
 var ecotax_tax_excl = parseFloat({$ecotax_tax_excl});
 $(document).ready(function () {
 	Customer = {
@@ -56,7 +56,7 @@ $(document).ready(function () {
 			Customer.showLoader();
 			jQuery.ajax({
 				"type": "POST",
-				"url": "{$link->getAdminLink('AdminCustomers')}",
+				"url": "{$link->getAdminLink('AdminCustomers')|escape:'html'}",
 				"async": true,
 				"dataType": "json",
 				"data": {
diff --git a/admin-dev/themes/default/template/controllers/shop/tree.tpl b/admin-dev/themes/default/template/controllers/shop/tree.tpl
index 25fba6604..50c27446f 100644
--- a/admin-dev/themes/default/template/controllers/shop/tree.tpl
+++ b/admin-dev/themes/default/template/controllers/shop/tree.tpl
@@ -186,7 +186,7 @@ $("#multishop-tree").jstree({
 	'plugins': ["themes","json_data","cookies","contextmenu"],
 	'json_data': {
 		'ajax': {
-			'url': "{$link->getAdminLink('AdminShop')}",
+			'url': "{$link->getAdminLink('AdminShop')|escape:'html'}",
 			'data': function(n)
 			{
 				return {
diff --git a/modules/bankwire/views/templates/front/payment_execution.tpl b/modules/bankwire/views/templates/front/payment_execution.tpl
index bb4ec3698..2d903529e 100644
--- a/modules/bankwire/views/templates/front/payment_execution.tpl
+++ b/modules/bankwire/views/templates/front/payment_execution.tpl
@@ -36,7 +36,7 @@
 {else}
 
 <h3>{l s='Bank-wire payment.' mod='bankwire'}</h3>
-<form action="{$link->getModuleLink('bankwire', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('bankwire', 'validation', [], true)|escape:'html'}" method="post">
 <p>
 	<img src="{$this_path_bw}bankwire.jpg" alt="{l s='Bank wire' mod='bankwire'}" width="86" height="49" style="float:left; margin: 0px 10px 5px 0px;" />
 	{l s='You have chosen to pay by bank wire.' mod='bankwire'}
@@ -73,7 +73,7 @@
 </p>
 <p class="cart_navigation">
 	<input type="submit" name="submit" value="{l s='Place my order' mod='bankwire'}" class="exclusive_large" />
-	<a href="{$link->getPageLink('order', true, NULL, "step=3")}" class="button_large">{l s='Other payment methods' mod='bankwire'}</a>
+	<a href="{$link->getPageLink('order', true, NULL, "step=3")|escape:'html'}" class="button_large">{l s='Other payment methods' mod='bankwire'}</a>
 </p>
 </form>
 {/if}
diff --git a/modules/bankwire/views/templates/hook/payment.tpl b/modules/bankwire/views/templates/hook/payment.tpl
index fce36997f..c2fa55e40 100644
--- a/modules/bankwire/views/templates/hook/payment.tpl
+++ b/modules/bankwire/views/templates/hook/payment.tpl
@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('bankwire', 'payment')}" title="{l s='Pay by bank wire' mod='bankwire'}">
+	<a href="{$link->getModuleLink('bankwire', 'payment')|escape:'html'}" title="{l s='Pay by bank wire' mod='bankwire'}">
 		<img src="{$this_path_bw}bankwire.jpg" alt="{l s='Pay by bank wire' mod='bankwire'}" width="86" height="49"/>
 		{l s='Pay by bank wire (order process will be longer)' mod='bankwire'}
 	</a>
diff --git a/modules/bankwire/views/templates/hook/payment_return.tpl b/modules/bankwire/views/templates/hook/payment_return.tpl
index d7baf1b6f..063a13bc2 100644
--- a/modules/bankwire/views/templates/hook/payment_return.tpl
+++ b/modules/bankwire/views/templates/hook/payment_return.tpl
@@ -37,11 +37,11 @@
 			<br /><br />- {l s='Do not forget to insert your order reference %s in the subject of your bank wire.' sprintf=$reference mod='bankwire'}
 		{/if}		<br /><br />{l s='An email has been sent with this information.' mod='bankwire'}
 		<br /><br /> <strong>{l s='Your order will be sent as soon as we receive payment.' mod='bankwire'}</strong>
-		<br /><br />{l s='If you have questions, comments or concerns, please contact our' mod='bankwire'} <a href="{$link->getPageLink('contact', true)}">{l s='expert customer support team. ' mod='bankwire'}</a>.
+		<br /><br />{l s='If you have questions, comments or concerns, please contact our' mod='bankwire'} <a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='expert customer support team. ' mod='bankwire'}</a>.
 	</p>
 {else}
 	<p class="warning">
 		{l s='We noticed a problem with your order. If you think this is an error, feel free to contact our' mod='bankwire'} 
-		<a href="{$link->getPageLink('contact', true)}">{l s='expert customer support team. ' mod='bankwire'}</a>.
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='expert customer support team. ' mod='bankwire'}</a>.
 	</p>
 {/if}
diff --git a/modules/blockbestsellers/blockbestsellers-home.tpl b/modules/blockbestsellers/blockbestsellers-home.tpl
index 1170dbb6b..4999a5b4d 100644
--- a/modules/blockbestsellers/blockbestsellers-home.tpl
+++ b/modules/blockbestsellers/blockbestsellers-home.tpl
@@ -38,7 +38,7 @@
 				<li style="border-bottom:0" class="ajax_block_product {if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 1}clear{/if} {if $smarty.foreach.myLoop.iteration > ($smarty.foreach.myLoop.total - ($smarty.foreach.myLoop.total % $nbItemsPerLine))}last_line{/if}">
 					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></h5>
 					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
+					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
 					<div>
 						{if !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{$product.price}</span></p>{else}<div style="height:21px;"></div>{/if}			
 						<a class="button" href="{$product.link}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
@@ -46,7 +46,7 @@
 				</li>
 			{/foreach}
 			</ul>
-			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
+			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
 		</div>
 	{else}
 		<p>{l s='No best sellers' mod='blockbestsellers'}</p>
diff --git a/modules/blockbestsellers/blockbestsellers.tpl b/modules/blockbestsellers/blockbestsellers.tpl
index c9609627a..900bd441d 100644
--- a/modules/blockbestsellers/blockbestsellers.tpl
+++ b/modules/blockbestsellers/blockbestsellers.tpl
@@ -26,7 +26,7 @@
 
 <!-- MODULE Block best sellers -->
 <div id="best-sellers_block_right" class="block products_block">
-	<h4 class="title_block"><a href="{$link->getPageLink('best-sales')}" title="{l s='View a top sellers products' mod='blockbestsellers'}">{l s='Top sellers' mod='blockbestsellers'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='View a top sellers products' mod='blockbestsellers'}">{l s='Top sellers' mod='blockbestsellers'}</a></h4>
 	<div class="block_content">
 	{if $best_sellers|@count > 0}
 		<ul class="product_images">
@@ -34,7 +34,7 @@
 			<li class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} clearfix">
 				<a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
 					<span class="number">{$smarty.foreach.myLoop.iteration}</span>
-					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
+					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
 				
 				</a>
 				<p><a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
@@ -44,7 +44,7 @@
 			</li>
 		{/foreach}
 		</ul>
-		<p class="lnk"><a href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
+		<p class="lnk"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
 	{else}
 		<p>{l s='No best sellers at this time' mod='blockbestsellers'}</p>
 	{/if}
diff --git a/modules/blockcart/blockcart-json.tpl b/modules/blockcart/blockcart-json.tpl
index 68ccf81d2..2afe1a214 100644
--- a/modules/blockcart/blockcart-json.tpl
+++ b/modules/blockcart/blockcart-json.tpl
@@ -83,7 +83,7 @@
 		"description":     "{$discount.description|addslashes|replace:'\\\'':'\''}",
 		"nameDescription": "{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|addslashes|replace:'\\\'':'\''}",
 		"code":            "{$discount.code}",
-		"link":            "{$link->getPageLink("$order_process", true, NULL, "deleteDiscount={$discount.id_discount}")}",
+		"link":            "{$link->getPageLink("$order_process", true, NULL, "deleteDiscount={$discount.id_discount}")|escape:'html'}",
 		"price":           "{if $priceDisplay == 1}{convertPrice|html_entity_decode:2:'UTF-8' price=$discount.value_tax_exc}{else}{convertPrice|html_entity_decode:2:'UTF-8' price=$discount.value_real}{/if}",
 		"price_float":     "{if $priceDisplay == 1}{$discount.value_tax_exc}{else}{$discount.value_real}{/if}"
 	{rdelim}
diff --git a/modules/blockcart/blockcart.tpl b/modules/blockcart/blockcart.tpl
index 0108a2381..005bef587 100644
--- a/modules/blockcart/blockcart.tpl
+++ b/modules/blockcart/blockcart.tpl
@@ -45,7 +45,7 @@ var generated_date = {$smarty.now|intval};
 <!-- MODULE Block cart -->
 <div id="cart_block" class="block exclusive">
 	<h4 class="title_block">
-		<a href="{$link->getPageLink("$order_process", true)}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>
+		<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>
 		{if $ajax_allowed}
 		<span id="block_cart_expand" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'expanded' || !isset($colapseExpandStatus)}class="hidden"{/if}>&nbsp;</span>
 		<span id="block_cart_collapse" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'collapsed'}class="hidden"{/if}>&nbsp;</span>
@@ -77,9 +77,9 @@ var generated_date = {$smarty.now|intval};
 			{assign var='productAttributeId' value=$product.id_product_attribute}
 			<dt id="cart_block_product_{$product.id_product}_{if $product.id_product_attribute}{$product.id_product_attribute}{else}0{/if}_{if $product.id_address_delivery}{$product.id_address_delivery}{else}0{/if}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
 				<span class="quantity-formated"><span class="quantity">{$product.cart_quantity}</span>x</span>
-				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{$product.name|escape:html:'UTF-8'}">
+				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}">
 				{$product.name|truncate:13:'...'|escape:html:'UTF-8'}</a>
-				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)}" title="{l s='Please remove this product from my cart.' mod='blockcart'}">&nbsp;</a>{/if}</span>
+				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)|escape:'html'}" title="{l s='Please remove this product from my cart.' mod='blockcart'}">&nbsp;</a>{/if}</span>
 				<span class="price">
 					{if !isset($product.is_gift) || !$product.is_gift}
 						{if $priceDisplay == $smarty.const.PS_TAX_EXC}{displayWtPrice p="`$product.total`"}{else}{displayWtPrice p="`$product.total_wt`"}{/if}
@@ -90,7 +90,7 @@ var generated_date = {$smarty.now|intval};
 			</dt>
 			{if isset($product.attributes_small)}
 			<dd id="cart_block_combination_of_{$product.id_product}{if $product.id_product_attribute}_{$product.id_product_attribute}{/if}_{$product.id_address_delivery|intval}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
-				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
+				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
 			{/if}
 
 			<!-- Customizable datas -->
@@ -99,7 +99,7 @@ var generated_date = {$smarty.now|intval};
 				<ul class="cart_block_customizations" id="customization_{$productId}_{$productAttributeId}">
 					{foreach from=$customizedDatas.$productId.$productAttributeId[$product.id_address_delivery] key='id_customization' item='customization' name='customizations'}
 						<li name="customization">
-							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)}" rel="nofollow"> </a></div>
+							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)|escape:'html'}" rel="nofollow"> </a></div>
 							<span class="quantity-formated"><span class="quantity">{$customization.quantity}</span>x</span>{if isset($customization.datas.$CUSTOMIZE_TEXTFIELD.0)}
 							{$customization.datas.$CUSTOMIZE_TEXTFIELD.0.value|replace:"<br />":" "|truncate:28:'...'|escape:html:'UTF-8'}
 							{else}
@@ -166,8 +166,8 @@ var generated_date = {$smarty.now|intval};
 			{/if}
 		{/if}
 		<p id="cart-buttons">
-			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
-			<a href="{$link->getPageLink("$order_process", true)}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Checkout' mod='blockcart'}" rel="nofollow"><span></span>{l s='Checkout' mod='blockcart'}</a>
+			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
+			<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Checkout' mod='blockcart'}" rel="nofollow"><span></span>{l s='Checkout' mod='blockcart'}</a>
 		</p>
 	</div>
 	</div>
diff --git a/modules/blockcms/blockcms.tpl b/modules/blockcms/blockcms.tpl
index 1b17da4dd..6d0484c9d 100755
--- a/modules/blockcms/blockcms.tpl
+++ b/modules/blockcms/blockcms.tpl
@@ -37,7 +37,7 @@
 				{foreach from=$cms_title.cms item=cms_page}
 					{if isset($cms_page.link)}<li><a href="{$cms_page.link}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
 				{/foreach}
-				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
 			</ul>
 		</div>
 	{/foreach}
@@ -47,17 +47,17 @@
 	<div class="block_various_links" id="block_various_links_footer">
 		<h4 class="title_block">{l s='Information' mod='blockcms'}</h4>
 		<ul>
-			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
-			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
-			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')}" title="{l s='Best sellers' mod='blockcms'}">{l s='Best sellers' mod='blockcms'}</a></li>{/if}
-			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
-			<li class="item"><a href="{$link->getPageLink($contact_url, true)}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
+			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
+			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
+			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='Best sellers' mod='blockcms'}">{l s='Best sellers' mod='blockcms'}</a></li>{/if}
+			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+			<li class="item"><a href="{$link->getPageLink($contact_url, true)|escape:'html'}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
 			{foreach from=$cmslinks item=cmslink}
 				{if $cmslink.meta_title != ''}
 					<li class="item"><a href="{$cmslink.link|addslashes}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 				{/if}
 			{/foreach}
-			<li><a href="{$link->getPageLink('sitemap')}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
+			<li><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
 			{if $display_poweredby}<li class="last_item">{l s='Powered by' mod='blockcms'} <a class="_blank" href="http://www.prestashop.com">PrestaShop</a>&trade;</li>{/if}
 		</ul>
 	{$footer_text}
diff --git a/modules/blockmanufacturer/blockmanufacturer.tpl b/modules/blockmanufacturer/blockmanufacturer.tpl
index c0cb88e68..eb5f81e6e 100644
--- a/modules/blockmanufacturer/blockmanufacturer.tpl
+++ b/modules/blockmanufacturer/blockmanufacturer.tpl
@@ -25,14 +25,14 @@
 
 <!-- Block manufacturers module -->
 <div id="manufacturers_block_left" class="block blockmanufacturer">
-	<h4 class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</h4>
+	<h4 class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')|escape:'html'}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</h4>
 	<div class="block_content">
 {if $manufacturers}
 	{if $text_list}
 	<ul class="bullet">
 	{foreach from=$manufacturers item=manufacturer name=manufacturer_list}
 		{if $smarty.foreach.manufacturer_list.iteration <= $text_list_nb}
-		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}" title="{l s='Learn more about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
+		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}" title="{l s='Learn more about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
 		{/if}
 	{/foreach}
 	</ul>
@@ -43,7 +43,7 @@
 				<select id="manufacturer_list" onchange="autoUrl('manufacturer_list', '');">
 					<option value="0">{l s='All manufacturers' mod='blockmanufacturer'}</option>
 				{foreach from=$manufacturers item=manufacturer}
-					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>
diff --git a/modules/blockmyaccount/blockmyaccount.tpl b/modules/blockmyaccount/blockmyaccount.tpl
index 0c796103e..ae4c88872 100644
--- a/modules/blockmyaccount/blockmyaccount.tpl
+++ b/modules/blockmyaccount/blockmyaccount.tpl
@@ -25,18 +25,18 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></h4>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="">{l s='My orders' mod='blockmyaccount'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="">{l s='My orders' mod='blockmyaccount'}</a></li>
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
-		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
+		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
 	</div>
 </div>
 <!-- /Block myaccount module -->
diff --git a/modules/blockmyaccountfooter/blockmyaccountfooter.tpl b/modules/blockmyaccountfooter/blockmyaccountfooter.tpl
index 078d867a2..417bbc65b 100644
--- a/modules/blockmyaccountfooter/blockmyaccountfooter.tpl
+++ b/modules/blockmyaccountfooter/blockmyaccountfooter.tpl
@@ -25,15 +25,15 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></h4>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="{l s='My orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='My orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
 		<p class="logout"><a href="{$link->getPageLink('index')}?mylogout" title="{l s='Sign out' mod='blockmyaccountfooter'}" rel="nofollow">{l s='Sign out' mod='blockmyaccount'}</a></p>
diff --git a/modules/blocknewproducts/blocknewproducts.tpl b/modules/blocknewproducts/blocknewproducts.tpl
index 193ad41b3..3a5585657 100644
--- a/modules/blocknewproducts/blocknewproducts.tpl
+++ b/modules/blocknewproducts/blocknewproducts.tpl
@@ -25,13 +25,13 @@
 
 <!-- MODULE Block new products -->
 <div id="new-products_block_right" class="block products_block">
-	<h4 class="title_block"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></h4>
 	<div class="block_content">
 	{if $new_products !== false}
 		<ul class="product_images clearfix">
 		{foreach from=$new_products item='product' name='newProducts'}
 			{if $smarty.foreach.newProducts.index < 2}
-				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
+				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
 			{/if}
 		{/foreach}
 		</ul>
@@ -41,7 +41,7 @@
 			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
 		{/foreach}
 		</dl>
-		<p><a href="{$link->getPageLink('new-products')}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
+		<p><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
 	{else}
 		<p>&raquo; {l s='Do not allow new products at this time.' mod='blocknewproducts'}</p>
 	{/if}
diff --git a/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl b/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl
index db017dadf..7da7eca1d 100644
--- a/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl
+++ b/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl
@@ -31,7 +31,7 @@
 	{if isset($msg) && $msg}
 		<p class="{if $nw_error}warning_inline{else}success_inline{/if}">{$msg}</p>
 	{/if}
-		<form action="{$link->getPageLink('index')}" method="post">
+		<form action="{$link->getPageLink('index')|escape:'html'}" method="post">
 			<p>
 				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}">
 				<input type="submit" value="ok" class="button_mini" name="submitNewsletter" />
diff --git a/modules/blockpaymentlogo/blockpaymentlogo.tpl b/modules/blockpaymentlogo/blockpaymentlogo.tpl
index bf3dc13ee..d825c62b5 100644
--- a/modules/blockpaymentlogo/blockpaymentlogo.tpl
+++ b/modules/blockpaymentlogo/blockpaymentlogo.tpl
@@ -25,7 +25,7 @@
 
 <!-- Block payment logo module -->
 <div id="paiement_logo_block_left" class="paiement_logo_block">
-	<a href="{$link->getCMSLink($cms_payement_logo)}">
+	<a href="{$link->getCMSLink($cms_payement_logo)|escape:'html'}">
 		<img src="{$img_dir}logo_paiement_visa.jpg" alt="visa" width="33" height="21" />
 		<img src="{$img_dir}logo_paiement_mastercard.jpg" alt="mastercard" width="32" height="21" />
 		<img src="{$img_dir}logo_paiement_paypal.jpg" alt="paypal" width="61" height="21" />
diff --git a/modules/blockpermanentlinks/blockpermanentlinks-footer.tpl b/modules/blockpermanentlinks/blockpermanentlinks-footer.tpl
index d0fa7b9b5..39c32729f 100755
--- a/modules/blockpermanentlinks/blockpermanentlinks-footer.tpl
+++ b/modules/blockpermanentlinks/blockpermanentlinks-footer.tpl
@@ -27,13 +27,13 @@
 <div id="permanent_links">
 	<!-- Sitemap -->
 	<div class="sitemap">
-		<a href="{$link->getPageLink('sitemap')}"><img src="{$img_dir}icon/sitemap.gif" alt="{l s='Sitemap' mod='blockpermanentlinks'}"/></a>&nbsp;
-		<a href="{$link->getPageLink('sitemap')}" title="{l s='Sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}"><img src="{$img_dir}icon/sitemap.gif" alt="{l s='Sitemap' mod='blockpermanentlinks'}"/></a>&nbsp;
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Contact -->
 	<div class="contact">
-		<a href="{$link->getPageLink('contact', true)}"><img src="{$img_dir}icon/contact.gif" alt="{l s='Contact' mod='blockpermanentlinks'}"/></a>&nbsp;
-		<a href="{$link->getPageLink('contact', true)}" title="{l s='Contact' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}"><img src="{$img_dir}icon/contact.gif" alt="{l s='Contact' mod='blockpermanentlinks'}"/></a>&nbsp;
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Bookmark -->
 	<div class="add_bookmark">
diff --git a/modules/blockpermanentlinks/blockpermanentlinks-header.tpl b/modules/blockpermanentlinks/blockpermanentlinks-header.tpl
index 9c3b0b980..ee6764f0d 100644
--- a/modules/blockpermanentlinks/blockpermanentlinks-header.tpl
+++ b/modules/blockpermanentlinks/blockpermanentlinks-header.tpl
@@ -25,8 +25,8 @@
 
 <!-- Block permanent links module HEADER -->
 <ul id="header_links">
-	<li id="header_link_contact"><a href="{$link->getPageLink('contact', true)}" title="{l s='contact' mod='blockpermanentlinks'}">{l s='contact' mod='blockpermanentlinks'}</a></li>
-	<li id="header_link_sitemap"><a href="{$link->getPageLink('sitemap')}" title="{l s='sitemap' mod='blockpermanentlinks'}">{l s='sitemap' mod='blockpermanentlinks'}</a></li>
+	<li id="header_link_contact"><a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='contact' mod='blockpermanentlinks'}">{l s='contact' mod='blockpermanentlinks'}</a></li>
+	<li id="header_link_sitemap"><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='sitemap' mod='blockpermanentlinks'}">{l s='sitemap' mod='blockpermanentlinks'}</a></li>
 	<li id="header_link_bookmark">
 		<script type="text/javascript">writeBookmarkLink('{$come_from}', '{$meta_title|addslashes|addslashes}', '{l s='bookmark' mod='blockpermanentlinks' js=1}');</script>
 	</li>
diff --git a/modules/blockpermanentlinks/blockpermanentlinks.tpl b/modules/blockpermanentlinks/blockpermanentlinks.tpl
index 09d2ddb9a..7e0766f66 100644
--- a/modules/blockpermanentlinks/blockpermanentlinks.tpl
+++ b/modules/blockpermanentlinks/blockpermanentlinks.tpl
@@ -27,11 +27,11 @@
 <div id="permanent_links">
 	<!-- Sitemap -->
 	<div class="sitemap">
-		<a href="{$link->getPageLink('sitemap')}" title="{l s='Shop sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Shop sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Contact -->
 	<div class="contact">
-		<a href="{$link->getPageLink('contact', true)}" title="{l s='Contact form' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact form' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Bookmark -->
 	<div class="add_bookmark" style="height:30px;">
diff --git a/modules/blocksearch/blocksearch-top.tpl b/modules/blocksearch/blocksearch-top.tpl
index 5818309c3..7bb21b555 100644
--- a/modules/blocksearch/blocksearch-top.tpl
+++ b/modules/blocksearch/blocksearch-top.tpl
@@ -25,7 +25,7 @@
 <!-- block seach mobile -->
 {if isset($hook_mobile)}
 <div class="input_search" data-role="fieldcontain">
-	<form method="get" action="{$link->getPageLink('search')}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<input type="hidden" name="controller" value="search" />
 		<input type="hidden" name="orderby" value="position" />
 		<input type="hidden" name="orderway" value="desc" />
@@ -36,7 +36,7 @@
 <!-- Block search module TOP -->
 <div id="search_block_top">
 
-	<form method="get" action="{$link->getPageLink('search')}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<p>
 			<label for="search_query_top"><!-- image on background --></label>
 			<input type="hidden" name="controller" value="search" />
diff --git a/modules/blocksearch/blocksearch.tpl b/modules/blocksearch/blocksearch.tpl
index a9f6235ea..0f4d185f3 100644
--- a/modules/blocksearch/blocksearch.tpl
+++ b/modules/blocksearch/blocksearch.tpl
@@ -26,7 +26,7 @@
 <!-- Block search module -->
 <div id="search_block_left" class="block exclusive">
 	<h4 class="title_block">{l s='Search' mod='blocksearch'}</h4>
-	<form method="get" action="{$link->getPageLink('search', true)}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search', true)|escape:'html'}" id="searchbox">
 		<p class="block_content">
 			<label for="search_query_block">{l s='Enter a product name or description.' mod='blocksearch'}</label>
 			<input type="hidden" name="orderby" value="position" />
diff --git a/modules/blockspecials/blockspecials.tpl b/modules/blockspecials/blockspecials.tpl
index a663585b3..2bc181b52 100644
--- a/modules/blockspecials/blockspecials.tpl
+++ b/modules/blockspecials/blockspecials.tpl
@@ -25,13 +25,13 @@
 
 <!-- MODULE Block specials -->
 <div id="special_block_right" class="block products_block exclusive blockspecials">
-	<h4 class="title_block"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></h4>
 	<div class="block_content">
 
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -51,7 +51,7 @@
 			</li>
 		</ul>
 		<p>
-			<a href="{$link->getPageLink('prices-drop')}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
+			<a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
 		</p>
 {else}
 		<p>{l s='No product specials are available at this time.' mod='blockspecials'}</p>
diff --git a/modules/blockstore/blockstore.tpl b/modules/blockstore/blockstore.tpl
index 9e975ba95..fceedc49c 100644
--- a/modules/blockstore/blockstore.tpl
+++ b/modules/blockstore/blockstore.tpl
@@ -25,11 +25,11 @@
 
 <!-- Block stores module -->
 <div id="stores_block_left" class="block">
-	<h4 class="title_block"><a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}">{l s='Our store(s)!' mod='blockstore'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}">{l s='Our store(s)!' mod='blockstore'}</a></h4>
 	<div class="block_content blockstore">
-		<p class="store_image"><a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our store(s)!' mod='blockstore'}" width="174" height="115" /></a></p>
+		<p class="store_image"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our store(s)!' mod='blockstore'}" width="174" height="115" /></a></p>
 		<p>
-			<a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}">&raquo; {l s='Discover our store(s)d!' mod='blockstore'}</a>
+			<a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}">&raquo; {l s='Discover our store(s)d!' mod='blockstore'}</a>
 		</p>
 	</div>
 </div>
diff --git a/modules/blocksupplier/blocksupplier.tpl b/modules/blocksupplier/blocksupplier.tpl
index 2460dab5f..5e4f49546 100644
--- a/modules/blocksupplier/blocksupplier.tpl
+++ b/modules/blocksupplier/blocksupplier.tpl
@@ -25,7 +25,7 @@
 
 <!-- Block suppliers module -->
 <div id="suppliers_block_left" class="block blocksupplier">
-	<h4 class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</h4>
+	<h4 class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')|escape:'html'}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</h4>
 	<div class="block_content">
 {if $suppliers}
 	{if $text_list}
@@ -33,7 +33,7 @@
 	{foreach from=$suppliers item=supplier name=supplier_list}
 		{if $smarty.foreach.supplier_list.iteration <= $text_list_nb}
 		<li class="{if $smarty.foreach.supplier_list.last}last_item{elseif $smarty.foreach.supplier_list.first}first_item{else}item{/if}">
-			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
 		</li>
 		{/if}
 	{/foreach}
@@ -45,7 +45,7 @@
 				<select id="supplier_list" onchange="autoUrl('supplier_list', '');">
 					<option value="0">{l s='All suppliers' mod='blocksupplier'}</option>
 				{foreach from=$suppliers item=supplier}
-					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>
diff --git a/modules/blocktags/blocktags.tpl b/modules/blocktags/blocktags.tpl
index bbfd33041..1f1d732b8 100644
--- a/modules/blocktags/blocktags.tpl
+++ b/modules/blocktags/blocktags.tpl
@@ -29,7 +29,7 @@
 	<p class="block_content">
 {if $tags}
 	{foreach from=$tags item=tag name=myLoop}
-		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
+		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")|escape:'html'}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
 	{/foreach}
 {else}
 	{l s='No tags have been specified yet.' mod='blocktags'}
diff --git a/modules/blocktopmenu/blocktopmenu.tpl b/modules/blocktopmenu/blocktopmenu.tpl
index 55f85d34e..2df21e5ca 100644
--- a/modules/blocktopmenu/blocktopmenu.tpl
+++ b/modules/blocktopmenu/blocktopmenu.tpl
@@ -6,7 +6,7 @@
 			{$MENU}
 			{if $MENU_SEARCH}
 				<li class="sf-search noBack" style="float:right">
-					<form id="searchbox" action="{$link->getPageLink('search')}" method="get">
+					<form id="searchbox" action="{$link->getPageLink('search')|escape:'html'}" method="get">
 						<p>
 							<input type="hidden" name="controller" value="search" />
 							<input type="hidden" value="position" name="orderby"/>
diff --git a/modules/blockuserinfo/blockuserinfo.tpl b/modules/blockuserinfo/blockuserinfo.tpl
index 6da51f4cf..aa2a6c1b7 100644
--- a/modules/blockuserinfo/blockuserinfo.tpl
+++ b/modules/blockuserinfo/blockuserinfo.tpl
@@ -28,7 +28,7 @@
 	<ul id="header_nav">
 		{if !$PS_CATALOG_MODE}
 		<li id="shopping_cart">
-			<a href="{$link->getPageLink($order_process, true)}" title="{l s='View my shopping cart' mod='blockuserinfo'}" rel="nofollow">{l s='Cart' mod='blockuserinfo'}
+			<a href="{$link->getPageLink($order_process, true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockuserinfo'}" rel="nofollow">{l s='Cart' mod='blockuserinfo'}
 			<span class="ajax_cart_quantity{if $cart_qties == 0} hidden{/if}">{$cart_qties}</span>
 			<span class="ajax_cart_product_txt{if $cart_qties != 1} hidden{/if}">{l s='Product' mod='blockuserinfo'}</span>
 			<span class="ajax_cart_product_txt_s{if $cart_qties < 2} hidden{/if}">{l s='Products' mod='blockuserinfo'}</span>
@@ -47,15 +47,15 @@
 			</a>
 		</li>
 		{/if}
-		<li id="your_account"><a href="{$link->getPageLink('my-account', true)}" title="{l s='View my customer account' mod='blockuserinfo'}" rel="nofollow">{l s='Your Account' mod='blockuserinfo'}</a></li>
+		<li id="your_account"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" rel="nofollow">{l s='Your Account' mod='blockuserinfo'}</a></li>
 	</ul>
 	<p id="header_user_info">
 		{l s='Welcome' mod='blockuserinfo'}
 		{if $logged}
-			<a href="{$link->getPageLink('my-account', true)}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
-			<a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Log out' mod='blockuserinfo'}</a>
+			<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
+			<a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Log out' mod='blockuserinfo'}</a>
 		{else}
-			<a href="{$link->getPageLink('my-account', true)}" title="{l s='Login to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Login' mod='blockuserinfo'}</a>
+			<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Login to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Login' mod='blockuserinfo'}</a>
 		{/if}
 	</p>
 </div>
diff --git a/modules/blockwishlist/blockwishlist-ajax.tpl b/modules/blockwishlist/blockwishlist-ajax.tpl
index 4ea9ce3c7..055c05ff3 100644
--- a/modules/blockwishlist/blockwishlist-ajax.tpl
+++ b/modules/blockwishlist/blockwishlist-ajax.tpl
@@ -28,12 +28,12 @@
 	{foreach from=$products item=product name=i}
 		<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 			<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
-			<a class="cart_block_product_name" href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}" style="font-weight:bold;">{$product.name|truncate:13:'...'|escape:'htmlall':'UTF-8'}</a>
+			<a class="cart_block_product_name" href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}" style="font-weight:bold;">{$product.name|truncate:13:'...'|escape:'htmlall':'UTF-8'}</a>
 			<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 		</dt>
 		{if isset($product.attributes_small)}
 		<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}" style="font-style:italic;margin:0 0 0 10px;">
-			<a href="{$link->getProductLink($product.id_product, $product.link_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getProductLink($product.id_product, $product.link_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 		</dd>
 		{/if}
 	{/foreach}
diff --git a/modules/blockwishlist/blockwishlist.tpl b/modules/blockwishlist/blockwishlist.tpl
index d3b30a69f..0a422e904 100644
--- a/modules/blockwishlist/blockwishlist.tpl
+++ b/modules/blockwishlist/blockwishlist.tpl
@@ -35,12 +35,12 @@
 				<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 					<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
 					<a class="cart_block_product_name"
-					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
+					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
 					<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0', '{$token}');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 				</dt>
 				{if isset($product.attributes_small)}
 				<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
-					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 				</dd>
 				{/if}
 			{/foreach}
diff --git a/modules/blockwishlist/managewishlist.tpl b/modules/blockwishlist/managewishlist.tpl
index 2cec1b0e2..bde773922 100644
--- a/modules/blockwishlist/managewishlist.tpl
+++ b/modules/blockwishlist/managewishlist.tpl
@@ -51,15 +51,15 @@
 				<a href="javascript:;" class="lnkdel" onclick="WishlistProductManage('wlp_bought', 'delete', '{$id_wishlist}', '{$product.id_product}', '{$product.id_product_attribute}', $('#quantity_{$product.id_product}_{$product.id_product_attribute}').val(), $('#priority_{$product.id_product}_{$product.id_product_attribute}').val());" title="{l s='Delete' mod='blockwishlist'}">&raquo; {l s='Delete' mod='blockwishlist'}</a>
 				<div class="clearfix">
 					<div class="product_image">
-						<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">
-							<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />
+						<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">
+							<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />
 						</a>
 					</div>
 					<div class="product_infos">
 						<p id="s_title" class="product_name">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</p>
 						<span class="wishlist_product_detail">
 						{if isset($product.attributes_small)}
-							<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+							<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 						{/if}
 							<br />{l s='Quantity' mod='blockwishlist'}:<input type="text" id="quantity_{$product.id_product}_{$product.id_product_attribute}" value="{$product.quantity|intval}" size="3"  />
 							<br /><br />
@@ -116,7 +116,7 @@
 			{if $bought.quantity > 0}
 				<tr>
 					<td class="first_item">
-						<span style="float:left;"><img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'small')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" /></span>			
+						<span style="float:left;"><img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'small')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" /></span>			
 						<span style="float:left;">
 							{$product.name|truncate:40:'...'|escape:'htmlall':'UTF-8'}
 						{if isset($product.attributes_small)}
diff --git a/modules/blockwishlist/view.tpl b/modules/blockwishlist/view.tpl
index c4e3a79e4..b0b9efba4 100644
--- a/modules/blockwishlist/view.tpl
+++ b/modules/blockwishlist/view.tpl
@@ -48,12 +48,12 @@
 		<li class="address_title"><a href="{$link->getProductLink($product.id_product,
 		$product.link_rewrite, $product.category_rewrite)}" title="{l s='View' mod='blockwishlist'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a></li>
 		<li class="address_name">
-			<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}" class="product_image"  title="{$product.name|escape:'htmlall':'UTF-8'}">
-				<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />				
+			<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}" class="product_image"  title="{$product.name|escape:'htmlall':'UTF-8'}">
+				<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />				
 			</a>
 		<span class="wishlist_product_detail">
 		{if isset($product.attributes_small)}
-			<br /><a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+			<br /><a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 		{/if}
 			<br />{l s='Quantity:' mod='blockwishlist'}<input type="text" id="{$product.id_product}_{$product.id_product_attribute}" size="3" value="{$product.quantity|intval}" readonly/>
 			<br />{l s='Priority:' mod='blockwishlist'}
@@ -67,10 +67,10 @@
 		</span>
 		</li>
 		<li class="address_address1 clear">
-			<a class="button_small clear" href="{$link->getProductLink($product.id_product,  $product.link_rewrite, $product.category_rewrite)}" title="{l s='View' mod='blockwishlist'}" rel="nofollow">{l s='View' mod='blockwishlist'}</a>
+			<a class="button_small clear" href="{$link->getProductLink($product.id_product,  $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='View' mod='blockwishlist'}" rel="nofollow">{l s='View' mod='blockwishlist'}</a>
 			{if isset($product.attribute_quantity) AND $product.attribute_quantity >= 1 OR !isset($product.attribute_quantity) AND $product.product_quantity >= 1}
 			{if !$ajax}
-			<form id="addtocart_{$product.id_product|intval}_{$product.id_product_attribute|intval}" action="{$link->getPageLink('cart')}" method="post">
+			<form id="addtocart_{$product.id_product|intval}_{$product.id_product_attribute|intval}" action="{$link->getPageLink('cart')|escape:'html'}" method="post">
 			<p class="hidden">
 				<input type="hidden" name="id_product" value="{$product.id_product|intval}" id="product_page_product_id"  />
 				<input type="hidden" name="add" value="1" />
diff --git a/modules/blockwishlist/views/templates/front/mywishlist.tpl b/modules/blockwishlist/views/templates/front/mywishlist.tpl
index c6d9e408f..0d5d716e5 100644
--- a/modules/blockwishlist/views/templates/front/mywishlist.tpl
+++ b/modules/blockwishlist/views/templates/front/mywishlist.tpl
@@ -24,7 +24,7 @@
 *}
 
 <div id="mywishlist">
-	{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account' mod='blockwishlist'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My wishlists' mod='blockwishlist'}{/capture}
+	{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account' mod='blockwishlist'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My wishlists' mod='blockwishlist'}{/capture}
 	{include file="$tpl_dir./breadcrumb.tpl"}
 
 	<h2>{l s='My wishlists' mod='blockwishlist'}</h2>
@@ -93,7 +93,7 @@
 	{/if}
 
 	<ul class="footer_links">
-		<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to Your Account' mod='blockwishlist'}</a></li>
+		<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to Your Account' mod='blockwishlist'}</a></li>
 		<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a><a href="{$base_dir}">{l s='Home' mod='blockwishlist'}</a></li>
 	</ul>
 </div>
diff --git a/modules/cashondelivery/views/templates/front/validation.tpl b/modules/cashondelivery/views/templates/front/validation.tpl
index 53542fd7a..3cef97272 100755
--- a/modules/cashondelivery/views/templates/front/validation.tpl
+++ b/modules/cashondelivery/views/templates/front/validation.tpl
@@ -33,7 +33,7 @@
 
 <h3>{l s='Cash on delivery (COD) payment' mod='cashondelivery'}</h3>
 
-<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" method="post">
 	<input type="hidden" name="confirm" value="1" />
 	<p>
 		<img src="{$this_path_cod}cashondelivery.jpg" alt="{l s='Cash on delivery (COD) payment' mod='cashondelivery'}" style="float:left; margin: 0px 10px 5px 0px;" />
diff --git a/modules/cashondelivery/views/templates/hook/confirmation.tpl b/modules/cashondelivery/views/templates/hook/confirmation.tpl
index 3d0f5c528..2081949c9 100755
--- a/modules/cashondelivery/views/templates/hook/confirmation.tpl
+++ b/modules/cashondelivery/views/templates/hook/confirmation.tpl
@@ -27,5 +27,5 @@
 	<br /><br />
 	{l s='You have chosen the cash on delivery method.' mod='cashondelivery'}
 	<br /><br /><span class="bold">{l s='Your order will be sent very soon.' mod='cashondelivery'}</span>
-	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)}">{l s='customer support' mod='cashondelivery'}</a>.
+	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)|escape:'html'}">{l s='customer support' mod='cashondelivery'}</a>.
 </p>
diff --git a/modules/cashondelivery/views/templates/hook/payment.tpl b/modules/cashondelivery/views/templates/hook/payment.tpl
index 3cbc0fabb..b0f1854bd 100755
--- a/modules/cashondelivery/views/templates/hook/payment.tpl
+++ b/modules/cashondelivery/views/templates/hook/payment.tpl
@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
+	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
 		<img src="{$this_path_cod}cashondelivery.gif" alt="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" style="float:left;" />
 		<br />{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}
 		<br />{l s='You pay for the merchandise upon delivery' mod='cashondelivery'}
diff --git a/modules/cheque/views/templates/front/payment_execution.tpl b/modules/cheque/views/templates/front/payment_execution.tpl
index effc1b066..a359168ae 100644
--- a/modules/cheque/views/templates/front/payment_execution.tpl
+++ b/modules/cheque/views/templates/front/payment_execution.tpl
@@ -36,7 +36,7 @@
 {else}
 
 <h3>{l s='Check payment' mod='cheque'}</h3>
-<form action="{$link->getModuleLink('cheque', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cheque', 'validation', [], true)|escape:'html'}" method="post">
 	<p>
 		<img src="{$this_path_cheque}cheque.jpg" alt="{l s='Check' mod='cheque'}" width="86" height="49" style="float:left; margin: 0px 10px 5px 0px;" />
 		{l s='You have chosen to pay by check.' mod='cheque'}
@@ -73,7 +73,7 @@
 	</p>
 	<p class="cart_navigation">
 		<input type="submit" name="submit" value="{l s='I confirm my order' mod='cheque'}" class="exclusive_large" />
-		<a href="{$link->getPageLink('order', true, NULL, "step=3")}" class="button_large">{l s='Other payment methods' mod='cheque'}</a>
+		<a href="{$link->getPageLink('order', true, NULL, "step=3")|escape:'html'}" class="button_large">{l s='Other payment methods' mod='cheque'}</a>
 	</p>
 </form>
 {/if}
diff --git a/modules/cheque/views/templates/hook/payment.tpl b/modules/cheque/views/templates/hook/payment.tpl
index 1c7654854..bb62047b6 100644
--- a/modules/cheque/views/templates/hook/payment.tpl
+++ b/modules/cheque/views/templates/hook/payment.tpl
@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cheque', 'payment', [], true)}" title="{l s='Pay by check.' mod='cheque'}">
+	<a href="{$link->getModuleLink('cheque', 'payment', [], true)|escape:'html'}" title="{l s='Pay by check.' mod='cheque'}">
 		<img src="{$this_path_cheque}cheque.jpg" alt="{l s='Pay by check.' mod='cheque'}" width="86" height="49" />
 		{l s='Pay by check (order processing will take more time).' mod='cheque'}
 	</a>
diff --git a/modules/cheque/views/templates/hook/payment_return.tpl b/modules/cheque/views/templates/hook/payment_return.tpl
index fe3f58aad..dc62a7670 100644
--- a/modules/cheque/views/templates/hook/payment_return.tpl
+++ b/modules/cheque/views/templates/hook/payment_return.tpl
@@ -37,11 +37,11 @@
 		{/if}
 		<br /><br />{l s='An email has been sent to you with this information.' mod='cheque'}
 		<br /><br /><strong>{l s='Your order will be sent as soon as we receive your payment.' mod='cheque'}</strong>
-		<br /><br />{l s='For any questions or for further information, please contact our' mod='cheque'} <a href="{$link->getPageLink('contact', true)}">{l s='customer service department.' mod='cheque'}</a>.
+		<br /><br />{l s='For any questions or for further information, please contact our' mod='cheque'} <a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='customer service department.' mod='cheque'}</a>.
 	</p>
 {else}
 	<p class="warning">
 		{l s='We have noticed that there is a problem with your order. If you think this is an error, you can contact our' mod='cheque'} 
-		<a href="{$link->getPageLink('contact', true)}">{l s='customer service department.' mod='cheque'}</a>.
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='customer service department.' mod='cheque'}</a>.
 	</p>
 {/if}
diff --git a/modules/editorial/editorial.tpl b/modules/editorial/editorial.tpl
index 00cea23d3..7393327ab 100644
--- a/modules/editorial/editorial.tpl
+++ b/modules/editorial/editorial.tpl
@@ -26,7 +26,7 @@
 <!-- Module Editorial -->
 <div id="editorial_block_center" class="editorial_block">
 	{if $editorial->body_home_logo_link}<a href="{$editorial->body_home_logo_link|escape:'htmlall':'UTF-8'}" title="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}">{/if}
-	{if $homepage_logo}<img src="{$link->getMediaLink($image_path)}" alt="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}" {if $image_width}width="{$image_width}"{/if} {if $image_height}height="{$image_height}" {/if}/>{/if}
+	{if $homepage_logo}<img src="{$link->getMediaLink($image_path)|escape:'html'}" alt="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}" {if $image_width}width="{$image_width}"{/if} {if $image_height}height="{$image_height}" {/if}/>{/if}
 	{if $editorial->body_home_logo_link}</a>{/if}
 	{if $editorial->body_logo_subheading}<p id="editorial_image_legend">{$editorial->body_logo_subheading|stripslashes}</p>{/if}
 	{if $editorial->body_title}<h1>{$editorial->body_title|stripslashes}</h1>{/if}
diff --git a/modules/favoriteproducts/views/templates/front/favoriteproducts-account.tpl b/modules/favoriteproducts/views/templates/front/favoriteproducts-account.tpl
index a23dbd6ed..8d389b032 100644
--- a/modules/favoriteproducts/views/templates/front/favoriteproducts-account.tpl
+++ b/modules/favoriteproducts/views/templates/front/favoriteproducts-account.tpl
@@ -32,7 +32,7 @@ $('document').ready(function()
 		var parent = $(this).parent().parent();
 
 		$.ajax({
-			url: "{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], true)}",
+			url: "{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], true)|escape:'html'}",
 			type: "POST",
 			data: {
 				'id_product': idFavoriteProduct,
diff --git a/modules/favoriteproducts/views/templates/hook/favoriteproducts-header.tpl b/modules/favoriteproducts/views/templates/hook/favoriteproducts-header.tpl
index dd7bad133..8dffafcb4 100755
--- a/modules/favoriteproducts/views/templates/hook/favoriteproducts-header.tpl
+++ b/modules/favoriteproducts/views/templates/hook/favoriteproducts-header.tpl
@@ -23,8 +23,8 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 <script type="text/javascript">
-	var favorite_products_url_add = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'add'], false)}';
-	var favorite_products_url_remove = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], false)}';
+	var favorite_products_url_add = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'add'], false)|escape:'html'}';
+	var favorite_products_url_remove = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], false)|escape:'html'}';
 {if isset($smarty.get.id_product)}
 	var favorite_products_id_product = '{$smarty.get.id_product|intval}';
 {/if} 
diff --git a/modules/homefeatured/homefeatured.tpl b/modules/homefeatured/homefeatured.tpl
index f8d48eed7..b9181b0ac 100644
--- a/modules/homefeatured/homefeatured.tpl
+++ b/modules/homefeatured/homefeatured.tpl
@@ -38,7 +38,7 @@
 				{math equation="(total%perLine)" total=$smarty.foreach.homeFeaturedProducts.total perLine=$nbItemsPerLine assign=totModulo}
 				{if $totModulo == 0}{assign var='totModulo' value=$nbItemsPerLine}{/if}
 				<li class="ajax_block_product {if $smarty.foreach.homeFeaturedProducts.first}first_item{elseif $smarty.foreach.homeFeaturedProducts.last}last_item{else}item{/if} {if $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 1} {/if} {if $smarty.foreach.homeFeaturedProducts.iteration > ($smarty.foreach.homeFeaturedProducts.total - $totModulo)}last_line{/if}">
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
+					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
 					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h5>
 					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
 					<div>
diff --git a/modules/loyalty/views/templates/front/loyalty.tpl b/modules/loyalty/views/templates/front/loyalty.tpl
index f5cc4d996..7d8be9a88 100644
--- a/modules/loyalty/views/templates/front/loyalty.tpl
+++ b/modules/loyalty/views/templates/front/loyalty.tpl
@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='loyalty'}" rel="nofollow">{l s='My account' mod='loyalty'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My loyalty points' mod='loyalty'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='loyalty'}" rel="nofollow">{l s='My account' mod='loyalty'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My loyalty points' mod='loyalty'}{/capture}
 
 {include file="$tpl_dir./breadcrumb.tpl"}
 
@@ -125,7 +125,7 @@
 
 {if $transformation_allowed}
 <p style="text-align:center; margin-top:20px">
-	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'transformpoints'])}" onclick="return confirm('{l s='Are you sure you want to transform your points into vouchers?' mod='loyalty' js=1}');">{l s='Transform my points into a voucher of' mod='loyalty'} <span class="price">{convertPrice price=$voucher}</span>.</a>
+	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'transformpoints'])|escape:'html'}" onclick="return confirm('{l s='Are you sure you want to transform your points into vouchers?' mod='loyalty' js=1}');">{l s='Transform my points into a voucher of' mod='loyalty'} <span class="price">{convertPrice price=$voucher}</span>.</a>
 </p>
 {/if}
 
@@ -205,8 +205,8 @@ $(document).ready(function()
 
 <ul class="footer_links">
 	<li>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow">{l s='Back to Your Account' mod='loyalty'}</a>
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a>
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow">{l s='Back to Your Account' mod='loyalty'}</a>
 	</li>
 	<li class="f_right">
 		<a href="{$base_dir}" title="{l s='Home' mod='loyalty'}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a>
diff --git a/modules/loyalty/views/templates/hook/my-account.tpl b/modules/loyalty/views/templates/hook/my-account.tpl
index 5ed284926..5705c2c70 100644
--- a/modules/loyalty/views/templates/hook/my-account.tpl
+++ b/modules/loyalty/views/templates/hook/my-account.tpl
@@ -25,7 +25,7 @@
 
 <!-- MODULE Loyalty -->
 <li class="loyalty">
-	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'summary'])}" title="{l s='My loyalty points' mod='loyalty'}" rel="nofollow">
+	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'summary'])|escape:'html'}" title="{l s='My loyalty points' mod='loyalty'}" rel="nofollow">
 		<img src="{$module_template_dir}images/loyalty.gif" alt="{l s='My loyalty points' mod='loyalty'}" class="icon" /> {l s='My loyalty points' mod='loyalty'}
 	</a>
 </li>
diff --git a/modules/mailalerts/views/templates/front/mailalerts-account.tpl b/modules/mailalerts/views/templates/front/mailalerts-account.tpl
index cdd94be52..d73cc2950 100644
--- a/modules/mailalerts/views/templates/front/mailalerts-account.tpl
+++ b/modules/mailalerts/views/templates/front/mailalerts-account.tpl
@@ -35,7 +35,7 @@ $('document').ready(function()
 		var parent = $(this).parent().parent();
 
 		$.ajax({
-			url: "{$link->getModuleLink('mailalerts', 'actions', ['process' => 'remove'])}",
+			url: "{$link->getModuleLink('mailalerts', 'actions', ['process' => 'remove'])|escape:'html'}",
 			type: "POST",
 			data: {
 				'id_product': id_product_mail_alert,
@@ -56,7 +56,7 @@ $('document').ready(function()
 });
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='mailalerts'}" rel="nofollow">{l s='My account' mod='mailalerts'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My alerts' mod='mailalerts'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='mailalerts'}" rel="nofollow">{l s='My account' mod='mailalerts'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My alerts' mod='mailalerts'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <div id="mailalerts_block_account">
@@ -65,8 +65,8 @@ $('document').ready(function()
 		<div>
 			{foreach from=$mailAlerts item=mailAlert}
 			<div class="mailalert clearfix">
-				<a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}" class="product_img_link"><img src="{$link->getImageLink($mailAlert.link_rewrite, $mailAlert.cover, 'small_default')}" alt=""/></a>
-				<h3><a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}">{$mailAlert.name|escape:'htmlall':'UTF-8'}</a></h3>
+				<a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}" class="product_img_link"><img src="{$link->getImageLink($mailAlert.link_rewrite, $mailAlert.cover, 'small_default')|escape:'html'}" alt=""/></a>
+				<h3><a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)|escape:'html'}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}">{$mailAlert.name|escape:'htmlall':'UTF-8'}</a></h3>
 				<div class="product_desc">{$mailAlert.attributes_small|escape:'htmlall':'UTF-8'}</div>
 
 				<div class="remove">
@@ -80,6 +80,6 @@ $('document').ready(function()
 	{/if}
 
 	<ul class="footer_links">
-		<li class="fleft"><a href="{$link->getPageLink('my-account', true)}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='mailalerts'}">{l s='Back to Your Account' mod='mailalerts'}</a></li>
+		<li class="fleft"><a href="{$link->getPageLink('my-account', true)}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='mailalerts'}">{l s='Back to Your Account' mod='mailalerts'}</a></li>
 	</ul>
 </div>
\ No newline at end of file
diff --git a/modules/mailalerts/views/templates/hook/my-account.tpl b/modules/mailalerts/views/templates/hook/my-account.tpl
index 4d75f38f3..84b0c8a1e 100644
--- a/modules/mailalerts/views/templates/hook/my-account.tpl
+++ b/modules/mailalerts/views/templates/hook/my-account.tpl
@@ -24,7 +24,7 @@
 *}
 
 <li class="mailalerts">
-	<a href="{$link->getModuleLink('mailalerts', 'account')}" title="{l s='My alerts' mod='mailalerts'}" rel="nofollow">
+	<a href="{$link->getModuleLink('mailalerts', 'account')|escape:'html'}" title="{l s='My alerts' mod='mailalerts'}" rel="nofollow">
 		<img src="{$module_template_dir}img/icon-alert.png" class="icon" />
 		{l s='My alerts' mod='mailalerts'}
 	</a>
diff --git a/modules/productcomments/productcomments.tpl b/modules/productcomments/productcomments.tpl
index ad829979f..dcff2e01d 100644
--- a/modules/productcomments/productcomments.tpl
+++ b/modules/productcomments/productcomments.tpl
@@ -89,7 +89,7 @@ var productcomments_url_rewrite = '{$productcomments_url_rewriting_activated}';
 		<form action="#">
 			<h2 class="title">{l s='Write your review' mod='productcomments'}</h2>
 			<div class="product clearfix">
-				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
+				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
 				<div class="product_desc">
 					<p class="product_name"><strong>{$product->name}</strong></p>
 					{$product->description_short}
diff --git a/modules/productscategory/productscategory.tpl b/modules/productscategory/productscategory.tpl
index 136630bc4..8b9b9f6cb 100644
--- a/modules/productscategory/productscategory.tpl
+++ b/modules/productscategory/productscategory.tpl
@@ -32,9 +32,9 @@
 		<ul {if count($categoryProducts) > 5}style="width: {math equation="width * nbImages" width=107 nbImages=$categoryProducts|@count}px"{/if}>
 			{foreach from=$categoryProducts item='categoryProduct' name=categoryProduct}
 			<li {if count($categoryProducts) < 6}style="width:60px"{/if}>
-				<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" class="lnk_img" title="{$categoryProduct.name|htmlspecialchars}"><img src="{$link->getImageLink($categoryProduct.link_rewrite, $categoryProduct.id_image, 'medium_default')}" alt="{$categoryProduct.name|htmlspecialchars}" /></a>
+				<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" class="lnk_img" title="{$categoryProduct.name|htmlspecialchars}"><img src="{$link->getImageLink($categoryProduct.link_rewrite, $categoryProduct.id_image, 'medium_default')|escape:'html'}" alt="{$categoryProduct.name|htmlspecialchars}" /></a>
 				<p class="product_name">
-					<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" title="{$categoryProduct.name|htmlspecialchars}">{$categoryProduct.name|truncate:14:'...'|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)|escape:'html'}" title="{$categoryProduct.name|htmlspecialchars}">{$categoryProduct.name|truncate:14:'...'|escape:'htmlall':'UTF-8'}</a>
 				</p>
 				{if $ProdDisplayPrice AND $categoryProduct.show_price == 1 AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE}
 				<p class="price_display">
diff --git a/modules/referralprogram/views/templates/front/program.tpl b/modules/referralprogram/views/templates/front/program.tpl
index 146470aec..b2ca271e7 100644
--- a/modules/referralprogram/views/templates/front/program.tpl
+++ b/modules/referralprogram/views/templates/front/program.tpl
@@ -31,7 +31,7 @@
 	//]]>
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='referralprogram'}" rel="nofollow">{l s='My account' mod='referralprogram'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Referral Program' mod='referralprogram'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='referralprogram'}" rel="nofollow">{l s='My account' mod='referralprogram'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Referral Program' mod='referralprogram'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h2>{l s='Referral program' mod='referralprogram'}</h2>
@@ -95,7 +95,7 @@
 				{/if},
 				{l s='he or she will receive a %1$d voucher and you will receive your own voucher worth %2$d.' sprintf=[$discount,$discount] mod='referralprogram'}
 			</p>
-			<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)}" class="std">
+			<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" class="std">
 				<table class="std">
 				<thead>
 					<tr>
@@ -122,12 +122,12 @@
 				<p class="checkbox">
 					<input type="checkbox" name="conditionsValided" id="conditionsValided" value="1" {if isset($smarty.post.conditionsValided) AND $smarty.post.conditionsValided eq 1}checked="checked"{/if} />
 					<label for="conditionsValided">{l s='I agree to the terms of service and adhere to them unconditionally.' mod='referralprogram'}</label>
-					<a href="{$link->getModuleLink('referralprogram', 'rules', ['height' => '500', 'width' => '400'], true)}" class="thickbox" title="{l s='Conditions of the referral program' mod='referralprogram'}" rel="nofollow">{l s='Read conditions.' mod='referralprogram'}</a>
+					<a href="{$link->getModuleLink('referralprogram', 'rules', ['height' => '500', 'width' => '400'], true)|escape:'html'}" class="thickbox" title="{l s='Conditions of the referral program' mod='referralprogram'}" rel="nofollow">{l s='Read conditions.' mod='referralprogram'}</a>
 				</p>
 				<p class="see_email">
 					{l s='Preview' mod='referralprogram'} 
 					{assign var="file" value="{$lang_iso}/referralprogram-invitation.html"}
-					<a href="{$link->getModuleLink('referralprogram', 'email', ['height' => '500', 'width' => '600', 'mail' => {$file}], true)}" class="thickbox" title="{l s='Invitation e-mail' mod='referralprogram'}" rel="nofollow">{l s='the default e-mail' mod='referralprogram'}</a> {l s='that will be sent to your friend(s).' mod='referralprogram'}
+					<a href="{$link->getModuleLink('referralprogram', 'email', ['height' => '500', 'width' => '600', 'mail' => {$file}], true)|escape:'html'}" class="thickbox" title="{l s='Invitation e-mail' mod='referralprogram'}" rel="nofollow">{l s='the default e-mail' mod='referralprogram'}</a> {l s='that will be sent to your friend(s).' mod='referralprogram'}
 				</p>
 				<p class="submit">
 					<input type="submit" id="submitSponsorFriends" name="submitSponsorFriends" class="button_large" value="{l s='Validate' mod='referralprogram'}" />
@@ -145,7 +145,7 @@
 		<p>
 			{l s='These friends have not yet placed an order on this Website since you sponsored them, but you can try again! To do so, mark the checkboxes of the friend(s) you want to remind, then click on the button "Remind my friend(s)"' mod='referralprogram'}
 		</p>
-		<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)}" class="std">
+		<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" class="std">
 			<table class="std">
 			<thead>
 				<tr>
@@ -218,7 +218,7 @@
 
 <ul class="footer_links">
 	<li>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='referralprogram'}" rel="nofollow">
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='referralprogram'}" rel="nofollow">
 		<img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account' mod='referralprogram'}</a>
 	</li>
 	<li class="f_right"><a href="{$base_dir}" title="{l s='Home' mod='referralprogram'}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home' mod='referralprogram'}</a></li>
diff --git a/modules/referralprogram/views/templates/hook/my-account.tpl b/modules/referralprogram/views/templates/hook/my-account.tpl
index 49a01a9a6..f5cea67c1 100755
--- a/modules/referralprogram/views/templates/hook/my-account.tpl
+++ b/modules/referralprogram/views/templates/hook/my-account.tpl
@@ -25,7 +25,7 @@
 
 <!-- MODULE ReferralProgram -->
 <li class="referralprogram">
-	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">
+	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">
 		<img src="{$module_template_dir}referralprogram.gif" alt="{l s='Referral program' mod='referralprogram'}" class="icon" /> 
 			{l s='Referral program' mod='referralprogram'}
 	</a>
diff --git a/modules/referralprogram/views/templates/hook/shopping-cart.tpl b/modules/referralprogram/views/templates/hook/shopping-cart.tpl
index 8b0ab4987..eaa522cb8 100755
--- a/modules/referralprogram/views/templates/hook/shopping-cart.tpl
+++ b/modules/referralprogram/views/templates/hook/shopping-cart.tpl
@@ -28,7 +28,7 @@
 	<img src="{$module_template_dir}referralprogram.gif" alt="{l s='Referral program' mod='referralprogram'}" class="icon" />
 	{l s='You have earned a voucher worth %s thanks to your sponsor!' sprintf=$discount_display mod='referralprogram'}
 	{l s='Enter voucher name %s to receive the reduction on this order.' sprintf=$discount->name mod='referralprogram'}
-	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">{l s='View your referral program.' mod='referralprogram'}</a>
+	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">{l s='View your referral program.' mod='referralprogram'}</a>
 </p>
 <br />
 <!-- END : MODULE ReferralProgram -->
\ No newline at end of file
diff --git a/modules/sendtoafriend/sendtoafriend-extra.tpl b/modules/sendtoafriend/sendtoafriend-extra.tpl
index e7c594ed4..8c701642a 100644
--- a/modules/sendtoafriend/sendtoafriend-extra.tpl
+++ b/modules/sendtoafriend/sendtoafriend-extra.tpl
@@ -66,7 +66,7 @@ $('document').ready(function(){
 	<div id="send_friend_form">
 			<h2 class="title">{l s='Send to a friend' mod='sendtoafriend'}</h2>
 			<div class="product clearfix">
-				<img src="{$link->getImageLink($stf_product->link_rewrite, $stf_product_cover, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$stf_product->name|escape:html:'UTF-8'}" />
+				<img src="{$link->getImageLink($stf_product->link_rewrite, $stf_product_cover, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$stf_product->name|escape:html:'UTF-8'}" />
 				<div class="product_desc">
 					<p class="product_name"><strong>{$stf_product->name}</strong></p>
 					{$stf_product->description_short}
diff --git a/modules/sendtoafriend/sendtoafriend.tpl b/modules/sendtoafriend/sendtoafriend.tpl
index b4bcffd30..7e511204d 100644
--- a/modules/sendtoafriend/sendtoafriend.tpl
+++ b/modules/sendtoafriend/sendtoafriend.tpl
@@ -38,7 +38,7 @@
 			<form method="post" action="{$request_uri}" class="std">
 				<fieldset>
 					<div class="product clearfix">
-						<a href="{$productLink}" class="img_link"><img src="{$link->getImageLink($product->link_rewrite, $cover.id_image, 'small_default')}" alt="" title="{$cover.legend}" /></a>
+						<a href="{$productLink}" class="img_link"><img src="{$link->getImageLink($product->link_rewrite, $cover.id_image, 'small_default')|escape:'html'}" alt="" title="{$cover.legend}" /></a>
 						<a href="{$productLink}" class="product_desc"><br />{$product->name}</a>
 					</div>
 
diff --git a/themes/default/404.tpl b/themes/default/404.tpl
index 82bca1568..290f97c1b 100644
--- a/themes/default/404.tpl
+++ b/themes/default/404.tpl
@@ -30,7 +30,7 @@
 	</p>
 
 	<h3>{l s='To find a product, please type its name in the field below.'}</h3>
-	<form action="{$link->getPageLink('search')}" method="post" class="std">
+	<form action="{$link->getPageLink('search')|escape:'html'}" method="post" class="std">
 		<fieldset>
 			<p>
 				<label for="search">{l s='Search our product catalog:'}</label>
diff --git a/themes/default/address.tpl b/themes/default/address.tpl
index f2d071ebe..77a01cb1a 100644
--- a/themes/default/address.tpl
+++ b/themes/default/address.tpl
@@ -75,7 +75,7 @@ $(function(){ldelim}
 	{if isset($smarty.post.alias)}
 		"{$smarty.post.alias}"
 	{else}
-		{if isset($address->alias)}"{$address->alias}"{/if}
+		{if isset($address->alias)}"{$address->alias|escape:'html'}"{/if}
 	{/if}
 {else}
 	{l s='To add a new address, please fill out the form below.'}
@@ -86,12 +86,12 @@ $(function(){ldelim}
 
 <p class="required"><sup>*</sup> {l s='Required field'}</p>
 
-<form action="{$link->getPageLink('address', true)}" method="post" class="std" id="add_address">
+<form action="{$link->getPageLink('address', true)|escape:'html'}" method="post" class="std" id="add_address">
 	<fieldset>
 		<h3>{if isset($id_address)}{l s='Your address'}{else}{l s='New address'}{/if}</h3>
 		<p class="required text dni">
 			<label for="dni">{l s='Identification number'} <sup>*</sup></label>
-			<input type="text" class="text" name="dni" id="dni" value="{if isset($smarty.post.dni)}{$smarty.post.dni}{else}{if isset($address->dni)}{$address->dni}{/if}{/if}" />
+			<input type="text" class="text" name="dni" id="dni" value="{if isset($smarty.post.dni)}{$smarty.post.dni}{else}{if isset($address->dni)}{$address->dni|escape:'html'}{/if}{/if}" />
 			<span class="form_info">{l s='DNI / NIF / NIE'}</span>
 		</p>
 	{assign var="stateExist" value="false"}
@@ -100,7 +100,7 @@ $(function(){ldelim}
 			<p class="text">
 			<input type="hidden" name="token" value="{$token}" />
 			<label for="company">{l s='Company'}</label>
-			<input type="text" id="company" name="company" value="{if isset($smarty.post.company)}{$smarty.post.company}{else}{if isset($address->company)}{$address->company}{/if}{/if}" />
+			<input type="text" id="company" name="company" value="{if isset($smarty.post.company)}{$smarty.post.company}{else}{if isset($address->company)}{$address->company|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'vat_number'}
@@ -108,7 +108,7 @@ $(function(){ldelim}
 				<div id="vat_number">
 					<p class="text">
 						<label for="vat_number">{l s='VAT number'}</label>
-						<input type="text" class="text" name="vat_number" value="{if isset($smarty.post.vat_number)}{$smarty.post.vat_number}{else}{if isset($address->vat_number)}{$address->vat_number}{/if}{/if}" />
+						<input type="text" class="text" name="vat_number" value="{if isset($smarty.post.vat_number)}{$smarty.post.vat_number}{else}{if isset($address->vat_number)}{$address->vat_number|escape:'html'}{/if}{/if}" />
 					</p>
 				</div>
 			</div>
@@ -116,37 +116,37 @@ $(function(){ldelim}
 		{if $field_name eq 'firstname'}
 		<p class="required text">
 			<label for="firstname">{l s='First name'} <sup>*</sup></label>
-			<input type="text" name="firstname" id="firstname" value="{if isset($smarty.post.firstname)}{$smarty.post.firstname}{else}{if isset($address->firstname)}{$address->firstname}{/if}{/if}" />
+			<input type="text" name="firstname" id="firstname" value="{if isset($smarty.post.firstname)}{$smarty.post.firstname}{else}{if isset($address->firstname)}{$address->firstname|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'lastname'}
 		<p class="required text">
 			<label for="lastname">{l s='Last name'} <sup>*</sup></label>
-			<input type="text" id="lastname" name="lastname" value="{if isset($smarty.post.lastname)}{$smarty.post.lastname}{else}{if isset($address->lastname)}{$address->lastname}{/if}{/if}" />
+			<input type="text" id="lastname" name="lastname" value="{if isset($smarty.post.lastname)}{$smarty.post.lastname}{else}{if isset($address->lastname)}{$address->lastname|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'address1'}
 		<p class="required text">
 			<label for="address1">{l s='Address'} <sup>*</sup></label>
-			<input type="text" id="address1" name="address1" value="{if isset($smarty.post.address1)}{$smarty.post.address1}{else}{if isset($address->address1)}{$address->address1}{/if}{/if}" />
+			<input type="text" id="address1" name="address1" value="{if isset($smarty.post.address1)}{$smarty.post.address1}{else}{if isset($address->address1)}{$address->address1|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'address2'}
 		<p class="required text">
 			<label for="address2">{l s='Address (Line 2)'}</label>
-			<input type="text" id="address2" name="address2" value="{if isset($smarty.post.address2)}{$smarty.post.address2}{else}{if isset($address->address2)}{$address->address2}{/if}{/if}" />
+			<input type="text" id="address2" name="address2" value="{if isset($smarty.post.address2)}{$smarty.post.address2}{else}{if isset($address->address2)}{$address->address2|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'postcode'}
 		<p class="required postcode text">
 			<label for="postcode">{l s='Zip / Postal Code'} <sup>*</sup></label>
-			<input type="text" id="postcode" name="postcode" value="{if isset($smarty.post.postcode)}{$smarty.post.postcode}{else}{if isset($address->postcode)}{$address->postcode}{/if}{/if}" onkeyup="$('#postcode').val($('#postcode').val().toUpperCase());" />
+			<input type="text" id="postcode" name="postcode" value="{if isset($smarty.post.postcode)}{$smarty.post.postcode}{else}{if isset($address->postcode)}{$address->postcode|escape:'html'}{/if}{/if}" onkeyup="$('#postcode').val($('#postcode').val().toUpperCase());" />
 		</p>
 		{/if}
 		{if $field_name eq 'city'}
 		<p class="required text">
 			<label for="city">{l s='City'} <sup>*</sup></label>
-			<input type="text" name="city" id="city" value="{if isset($smarty.post.city)}{$smarty.post.city}{else}{if isset($address->city)}{$address->city}{/if}{/if}" maxlength="64" />
+			<input type="text" name="city" id="city" value="{if isset($smarty.post.city)}{$smarty.post.city}{else}{if isset($address->city)}{$address->city|escape:'html'}{/if}{/if}" maxlength="64" />
 		</p>
 		{*
 			if customer hasn't update his layout address, country has to be verified
@@ -205,22 +205,22 @@ $(function(){ldelim}
 		{/if}
 		<p class="textarea">
 			<label for="other">{l s='Additional information'}</label>
-			<textarea id="other" name="other" cols="26" rows="3">{if isset($smarty.post.other)}{$smarty.post.other}{else}{if isset($address->other)}{$address->other}{/if}{/if}</textarea>
+			<textarea id="other" name="other" cols="26" rows="3">{if isset($smarty.post.other)}{$smarty.post.other}{else}{if isset($address->other)}{$address->other|escape:'html'}{/if}{/if}</textarea>
 		</p>
 		{if isset($one_phone_at_least) && $one_phone_at_least}
 			<p class="inline-infos required">{l s='You must register at least one phone number.'}</p>
 		{/if}
 		<p class="text">
 			<label for="phone">{l s='Home phone'}</label>
-			<input type="text" id="phone" name="phone" value="{if isset($smarty.post.phone)}{$smarty.post.phone}{else}{if isset($address->phone)}{$address->phone}{/if}{/if}" />
+			<input type="text" id="phone" name="phone" value="{if isset($smarty.post.phone)}{$smarty.post.phone}{else}{if isset($address->phone)}{$address->phone|escape:'html'}{/if}{/if}" />
 		</p>
 		<p class="{if isset($one_phone_at_least) && $one_phone_at_least}required {/if}text">
 			<label for="phone_mobile">{l s='Mobile phone'}{if isset($one_phone_at_least) && $one_phone_at_least} <sup>*</sup>{/if}</label>
-			<input type="text" id="phone_mobile" name="phone_mobile" value="{if isset($smarty.post.phone_mobile)}{$smarty.post.phone_mobile}{else}{if isset($address->phone_mobile)}{$address->phone_mobile}{/if}{/if}" />
+			<input type="text" id="phone_mobile" name="phone_mobile" value="{if isset($smarty.post.phone_mobile)}{$smarty.post.phone_mobile}{else}{if isset($address->phone_mobile)}{$address->phone_mobile|escape:'html'}{/if}{/if}" />
 		</p>
 		<p class="required text" id="adress_alias">
 			<label for="alias">{l s='Please assign an address title for future reference.'} <sup>*</sup></label>
-			<input type="text" id="alias" name="alias" value="{if isset($smarty.post.alias)}{$smarty.post.alias}{else if isset($address->alias)}{$address->alias}{elseif !$select_address}{l s='My address'}{/if}" />
+			<input type="text" id="alias" name="alias" value="{if isset($smarty.post.alias)}{$smarty.post.alias}{else if isset($address->alias)}{$address->alias|escape:'html'}{elseif !$select_address}{l s='My address'}{/if}" />
 		</p>
 	</fieldset>
 	<p class="submit2">
diff --git a/themes/default/addresses.tpl b/themes/default/addresses.tpl
index e5059dc9d..cb4097651 100644
--- a/themes/default/addresses.tpl
+++ b/themes/default/addresses.tpl
@@ -86,7 +86,7 @@
 //]]>
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My addresses'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My addresses'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='My addresses'}</h1>
@@ -111,20 +111,20 @@
 				{/foreach}
 				</li>
 			{/foreach}
-			<li class="address_update"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")}" title="{l s='Update'}">&raquo; {l s='Update'}</a></li>
-			<li class="address_delete"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}&delete")}" onclick="return confirm('{l s='Are you sure?' js=1}');" title="{l s='Delete'}">&raquo; {l s='Delete'}</a></li>
+			<li class="address_update"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")|escape:'html'}" title="{l s='Update'}">&raquo; {l s='Update'}</a></li>
+			<li class="address_delete"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}&delete")|escape:'html'}" onclick="return confirm('{l s='Are you sure?' js=1}');" title="{l s='Delete'}">&raquo; {l s='Delete'}</a></li>
 		</ul>
 	{/foreach}
 	</div>
 	<p class="clear" />
 </div>
 {else}
-	<p class="warning">{l s='No addresses are available.'}&nbsp;<a href="{$link->getPageLink('address', true)}">{l s='Add a new address'}</a></p>
+	<p class="warning">{l s='No addresses are available.'}&nbsp;<a href="{$link->getPageLink('address', true)|escape:'html'}">{l s='Add a new address'}</a></p>
 {/if}
 
-<div class="clear address_add"><a href="{$link->getPageLink('address', true)}" title="{l s='Add an address'}" class="button_large">{l s='Add an address'}</a></div>
+<div class="clear address_add"><a href="{$link->getPageLink('address', true)|escape:'html'}" title="{l s='Add an address'}" class="button_large">{l s='Add an address'}</a></div>
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>
diff --git a/themes/default/authentication.tpl b/themes/default/authentication.tpl
index 033c2cd72..f6b643463 100644
--- a/themes/default/authentication.tpl
+++ b/themes/default/authentication.tpl
@@ -25,7 +25,7 @@
 
 {capture name=path}
 	{if !isset($email_create)}{l s='Authentication'}{else}
-		<a href="{$link->getPageLink('authentication', true)}" rel="nofollow" title="{l s='Authentication'}">{l s='Authentication'}</a>
+		<a href="{$link->getPageLink('authentication', true)|escape:'html'}" rel="nofollow" title="{l s='Authentication'}">{l s='Authentication'}</a>
 		<span class="navigation-pipe">{$navigationPipe}</span>{l s='Create your account'}
 	{/if}
 {/capture}
@@ -155,7 +155,7 @@ $(document).ready(function() {
 		</ol>
 	</div>
 	{/if}-->
-	<form action="{$link->getPageLink('authentication', true)}" method="post" id="create-account_form" class="std">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="create-account_form" class="std">
 		<fieldset>
 			<h3>{l s='Create an account'}</h3>
 			<div class="form_content clearfix">
@@ -174,7 +174,7 @@ $(document).ready(function() {
 		</fieldset>
 	</form>
 
-	<form action="{$link->getPageLink('authentication', true)}" method="post" id="login_form" class="std">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="login_form" class="std">
 		<fieldset>
 			<h3>{l s='Already registered?'}</h3>
 			<div class="form_content clearfix">
@@ -186,7 +186,7 @@ $(document).ready(function() {
 					<label for="passwd">{l s='Password'}</label>
 					<span><input type="password" id="passwd" name="passwd" value="{if isset($smarty.post.passwd)}{$smarty.post.passwd|stripslashes}{/if}" class="account_input" /></span>
 				</p>
-				<p class="lost_password"><a href="{$link->getPageLink('password')}" title="{l s='Recover your forgotten password'}" rel="nofollow">{l s='Forgot your password?'}</a></p>
+				<p class="lost_password"><a href="{$link->getPageLink('password')|escape:'html'}" title="{l s='Recover your forgotten password'}" rel="nofollow">{l s='Forgot your password?'}</a></p>
 				<p class="submit">
 					{if isset($back)}<input type="hidden" class="hidden" name="back" value="{$back|escape:'htmlall':'UTF-8'}" />{/if}
 					<input type="submit" id="SubmitLogin" name="SubmitLogin" class="button" value="{l s='Authentication'}" />
@@ -196,7 +196,7 @@ $(document).ready(function() {
 	</form>
 
 	{if isset($inOrderProcess) && $inOrderProcess && $PS_GUEST_CHECKOUT_ENABLED}
-	<form action="{$link->getPageLink('authentication', true, NULL, "back=$back")}" method="post" id="new_account_form" class="std clearfix">
+	<form action="{$link->getPageLink('authentication', true, NULL, "back=$back")|escape:'html'}" method="post" id="new_account_form" class="std clearfix">
 		<fieldset>
 			<h3>{l s='Instant checkout'}</h3>
 			<div id="opc_account_form" style="display: block; ">
@@ -370,7 +370,7 @@ $(document).ready(function() {
 		</ol>
 	</div>
 	{/if}-->
-<form action="{$link->getPageLink('authentication', true)}" method="post" id="account-creation_form" class="std">
+<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="account-creation_form" class="std">
 	{$HOOK_CREATE_ACCOUNT_TOP}
 	<fieldset class="account_creation">
 		<h3>{l s='Your personal information'}</h3>
diff --git a/themes/default/category.tpl b/themes/default/category.tpl
index 2dd8072cd..15a7187c6 100644
--- a/themes/default/category.tpl
+++ b/themes/default/category.tpl
@@ -50,7 +50,7 @@
 				<!-- Category image -->
 				{if $category->id_image}
 				<div class="align_center">
-					<img src="{$link->getCatImageLink($category->link_rewrite, $category->id_image, 'category_default')}" alt="{$category->name|escape:'htmlall':'UTF-8'}" title="{$category->name|escape:'htmlall':'UTF-8'}" id="categoryImage" width="{$categorySize.width}" height="{$categorySize.height}" />
+					<img src="{$link->getCatImageLink($category->link_rewrite, $category->id_image, 'category_default')|escape:'html'}" alt="{$category->name|escape:'htmlall':'UTF-8'}" title="{$category->name|escape:'htmlall':'UTF-8'}" id="categoryImage" width="{$categorySize.width}" height="{$categorySize.height}" />
 				</div>
 				{/if}
 			{/if}
@@ -77,7 +77,7 @@
 				<li class="clearfix">
 					<a href="{$link->getCategoryLink($subcategory.id_category, $subcategory.link_rewrite)|escape:'htmlall':'UTF-8'}" title="{$subcategory.name|escape:'htmlall':'UTF-8'}" class="img">
 						{if $subcategory.id_image}
-							<img src="{$link->getCatImageLink($subcategory.link_rewrite, $subcategory.id_image, 'medium_default')}" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
+							<img src="{$link->getCatImageLink($subcategory.link_rewrite, $subcategory.id_image, 'medium_default')|escape:'html'}" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 						{else}
 							<img src="{$img_cat_dir}default-medium_default.jpg" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 						{/if}
diff --git a/themes/default/discount.tpl b/themes/default/discount.tpl
index 3e4abef8c..aebe0328c 100644
--- a/themes/default/discount.tpl
+++ b/themes/default/discount.tpl
@@ -22,7 +22,7 @@
 *  @license    http://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
 *  International Registered Trademark & Property of PrestaShop SA
 *}
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My vouchers'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My vouchers'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='My vouchers'}</h1>
@@ -81,6 +81,6 @@
 {/if}
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>
diff --git a/themes/default/guest-tracking.tpl b/themes/default/guest-tracking.tpl
index 030081797..c53b2df17 100644
--- a/themes/default/guest-tracking.tpl
+++ b/themes/default/guest-tracking.tpl
@@ -66,7 +66,7 @@
 	{include file="$tpl_dir./errors.tpl"}
 	
 	{if isset($transformSuccess)}
-		<p class="success">{l s='Your guest account has been successfully transformed into a customer account. You can now login as a registered shopper. '} <a href="{$link->getPageLink('authentication', true)}">{l s='page.'}</a></p>
+		<p class="success">{l s='Your guest account has been successfully transformed into a customer account. You can now login as a registered shopper. '} <a href="{$link->getPageLink('authentication', true)|escape:'html'}">{l s='page.'}</a></p>
 	{else}
 		<form method="post" action="{$action|escape:'htmlall':'UTF-8'}#guestToCustomer" class="std">
 			<fieldset class="description_box">
@@ -92,7 +92,7 @@
 {else}
 	{include file="$tpl_dir./errors.tpl"}
 	{if isset($show_login_link) && $show_login_link}
-		<p><img src="{$img_dir}icon/userinfo.gif" alt="{l s='Information'}" class="icon" /><a href="{$link->getPageLink('my-account', true)}">{l s='Click here to login to your customer account.'}</a><br /><br /></p>
+		<p><img src="{$img_dir}icon/userinfo.gif" alt="{l s='Information'}" class="icon" /><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Click here to login to your customer account.'}</a><br /><br /></p>
 	{/if}
 	<form method="post" action="{$action|escape:'htmlall':'UTF-8'}" class="std">
 		<fieldset class="description_box">
diff --git a/themes/default/history.tpl b/themes/default/history.tpl
index 335e6a6e8..157911ef3 100644
--- a/themes/default/history.tpl
+++ b/themes/default/history.tpl
@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Order history'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Order history'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 {include file="$tpl_dir./errors.tpl"}
 
@@ -51,7 +51,7 @@
 			<tr class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.index % 2}alternate_item{/if}">
 				<td class="history_link bold">
 					{if isset($order.invoice) && $order.invoice && isset($order.virtual) && $order.virtual}<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Products to download'}" title="{l s='Products to download'}" />{/if}
-					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)}');">{Order::getUniqReferenceOf($order.id_order)}</a>
+					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)|escape:'html'}');">{Order::getUniqReferenceOf($order.id_order)}</a>
 				</td>
 				<td class="history_date bold">{dateFormat date=$order.date_add full=0}</td>
 				<td class="history_price"><span class="price">{displayPrice price=$order.total_paid currency=$order.id_currency no_utf8=false convert=false}</span></td>
@@ -59,16 +59,16 @@
 				<td class="history_state">{if isset($order.order_state)}{$order.order_state|escape:'htmlall':'UTF-8'}{/if}</td>
 				<td class="history_invoice">
 				{if (isset($order.invoice) && $order.invoice && isset($order.invoice_number) && $order.invoice_number) && isset($invoiceAllowed) && $invoiceAllowed == true}
-					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")}" title="{l s='Invoice'}" class="_blank"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Invoice'}" class="icon" /></a>
-					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")}" title="{l s='Invoice'}" class="_blank">{l s='PDF'}</a>
+					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")|escape:'html'}" title="{l s='Invoice'}" class="_blank"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Invoice'}" class="icon" /></a>
+					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")|escape:'html'}" title="{l s='Invoice'}" class="_blank">{l s='PDF'}</a>
 				{else}-{/if}
 				</td>
 				<td class="history_detail">
-					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)}');">{l s='details'}</a>
+					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)|escape:'html'}');">{l s='details'}</a>
 					{if isset($opc) && $opc}
-					<a href="{$link->getPageLink('order-opc', true, NULL, "submitReorder&id_order={$order.id_order}")}" title="{l s='Reorder'}">
+					<a href="{$link->getPageLink('order-opc', true, NULL, "submitReorder&id_order={$order.id_order}")|escape:'html'}" title="{l s='Reorder'}">
 					{else}
-					<a href="{$link->getPageLink('order', true, NULL, "submitReorder&id_order={$order.id_order}")}" title="{l s='Reorder'}">
+					<a href="{$link->getPageLink('order', true, NULL, "submitReorder&id_order={$order.id_order}")|escape:'html'}" title="{l s='Reorder'}">
 					{/if}
 						<img src="{$img_dir}arrow_rotate_anticlockwise.png" alt="{l s='Reorder'}" title="{l s='Reorder'}" class="icon" />
 					</a>
@@ -84,6 +84,6 @@
 </div>
 
 <ul class="footer_links clearfix">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>
diff --git a/themes/default/identity.tpl b/themes/default/identity.tpl
index 35f3cf594..ad52f01a3 100644
--- a/themes/default/identity.tpl
+++ b/themes/default/identity.tpl
@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Your personal information'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Your personal information'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='Your personal information'}</h1>
@@ -38,7 +38,7 @@
 {else}
 	<h3>{l s='Please be sure to update your personal information if it has changed.'}</h3>
 	<p class="required"><sup>*</sup>{l s='Required field'}</p>
-	<form action="{$link->getPageLink('identity', true)}" method="post" class="std">
+	<form action="{$link->getPageLink('identity', true)|escape:'html'}" method="post" class="std">
 		<fieldset>
 			<p class="radio">
 				<span>{l s='Title'}</span>
@@ -127,6 +127,6 @@
 {/if}
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>
diff --git a/themes/default/mobile/404.tpl b/themes/default/mobile/404.tpl
index fb5a10b9b..16978f198 100644
--- a/themes/default/mobile/404.tpl
+++ b/themes/default/mobile/404.tpl
@@ -33,7 +33,7 @@
 			<p>{l s='We\'re sorry, but the Web address you\'ve entered is no longer available.'}</p>
 			<p>{l s='To find a product, please type its name in the field below.'}</p>
 			<div data-role="fieldcontain" class="input_search_404">
-				<form action="{$link->getPageLink('search')}" method="post" class="std">
+				<form action="{$link->getPageLink('search')|escape:'html'}" method="post" class="std">
 				<input type="search" name="search_query" id="search_query" value="{l s='Search'}" />
 				</form>
 			</div>
diff --git a/themes/default/mobile/address.tpl b/themes/default/mobile/address.tpl
index 25fdb9e5d..7aa8618b3 100644
--- a/themes/default/mobile/address.tpl
+++ b/themes/default/mobile/address.tpl
@@ -84,7 +84,7 @@ $(document).ready(function() {
 		{/if}
 		</p>
 		
-		<form action="{$link->getPageLink('address', true)}" method="post" id="add_address" data-ajax="false">
+		<form action="{$link->getPageLink('address', true)|escape:'html'}" method="post" id="add_address" data-ajax="false">
 			<legend><h3>{if isset($id_address) && $id_address != 0}{l s='Your address'}{else}{l s='New address'}{/if}</h3></legend>
 			<div class="required text dni">
 				<label for="dni">{l s='Identification number'}</label>
diff --git a/themes/default/mobile/addresses.tpl b/themes/default/mobile/addresses.tpl
index 3978d1485..4704fbba1 100644
--- a/themes/default/mobile/addresses.tpl
+++ b/themes/default/mobile/addresses.tpl
@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 	<p>{l s='Please configure your default billing and delivery addresses when placing an order. You may also add additional addresses, which can be useful for sending gifts or receiving an order at your office.'}</p>
 	<div>
 		{if isset($multipleAddresses) && $multipleAddresses}
@@ -38,7 +38,7 @@
 			<ul data-role="listview" data-theme="g">
 				{foreach from=$multipleAddresses item=address name=myLoop}
 				<li>
-					<a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")}" title="{l s='Update'}" data-ajax="false">
+					<a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")|escape:'html'}" title="{l s='Update'}" data-ajax="false">
 						<p class="title_block">{$address.object.alias}</p>
 						{foreach from=$address.ordered name=adr_loop item=pattern}
 							{assign var=addressKey value=" "|explode:$pattern}
@@ -55,7 +55,7 @@
 		{else}
 		<p class="warning">{l s='No addresses are available.'}</p>
 	{/if}
-		<a href="{$link->getPageLink('address', true)}" data-role="button" data-theme="a" data-ajax="false">{l s='Add a new address'}</a>
+		<a href="{$link->getPageLink('address', true)|escape:'html'}" data-role="button" data-theme="a" data-ajax="false">{l s='Add a new address'}</a>
 	</div>
 	
 	{include file='./sitemap.tpl'}
diff --git a/themes/default/mobile/authentication-choice.tpl b/themes/default/mobile/authentication-choice.tpl
index 7d8346a4d..2c01fbfd7 100644
--- a/themes/default/mobile/authentication-choice.tpl
+++ b/themes/default/mobile/authentication-choice.tpl
@@ -1,6 +1,6 @@
 <div data-role="content" id="content">
 	
-	<form action="{$link->getPageLink('authentication', true)}" method="post" id="create-account_form" class="std login_form" data-ajax="false">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="create-account_form" class="std login_form" data-ajax="false">
 		<h2>{l s='Create an account'}</h2>
 		<div class="form_content clearfix">
 			<p class="title_block">{l s='Enter your email address to create an account'}.</p>
@@ -15,7 +15,7 @@
 
 	<hr/>
 
-	<form action="{$link->getPageLink('authentication', true)}" method="post" class="login_form">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" class="login_form">
 		<h2>{l s='Already registered?'}</h2>
 		<fieldset>
 			<input type="email" id="email" name="email" placeholder="{l s='Email address'}" value="{if isset($smarty.post.email)}{$smarty.post.email|escape:'htmlall':'UTF-8'|stripslashes}{/if}" class="account_input" />
@@ -23,7 +23,7 @@
 		
 		<fieldset>
 			<input type="password" id="passwd" name="passwd" placeholder="{l s='Password'}" value="{if isset($smarty.post.passwd)}{$smarty.post.passwd|escape:'htmlall':'UTF-8'|stripslashes}{/if}" class="account_input" />
-			<p class="forget_pwd"><a href="{$link->getPageLink('password')}" data-ajax="false">{l s='Forgot your password?'}</a></p>
+			<p class="forget_pwd"><a href="{$link->getPageLink('password')|escape:'html'}" data-ajax="false">{l s='Forgot your password?'}</a></p>
 		</fieldset>
 		<button type="submit" class="ui-btn-hidden submit_button" id="SubmitLogin" name="SubmitLogin" aria-disabled="false" data-theme="a">{l s='Login'}</button>
 	</form> 
diff --git a/themes/default/mobile/authentication-create-account.tpl b/themes/default/mobile/authentication-create-account.tpl
index 7477c6f26..8fcfc5551 100644
--- a/themes/default/mobile/authentication-create-account.tpl
+++ b/themes/default/mobile/authentication-create-account.tpl
@@ -1,4 +1,4 @@
-<form action="{$link->getPageLink('authentication', true)}" method="post" id="account-creation_form" class="std">
+<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="account-creation_form" class="std">
 	{$HOOK_CREATE_ACCOUNT_TOP}
 	<fieldset class="account_creation">
 		<h3>{l s='Your personal information'}</h3>
diff --git a/themes/default/mobile/category-product-list.tpl b/themes/default/mobile/category-product-list.tpl
index aa47d45ba..8eff694b1 100644
--- a/themes/default/mobile/category-product-list.tpl
+++ b/themes/default/mobile/category-product-list.tpl
@@ -28,7 +28,7 @@
 	{foreach from=$products item=product name=products}
 		<li class="ui-block-{if $smarty.foreach.products.index % 2}b{else}a{/if} product-list-row">
 			<a href="{$product.link|escape:'htmlall':'UTF-8'}" data-ajax="false">
-				<div class="product_img_wrapper"><img class="ui-li-thumb" src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" /></div>
+				<div class="product_img_wrapper"><img class="ui-li-thumb" src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" /></div>
 				<h3 class="ui-li-heading">{$product.name|escape:'htmlall':'UTF-8'}</h3>
 				{if (!$PS_CATALOG_MODE AND ((isset($product.show_price) && $product.show_price) || (isset($product.available_for_order) && $product.available_for_order)))}
 					<p class="ui-li-price">
diff --git a/themes/default/mobile/discount.tpl b/themes/default/mobile/discount.tpl
index a161d59de..af0d47ea8 100644
--- a/themes/default/mobile/discount.tpl
+++ b/themes/default/mobile/discount.tpl
@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 	
 	{if isset($discount) && count($discount) && $nbDiscounts}
 	<table class="discount std table_block">
diff --git a/themes/default/mobile/footer.tpl b/themes/default/mobile/footer.tpl
index 1b8771f8f..c725a4d2a 100644
--- a/themes/default/mobile/footer.tpl
+++ b/themes/default/mobile/footer.tpl
@@ -35,11 +35,11 @@
 				<div data-role="footer" data-theme="a" id="bar_footer">
 					<div id="link_bar_footer" class="ui-grid-a">
 						<div class="ui-block-a">
-							<a href="{$link->getPageLink('index', true)}" data-ajax="false">{$PS_SHOP_NAME}</a>
+							<a href="{$link->getPageLink('index', true)|escape:'html'}" data-ajax="false">{$PS_SHOP_NAME}</a>
 						</div>
 						{if $conditions}
 						<div class="ui-block-b">
-							<a href="{$link->getCMSLink($id_cgv)}" data-ajax="false">{l s='Terms of service'}</a>
+							<a href="{$link->getCMSLink($id_cgv)|escape:'html'}" data-ajax="false">{l s='Terms of service'}</a>
 						</div>
 						{/if}
 					</div>
diff --git a/themes/default/mobile/header.tpl b/themes/default/mobile/header.tpl
index cdc61a16e..ae6fb32d5 100644
--- a/themes/default/mobile/header.tpl
+++ b/themes/default/mobile/header.tpl
@@ -69,12 +69,12 @@
 				<div class="ui-block-b">
 					<div id="block_cart" class="clearfix">
 						{if !$PS_CATALOG_MODE}
-						<a href="{$link->getPageLink('order-opc', true)}" class="link_cart" data-ajax="false">{l s='Cart'}</a>
+						<a href="{$link->getPageLink('order-opc', true)|escape:'html'}" class="link_cart" data-ajax="false">{l s='Cart'}</a>
 						{/if}
 						{if $logged}
-							<a href="{$link->getPageLink('my-account', true)}" class="link_account" data-ajax="false">{l s='My account'}</a>
+							<a href="{$link->getPageLink('my-account', true)|escape:'html'}" class="link_account" data-ajax="false">{l s='My account'}</a>
 						{else}
-							<a href="{$link->getPageLink('authentication', true)}" class="link_account" data-ajax="false">{l s='Authentication'}</a>
+							<a href="{$link->getPageLink('authentication', true)|escape:'html'}" class="link_account" data-ajax="false">{l s='Authentication'}</a>
 						{/if}
 					</div>
 					{hook h="displayMobileTop"}
diff --git a/themes/default/mobile/history.tpl b/themes/default/mobile/history.tpl
index 4631d0cd0..c562b65cc 100644
--- a/themes/default/mobile/history.tpl
+++ b/themes/default/mobile/history.tpl
@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 {include file="$tpl_dir./errors.tpl"}
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 	<p>{l s='Here are the orders you\'ve placed since your account was created.'}.</p>
 
@@ -39,7 +39,7 @@
 		{foreach from=$orders item=order name=myLoop}
 			<li>
 				{assign var="id_order" value={$order.id_order|intval}}
-				<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")}" data-ajax="false">
+				<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")|escape:'html'}" data-ajax="false">
 					{if isset($order.invoice) && $order.invoice && isset($order.virtual) && $order.virtual}<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Products to download'}" title="{l s='Products to download'}" />{/if}
 					<h3>{l s='#'}{$order.id_order|string_format:"%06d"}</h3>
 					<p><strong>{l s='Total price'}</strong> {displayPrice price=$order.total_paid currency=$order.id_currency no_utf8=false convert=false}</p>
@@ -48,7 +48,7 @@
 					<span class="ui-li-aside">{dateFormat date=$order.date_add full=0}</span>
 				</a>
 				{if (isset($order.invoice) && $order.invoice && isset($order.invoice_number) && $order.invoice_number) && isset($invoiceAllowed) && $invoiceAllowed == true}
-				<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")}" title="{l s='Invoice'}" data-ajax="false">
+				<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")|escape:'html'}" title="{l s='Invoice'}" data-ajax="false">
 					{l s='PDF'}
 				</a>
 				{/if}
diff --git a/themes/default/mobile/identity.tpl b/themes/default/mobile/identity.tpl
index 2d8b059bc..b57189b05 100644
--- a/themes/default/mobile/identity.tpl
+++ b/themes/default/mobile/identity.tpl
@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 {include file="./errors.tpl"}
 
@@ -39,7 +39,7 @@
 {else}
 	<h3>{l s='Please be sure to update your personal information if it has changed.'}</h3>
 	<p class="required bold"><sup>*</sup>{l s='Required field'}</p>
-	<form action="{$link->getPageLink('identity', true)}" method="post" class="std">
+	<form action="{$link->getPageLink('identity', true)|escape:'html'}" method="post" class="std">
 		<label>{l s='Title'}</label>
 		<fieldset data-role="controlgroup">
 		{foreach from=$genders key=k item=gender}
diff --git a/themes/default/mobile/manufacturer.tpl b/themes/default/mobile/manufacturer.tpl
index 5233a48ed..35ea21f70 100644
--- a/themes/default/mobile/manufacturer.tpl
+++ b/themes/default/mobile/manufacturer.tpl
@@ -31,7 +31,7 @@
 {if !isset($errors) OR !sizeof($errors)}
 
 <div data-role="content" id="content">
-	<p><a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('manufacturer', true)}" data-ajax="false">{l s='Manufacturers:'}</a></p>
+	<p><a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('manufacturer', true)|escape:'html'}" data-ajax="false">{l s='Manufacturers:'}</a></p>
 	{if !empty($manufacturer->description) || !empty($manufacturer->short_description)}
 		<div class="category_desc clearfix">
 			{if !empty($manufacturer->short_description)}
diff --git a/themes/default/mobile/my-account.tpl b/themes/default/mobile/my-account.tpl
index cd1356631..0ca6e1b02 100644
--- a/themes/default/mobile/my-account.tpl
+++ b/themes/default/mobile/my-account.tpl
@@ -32,47 +32,47 @@
 		<ul data-role="listview" data-inset="true" id="list_myaccount">
 			{if $has_customer_an_address}
 			<li>
-				<a href="{$link->getPageLink('address', true)}" title="{l s='Add my first address'}" data-ajax="false">
+				<a href="{$link->getPageLink('address', true)|escape:'html'}" title="{l s='Add my first address'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/addrbook.png" alt="{l s='Addresses'}" class="ui-li-icon ui-li-thumb" />
 					{l s='Add my first address'}
 				</a>
 			</li>
 			{/if}
 			<li>
-				<a href="{$link->getPageLink('history', true)}" title="{l s='Orders'}" data-ajax="false">
+				<a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='Orders'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/order.png" alt="{l s='Orders'}" class="ui-li-icon ui-li-thumb" />
 					{l s='Order history and details '}
 				</a>
 			</li>
 			{if $returnAllowed}
 			<li>
-				<a href="{$link->getPageLink('order-follow', true)}" title="{l s='Merchandise returns'}" data-ajax="false">
+				<a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='Merchandise returns'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/return.png" alt="{l s='Merchandise returns'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My merchandise returns'}
 				</a>
 			</li>
 			{/if}
 			<li>
-				<a href="{$link->getPageLink('order-slip', true)}" title="{l s='Credit slips'}" data-ajax="false">
+				<a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='Credit slips'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/slip.png" alt="{l s='Credit slips'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My credit slips'}
 				</a>
 			</li>
 			<li>
-				<a href="{$link->getPageLink('addresses', true)}" title="{l s='Addresses'}" data-ajax="false">
+				<a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='Addresses'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/addrbook.png" alt="{l s='Addresses'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My addresses'}
 				</a>
 			</li>
 			<li>
-				<a href="{$link->getPageLink('identity', true)}" title="{l s='Information'}" data-ajax="false">
+				<a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Information'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/userinfos.png" alt="{l s='Information'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My personal information'}
 				</a>
 			</li>
 			{if $voucherAllowed}
 			<li>
-				<a href="{$link->getPageLink('discount', true)}" title="{l s='Vouchers'}" data-ajax="false">
+				<a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='Vouchers'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/voucher.png" alt="{l s='Vouchers'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My vouchers'}
 				</a>
diff --git a/themes/default/mobile/order-address.tpl b/themes/default/mobile/order-address.tpl
index 4a745a6be..629d42a66 100644
--- a/themes/default/mobile/order-address.tpl
+++ b/themes/default/mobile/order-address.tpl
@@ -16,8 +16,8 @@
 	var txtProducts = "{l s='products' js=1}";
 	{/if}
 	
-	var addressMultishippingUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")}";
-	var addressUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}";
+	var addressMultishippingUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")|escape:'html'}";
+	var addressUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}";
 
 	var formatedAddressFieldsValuesList = new Array();
 
@@ -59,7 +59,7 @@
 		dest_comp.html('');
 
 		li_content['title'] = adr_titles_vals[address_type];
-		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")}'+id_address+'&amp;back={$back_order_page}?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}" style="font-size:.9em;font-weight:normal;padding:8px 0;display:block;text-align:right">&raquo; {l s='Update' js=1}</a>';
+		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")|escape:'html'}'+id_address+'&amp;back={$back_order_page}?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}" style="font-size:.9em;font-weight:normal;padding:8px 0;display:block;text-align:right">&raquo; {l s='Update' js=1}</a>';
 
 		appendAddressList(dest_comp, li_content, ordered_fields_name);
 	}
@@ -118,13 +118,13 @@
 				<div class="button_multishipping_mode" id="multishipping_mode_box">
 					<div class="title">{l s='Multi-shipping'}</div>
 					<div class="description">
-						<a href="{$link->getPageLink('order', true, NULL, 'step=1&multi-shipping=1')}"/>
+						<a href="{$link->getPageLink('order', true, NULL, 'step=1&multi-shipping=1')|escape:'html'}"/>
 							{l s='Specify a delivery address for each product ordered.'}
 						</a>
 					</div>
 				</div>
 			{/if}
-		<form action="{$link->getPageLink($back_order_page, true)}" method="post" data-ajax="false">
+		<form action="{$link->getPageLink($back_order_page, true)|escape:'html'}" method="post" data-ajax="false">
 		{else}
 			{if {Configuration::get('PS_ALLOW_MULTISHIPPING')} && !$cart->isVirtualCart()}
 				<div class="address-form-multishipping">
@@ -134,7 +134,7 @@
 							<input type="checkbox" id="multishipping_mode_checkbox" onchange="multishippingMode(this); return false;"/><label for="multishipping_mode_checkbox">{l s='I\'d like to specify a delivery address for each product ordered.'}</label>
 						</div>
 						<div class="description_off">
-							<a href="{$link->getPageLink('order-opc', true, NULL, 'ajax=1&multi-shipping=1&method=multishipping')}" id="link_multishipping_form" title="{l s='Choose the delivery address(es)'}">
+							<a href="{$link->getPageLink('order-opc', true, NULL, 'ajax=1&multi-shipping=1&method=multishipping')|escape:'html'}" id="link_multishipping_form" title="{l s='Choose the delivery address(es)'}">
 								{l s='Specify a delivery address for each product.'}
 							</a>
 						</div>
@@ -178,7 +178,7 @@
 					{/section}
 					</select>
 					{else}
-						<a style="margin-left: 221px;" href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1&select_address=1{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
+						<a style="margin-left: 221px;" href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1&select_address=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
 					{/if}
 				</p>
 			</div>
@@ -196,7 +196,7 @@
 					</div>
 				</div>
 				<p class="address_add submit">
-					<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large" data-role="button" data-icon="plus">{l s='Add a new address'}</a>
+					<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large" data-role="button" data-icon="plus">{l s='Add a new address'}</a>
 				</p>
 				{if !$opc}
 				<div id="ordermsg" class="clearfix">
@@ -209,7 +209,7 @@
 			<fieldset class="cart_navigation submit ui-grid-a">
 				<input type="hidden" class="hidden" name="step" value="2" />
 				<input type="hidden" name="back" value="{$back}" />
-				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=0{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
+				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=0{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
 				<div class="ui-block-b"><input type="submit" name="processAddress" value="{l s='Next'}" class="exclusive" data-icon="check" data-iconpos="right" data-theme="b" /></div>
 			</fieldset>
 		</form>
diff --git a/themes/default/mobile/order-carrier.tpl b/themes/default/mobile/order-carrier.tpl
index 2b8ab93d7..bfb6c9cc0 100644
--- a/themes/default/mobile/order-carrier.tpl
+++ b/themes/default/mobile/order-carrier.tpl
@@ -14,7 +14,7 @@
 		var currencyBlank = '{$currencyBlank|intval}';
 		var txtProduct = "{l s='product' js=1}";
 		var txtProducts = "{l s='products' js=1}";
-		var orderUrl = '{$link->getPageLink("order", true)}';
+		var orderUrl = '{$link->getPageLink("order", true)|escape:'html'}';
 	
 		var msg = "{l s='You must agree to the terms of service before continuing.' js=1}";
 		{literal}
@@ -67,7 +67,7 @@
 			{assign var='current_step' value='shipping'}
 			{include file="$tpl_dir./errors.tpl"}
 			
-			<form id="form" action="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")}" method="post" onsubmit="return acceptCGV();" data-ajax="false">
+			<form id="form" action="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")|escape:'html'}" method="post" onsubmit="return acceptCGV();" data-ajax="false">
 		{else}
 			<div id="opc_delivery_methods" class="opc-main-block">
 			<div id="opc_delivery_methods-overlay" class="opc-overlay" style="display: none;"></div>
@@ -237,7 +237,7 @@
 			<fieldset class="cart_navigation submit ui-grid-a">
 				<input type="hidden" class="hidden" name="step" value="3" />
 				<input type="hidden" name="back" value="{$back}" />
-				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=1{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
+				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=1{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
 				<div class="ui-block-b"><input type="submit" name="processCarrier" value="{l s='Next'}" class="exclusive" data-icon="check" data-iconpos="right" data-theme="b" data-ajax="false" /></div>
 			</fieldset>
 		</form>
diff --git a/themes/default/mobile/order-detail-product-li.tpl b/themes/default/mobile/order-detail-product-li.tpl
index 9ba9c2bc1..6f35fd8f9 100644
--- a/themes/default/mobile/order-detail-product-li.tpl
+++ b/themes/default/mobile/order-detail-product-li.tpl
@@ -89,9 +89,9 @@
 		<h3>
 			{if $product.download_hash && $invoice && $product.display_filename != ''}
 				{if isset($is_guest) && $is_guest}
-				<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&amp;id_order={$order->id}&secure_key={$order->secure_key}")}" title="{l s='Download this product'}" data-ajax="false">
+				<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&amp;id_order={$order->id}&secure_key={$order->secure_key}")|escape:'html'}" title="{l s='Download this product'}" data-ajax="false">
 				{else}
-					<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")}" title="{l s='Download this product'}" data-ajax="false">
+					<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")|escape:'html'}" title="{l s='Download this product'}" data-ajax="false">
 				{/if}
 					<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Download product'}" />
 					{$product.product_name|escape:'htmlall':'UTF-8'}
diff --git a/themes/default/mobile/order-detail.tpl b/themes/default/mobile/order-detail.tpl
index 558854be4..feaf3fee9 100644
--- a/themes/default/mobile/order-detail.tpl
+++ b/themes/default/mobile/order-detail.tpl
@@ -35,7 +35,7 @@
 		{if isset($opc) && $opc}
 			{assign var='type_order' value="order-opc"}
 		{/if}
-		<a data-icon="refresh" data-role="button" data-theme="e" href="{$link->getPageLink({$type_order}, true, NULL, "submitReorder&id_order={$order->id|intval}")}" title="{l s='Reorder'}" data-ajax="false">
+		<a data-icon="refresh" data-role="button" data-theme="e" href="{$link->getPageLink({$type_order}, true, NULL, "submitReorder&id_order={$order->id|intval}")|escape:'html'}" title="{l s='Reorder'}" data-ajax="false">
 		{l s='Reorder'}
 		</a>
 	</div>
@@ -91,9 +91,9 @@
 <p>
 	<img src="{$img_dir}icon/pdf.gif" alt="" class="icon" />
 	{if $is_guest}
-		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}&amp;secure_key=$order->secure_key")}" >{l s='Download your invoice as a PDF file.'}</a>
+		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}&amp;secure_key=$order->secure_key")|escape:'html'}" >{l s='Download your invoice as a PDF file.'}</a>
 	{else}
-		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}")}" >{l s='Download your invoice as a PDF file.'}</a>
+		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}")|escape:'html'}" >{l s='Download your invoice as a PDF file.'}</a>
 	{/if}
 </p>
 {/if}
@@ -143,7 +143,7 @@
 {*$HOOK_ORDERDETAILDISPLAYED*}
 {* / TO CHECK ==========================*}
 {if $return_allowed}<p>{l s='If you wish to return one or more products, please mark the corresponding boxes and provide an explanation for the return. When complete, click the button below.'}</p>{/if}
-{if !$is_guest}<form action="{$link->getPageLink('order-follow', true)}" method="post">{/if}
+{if !$is_guest}<form action="{$link->getPageLink('order-follow', true)|escape:'html'}" method="post">{/if}
 <ul data-role="listview" data-inset="true">
 {foreach from=$products item=product name=products}
 	{if !isset($product.deleted)}
@@ -273,7 +273,7 @@
 		</div>
 	{/if}
 	{* / TO CHECK ==========================*}
-	<form action="{$link->getPageLink('order-detail', true)}" method="post" class="std" id="sendOrderMessage">
+	<form action="{$link->getPageLink('order-detail', true)|escape:'html'}" method="post" class="std" id="sendOrderMessage">
 		<h3 class="bg">{l s='Add a message'}</h3>
 		<p>{l s='If you would like to add a comment about your order, please write it in the field below.'}</p>
 		<fieldset>
diff --git a/themes/default/mobile/order-follow.tpl b/themes/default/mobile/order-follow.tpl
index ab8a27874..1db27abbd 100644
--- a/themes/default/mobile/order-follow.tpl
+++ b/themes/default/mobile/order-follow.tpl
@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 	{if isset($errorQuantity) && $errorQuantity}<p class="error">{l s='You do not have enough products to request an additional merchandise return.'}</p>{/if}
 	{if isset($errorMsg) && $errorMsg}<p class="error">{l s='Please provide an explanation for your RMA.'}</p>{/if}
@@ -51,14 +51,14 @@
 			<tbody>
 			{foreach from=$ordersReturn item=return name=myLoop}
 				<tr class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.index % 2}alternate_item{/if}">
-					<td class="bold"><a class="color-myaccount" href="javascript:showOrder(0, {$return.id_order_return|intval}, '{$link->getPageLink('order-return')}');" data-ajax="false">{l s='#'}{$return.id_order_return|string_format:"%06d"}</a></td>
-					<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$return.id_order|intval}, '{$link->getPageLink('order-detail')}');" data-ajax="false">{l s='#'}{$return.id_order|string_format:"%06d"}</a></td>
+					<td class="bold"><a class="color-myaccount" href="javascript:showOrder(0, {$return.id_order_return|intval}, '{$link->getPageLink('order-return')|escape:'html'}');" data-ajax="false">{l s='#'}{$return.id_order_return|string_format:"%06d"}</a></td>
+					<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$return.id_order|intval}, '{$link->getPageLink('order-detail')|escape:'html'}');" data-ajax="false">{l s='#'}{$return.id_order|string_format:"%06d"}</a></td>
 					<td class="history_method"><span class="bold">{$return.state_name|escape:'htmlall':'UTF-8'}</span></td>
 					<td class="bold">{dateFormat date=$return.date_add full=0}</td>
 					<td class="history_invoice">
 					{if $return.state == 2}
-						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" class="icon" /></a>
-						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false">{l s='Print out'}</a>
+						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")|escape:'html'}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" class="icon" /></a>
+						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")|escape:'html'}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false">{l s='Print out'}</a>
 					{else}
 						--
 					{/if}
diff --git a/themes/default/mobile/order-opc-address.tpl b/themes/default/mobile/order-opc-address.tpl
index 2393b563c..64b28cdd0 100644
--- a/themes/default/mobile/order-opc-address.tpl
+++ b/themes/default/mobile/order-opc-address.tpl
@@ -96,6 +96,6 @@
 		{assign var="back_order_page" value="order.php"}
 	{/if}
 
-	<p><a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}" title="{l s='Add a new address'}" data-role="button" data-theme="e" data-icon="plus" data-ajax="false">{l s='Add a new address'}</a><br /></p>
+	<p><a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add a new address'}" data-role="button" data-theme="e" data-icon="plus" data-ajax="false">{l s='Add a new address'}</a><br /></p>
 
 </div>
diff --git a/themes/default/mobile/order-opc-carrier.tpl b/themes/default/mobile/order-opc-carrier.tpl
index e5b3e64f0..0e2238675 100644
--- a/themes/default/mobile/order-opc-carrier.tpl
+++ b/themes/default/mobile/order-opc-carrier.tpl
@@ -36,7 +36,7 @@
 	var currencyBlank = '{$currencyBlank|intval}';
 	var txtProduct = "{l s='product' js=1}";
 	var txtProducts = "{l s='products' js=1}";
-	var orderUrl = '{$link->getPageLink("order", true)}';
+	var orderUrl = '{$link->getPageLink("order", true)|escape:'html'}';
 
 	var msg = "{l s='You must agree to the terms of service before continuing.' js=1}";
 	{literal}
diff --git a/themes/default/mobile/order-opc.tpl b/themes/default/mobile/order-opc.tpl
index b1122b0c7..ed32d8e42 100644
--- a/themes/default/mobile/order-opc.tpl
+++ b/themes/default/mobile/order-opc.tpl
@@ -33,11 +33,11 @@
 <script type="text/javascript">
 	// <![CDATA[
 	var imgDir = '{$img_dir}';
-	var authenticationUrl = '{$link->getPageLink("authentication", true)}';
-	var orderOpcUrl = '{$link->getPageLink("order-opc", true)}';
-	var historyUrl = '{$link->getPageLink("history", true)}';
-	var guestTrackingUrl = '{$link->getPageLink("guest-tracking", true)}';
-	var addressUrl = '{$link->getPageLink("address", true)}';
+	var authenticationUrl = '{$link->getPageLink("authentication", true)|escape:'html'}';
+	var orderOpcUrl = '{$link->getPageLink("order-opc", true)|escape:'html'}';
+	var historyUrl = '{$link->getPageLink("history", true)|escape:'html'}';
+	var guestTrackingUrl = '{$link->getPageLink("guest-tracking", true)|escape:'html'}';
+	var addressUrl = '{$link->getPageLink("address", true)|escape:'html'}';
 	var orderProcess = 'order-opc';
 	var guestCheckoutEnabled = {$PS_GUEST_CHECKOUT_ENABLED|intval};
 	var currencySign = '{$currencySign|html_entity_decode:2:"UTF-8"}';
diff --git a/themes/default/mobile/order-payment.tpl b/themes/default/mobile/order-payment.tpl
index 20428cd6c..c55d8380c 100644
--- a/themes/default/mobile/order-payment.tpl
+++ b/themes/default/mobile/order-payment.tpl
@@ -255,12 +255,12 @@
 											<span style="float:left">{if $quantityDisplayed == 0 AND isset($customizedDatas.$productId.$productAttributeId)}{$customizedDatas.$productId.$productAttributeId|@count}{else}{$product.cart_quantity-$quantityDisplayed}{/if}</span>
 										{else}
 											<div style="float:right">
-												<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" title="{l s='Delete this customization'}" width="11" height="13" class="icon" /></a>
+												<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" title="{l s='Delete this customization'}" width="11" height="13" class="icon" /></a>
 											</div>
 											<div id="cart_quantity_button" style="float:left">
-											<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+											<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 											{if $product.minimal_quantity < ($customization.quantity -$quantityDisplayed) OR $product.minimal_quantity <= 1}
-											<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+											<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 												<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 											</a>
 											{else}
@@ -325,7 +325,7 @@
 			{/if}
 			
 			{if !$opc}
-				<p class="cart_navigation"><a href="{$link->getPageLink('order', true, NULL, "step=2{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></p>
+				<p class="cart_navigation"><a href="{$link->getPageLink('order', true, NULL, "step=2{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></p>
 			{else}
 				</div>
 			{/if}
diff --git a/themes/default/mobile/order-slip.tpl b/themes/default/mobile/order-slip.tpl
index c5b3d3529..00fff91a1 100644
--- a/themes/default/mobile/order-slip.tpl
+++ b/themes/default/mobile/order-slip.tpl
@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 	<p>{l s='Credit slips you have received after cancelled orders'}.</p>
 	<div class="block-center" id="block-history">
@@ -36,12 +36,12 @@
 			{foreach from=$ordersSlip item=slip name=myLoop}
 				<li>
 					{assign var="id_order" value={$slip.id_order|intval}}
-					<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")}" data-ajax="false">
+					<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")|escape:'html'}" data-ajax="false">
 						<h3>{l s='Credit slip'} {l s='#'}{$slip.id_order_slip|string_format:"%06d"}</h3>
 						<p>{l s='Order'} {l s='#'}{$slip.id_order|string_format:"%06d"}</p>
 						<span class="ui-li-aside">{dateFormat date=$slip.date_add full=0}</span>
 					</a>
-					<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")}" title="{l s='Credit slip'} {l s='#'}{$slip.id_order_slip|string_format:"%06d"}" data-ajax="false">
+					<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")|escape:'html'}" title="{l s='Credit slip'} {l s='#'}{$slip.id_order_slip|string_format:"%06d"}" data-ajax="false">
 						{l s='PDF'}
 					</a>
 				</li>
diff --git a/themes/default/mobile/pages-list.tpl b/themes/default/mobile/pages-list.tpl
index 8513b4714..7e1c67288 100644
--- a/themes/default/mobile/pages-list.tpl
+++ b/themes/default/mobile/pages-list.tpl
@@ -26,14 +26,14 @@
 		<hr/>
 		<h2 class="site_map">{l s='Sitemap'}</h2>
 		<ul data-role="listview" data-inset="true" id="category">
-			{if $controller_name != 'index'}<li><a href="{$link->getPageLink('index', true)}" data-ajax="false">Accueil</a></li>{/if}
+			{if $controller_name != 'index'}<li><a href="{$link->getPageLink('index', true)|escape:'html'}" data-ajax="false">Accueil</a></li>{/if}
 			
 			{* need to set a Hook : hookMobilePagesList *}
 			{* ===================================== *}
-			<li><a href="{$link->getCategoryLink(3, false)}" data-ajax="false">IPod</a></li>
-			<li><a href="{$link->getCategoryLink(4, false)}" data-ajax="false">Accessoires</a></li>
+			<li><a href="{$link->getCategoryLink(3, false)|escape:'html'}" data-ajax="false">IPod</a></li>
+			<li><a href="{$link->getCategoryLink(4, false)|escape:'html'}" data-ajax="false">Accessoires</a></li>
 			{* ===================================== *}
 			
-			{if $controller_name != 'my-account'}<li><a href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a></li>{/if}
-			{if $controller_name != 'contact'}<li><a href="{$link->getPageLink('contact', true)}" data-ajax="false">{l s='Contact'}</a></li>{/if}
+			{if $controller_name != 'my-account'}<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a></li>{/if}
+			{if $controller_name != 'contact'}<li><a href="{$link->getPageLink('contact', true)|escape:'html'}" data-ajax="false">{l s='Contact'}</a></li>{/if}
 		</ul>
diff --git a/themes/default/mobile/pagination.tpl b/themes/default/mobile/pagination.tpl
index 42d450e6a..0d78062de 100644
--- a/themes/default/mobile/pagination.tpl
+++ b/themes/default/mobile/pagination.tpl
@@ -59,19 +59,19 @@
 			<a {$no_follow_text} class="button_prev{if $p == 1} disabled{/if}" data-role="button" data-icon="arrow-l" data-iconpos="left" href="{if isset($p_previous)}{$link->goPage($requestPage, $p_previous)}{/if}" data-ajax="false">{l s='Previous'}</a>
 		</li>
 		{if $start>3}
-			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)}" data-ajax="false">1</a></li>
+			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)|escape:'html'}" data-ajax="false">1</a></li>
 			<li class="truncate">...</li>
 		{/if}
 		{section name=pagination start=$start loop=$stop+1 step=1}
 			{if $p == $smarty.section.pagination.index}
 				<li class="current"><a href="#" data-role="button" class="ui-btn-active" data-ajax="false">{$p|escape:'htmlall':'UTF-8'}</a></li>
 			{else}
-				<li><a data-role="button" {$no_follow_text} href="{$link->goPage($requestPage, $smarty.section.pagination.index)}" data-ajax="false">{$smarty.section.pagination.index|escape:'htmlall':'UTF-8'}</a></li>
+				<li><a data-role="button" {$no_follow_text} href="{$link->goPage($requestPage, $smarty.section.pagination.index)|escape:'html'}" data-ajax="false">{$smarty.section.pagination.index|escape:'htmlall':'UTF-8'}</a></li>
 			{/if}
 		{/section}
 		{if $pages_nb>$stop+2}
 			<li class="truncate">...</li>
-			<li><a href="{$link->goPage($requestPage, $pages_nb)}" data-ajax="false">{$pages_nb|intval}</a></li>
+			<li><a href="{$link->goPage($requestPage, $pages_nb)|escape:'html'}" data-ajax="false">{$pages_nb|intval}</a></li>
 		{/if}
 		{if $pages_nb > 1 AND $p != $pages_nb}
 			{assign var='p_next' value=$p+1}
diff --git a/themes/default/mobile/password.tpl b/themes/default/mobile/password.tpl
index c97b40469..11c1ce944 100644
--- a/themes/default/mobile/password.tpl
+++ b/themes/default/mobile/password.tpl
@@ -42,6 +42,6 @@
 	</form>
 	{/if}
 	<p class="clear">
-		<a href="{$link->getPageLink('authentication', true)}" title="{l s='Return to Login'}"><img src="{$img_dir}icon/my-account.gif" alt="{l s='Return to Login'}" class="icon" /></a><a href="{$link->getPageLink('authentication')}" title="{l s='Back to Login'}" data-ajax="false">{l s='Back to Login'}</a>
+		<a href="{$link->getPageLink('authentication', true)}" title="{l s='Return to Login'}"><img src="{$img_dir}icon/my-account.gif" alt="{l s='Return to Login'}" class="icon" /></a><a href="{$link->getPageLink('authentication')|escape:'html'}" title="{l s='Back to Login'}" data-ajax="false">{l s='Back to Login'}</a>
 	</p>
 </div><!-- /content -->
diff --git a/themes/default/mobile/product-desc-features.tpl b/themes/default/mobile/product-desc-features.tpl
index 8692a9a3d..122350629 100644
--- a/themes/default/mobile/product-desc-features.tpl
+++ b/themes/default/mobile/product-desc-features.tpl
@@ -29,7 +29,7 @@
 			<h3>{l s='Download'}</h3>
 			<ul>
 				{foreach from=$attachments item=attachment}
-					<li><a href="{$link->getPageLink('attachment', true, NULL, "id_attachment={$attachment.id_attachment}")}" data-ajax="false">{$attachment.name|escape:'htmlall':'UTF-8'}</a><br />{$attachment.description|escape:'htmlall':'UTF-8'}</li>
+					<li><a href="{$link->getPageLink('attachment', true, NULL, "id_attachment={$attachment.id_attachment}")|escape:'html'}" data-ajax="false">{$attachment.name|escape:'htmlall':'UTF-8'}</a><br />{$attachment.description|escape:'htmlall':'UTF-8'}</li>
 				{/foreach}
 			</ul>
 		</div>
@@ -46,7 +46,7 @@
 						<a href="{$accessoryLink|escape:'htmlall':'UTF-8'}" data-ajax="false">
 							<div class="clearfix" >
 								<div class="col-left" style="width:{$mediumSize.width+10}px;">
-									<img src="{$link->getImageLink($accessory.link_rewrite, $accessory.id_image, 'medium_default')}" alt="{$accessory.legend|escape:'htmlall':'UTF-8'}" width="{$mediumSize.width}" height="{$mediumSize.height}" />
+									<img src="{$link->getImageLink($accessory.link_rewrite, $accessory.id_image, 'medium_default')|escape:'html'}" alt="{$accessory.legend|escape:'htmlall':'UTF-8'}" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 								</div><!-- .col-left -->
 								<div class="col-right">
 									<div class="inner">
diff --git a/themes/default/mobile/product-images.tpl b/themes/default/mobile/product-images.tpl
index 1fbe7a31d..037bf7283 100644
--- a/themes/default/mobile/product-images.tpl
+++ b/themes/default/mobile/product-images.tpl
@@ -29,13 +29,13 @@
 	<div data-role="header" class="ui-bar-a list_view">
 		{assign var=image_cover value=$product->getCover($product->id)}
 		{assign var=imageIds value="`$product->id`-`$image_cover.id_image`"}
-		<img id="bigpic" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'large_default')}" alt="{$product->name|escape:'htmlall':'UTF-8'}" />
+		<img id="bigpic" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'large_default')|escape:'html'}" alt="{$product->name|escape:'htmlall':'UTF-8'}" />
 		<div class="thumbs_list">
 			<ul id="gallery" class="thumbs_list_frame clearfix">
 			{foreach from=$images item=image name=thumbnails}
 				{assign var=imageIds value="`$product->id`-`$image.id_image`"}
 				<li id="thumbnail_{$image.id_image}">
-					<img id="thumb_{$image.id_image}" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'medium_default')}" alt="{$image.legend|htmlspecialchars}" height="{$mediumSize.height}" width="{$mediumSize.width}" data-large="{$link->getImageLink($product->link_rewrite, $imageIds, 'thickbox_default')}" />
+					<img id="thumb_{$image.id_image}" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'medium_default')}" alt="{$image.legend|htmlspecialchars}" height="{$mediumSize.height}" width="{$mediumSize.width}" data-large="{$link->getImageLink($product->link_rewrite, $imageIds, 'thickbox_default')|escape:'html'}" />
 				</li>
 			{/foreach}
 			</ul>
diff --git a/themes/default/mobile/product.tpl b/themes/default/mobile/product.tpl
index e9b88fd95..8e6644239 100644
--- a/themes/default/mobile/product.tpl
+++ b/themes/default/mobile/product.tpl
@@ -49,7 +49,7 @@
 			<h3>{l s='Pack content'}</h3>
 			{foreach from=$packItems item=packItem}
 			<div class="pack_content">
-				{$packItem.pack_quantity} x <a href="{$link->getProductLink($packItem.id_product, $packItem.link_rewrite, $packItem.category)}" data-ajax="false">{$packItem.name|escape:'htmlall':'UTF-8'}</a>
+				{$packItem.pack_quantity} x <a href="{$link->getProductLink($packItem.id_product, $packItem.link_rewrite, $packItem.category)|escape:'html'}" data-ajax="false">{$packItem.name|escape:'htmlall':'UTF-8'}</a>
 				<p>{$packItem.description_short}</p>
 			</div>
 			{/foreach}
@@ -57,7 +57,7 @@
 	{/if}
 	
 	{if ($product->show_price AND !isset($restricted_country_mode)) OR isset($groups) OR $product->reference}
-	<form id="buy_block" {if $PS_CATALOG_MODE AND !isset($groups) AND $product->quantity > 0}class="hidden"{/if} action="{$link->getPageLink('cart')}" method="post" data-ajax="false">
+	<form id="buy_block" {if $PS_CATALOG_MODE AND !isset($groups) AND $product->quantity > 0}class="hidden"{/if} action="{$link->getPageLink('cart')|escape:'html'}" method="post" data-ajax="false">
 
 			<!-- hidden datas -->
 			<p class="hidden">
diff --git a/themes/default/mobile/shopping-cart-gift-line.tpl b/themes/default/mobile/shopping-cart-gift-line.tpl
index 4da67125a..07d4e2f4d 100644
--- a/themes/default/mobile/shopping-cart-gift-line.tpl
+++ b/themes/default/mobile/shopping-cart-gift-line.tpl
@@ -28,7 +28,7 @@
 <input type="hidden" id="cart_product_address_delivery_id_{$product.id_product}" value="{$product.id_address_delivery}"/>
 
 <div class="fl width-20">
-	<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" class="img_product_cart" />
+	<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" class="img_product_cart" />
 </div>
 <div class="fl width-60 padding-left-5px">
 	<h3>{$product.name}</h3>
diff --git a/themes/default/mobile/shopping-cart-product-line.tpl b/themes/default/mobile/shopping-cart-product-line.tpl
index 6e218e936..0ffcf3a53 100644
--- a/themes/default/mobile/shopping-cart-product-line.tpl
+++ b/themes/default/mobile/shopping-cart-product-line.tpl
@@ -25,7 +25,7 @@
 
 <tr id="product_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}{if !empty($product.gift)}_gift{/if}" class="{if isset($productLast) && $productLast && (!isset($ignoreProductLast) || !$ignoreProductLast)}last_item{elseif isset($productFirst) && $productFirst}first_item{/if} {if isset($customizedDatas.$productId.$productAttributeId) AND $quantityDisplayed == 0}alternate_item{/if} cart_item address_{$product.id_address_delivery|intval} {if $odd}odd{else}even{/if}">
 	<td class="cart_product">
-		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
+		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
 	</td>
 	<td class="cart_description">
 		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}">{$product.name|escape:'htmlall':'UTF-8'}</a>
@@ -62,9 +62,9 @@
 			{/if}
 			{if !isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed > 0}
 				<div class="cart_quantity_button">
-				<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+				<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 				{if $product.minimal_quantity < ($product.cart_quantity-$quantityDisplayed) OR $product.minimal_quantity <= 1}
-				<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+				<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 					<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 				</a>
 				{else}
@@ -96,7 +96,7 @@
 		<td class="cart_delete">
 		{if (!isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed) > 0 && empty($product.gift)}
 			<div>
-				<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}">{l s='Delete'}</a>
+				<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}">{l s='Delete'}</a>
 			</div>
 		{/if}
 		</td>
diff --git a/themes/default/mobile/shopping-cart.tpl b/themes/default/mobile/shopping-cart.tpl
index 84ac98d07..06bf669fc 100644
--- a/themes/default/mobile/shopping-cart.tpl
+++ b/themes/default/mobile/shopping-cart.tpl
@@ -20,7 +20,7 @@
 						<input type="hidden" id="cart_product_address_delivery_id_{$product.id_product}" value="{$product.id_address_delivery}"/>
 
 						<div class="fl width-20">
-							<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" class="img_product_cart" />
+							<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" class="img_product_cart" />
 						</div>
 						<div class="fl width-60 padding-left-5px">
 							<h3>{$product.name}</h3>
@@ -58,7 +58,7 @@
 							</tbody>
 						</table>
 					</a>
-					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" data-ajax="false">{l s='Delete'}</a>
+					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" data-ajax="false">{l s='Delete'}</a>
 				</li>
 			{/foreach}
 			{assign var='last_was_odd' value=$product@iteration%2}
@@ -74,7 +74,7 @@
 						{* Display the gift product line *}
 						{include file="./shopping-cart-gift-line.tpl" productLast=$product@last productFirst=$product@first}
 					</a>
-					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" data-ajax="false" style="display:none">{l s='Delete'}</a>
+					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" data-ajax="false" style="display:none">{l s='Delete'}</a>
 				</li>
 			{/foreach}
 		</ul>
@@ -205,11 +205,11 @@
 		</div><!-- /grid-a -->
 		<br />
 		{if $opc && $isLogged && !$isGuest}
-			<a href="{$link->getPageLink('index', true)}" data-role="button" data-theme="a" data-icon="back" data-ajax="false">{l s='Continue shopping'}</a>
+			<a href="{$link->getPageLink('index', true)|escape:'html'}" data-role="button" data-theme="a" data-icon="back" data-ajax="false">{l s='Continue shopping'}</a>
 		{else}
 			<ul data-role="listview" data-inset="true" id="list_myaccount">
 				<li data-theme="a" data-icon="back">
-					<a href="{$link->getPageLink('index', true)}" data-ajax="false">{l s='Continue shopping'}</a>
+					<a href="{$link->getPageLink('index', true)|escape:'html'}" data-ajax="false">{l s='Continue shopping'}</a>
 				</li>
 				<li data-theme="b" data-icon="check">
 					<a href="{if $back}{$link->getPageLink('order', true, NULL, 'step=1&amp;back={$back}')}{else}{$link->getPageLink('order', true, NULL, 'step=1')}{/if}" data-ajax="false">{l s='Confirm order'}</a>
diff --git a/themes/default/mobile/sitemap.tpl b/themes/default/mobile/sitemap.tpl
index 7b0f17401..ba82ea339 100644
--- a/themes/default/mobile/sitemap.tpl
+++ b/themes/default/mobile/sitemap.tpl
@@ -57,25 +57,25 @@
 <hr/>
 <h2>{l s='Sitemap'}</h2>
 <ul data-role="listview" data-inset="true" id="category">
-	{if $controller_name != 'index'}<li><a href="{$link->getPageLink('index', true)}">{l s='Home'}</a></li>{/if}
+	{if $controller_name != 'index'}<li><a href="{$link->getPageLink('index', true)|escape:'html'}">{l s='Home'}</a></li>{/if}
 	<li>{l s='Our offers'}
 		<ul data-role="listview" data-inset="true">
-			<li><a href="{$link->getPageLink('new-products')}" title="{l s='New products'}">{l s='New products'}</a></li>
+			<li><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products'}">{l s='New products'}</a></li>
 			{if !$PS_CATALOG_MODE}
-			<li><a href="{$link->getPageLink('prices-drop')}" title="{l s='Price drop'}">{l s='Price drop'}</a></li>
-			<li><a href="{$link->getPageLink('best-sales', true)}" title="{l s='Best sellers'}">{l s='Best sellers'}</a></li>
+			<li><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Price drop'}">{l s='Price drop'}</a></li>
+			<li><a href="{$link->getPageLink('best-sales', true)|escape:'html'}" title="{l s='Best sellers'}">{l s='Best sellers'}</a></li>
 			{/if}
-			{if $display_manufacturer_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('manufacturer')}">{l s='Manufacturers:'}</a></li>{/if}
-			{if $display_supplier_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('supplier')}">{l s='Suppliers:'}</a></li>{/if}
+			{if $display_manufacturer_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('manufacturer')|escape:'html'}">{l s='Manufacturers:'}</a></li>{/if}
+			{if $display_supplier_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('supplier')|escape:'html'}">{l s='Suppliers:'}</a></li>{/if}
 		</ul>
 	</li>
 	<li>{l s='Your Account'}
 		<ul data-role="listview" data-inset="true">
-			<li><a href="{$link->getPageLink('my-account', true)}">{l s='Your Account'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}">{l s='Personal information'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}">{l s='Addresses'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}">{l s='Discounts'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('history', true)}">{l s='Order history'}</a></li>
+			<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Your Account'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}">{l s='Personal information'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}">{l s='Addresses'}</a></li>
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}">{l s='Discounts'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}">{l s='Order history'}</a></li>
 		</ul>
 	</li>
 	<li>{l s='Pages'}
@@ -90,8 +90,8 @@
 			{foreach from=$categoriescmsTree.cms item=cms name=cmsTree}
 				<li><a href="{$cms.link|escape:'htmlall':'UTF-8'}" title="{$cms.meta_title|escape:'htmlall':'UTF-8'}">{$cms.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 			{/foreach}
-			<li><a href="{$link->getPageLink('contact', true)}" title="{l s='Contact'}">{l s='Contact'}</a></li>
-			{if $display_store}<li><a href="{$link->getPageLink('stores')}" title="{l s='Our stores'}">{l s='Our stores'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact'}">{l s='Contact'}</a></li>
+			{if $display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores'}">{l s='Our stores'}</a></li>{/if}
 		</ul>
 	</li>
 </ul>
diff --git a/themes/default/mobile/supplier.tpl b/themes/default/mobile/supplier.tpl
index 1526f58c0..a05b755bc 100644
--- a/themes/default/mobile/supplier.tpl
+++ b/themes/default/mobile/supplier.tpl
@@ -30,7 +30,7 @@
 
 {if !isset($errors) OR !sizeof($errors)}
 	<div data-role="content" id="content">
-	<p><a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('supplier', true)}" data-ajax="false">{l s='Suppliers:'}</a></p>
+	<p><a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('supplier', true)|escape:'html'}" data-ajax="false">{l s='Suppliers:'}</a></p>
 	{if !empty($supplier->description) || !empty($supplier->short_description)}
 		<div class="category_desc clearfix">
 			{if !empty($supplier->short_description)}
diff --git a/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl b/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl
index 29f36fb94..8ff9cc02b 100644
--- a/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl
+++ b/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl
@@ -38,7 +38,7 @@
 				<li style="border-bottom:0" class="ajax_block_product {if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 1}clear{/if} {if $smarty.foreach.myLoop.iteration > ($smarty.foreach.myLoop.total - ($smarty.foreach.myLoop.total % $nbItemsPerLine))}last_line{/if}">
 					<p class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></p>
 					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
+					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
 					<div>
 						{if !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{$product.price}</span></p>{else}<div style="height:21px;"></div>{/if}			
 						<a class="button" href="{$product.link}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
@@ -46,7 +46,7 @@
 				</li>
 			{/foreach}
 			</ul>
-			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
+			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
 		</div>
 	{else}
 		<p>{l s='No best sellers at this time' mod='blockbestsellers'}</p>
diff --git a/themes/default/modules/blockbestsellers/blockbestsellers.tpl b/themes/default/modules/blockbestsellers/blockbestsellers.tpl
index e335bd232..17bc2797f 100644
--- a/themes/default/modules/blockbestsellers/blockbestsellers.tpl
+++ b/themes/default/modules/blockbestsellers/blockbestsellers.tpl
@@ -25,7 +25,7 @@
 
 <!-- MODULE Block best sellers -->
 <div id="best-sellers_block_right" class="block products_block">
-	<p class="title_block"><a href="{$link->getPageLink('best-sales')}">{l s='Top sellers' mod='blockbestsellers'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('best-sales')|escape:'html'}">{l s='Top sellers' mod='blockbestsellers'}</a></p>
 	<div class="block_content">
 	{if $best_sellers|@count > 0}
 		<ul class="product_images">
@@ -33,7 +33,7 @@
 			<li class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} clearfix">
 				<a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
 					<span class="number">{$smarty.foreach.myLoop.iteration}</span>
-					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
+					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
 				
 				</a>
 				<p><a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
@@ -43,7 +43,7 @@
 			</li>
 		{/foreach}
 		</ul>
-		<p class="lnk"><a href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
+		<p class="lnk"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
 	{else}
 		<p>{l s='No best sellers at this time' mod='blockbestsellers'}</p>
 	{/if}
diff --git a/themes/default/modules/blockcart/blockcart.tpl b/themes/default/modules/blockcart/blockcart.tpl
index e221858d4..9a6c574d3 100644
--- a/themes/default/modules/blockcart/blockcart.tpl
+++ b/themes/default/modules/blockcart/blockcart.tpl
@@ -45,7 +45,7 @@ var generated_date = {$smarty.now|intval};
 <!-- MODULE Block cart -->
 <div id="cart_block" class="block exclusive">
 	<p class="title_block">
-		<a href="{$link->getPageLink("$order_process", true)}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}
+		<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}
 		{if $ajax_allowed}
 		<span id="block_cart_expand" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'expanded' || !isset($colapseExpandStatus)}class="hidden"{/if}>&nbsp;</span>
 		<span id="block_cart_collapse" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'collapsed'}class="hidden"{/if}>&nbsp;</span>
@@ -77,9 +77,9 @@ var generated_date = {$smarty.now|intval};
 			{assign var='productAttributeId' value=$product.id_product_attribute}
 			<dt id="cart_block_product_{$product.id_product}_{if $product.id_product_attribute}{$product.id_product_attribute}{else}0{/if}_{if $product.id_address_delivery}{$product.id_address_delivery}{else}0{/if}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
 				<span class="quantity-formated"><span class="quantity">{$product.cart_quantity}</span>x</span>
-				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{$product.name|escape:html:'UTF-8'}">
+				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}">
 				{$product.name|truncate:13:'...'|escape:html:'UTF-8'}</a>
-				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)}" title="{l s='remove this product from my cart' mod='blockcart'}">&nbsp;</a>{/if}</span>
+				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)|escape:'html'}" title="{l s='remove this product from my cart' mod='blockcart'}">&nbsp;</a>{/if}</span>
 				<span class="price">
 					{if !isset($product.is_gift) || !$product.is_gift}
 						{if $priceDisplay == $smarty.const.PS_TAX_EXC}{displayWtPrice p="`$product.total`"}{else}{displayWtPrice p="`$product.total_wt`"}{/if}
@@ -90,7 +90,7 @@ var generated_date = {$smarty.now|intval};
 			</dt>
 			{if isset($product.attributes_small)}
 			<dd id="cart_block_combination_of_{$product.id_product}{if $product.id_product_attribute}_{$product.id_product_attribute}{/if}_{$product.id_address_delivery|intval}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
-				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
+				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
 			{/if}
 
 			<!-- Customizable datas -->
@@ -99,7 +99,7 @@ var generated_date = {$smarty.now|intval};
 				<ul class="cart_block_customizations" id="customization_{$productId}_{$productAttributeId}">
 					{foreach from=$customizedDatas.$productId.$productAttributeId[$product.id_address_delivery] key='id_customization' item='customization' name='customizations'}
 						<li name="customization">
-							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)}" rel="nofollow"> </a></div>
+							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)|escape:'html'}" rel="nofollow"> </a></div>
 							<span class="quantity-formated"><span class="quantity">{$customization.quantity}</span>x</span>{if isset($customization.datas.$CUSTOMIZE_TEXTFIELD.0)}
 							{$customization.datas.$CUSTOMIZE_TEXTFIELD.0.value|replace:"<br />":" "|truncate:28:'...'|escape:html:'UTF-8'}
 							{else}
@@ -166,8 +166,8 @@ var generated_date = {$smarty.now|intval};
 			{/if}
 		{/if}
 		<p id="cart-buttons">
-			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
-			<a href="{$link->getPageLink("$order_process", true)}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Check out' mod='blockcart'}" rel="nofollow"><span></span>{l s='Check out' mod='blockcart'}</a>
+			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
+			<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Check out' mod='blockcart'}" rel="nofollow"><span></span>{l s='Check out' mod='blockcart'}</a>
 		</p>
 	</div>
 	</div>
diff --git a/themes/default/modules/blockcms/blockcms.tpl b/themes/default/modules/blockcms/blockcms.tpl
index 5c35ad684..5ae5d7f6c 100644
--- a/themes/default/modules/blockcms/blockcms.tpl
+++ b/themes/default/modules/blockcms/blockcms.tpl
@@ -37,7 +37,7 @@
 				{foreach from=$cms_title.cms item=cms_page}
 					{if isset($cms_page.link)}<li><a href="{$cms_page.link}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
 				{/foreach}
-				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
 			</ul>
 		</div>
 	{/foreach}
@@ -47,17 +47,17 @@
 	<div class="block_various_links" id="block_various_links_footer">
 		<p class="title_block">{l s='Information' mod='blockcms'}</p>
 		<ul>
-			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
-			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
-			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')}" title="{l s='Top sellers' mod='blockcms'}">{l s='Top sellers' mod='blockcms'}</a></li>{/if}
-			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
-			<li class="item"><a href="{$link->getPageLink($contact_url, true)}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
+			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
+			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
+			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='Top sellers' mod='blockcms'}">{l s='Top sellers' mod='blockcms'}</a></li>{/if}
+			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+			<li class="item"><a href="{$link->getPageLink($contact_url, true)|escape:'html'}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
 			{foreach from=$cmslinks item=cmslink}
 				{if $cmslink.meta_title != ''}
 					<li class="item"><a href="{$cmslink.link|addslashes}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 				{/if}
 			{/foreach}
-			<li><a href="{$link->getPageLink('sitemap')}" title="{l s='sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
+			<li><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
 			{if $display_poweredby}<li class="last_item">{l s='Powered by' mod='blockcms'} <a class="_blank" href="http://www.prestashop.com">PrestaShop</a>&trade;</li>{/if}
 		</ul>
 	{$footer_text}
diff --git a/themes/default/modules/blockmanufacturer/blockmanufacturer.tpl b/themes/default/modules/blockmanufacturer/blockmanufacturer.tpl
index b821bef4d..227669957 100644
--- a/themes/default/modules/blockmanufacturer/blockmanufacturer.tpl
+++ b/themes/default/modules/blockmanufacturer/blockmanufacturer.tpl
@@ -25,14 +25,14 @@
 
 <!-- Block manufacturers module -->
 <div id="manufacturers_block_left" class="block blockmanufacturer">
-	<p class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</p>
+	<p class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')|escape:'html'}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</p>
 	<div class="block_content">
 {if $manufacturers}
 	{if $text_list}
 	<ul class="bullet">
 	{foreach from=$manufacturers item=manufacturer name=manufacturer_list}
 		{if $smarty.foreach.manufacturer_list.iteration <= $text_list_nb}
-		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}" title="{l s='More about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
+		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}" title="{l s='More about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
 		{/if}
 	{/foreach}
 	</ul>
@@ -43,7 +43,7 @@
 				<select id="manufacturer_list" onchange="autoUrl('manufacturer_list', '');">
 					<option value="0">{l s='All manufacturers' mod='blockmanufacturer'}</option>
 				{foreach from=$manufacturers item=manufacturer}
-					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>
diff --git a/themes/default/modules/blockmyaccount/blockmyaccount.tpl b/themes/default/modules/blockmyaccount/blockmyaccount.tpl
index a646ccd4f..5c8c3d05a 100644
--- a/themes/default/modules/blockmyaccount/blockmyaccount.tpl
+++ b/themes/default/modules/blockmyaccount/blockmyaccount.tpl
@@ -25,18 +25,18 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<p class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></p>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="{l s='My orders' mod='blockmyaccount'}">{l s='My orders' mod='blockmyaccount'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='My orders' mod='blockmyaccount'}">{l s='My orders' mod='blockmyaccount'}</a></li>
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
-		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
+		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
 	</div>
 </div>
 <!-- /Block myaccount module -->
diff --git a/themes/default/modules/blockmyaccountfooter/blockmyaccountfooter.tpl b/themes/default/modules/blockmyaccountfooter/blockmyaccountfooter.tpl
index e196fc806..baa0844ef 100644
--- a/themes/default/modules/blockmyaccountfooter/blockmyaccountfooter.tpl
+++ b/themes/default/modules/blockmyaccountfooter/blockmyaccountfooter.tpl
@@ -25,15 +25,15 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<p class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></p>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="{l s='List of my orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='List of my merchandise returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='List of my credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='List of my addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='List of my vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='List of my orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='List of my merchandise returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='List of my credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='List of my addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='List of my vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
 		<p class="logout"><a href="{$link->getPageLink('index')}?mylogout" title="{l s='Sign out' mod='blockmyaccountfooter'}" rel="nofollow">{l s='Sign out' mod='blockmyaccount'}</a></p>
diff --git a/themes/default/modules/blocknewproducts/blocknewproducts.tpl b/themes/default/modules/blocknewproducts/blocknewproducts.tpl
index 697191a15..f7db3c8a6 100644
--- a/themes/default/modules/blocknewproducts/blocknewproducts.tpl
+++ b/themes/default/modules/blocknewproducts/blocknewproducts.tpl
@@ -25,13 +25,13 @@
 
 <!-- MODULE Block new products -->
 <div id="new-products_block_right" class="block products_block">
-	<p class="title_block"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></p>
 	<div class="block_content">
 	{if $new_products !== false}
 		<ul class="product_images clearfix">
 		{foreach from=$new_products item='product' name='newProducts'}
 			{if $smarty.foreach.newProducts.index < 2}
-				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
+				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
 			{/if}
 		{/foreach}
 		</ul>
@@ -41,7 +41,7 @@
 			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
 		{/foreach}
 		</dl>
-		<p><a href="{$link->getPageLink('new-products')}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
+		<p><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
 	{else}
 		<p>&raquo; {l s='No new products at this time' mod='blocknewproducts'}</p>
 	{/if}
diff --git a/themes/default/modules/blocknewsletter/blocknewsletter.tpl b/themes/default/modules/blocknewsletter/blocknewsletter.tpl
index 24d94f59f..28d05af91 100644
--- a/themes/default/modules/blocknewsletter/blocknewsletter.tpl
+++ b/themes/default/modules/blocknewsletter/blocknewsletter.tpl
@@ -31,7 +31,7 @@
 	{if isset($msg) && $msg}
 		<p class="{if $nw_error}warning_inline{else}success_inline{/if}">{$msg}</p>
 	{/if}
-		<form action="{$link->getPageLink('index')}" method="post">
+		<form action="{$link->getPageLink('index')|escape:'html'}" method="post">
 			<p>
 				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}">
 				<input type="submit" value="ok" class="button_mini" name="submitNewsletter" />
diff --git a/themes/default/modules/blocksearch/blocksearch.tpl b/themes/default/modules/blocksearch/blocksearch.tpl
index 4e5512b04..591644331 100644
--- a/themes/default/modules/blocksearch/blocksearch.tpl
+++ b/themes/default/modules/blocksearch/blocksearch.tpl
@@ -26,7 +26,7 @@
 <!-- Block search module -->
 <div id="search_block_left" class="block exclusive">
 	<p class="title_block">{l s='Search' mod='blocksearch'}</p>
-	<form method="get" action="{$link->getPageLink('search', true)}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search', true)|escape:'html'}" id="searchbox">
 		<p class="block_content">
 			<label for="search_query_block">{l s='Enter a product name' mod='blocksearch'}</label>
 			<input type="hidden" name="orderby" value="position" />
diff --git a/themes/default/modules/blocksocial/blockspecials.tpl b/themes/default/modules/blocksocial/blockspecials.tpl
index 651cd8134..da8f71037 100644
--- a/themes/default/modules/blocksocial/blockspecials.tpl
+++ b/themes/default/modules/blocksocial/blockspecials.tpl
@@ -25,13 +25,13 @@
 
 <!-- MODULE Block specials -->
 <div id="special_block_right" class="block products_block exclusive blockspecials">
-	<p class="title_block"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></p>
 	<div class="block_content">
 
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -51,7 +51,7 @@
 			</li>
 		</ul>
 		<p>
-			<a href="{$link->getPageLink('prices-drop')}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
+			<a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
 		</p>
 {else}
 		<p>{l s='No specials at this time' mod='blockspecials'}</p>
diff --git a/themes/default/modules/blockspecials/blockspecials.tpl b/themes/default/modules/blockspecials/blockspecials.tpl
index 651cd8134..da8f71037 100644
--- a/themes/default/modules/blockspecials/blockspecials.tpl
+++ b/themes/default/modules/blockspecials/blockspecials.tpl
@@ -25,13 +25,13 @@
 
 <!-- MODULE Block specials -->
 <div id="special_block_right" class="block products_block exclusive blockspecials">
-	<p class="title_block"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></p>
 	<div class="block_content">
 
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -51,7 +51,7 @@
 			</li>
 		</ul>
 		<p>
-			<a href="{$link->getPageLink('prices-drop')}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
+			<a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
 		</p>
 {else}
 		<p>{l s='No specials at this time' mod='blockspecials'}</p>
diff --git a/themes/default/modules/blockstore/blockstore.tpl b/themes/default/modules/blockstore/blockstore.tpl
index 2f11399a2..6520504c3 100644
--- a/themes/default/modules/blockstore/blockstore.tpl
+++ b/themes/default/modules/blockstore/blockstore.tpl
@@ -25,11 +25,11 @@
 
 <!-- Block stores module -->
 <div id="stores_block_left" class="block">
-	<p class="title_block"><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockstore'}">{l s='Our stores' mod='blockstore'}</a></p>
+	<p class="title_block"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockstore'}">{l s='Our stores' mod='blockstore'}</a></p>
 	<div class="block_content blockstore">
-		<p class="store_image"><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our stores' mod='blockstore'}" width="174" height="115" /></a></p>
+		<p class="store_image"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our stores' mod='blockstore'}" width="174" height="115" /></a></p>
 		<p>
-			<a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockstore'}">&raquo; {l s='Discover our stores' mod='blockstore'}</a>
+			<a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockstore'}">&raquo; {l s='Discover our stores' mod='blockstore'}</a>
 		</p>
 	</div>
 </div>
diff --git a/themes/default/modules/blocksupplier/blocksupplier.tpl b/themes/default/modules/blocksupplier/blocksupplier.tpl
index df4bdb9d1..b98d837f7 100644
--- a/themes/default/modules/blocksupplier/blocksupplier.tpl
+++ b/themes/default/modules/blocksupplier/blocksupplier.tpl
@@ -25,7 +25,7 @@
 
 <!-- Block suppliers module -->
 <div id="suppliers_block_left" class="block blocksupplier">
-	<p class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</p>
+	<p class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')|escape:'html'}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</p>
 	<div class="block_content">
 {if $suppliers}
 	{if $text_list}
@@ -33,7 +33,7 @@
 	{foreach from=$suppliers item=supplier name=supplier_list}
 		{if $smarty.foreach.supplier_list.iteration <= $text_list_nb}
 		<li class="{if $smarty.foreach.supplier_list.last}last_item{elseif $smarty.foreach.supplier_list.first}first_item{else}item{/if}">
-			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
 		</li>
 		{/if}
 	{/foreach}
@@ -45,7 +45,7 @@
 				<select id="supplier_list" onchange="autoUrl('supplier_list', '');">
 					<option value="0">{l s='All suppliers' mod='blocksupplier'}</option>
 				{foreach from=$suppliers item=supplier}
-					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>
diff --git a/themes/default/modules/blocktags/blocktags.tpl b/themes/default/modules/blocktags/blocktags.tpl
index 9f0275e1b..f76c7bf1e 100644
--- a/themes/default/modules/blocktags/blocktags.tpl
+++ b/themes/default/modules/blocktags/blocktags.tpl
@@ -29,7 +29,7 @@
 	<p class="block_content">
 {if $tags}
 	{foreach from=$tags item=tag name=myLoop}
-		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
+		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")|escape:'html'}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
 	{/foreach}
 {else}
 	{l s='No tags specified yet' mod='blocktags'}
diff --git a/themes/default/modules/blockwishlist/blockwishlist.tpl b/themes/default/modules/blockwishlist/blockwishlist.tpl
index 5e2e60cdb..fc1fbf503 100644
--- a/themes/default/modules/blockwishlist/blockwishlist.tpl
+++ b/themes/default/modules/blockwishlist/blockwishlist.tpl
@@ -35,12 +35,12 @@
 				<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 					<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
 					<a class="cart_block_product_name"
-					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
+					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
 					<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0', '{$token}');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 				</dt>
 				{if isset($product.attributes_small)}
 				<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
-					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 				</dd>
 				{/if}
 			{/foreach}
diff --git a/themes/default/modules/homefeatured/homefeatured.tpl b/themes/default/modules/homefeatured/homefeatured.tpl
index 0e6b46a26..38fedd873 100644
--- a/themes/default/modules/homefeatured/homefeatured.tpl
+++ b/themes/default/modules/homefeatured/homefeatured.tpl
@@ -38,7 +38,7 @@
 				{math equation="(total%perLine)" total=$smarty.foreach.homeFeaturedProducts.total perLine=$nbItemsPerLine assign=totModulo}
 				{if $totModulo == 0}{assign var='totModulo' value=$nbItemsPerLine}{/if}
 				<li class="ajax_block_product {if $smarty.foreach.homeFeaturedProducts.first}first_item{elseif $smarty.foreach.homeFeaturedProducts.last}last_item{else}item{/if} {if $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 1} {/if} {if $smarty.foreach.homeFeaturedProducts.iteration > ($smarty.foreach.homeFeaturedProducts.total - $totModulo)}last_line{/if}">
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
+					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
 					<p class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></p>
 					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
 					<div>
diff --git a/themes/default/modules/productcomments/productcomments.tpl b/themes/default/modules/productcomments/productcomments.tpl
index 2e90f6e54..b5594be60 100644
--- a/themes/default/modules/productcomments/productcomments.tpl
+++ b/themes/default/modules/productcomments/productcomments.tpl
@@ -89,7 +89,7 @@ var productcomments_url_rewrite = '{$productcomments_url_rewriting_activated}';
 		<form action="#">
 			<h2 class="title">{l s='Write your review' mod='productcomments'}</h2>
 			<div class="product clearfix">
-				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
+				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
 				<div class="product_desc">
 					<p class="product_name"><strong>{$product->name}</strong></p>
 					{$product->description_short}
diff --git a/themes/default/my-account.tpl b/themes/default/my-account.tpl
index b4a7fe6ea..878ef0e64 100644
--- a/themes/default/my-account.tpl
+++ b/themes/default/my-account.tpl
@@ -35,17 +35,17 @@
 <p class="title_block">{l s='Welcome to your account. Here you can manage al of your personal information and orders. '}</p>
 <ul class="myaccount_lnk_list">
 	{if $has_customer_an_address}
-	<li><a href="{$link->getPageLink('address', true)}" title="{l s='Add my first address'}"><img src="{$img_dir}icon/addrbook.gif" alt="{l s='Add my first address'}" class="icon" /> {l s='Add my first address'}</a></li>
+	<li><a href="{$link->getPageLink('address', true)|escape:'html'}" title="{l s='Add my first address'}"><img src="{$img_dir}icon/addrbook.gif" alt="{l s='Add my first address'}" class="icon" /> {l s='Add my first address'}</a></li>
 	{/if}
-	<li><a href="{$link->getPageLink('history', true)}" title="{l s='Orders'}"><img src="{$img_dir}icon/order.gif" alt="{l s='Orders'}" class="icon" /> {l s='Order history and details '}</a></li>
+	<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='Orders'}"><img src="{$img_dir}icon/order.gif" alt="{l s='Orders'}" class="icon" /> {l s='Order history and details '}</a></li>
 	{if $returnAllowed}
-		<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='Merchandise returns'}"><img src="{$img_dir}icon/return.gif" alt="{l s='Merchandise returns'}" class="icon" /> {l s='My merchandise returns'}</a></li>
+		<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='Merchandise returns'}"><img src="{$img_dir}icon/return.gif" alt="{l s='Merchandise returns'}" class="icon" /> {l s='My merchandise returns'}</a></li>
 	{/if}
-	<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='Credit slips'}"><img src="{$img_dir}icon/slip.gif" alt="{l s='Credit slips'}" class="icon" /> {l s='My credit slips'}</a></li>
-	<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='Addresses'}"><img src="{$img_dir}icon/addrbook.gif" alt="{l s='Addresses'}" class="icon" /> {l s='My addresses'}</a></li>
-	<li><a href="{$link->getPageLink('identity', true)}" title="{l s='Information'}"><img src="{$img_dir}icon/userinfo.gif" alt="{l s='Information'}" class="icon" /> {l s='My personal information'}</a></li>
+	<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='Credit slips'}"><img src="{$img_dir}icon/slip.gif" alt="{l s='Credit slips'}" class="icon" /> {l s='My credit slips'}</a></li>
+	<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='Addresses'}"><img src="{$img_dir}icon/addrbook.gif" alt="{l s='Addresses'}" class="icon" /> {l s='My addresses'}</a></li>
+	<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Information'}"><img src="{$img_dir}icon/userinfo.gif" alt="{l s='Information'}" class="icon" /> {l s='My personal information'}</a></li>
 	{if $voucherAllowed}
-		<li><a href="{$link->getPageLink('discount', true)}" title="{l s='Vouchers'}"><img src="{$img_dir}icon/voucher.gif" alt="{l s='Vouchers'}" class="icon" /> {l s='My vouchers'}</a></li>
+		<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='Vouchers'}"><img src="{$img_dir}icon/voucher.gif" alt="{l s='Vouchers'}" class="icon" /> {l s='My vouchers'}</a></li>
 	{/if}
 	{$HOOK_CUSTOMER_ACCOUNT}
 </ul>
diff --git a/themes/default/order-address-multishipping.tpl b/themes/default/order-address-multishipping.tpl
index 8b8359c33..62a20a126 100644
--- a/themes/default/order-address-multishipping.tpl
+++ b/themes/default/order-address-multishipping.tpl
@@ -112,7 +112,7 @@
 		dest_comp.html('');
 
 		li_content['title'] = adr_titles_vals[address_type];
-		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")}'+id_address+'&amp;back=order?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}">{l s='Update' js=1}</a>';
+		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")|escape:'html'}'+id_address+'&amp;back=order?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}">{l s='Update' js=1}</a>';
 
 		appendAddressList(dest_comp, li_content, ordered_fields_name);
 	}
@@ -162,7 +162,7 @@
 
 {include file="$tpl_dir./order-address-multishipping-products.tpl"}
 
-<form action="{$link->getPageLink('order', true, NULL, 'multi-shipping=1')}" method="post">
+<form action="{$link->getPageLink('order', true, NULL, 'multi-shipping=1')|escape:'html'}" method="post">
 {else}
 <div id="opc_account" class="opc-main-block">
 	<div id="opc_account-overlay" class="opc-overlay" style="display: none;"></div>
@@ -179,7 +179,7 @@
 			{/section}
 			</select>
 		{else}
-			<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
+			<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
 		{/if}
 		</p>
 		<div class="clearfix">
@@ -187,7 +187,7 @@
 			</ul>
 		</div>
 		<p class="address_add submit">
-			<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")}" title="{l s='Add'}" class="button_large">&raquo; {l s='Add a new address'}</a>
+			<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large">&raquo; {l s='Add a new address'}</a>
 		</p>
 		{if !$opc}
 		<div id="ordermsg" class="clearfix">
@@ -201,9 +201,9 @@
 		<input type="hidden" class="hidden" name="step" value="2" />
 		<input type="hidden" name="back" value="{$back}" />
 		{if $back}
-			<a href="{$link->getPageLink('order', true, NULL, "step=0&amp;back={$back}")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
+			<a href="{$link->getPageLink('order', true, NULL, "step=0&amp;back={$back}")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
 		{else}
-			<a href="{$link->getPageLink('order', true, NULL, "step=0")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
+			<a href="{$link->getPageLink('order', true, NULL, "step=0")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
 		{/if}
 		<input type="submit" name="processAddress" value="{l s='Next'} &raquo;" class="exclusive" />
 	</p>
diff --git a/themes/default/order-address-product-line.tpl b/themes/default/order-address-product-line.tpl
index 4e7acf037..59e10ccf6 100644
--- a/themes/default/order-address-product-line.tpl
+++ b/themes/default/order-address-product-line.tpl
@@ -25,7 +25,7 @@
 *}
 <tr id="product_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" class="{if $productLast}last_item{elseif $productFirst}first_item{/if} {if isset($customizedDatas.$productId.$productAttributeId) AND $quantityDisplayed == 0}alternate_item{/if} cart_item {if $odd}odd{else}even{/if}">
 	<td class="cart_product">
-		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
+		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
 	</td>
 	<td class="cart_description">
 		<p class="s_title_block"><a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category)|escape:'htmlall':'UTF-8'}">{$product.name|escape:'htmlall':'UTF-8'}</a></p>
@@ -38,9 +38,9 @@
 	{else}
 		{if !isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed > 0}
 			<div class="cart_quantity_button">
-			<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+			<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 			{if $product.minimal_quantity < ($product.cart_quantity-$quantityDisplayed) OR $product.minimal_quantity <= 1}
-			<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+			<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 				<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 			</a>
 			{else}
@@ -56,7 +56,7 @@
 	{/if}
 	</td>
 	<td>
-		<form method="post" action="{$link->getPageLink('cart', true, NULL, "token={$token_cart}")}">
+		<form method="post" action="{$link->getPageLink('cart', true, NULL, "token={$token_cart}")|escape:'html'}">
 			<input type="hidden" name="id_product" value="{$product.id_product}" />
 			<input type="hidden" name="id_product_attribute" value="{$product.id_product_attribute}" />
 			<select name="address_delivery" id="select_address_delivery_{$product.id_product}_{$product.id_product_attribute}_{$product.id_address_delivery|intval}" class="cart_address_delivery">
diff --git a/themes/default/order-address.tpl b/themes/default/order-address.tpl
index 538402174..2043b00ec 100644
--- a/themes/default/order-address.tpl
+++ b/themes/default/order-address.tpl
@@ -75,8 +75,8 @@
 	var txtProducts = "{l s='products' js=1}";
 	{/if}
 	
-	var addressMultishippingUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")}";
-	var addressUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}";
+	var addressMultishippingUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")|escape:'html'}";
+	var addressUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}";
 
 	var formatedAddressFieldsValuesList = new Array();
 
@@ -118,7 +118,7 @@
 		dest_comp.html('');
 
 		li_content['title'] = adr_titles_vals[address_type];
-		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")}'+id_address+'&amp;back={$back_order_page}?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}">&raquo; {l s='Update' js=1}</a>';
+		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")|escape:'html'}'+id_address+'&amp;back={$back_order_page}?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}">&raquo; {l s='Update' js=1}</a>';
 
 		appendAddressList(dest_comp, li_content, ordered_fields_name);
 	}
@@ -173,13 +173,13 @@
 		<div class="button_multishipping_mode" id="multishipping_mode_box">
 			<div class="title">{l s='Multi-shipping'}</div>
 			<div class="description">
-				<a href="{$link->getPageLink('order', true, NULL, 'step=1&multi-shipping=1')}"/>
+				<a href="{$link->getPageLink('order', true, NULL, 'step=1&multi-shipping=1')|escape:'html'}"/>
 					{l s='Specify a delivery address for each product ordered.'}
 				</a>
 			</div>
 		</div>
 	{/if}
-<form action="{$link->getPageLink($back_order_page, true)}" method="post">
+<form action="{$link->getPageLink($back_order_page, true)|escape:'html'}" method="post">
 {else}
 	{if {Configuration::get('PS_ALLOW_MULTISHIPPING')} && !$cart->isVirtualCart()}
 		<div class="address-form-multishipping">
@@ -189,7 +189,7 @@
 					<input type="checkbox" id="multishipping_mode_checkbox" onchange="multishippingMode(this); return false;"/><label for="multishipping_mode_checkbox">{l s='I\'d like to specify a delivery address for each product ordered.'}</label>
 				</div>
 				<div class="description_off">
-					<a href="{$link->getPageLink('order-opc', true, NULL, 'ajax=1&multi-shipping=1&method=multishipping')}" id="link_multishipping_form" title="{l s='Choose the delivery address(es)'}">
+					<a href="{$link->getPageLink('order-opc', true, NULL, 'ajax=1&multi-shipping=1&method=multishipping')|escape:'html'}" id="link_multishipping_form" title="{l s='Choose the delivery address(es)'}">
 						{l s='Specify a delivery address for each product.'}
 					</a>
 				</div>
@@ -233,7 +233,7 @@
 			{/section}
 			</select>
 			{else}
-				<a style="margin-left: 221px;" href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1&select_address=1{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
+				<a style="margin-left: 221px;" href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1&select_address=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
 			{/if}
 		</p>
 		<div class="clearfix">
@@ -243,7 +243,7 @@
 			</ul>
 		</div>
 		<p class="address_add submit">
-			<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
+			<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
 		</p>
 		{if !$opc}
 		<div id="ordermsg" class="clearfix">
@@ -256,7 +256,7 @@
 	<p class="cart_navigation submit">
 		<input type="hidden" class="hidden" name="step" value="2" />
 		<input type="hidden" name="back" value="{$back}" />
-		<a href="{$link->getPageLink($back_order_page, true, NULL, "step=0{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
+		<a href="{$link->getPageLink($back_order_page, true, NULL, "step=0{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
 		<input type="submit" name="processAddress" value="{l s='Next'} &raquo;" class="exclusive" />
 	</p>
 </form>
diff --git a/themes/default/order-carrier.tpl b/themes/default/order-carrier.tpl
index a8b9c2f2f..5feb5ce83 100644
--- a/themes/default/order-carrier.tpl
+++ b/themes/default/order-carrier.tpl
@@ -32,7 +32,7 @@
 	var currencyBlank = '{$currencyBlank|intval}';
 	var txtProduct = "{l s='Product' js=1}";
 	var txtProducts = "{l s='Products' js=1}";
-	var orderUrl = '{$link->getPageLink("order", true)}';
+	var orderUrl = '{$link->getPageLink("order", true)|escape:'html'}';
 
 	var msg = "{l s='You must agree to the terms of service before continuing.' js=1}";
 	{literal}
@@ -91,7 +91,7 @@
 	
 	{include file="$tpl_dir./errors.tpl"}
 	
-	<form id="form" action="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")}" method="post" onsubmit="return acceptCGV();">
+	<form id="form" action="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")|escape:'html'}" method="post" onsubmit="return acceptCGV();">
 {else}
 	<div id="opc_delivery_methods" class="opc-main-block">
 	<div id="opc_delivery_methods-overlay" class="opc-overlay" style="display: none;"></div>
@@ -277,12 +277,12 @@
 		<input type="hidden" name="back" value="{$back}" />
 		{if !$is_guest}
 			{if $back}
-				<a href="{$link->getPageLink('order', true, NULL, "step=1&back={$back}&multi-shipping={$multi_shipping}")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
+				<a href="{$link->getPageLink('order', true, NULL, "step=1&back={$back}&multi-shipping={$multi_shipping}")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
 			{else}
-				<a href="{$link->getPageLink('order', true, NULL, "step=1&multi-shipping={$multi_shipping}")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
+				<a href="{$link->getPageLink('order', true, NULL, "step=1&multi-shipping={$multi_shipping}")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
 			{/if}
 		{else}
-				<a href="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
+				<a href="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a>
 		{/if}
 		{if isset($virtual_cart) && $virtual_cart || (isset($delivery_option_list) && !empty($delivery_option_list))}
 			<input type="submit" name="processCarrier" value="{l s='Next'} &raquo;" class="exclusive" />
diff --git a/themes/default/order-confirmation.tpl b/themes/default/order-confirmation.tpl
index 7809cff4c..8e140fcb2 100644
--- a/themes/default/order-confirmation.tpl
+++ b/themes/default/order-confirmation.tpl
@@ -39,9 +39,9 @@
 <br />
 {if $is_guest}
 	<p>{l s='Your order ID is:'} <span class="bold">{$id_order_formatted}</span> . {l s='Your order ID has been sent via email.'}</p>
-	<a href="{$link->getPageLink('guest-tracking', true, NULL, "id_order={$reference_order}&email={$email}")}" title="{l s='Follow my order'}"><img src="{$img_dir}icon/order.gif" alt="{l s='Follow my order'}" class="icon" /></a>
-	<a href="{$link->getPageLink('guest-tracking', true, NULL, "id_order={$reference_order}&email={$email}")}" title="{l s='Follow my order'}">{l s='Follow my order'}</a>
+	<a href="{$link->getPageLink('guest-tracking', true, NULL, "id_order={$reference_order}&email={$email}")|escape:'html'}" title="{l s='Follow my order'}"><img src="{$img_dir}icon/order.gif" alt="{l s='Follow my order'}" class="icon" /></a>
+	<a href="{$link->getPageLink('guest-tracking', true, NULL, "id_order={$reference_order}&email={$email}")|escape:'html'}" title="{l s='Follow my order'}">{l s='Follow my order'}</a>
 {else}
-	<a href="{$link->getPageLink('history', true)}" title="{l s='Back to orders'}"><img src="{$img_dir}icon/order.gif" alt="{l s='Back to orders'}" class="icon" /></a>
-	<a href="{$link->getPageLink('history', true)}" title="{l s='Back to orders'}">{l s='Back to orders'}</a>
+	<a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='Back to orders'}"><img src="{$img_dir}icon/order.gif" alt="{l s='Back to orders'}" class="icon" /></a>
+	<a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='Back to orders'}">{l s='Back to orders'}</a>
 {/if}
diff --git a/themes/default/order-detail.tpl b/themes/default/order-detail.tpl
index c36c33366..0c5371405 100644
--- a/themes/default/order-detail.tpl
+++ b/themes/default/order-detail.tpl
@@ -107,7 +107,7 @@
 </ul>
 </div>
 {$HOOK_ORDERDETAILDISPLAYED}
-{if !$is_guest}<form action="{$link->getPageLink('order-follow', true)}" method="post">{/if}
+{if !$is_guest}<form action="{$link->getPageLink('order-follow', true)|escape:'html'}" method="post">{/if}
 <div id="order-detail-content" class="table_block">
 	<table class="std">
 		<thead>
@@ -251,16 +251,16 @@
 							<label for="cb_{$product.id_order_detail|intval}">
 								{if $product.download_hash && $invoice && $product.display_filename != '' && $product.product_quantity_refunded == 0 && $product.product_quantity_return == 0}
 									{if isset($is_guest) && $is_guest}
-									<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&amp;id_order={$order->id}&secure_key={$order->secure_key}")}" title="{l s='Download this product'}">
+									<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&amp;id_order={$order->id}&secure_key={$order->secure_key}")|escape:'html'}" title="{l s='Download this product'}">
 									{else}
-										<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")}" title="{l s='Download this product'}">
+										<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")|escape:'html'}" title="{l s='Download this product'}">
 									{/if}
 										<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Download product'}" />
 									</a>
 									{if isset($is_guest) && $is_guest}
-										<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&id_order={$order->id}&secure_key={$order->secure_key}")}" title="{l s='Download this product'}"> {$product.product_name|escape:'htmlall':'UTF-8'} 	</a>
+										<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&id_order={$order->id}&secure_key={$order->secure_key}")|escape:'html'}" title="{l s='Download this product'}"> {$product.product_name|escape:'htmlall':'UTF-8'} 	</a>
 									{else}
-									<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")}" title="{l s='Download this product'}"> {$product.product_name|escape:'htmlall':'UTF-8'} 	</a>
+									<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")|escape:'html'}" title="{l s='Download this product'}"> {$product.product_name|escape:'htmlall':'UTF-8'} 	</a>
 									{/if}
 								{else}
 									{$product.product_name|escape:'htmlall':'UTF-8'}
@@ -397,7 +397,7 @@
 			</ol>
 		</div>
 	{/if}
-	<form action="{$link->getPageLink('order-detail', true)}" method="post" class="std" id="sendOrderMessage">
+	<form action="{$link->getPageLink('order-detail', true)|escape:'html'}" method="post" class="std" id="sendOrderMessage">
 		<h3>{l s='Add a message'}</h3>
 		<p>{l s='If you would like to add a comment about your order, please write it in the field below.'}</p>
 		<p>
diff --git a/themes/default/order-follow.tpl b/themes/default/order-follow.tpl
index d8a8e7092..bf4d6a7d8 100644
--- a/themes/default/order-follow.tpl
+++ b/themes/default/order-follow.tpl
@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Return Merchandise Authorization (RMA)'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Return Merchandise Authorization (RMA)'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='Return Merchandise Authorization (RMA)'}</h1>
@@ -69,14 +69,14 @@
 		<tbody>
 		{foreach from=$ordersReturn item=return name=myLoop}
 			<tr class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.index % 2}alternate_item{/if}">
-				<td class="bold"><a class="color-myaccount" href="javascript:showOrder(0, {$return.id_order_return|intval}, '{$link->getPageLink('order-return', true)}');">{l s='#'}{$return.id_order_return|string_format:"%06d"}</a></td>
-				<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$return.id_order|intval}, '{$link->getPageLink('order-detail', true)}');">{l s='#'}{$return.id_order|string_format:"%06d"}</a></td>
+				<td class="bold"><a class="color-myaccount" href="javascript:showOrder(0, {$return.id_order_return|intval}, '{$link->getPageLink('order-return', true)|escape:'html'}');">{l s='#'}{$return.id_order_return|string_format:"%06d"}</a></td>
+				<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$return.id_order|intval}, '{$link->getPageLink('order-detail', true)|escape:'html'}');">{l s='#'}{$return.id_order|string_format:"%06d"}</a></td>
 				<td class="history_method"><span class="bold">{$return.state_name|escape:'htmlall':'UTF-8'}</span></td>
 				<td class="bold">{dateFormat date=$return.date_add full=0}</td>
 				<td class="history_invoice">
 				{if $return.state == 2}
-					<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" class="icon" /></a>
-					<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}">{l s='Print out'}</a>
+					<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")|escape:'html'}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" class="icon" /></a>
+					<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")|escape:'html'}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}">{l s='Print out'}</a>
 				{else}
 					--
 				{/if}
@@ -92,6 +92,6 @@
 </div>
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a><a href="{$base_dir}">{l s='Home'}</a></li>
 </ul>
diff --git a/themes/default/order-opc-new-account.tpl b/themes/default/order-opc-new-account.tpl
index 04c2c6f70..0e42f8615 100644
--- a/themes/default/order-opc-new-account.tpl
+++ b/themes/default/order-opc-new-account.tpl
@@ -1,7 +1,7 @@
 <div id="opc_new_account" class="opc-main-block">
 	<div id="opc_new_account-overlay" class="opc-overlay" style="display: none;"></div>
 	<h2><span>1</span> {l s='Account'}</h2>
-	<form action="{$link->getPageLink('authentication', true, NULL, "back=order-opc")}" method="post" id="login_form" class="std">
+	<form action="{$link->getPageLink('authentication', true, NULL, "back=order-opc")|escape:'html'}" method="post" id="login_form" class="std">
 		<fieldset>
 			<h3>{l s='Already registered?'}</h3>
 			<p><a href="#" id="openLoginFormBlock">&raquo; {l s='Click here'}</a></p>
@@ -16,7 +16,7 @@
 				<div style="margin-left:40px;margin-bottom:5px;float:left;width:40%;">
 					<label for="login_passwd">{l s='Password'}</label>
 					<span><input type="password" id="login_passwd" name="login_passwd" /></span>
-					<a href="{$link->getPageLink('password', true)}" class="lost_password">{l s='Forgot your password?'}</a>
+					<a href="{$link->getPageLink('password', true)|escape:'html'}" class="lost_password">{l s='Forgot your password?'}</a>
 				</div>
 				<p class="submit">
 					{if isset($back)}<input type="hidden" class="hidden" name="back" value="{$back|escape:'htmlall':'UTF-8'}" />{/if}
diff --git a/themes/default/order-opc.tpl b/themes/default/order-opc.tpl
index fb050a64c..5c133ed5e 100755
--- a/themes/default/order-opc.tpl
+++ b/themes/default/order-opc.tpl
@@ -38,11 +38,11 @@
 <script type="text/javascript">
 	// <![CDATA[
 	var imgDir = '{$img_dir}';
-	var authenticationUrl = '{$link->getPageLink("authentication", true)}';
-	var orderOpcUrl = '{$link->getPageLink("order-opc", true)}';
-	var historyUrl = '{$link->getPageLink("history", true)}';
-	var guestTrackingUrl = '{$link->getPageLink("guest-tracking", true)}';
-	var addressUrl = '{$link->getPageLink("address", true, NULL, "back={$back_order_page}")}';
+	var authenticationUrl = '{$link->getPageLink("authentication", true)|escape:'html'}';
+	var orderOpcUrl = '{$link->getPageLink("order-opc", true)|escape:'html'}';
+	var historyUrl = '{$link->getPageLink("history", true)|escape:'html'}';
+	var guestTrackingUrl = '{$link->getPageLink("guest-tracking", true)|escape:'html'}';
+	var addressUrl = '{$link->getPageLink("address", true, NULL, "back={$back_order_page}")|escape:'html'}';
 	var orderProcess = 'order-opc';
 	var guestCheckoutEnabled = {$PS_GUEST_CHECKOUT_ENABLED|intval};
 	var currencySign = '{$currencySign|html_entity_decode:2:"UTF-8"}';
diff --git a/themes/default/order-payment.tpl b/themes/default/order-payment.tpl
index db4482b2f..27786cb5c 100644
--- a/themes/default/order-payment.tpl
+++ b/themes/default/order-payment.tpl
@@ -273,12 +273,12 @@
 								<span style="float:left">{if $quantityDisplayed == 0 AND isset($customizedDatas.$productId.$productAttributeId)}{$customizedDatas.$productId.$productAttributeId|@count}{else}{$product.cart_quantity-$quantityDisplayed}{/if}</span>
 							{else}
 								<div style="float:right">
-									<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" title="{l s='Delete this customization'}" width="11" height="13" class="icon" /></a>
+									<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" title="{l s='Delete this customization'}" width="11" height="13" class="icon" /></a>
 								</div>
 								<div id="cart_quantity_button" style="float:left">
-								<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+								<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 								{if $product.minimal_quantity < ($customization.quantity -$quantityDisplayed) OR $product.minimal_quantity <= 1}
-								<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+								<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 									<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 								</a>
 								{else}
@@ -343,7 +343,7 @@
 {/if}
 
 {if !$opc}
-	<p class="cart_navigation"><a href="{$link->getPageLink('order', true, NULL, "step=2")}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a></p>
+	<p class="cart_navigation"><a href="{$link->getPageLink('order', true, NULL, "step=2")|escape:'html'}" title="{l s='Previous'}" class="button">&laquo; {l s='Previous'}</a></p>
 {else}
 	</div>
 {/if}
diff --git a/themes/default/order-return.tpl b/themes/default/order-return.tpl
index c9bdf3419..06c9d8510 100644
--- a/themes/default/order-return.tpl
+++ b/themes/default/order-return.tpl
@@ -94,11 +94,11 @@
 	<p class="bold">{l s='Reminder:'}</p>
 	<div>
 		- {l s='All merchandise must be returned in its original packaging and in its original state.'}
-		<br />- {l s='Please print out the'} <a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$orderRet->id|intval}")}">{l s='PDF return slip'}</a> {l s='and include it with your package.'}
-		<br />- {l s='Please see the PDF return slip'} (<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$orderRet->id|intval}")}">{l s='for the correct address'}</a>)
+		<br />- {l s='Please print out the'} <a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$orderRet->id|intval}")|escape:'html'}">{l s='PDF return slip'}</a> {l s='and include it with your package.'}
+		<br />- {l s='Please see the PDF return slip'} (<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$orderRet->id|intval}")|escape:'html'}">{l s='for the correct address'}</a>)
 		<br /><br />
 		{l s='When we receive your package, we will notify you by email. We will then begin processing order reimbursement.'}
-		<br /><br /><a href="{$link->getPageLink('contact', true)}">{l s='Please let us know if you have any questions.'}</a>
+		<br /><br /><a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='Please let us know if you have any questions.'}</a>
 		<br />
 		<p class="bold">{l s='If the conditions of return listed above are not respected, we reserve the right to refuse your package and/or reimbursement.'}</p>
 	</div>
diff --git a/themes/default/order-slip.tpl b/themes/default/order-slip.tpl
index 0adda6a57..9234c40aa 100644
--- a/themes/default/order-slip.tpl
+++ b/themes/default/order-slip.tpl
@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Credit slips'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Credit slips'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='Credit slips'}</h1>
@@ -43,11 +43,11 @@
 		{foreach from=$ordersSlip item=slip name=myLoop}
 			<tr class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.index % 2}alternate_item{/if}">
 				<td class="bold"><span class="color-myaccount">{l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}</span></td>
-				<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$slip.id_order|intval}, '{$link->getPageLink('order-detail')}');">{l s='#%s' sprintf=$slip.id_order|string_format:"%06d"}</a></td>
+				<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$slip.id_order|intval}, '{$link->getPageLink('order-detail')|escape:'html'}');">{l s='#%s' sprintf=$slip.id_order|string_format:"%06d"}</a></td>
 				<td class="bold">{dateFormat date=$slip.date_add full=0}</td>
 				<td class="history_invoice">
-					<a href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")}" title="{l s='Credit slip'} {l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order slip'} {l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}" class="icon" /></a>
-					<a href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")}" title="{l s='Credit slip'} {l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}">{l s='PDF'}</a>
+					<a href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")|escape:'html'}" title="{l s='Credit slip'} {l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order slip'} {l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}" class="icon" /></a>
+					<a href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")|escape:'html'}" title="{l s='Credit slip'} {l s='#%s' sprintf=$slip.id_order_slip|string_format:"%06d"}">{l s='PDF'}</a>
 				</td>
 			</tr>
 		{/foreach}
@@ -59,6 +59,6 @@
 	{/if}
 </div>
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a><a href="{$base_dir}">{l s='Home'}</a></li>
 </ul>
diff --git a/themes/default/order-steps.tpl b/themes/default/order-steps.tpl
index ea7d8377e..edb3a549b 100644
--- a/themes/default/order-steps.tpl
+++ b/themes/default/order-steps.tpl
@@ -37,7 +37,7 @@
 <ul class="step" id="order_step">
 	<li class="{if $current_step=='summary'}step_current{else}{if $current_step=='payment' || $current_step=='shipping' || $current_step=='address' || $current_step=='login'}step_done{else}step_todo{/if}{/if}">
 		{if $current_step=='payment' || $current_step=='shipping' || $current_step=='address' || $current_step=='login'}
-		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&multi-shipping={$multi_shipping}")}">
+		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&multi-shipping={$multi_shipping}")|escape:'html'}">
 			1. {l s='Summary'}
 		</a>
 		{else}
@@ -46,7 +46,7 @@
 	</li>
 	<li class="{if $current_step=='login'}step_current{else}{if $current_step=='payment' || $current_step=='shipping' || $current_step=='address'}step_done{else}step_todo{/if}{/if}">
 		{if $current_step=='payment' || $current_step=='shipping' || $current_step=='address'}
-		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&step=1&multi-shipping={$multi_shipping}")}">
+		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&step=1&multi-shipping={$multi_shipping}")|escape:'html'}">
 			2. {l s='Login'}
 		</a>
 		{else}
@@ -55,7 +55,7 @@
 	</li>
 	<li class="{if $current_step=='address'}step_current{else}{if $current_step=='payment' || $current_step=='shipping'}step_done{else}step_todo{/if}{/if}">
 		{if $current_step=='payment' || $current_step=='shipping'}
-		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&step=1&multi-shipping={$multi_shipping}")}">
+		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&step=1&multi-shipping={$multi_shipping}")|escape:'html'}">
 			3. {l s='Address'}
 		</a>
 		{else}
@@ -64,7 +64,7 @@
 	</li>
 	<li class="{if $current_step=='shipping'}step_current{else}{if $current_step=='payment'}step_done{else}step_todo{/if}{/if}">
 		{if $current_step=='payment'}
-		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&step=2&multi-shipping={$multi_shipping}")}">
+		<a href="{$link->getPageLink('order', true, NULL, "{$smarty.capture.url_back}&step=2&multi-shipping={$multi_shipping}")|escape:'html'}">
 			4. {l s='Shipping'}
 		</a>
 		{else}
diff --git a/themes/default/pagination.tpl b/themes/default/pagination.tpl
index fa806db11..070ab7e9b 100644
--- a/themes/default/pagination.tpl
+++ b/themes/default/pagination.tpl
@@ -53,42 +53,42 @@
 		<ul class="pagination">
 		{if $p != 1}
 			{assign var='p_previous' value=$p-1}
-			<li id="pagination_previous"><a {$no_follow_text} href="{$link->goPage($requestPage, $p_previous)}">&laquo;&nbsp;{l s='Previous'}</a></li>
+			<li id="pagination_previous"><a {$no_follow_text} href="{$link->goPage($requestPage, $p_previous)|escape:'html'}">&laquo;&nbsp;{l s='Previous'}</a></li>
 		{else}
 			<li id="pagination_previous" class="disabled"><span>&laquo;&nbsp;{l s='Previous'}</span></li>
 		{/if}
 		{if $start==3}
-			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)}">1</a></li>
-			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 2)}">2</a></li>
+			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)|escape:'html'}">1</a></li>
+			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 2)|escape:'html'}">2</a></li>
 		{/if}
 		{if $start==2}
-			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)}">1</a></li>
+			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)|escape:'html'}">1</a></li>
 		{/if}
 		{if $start>3}
-			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)}">1</a></li>
+			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)|escape:'html'}">1</a></li>
 			<li class="truncate">...</li>
 		{/if}
 		{section name=pagination start=$start loop=$stop+1 step=1}
 			{if $p == $smarty.section.pagination.index}
 				<li class="current"><span>{$p|escape:'htmlall':'UTF-8'}</span></li>
 			{else}
-				<li><a {$no_follow_text} href="{$link->goPage($requestPage, $smarty.section.pagination.index)}">{$smarty.section.pagination.index|escape:'htmlall':'UTF-8'}</a></li>
+				<li><a {$no_follow_text} href="{$link->goPage($requestPage, $smarty.section.pagination.index)|escape:'html'}">{$smarty.section.pagination.index|escape:'htmlall':'UTF-8'}</a></li>
 			{/if}
 		{/section}
 		{if $pages_nb>$stop+2}
 			<li class="truncate">...</li>
-			<li><a href="{$link->goPage($requestPage, $pages_nb)}">{$pages_nb|intval}</a></li>
+			<li><a href="{$link->goPage($requestPage, $pages_nb)|escape:'html'}">{$pages_nb|intval}</a></li>
 		{/if}
 		{if $pages_nb==$stop+1}
-			<li><a href="{$link->goPage($requestPage, $pages_nb)}">{$pages_nb|intval}</a></li>
+			<li><a href="{$link->goPage($requestPage, $pages_nb)|escape:'html'}">{$pages_nb|intval}</a></li>
 		{/if}
 		{if $pages_nb==$stop+2}
-			<li><a href="{$link->goPage($requestPage, $pages_nb-1)}">{$pages_nb-1|intval}</a></li>
-			<li><a href="{$link->goPage($requestPage, $pages_nb)}">{$pages_nb|intval}</a></li>
+			<li><a href="{$link->goPage($requestPage, $pages_nb-1)|escape:'html'}">{$pages_nb-1|intval}</a></li>
+			<li><a href="{$link->goPage($requestPage, $pages_nb)|escape:'html'}">{$pages_nb|intval}</a></li>
 		{/if}
 		{if $pages_nb > 1 AND $p != $pages_nb}
 			{assign var='p_next' value=$p+1}
-			<li id="pagination_next"><a {$no_follow_text} href="{$link->goPage($requestPage, $p_next)}">{l s='Next'}&nbsp;&raquo;</a></li>
+			<li id="pagination_next"><a {$no_follow_text} href="{$link->goPage($requestPage, $p_next)|escape:'html'}">{l s='Next'}&nbsp;&raquo;</a></li>
 		{else}
 			<li id="pagination_next" class="disabled"><span>{l s='Next'}&nbsp;&raquo;</span></li>
 		{/if}
diff --git a/themes/default/password.tpl b/themes/default/password.tpl
index 83bdd5a3a..db61001a3 100644
--- a/themes/default/password.tpl
+++ b/themes/default/password.tpl
@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('authentication', true)}" title="{l s='Authentication'}" rel="nofollow">{l s='Authentication'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Forgot your password'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('authentication', true)|escape:'html'}" title="{l s='Authentication'}" rel="nofollow">{l s='Authentication'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Forgot your password'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='Forgot your password?'}</h1>
@@ -49,5 +49,5 @@
 </form>
 {/if}
 <p class="clear">
-	<a href="{$link->getPageLink('authentication', true)}" title="{l s='Return to Login'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="{l s='Return to Login'}" class="icon" /></a><a href="{$link->getPageLink('authentication')}" title="{l s='Back to Login'}" rel="nofollow">{l s='Back to Login'}</a>
+	<a href="{$link->getPageLink('authentication', true)}" title="{l s='Return to Login'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="{l s='Return to Login'}" class="icon" /></a><a href="{$link->getPageLink('authentication')|escape:'html'}" title="{l s='Back to Login'}" rel="nofollow">{l s='Back to Login'}</a>
 </p>
diff --git a/themes/default/product-compare.tpl b/themes/default/product-compare.tpl
index ad09f7c51..b4efd19b2 100644
--- a/themes/default/product-compare.tpl
+++ b/themes/default/product-compare.tpl
@@ -31,7 +31,7 @@
 //]]>
 </script>
 
-	<form method="post" action="{$link->getPageLink('products-comparison')}" onsubmit="true">
+	<form method="post" action="{$link->getPageLink('products-comparison')|escape:'html'}" onsubmit="true">
 		<p>
 		<input type="submit" id="bt_compare" class="button" value="{l s='Compare'}" />
 		<input type="hidden" name="compare_product_list" class="compare_product_list" value="" />
diff --git a/themes/default/product-list.tpl b/themes/default/product-list.tpl
index 0e4185b3d..60fb6f40f 100644
--- a/themes/default/product-list.tpl
+++ b/themes/default/product-list.tpl
@@ -38,7 +38,7 @@
 			</div>
 			<div class="center_block">
 				<a href="{$product.link|escape:'htmlall':'UTF-8'}" class="product_img_link" title="{$product.name|escape:'htmlall':'UTF-8'}">
-					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" {if isset($homeSize)} width="{$homeSize.width}" height="{$homeSize.height}"{/if} />
+					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" {if isset($homeSize)} width="{$homeSize.width}" height="{$homeSize.height}"{/if} />
 					{if isset($product.new) && $product.new == 1}<span class="new">{l s='New'}</span>{/if}
 				</a>
 				<h3><a href="{$product.link|escape:'htmlall':'UTF-8'}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h3>
@@ -57,9 +57,9 @@
 				{if ($product.id_product_attribute == 0 || (isset($add_prod_display) && ($add_prod_display == 1))) && $product.available_for_order && !isset($restricted_country_mode) && $product.minimal_quantity <= 1 && $product.customizable != 2 && !$PS_CATALOG_MODE}
 					{if ($product.allow_oosp || $product.quantity > 0)}
 						{if isset($static_token)}
-							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;token={$static_token}", false)}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
+							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;token={$static_token}", false)|escape:'html'}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
 						{else}
-							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add=1&amp;id_product={$product.id_product|intval}", false)}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
+							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add=1&amp;id_product={$product.id_product|intval}", false)|escape:'html'}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
 						{/if}						
 					{else}
 						<span class="exclusive"><span></span>{l s='Add to cart'}</span><br />
diff --git a/themes/default/product.tpl b/themes/default/product.tpl
index 03da23203..21d0c3b23 100644
--- a/themes/default/product.tpl
+++ b/themes/default/product.tpl
@@ -183,7 +183,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 		<div id="image-block">
 		{if $have_image}
 			<span id="view_full_size">
-				<img src="{$link->getImageLink($product->link_rewrite, $cover.id_image, 'large_default')}"{if $jqZoomEnabled && $have_image} class="jqzoom"{/if} title="{$product->name|escape:'htmlall':'UTF-8'}" alt="{$product->name|escape:'htmlall':'UTF-8'}" id="bigpic" width="{$largeSize.width}" height="{$largeSize.height}"/>
+				<img src="{$link->getImageLink($product->link_rewrite, $cover.id_image, 'large_default')|escape:'html'}"{if $jqZoomEnabled && $have_image} class="jqzoom"{/if} title="{$product->name|escape:'htmlall':'UTF-8'}" alt="{$product->name|escape:'htmlall':'UTF-8'}" id="bigpic" width="{$largeSize.width}" height="{$largeSize.height}"/>
 				<span class="span_link">{l s='Maximize'}</span>
 			</span>
 		{else}
@@ -203,8 +203,8 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 					{foreach from=$images item=image name=thumbnails}
 					{assign var=imageIds value="`$product->id`-`$image.id_image`"}
 					<li id="thumbnail_{$image.id_image}">
-						<a href="{$link->getImageLink($product->link_rewrite, $imageIds, 'thickbox_default')}" rel="other-views" class="thickbox{if $smarty.foreach.thumbnails.first} shown{/if}" title="{$image.legend|htmlspecialchars}">
-							<img id="thumb_{$image.id_image}" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'medium_default')}" alt="{$image.legend|htmlspecialchars}" height="{$mediumSize.height}" width="{$mediumSize.width}" />
+						<a href="{$link->getImageLink($product->link_rewrite, $imageIds, 'thickbox_default')|escape:'html'}" rel="other-views" class="thickbox{if $smarty.foreach.thumbnails.first} shown{/if}" title="{$image.legend|htmlspecialchars}">
+							<img id="thumb_{$image.id_image}" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'medium_default')|escape:'html'}" alt="{$image.legend|htmlspecialchars}" height="{$mediumSize.height}" width="{$mediumSize.width}" />
 						</a>
 					</li>
 					{/foreach}
@@ -214,7 +214,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 		{if isset($images) && count($images) > 3}<a id="view_scroll_right" title="{l s='Other views'}" href="javascript:{ldelim}{rdelim}">{l s='Next'}</a>{/if}
 		</div>
 		{/if}
-		{if isset($images) && count($images) > 1}<p class="resetimg clear"><span id="wrapResetImages" style="display: none;"><img src="{$img_dir}icon/cancel_11x13.gif" alt="{l s='Cancel'}" width="11" height="13"/> <a id="resetImages" href="{$link->getProductLink($product)}" onclick="$('span#wrapResetImages').hide('slow');return (false);">{l s='Display all pictures'}</a></span></p>{/if}
+		{if isset($images) && count($images) > 1}<p class="resetimg clear"><span id="wrapResetImages" style="display: none;"><img src="{$img_dir}icon/cancel_11x13.gif" alt="{l s='Cancel'}" width="11" height="13"/> <a id="resetImages" href="{$link->getProductLink($product)|escape:'html'}" onclick="$('span#wrapResetImages').hide('slow');return (false);">{l s='Display all pictures'}</a></span></p>{/if}
 		<!-- usefull links-->
 		<ul id="usefull_link_block">
 			{if $HOOK_EXTRA_LEFT}{$HOOK_EXTRA_LEFT}{/if}
@@ -241,7 +241,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 				<h3>{l s='Pack content'}</h3>
 				{foreach from=$packItems item=packItem}
 				<div class="pack_content">
-					{$packItem.pack_quantity} x <a href="{$link->getProductLink($packItem.id_product, $packItem.link_rewrite, $packItem.category)}">{$packItem.name|escape:'htmlall':'UTF-8'}</a>
+					{$packItem.pack_quantity} x <a href="{$link->getProductLink($packItem.id_product, $packItem.link_rewrite, $packItem.category)|escape:'html'}">{$packItem.name|escape:'htmlall':'UTF-8'}</a>
 					<p>{$packItem.description_short}</p>
 				</div>
 				{/foreach}
@@ -266,7 +266,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 
 		{if ($product->show_price AND !isset($restricted_country_mode)) OR isset($groups) OR $product->reference OR (isset($HOOK_PRODUCT_ACTIONS) && $HOOK_PRODUCT_ACTIONS)}
 		<!-- add to cart form-->
-		<form id="buy_block" {if $PS_CATALOG_MODE AND !isset($groups) AND $product->quantity > 0}class="hidden"{/if} action="{$link->getPageLink('cart')}" method="post">
+		<form id="buy_block" {if $PS_CATALOG_MODE AND !isset($groups) AND $product->quantity > 0}class="hidden"{/if} action="{$link->getPageLink('cart')|escape:'html'}" method="post">
 
 			<!-- hidden datas -->
 			<p class="hidden">
@@ -530,7 +530,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 	{if isset($attachments) && $attachments}
 		<ul id="idTab9" class="bullet">
 		{foreach from=$attachments item=attachment}
-			<li><a href="{$link->getPageLink('attachment', true, NULL, "id_attachment={$attachment.id_attachment}")}">{$attachment.name|escape:'htmlall':'UTF-8'}</a><br />{$attachment.description|escape:'htmlall':'UTF-8'}</li>
+			<li><a href="{$link->getPageLink('attachment', true, NULL, "id_attachment={$attachment.id_attachment}")|escape:'html'}">{$attachment.name|escape:'htmlall':'UTF-8'}</a><br />{$attachment.description|escape:'htmlall':'UTF-8'}</li>
 		{/foreach}
 		</ul>
 	{/if}
@@ -549,7 +549,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 									{if $accessory.show_price AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE} - <span class="price">{if $priceDisplay != 1}{displayWtPrice p=$accessory.price}{else}{displayWtPrice p=$accessory.price_tax_exc}{/if}</span>{/if}
 								</p>
 								<div class="product_desc">
-									<a href="{$accessoryLink|escape:'htmlall':'UTF-8'}" title="{$accessory.legend|escape:'htmlall':'UTF-8'}" class="product_image"><img src="{$link->getImageLink($accessory.link_rewrite, $accessory.id_image, 'medium_default')}" alt="{$accessory.legend|escape:'htmlall':'UTF-8'}" width="{$mediumSize.width}" height="{$mediumSize.height}" /></a>
+									<a href="{$accessoryLink|escape:'htmlall':'UTF-8'}" title="{$accessory.legend|escape:'htmlall':'UTF-8'}" class="product_image"><img src="{$link->getImageLink($accessory.link_rewrite, $accessory.id_image, 'medium_default')|escape:'html'}" alt="{$accessory.legend|escape:'htmlall':'UTF-8'}" width="{$mediumSize.width}" height="{$mediumSize.height}" /></a>
 									<div class="block_description">
 										<a href="{$accessoryLink|escape:'htmlall':'UTF-8'}" title="{l s='More'}" class="product_description">{$accessory.description_short|strip_tags|truncate:400:'...'}</a>
 									</div>
@@ -559,7 +559,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 								<p class="clearfix" style="margin-top:5px">
 									<a class="button" href="{$accessoryLink|escape:'htmlall':'UTF-8'}" title="{l s='View'}">{l s='View'}</a>
 									{if !$PS_CATALOG_MODE && ($accessory.allow_oosp || $accessory.quantity > 0)}
-									<a class="exclusive button ajax_add_to_cart_button" href="{$link->getPageLink('cart', true, NULL, "qty=1&amp;id_product={$accessory.id_product|intval}&amp;token={$static_token}&amp;add")}" rel="ajax_id_product_{$accessory.id_product|intval}" title="{l s='Add to cart'}">{l s='Add to cart'}</a>
+									<a class="exclusive button ajax_add_to_cart_button" href="{$link->getPageLink('cart', true, NULL, "qty=1&amp;id_product={$accessory.id_product|intval}&amp;token={$static_token}&amp;add")|escape:'html'}" rel="ajax_id_product_{$accessory.id_product|intval}" title="{l s='Add to cart'}">{l s='Add to cart'}</a>
 									{/if}
 								</p>
 								
@@ -591,7 +591,7 @@ var fieldRequired = '{l s='Please fill in all the required fields before saving
 									{if isset($pictures.$key)}
 									<div class="customizationUploadBrowse">
 										<img src="{$pic_dir}{$pictures.$key}_small" alt="" />
-										<a href="{$link->getProductDeletePictureLink($product, $field.id_customization_field)}" title="{l s='Delete'}" >
+										<a href="{$link->getProductDeletePictureLink($product, $field.id_customization_field)|escape:'html'}" title="{l s='Delete'}" >
 											<img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" class="customization_delete_icon" width="11" height="13" />
 										</a>
 									</div>
diff --git a/themes/default/products-comparison.tpl b/themes/default/products-comparison.tpl
index c85bb5c88..b34932e78 100644
--- a/themes/default/products-comparison.tpl
+++ b/themes/default/products-comparison.tpl
@@ -41,7 +41,7 @@
 
 			<td width="{$width}%" class="ajax_block_product comparison_infos">
 				<a href="{$product->getLink()}" title="{$product->name|escape:html:'UTF-8'}" class="product_image" >
-					<img src="{$link->getImageLink($product->link_rewrite, $product->id_image, 'home_default')}" alt="{$product->name|escape:html:'UTF-8'}" width="{$homeSize.width}" height="{$homeSize.height}" />
+					<img src="{$link->getImageLink($product->link_rewrite, $product->id_image, 'home_default')|escape:'html'}" alt="{$product->name|escape:html:'UTF-8'}" width="{$homeSize.width}" height="{$homeSize.height}" />
 				</a>
 				<p class="s_title_block"><a href="{$product->getLink()}" title="{$product->name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product->name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></p>
 				<div class="product_desc"><a href="{$product->getLink()}">{$product->description_short|strip_tags|truncate:60:'...'}</a></div>
@@ -84,10 +84,10 @@
 						</span>
 					{/if}
 				</p>
-				<a class="cmp_remove" href="{$link->getPageLink('products-comparison', true)}" rel="ajax_id_product_{$product->id}">{l s='Remove'}</a>
+				<a class="cmp_remove" href="{$link->getPageLink('products-comparison', true)|escape:'html'}" rel="ajax_id_product_{$product->id}">{l s='Remove'}</a>
 				{if (!$product->hasAttributes() OR (isset($add_prod_display) AND ($add_prod_display == 1))) AND $product->minimal_quantity == 1 AND $product->customizable != 2 AND !$PS_CATALOG_MODE}
 					{if ($product->quantity > 0 OR $product->allow_oosp)}
-						<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product->id}" href="{$link->getPageLink('cart', true, NULL, "qty=1&amp;id_product={$product->id}&amp;token={$static_token}&amp;add")}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
+						<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product->id}" href="{$link->getPageLink('cart', true, NULL, "qty=1&amp;id_product={$product->id}&amp;token={$static_token}&amp;add")|escape:'html'}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
 					{else}
 						<span class="exclusive">{l s='Add to cart'}</span>
 					{/if}
diff --git a/themes/default/scenes.tpl b/themes/default/scenes.tpl
index e8b86fefe..22a583c86 100644
--- a/themes/default/scenes.tpl
+++ b/themes/default/scenes.tpl
@@ -55,7 +55,7 @@ $(function () {ldelim}
 						{/if}
 					</div>
 					{/if}
-					<img src="{$link->getImageLink($product.id_product, $imageIds, 'medium_default')}" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
+					<img src="{$link->getImageLink($product.id_product, $imageIds, 'medium_default')|escape:'html'}" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 					<p class="title_block"><span class="product_name">{$product.details->name}</span></p>
 					<p class="description">{$product.details->description_short|strip_tags|truncate:170:'...'}</p>
 				</div>
diff --git a/themes/default/shopping-cart-product-line.tpl b/themes/default/shopping-cart-product-line.tpl
index 3d75c8ede..db2831763 100644
--- a/themes/default/shopping-cart-product-line.tpl
+++ b/themes/default/shopping-cart-product-line.tpl
@@ -25,7 +25,7 @@
 
 <tr id="product_{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}{if !empty($product.gift)}_gift{/if}" class="cart_item{if isset($productLast) && $productLast && (!isset($ignoreProductLast) || !$ignoreProductLast)} last_item{/if}{if isset($productFirst) && $productFirst} first_item{/if}{if isset($customizedDatas.$productId.$productAttributeId) AND $quantityDisplayed == 0} alternate_item{/if} address_{$product.id_address_delivery|intval} {if $odd}odd{else}even{/if}">
 	<td class="cart_product">
-		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
+		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
 	</td>
 	<td class="cart_description">
 		<p class="s_title_block"><a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}">{$product.name|escape:'htmlall':'UTF-8'}</a></p>
@@ -62,9 +62,9 @@
 			{/if}
 			{if !isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed > 0}
 				<div class="cart_quantity_button">
-				<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+				<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 				{if $product.minimal_quantity < ($product.cart_quantity-$quantityDisplayed) OR $product.minimal_quantity <= 1}
-				<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+				<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 					<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 				</a>
 				{else}
@@ -96,7 +96,7 @@
 		<td class="cart_delete">
 		{if (!isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed) > 0 && empty($product.gift)}
 			<div>
-				<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}">{l s='Delete'}</a>
+				<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{if $quantityDisplayed > 0}nocustom{else}0{/if}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}">{l s='Delete'}</a>
 			</div>
 		{/if}
 		</td>
diff --git a/themes/default/shopping-cart.tpl b/themes/default/shopping-cart.tpl
index cf3a8858a..9eb72433e 100644
--- a/themes/default/shopping-cart.tpl
+++ b/themes/default/shopping-cart.tpl
@@ -59,7 +59,7 @@
 		<div class="cart_last_product_header">
 			<div class="left">{l s='Last product added'}</div>
 		</div>
-		<a  class="cart_last_product_img" href="{$link->getProductLink($lastProductAdded.id_product, $lastProductAdded.link_rewrite, $lastProductAdded.category, null, null, $lastProductAdded.id_shop)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($lastProductAdded.link_rewrite, $lastProductAdded.id_image, 'small_default')}" alt="{$lastProductAdded.name|escape:'htmlall':'UTF-8'}"/></a>
+		<a  class="cart_last_product_img" href="{$link->getProductLink($lastProductAdded.id_product, $lastProductAdded.link_rewrite, $lastProductAdded.category, null, null, $lastProductAdded.id_shop)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($lastProductAdded.link_rewrite, $lastProductAdded.id_image, 'small_default')|escape:'html'}" alt="{$lastProductAdded.name|escape:'htmlall':'UTF-8'}"/></a>
 		<div class="cart_last_product_content">
 			<p class="s_title_block"><a href="{$link->getProductLink($lastProductAdded.id_product, $lastProductAdded.link_rewrite, $lastProductAdded.category, null, null, null, $lastProductAdded.id_product_attribute)|escape:'htmlall':'UTF-8'}">{$lastProductAdded.name|escape:'htmlall':'UTF-8'}</a></p>
 			{if isset($lastProductAdded.attributes) && $lastProductAdded.attributes}<a href="{$link->getProductLink($lastProductAdded.id_product, $lastProductAdded.link_rewrite, $lastProductAdded.category, null, null, null, $lastProductAdded.id_product_attribute)|escape:'htmlall':'UTF-8'}">{$lastProductAdded.attributes|escape:'htmlall':'UTF-8'}</a>{/if}
@@ -265,9 +265,9 @@
 								<span style="float:left">{if $quantityDisplayed == 0 AND isset($customizedDatas.$productId.$productAttributeId)}{$customizedDatas.$productId.$productAttributeId|@count}{else}{$product.cart_quantity-$quantityDisplayed}{/if}</span>
 							{else}
 								<div class="cart_quantity_button">
-								<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+								<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 								{if $product.minimal_quantity < ($customization.quantity -$quantityDisplayed) OR $product.minimal_quantity <= 1}
-								<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+								<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 									<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 								</a>
 								{else}
@@ -284,7 +284,7 @@
 							{if isset($cannotModify) AND $cannotModify == 1}
 							{else}
 								<div>
-									<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$token_cart}")}">{l s='Delete'}</a>
+									<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$token_cart}")|escape:'html'}">{l s='Delete'}</a>
 								</div>
 							{/if}
 						</td>
diff --git a/themes/default/sitemap.tpl b/themes/default/sitemap.tpl
index 0337bcb87..40fb6dd4e 100644
--- a/themes/default/sitemap.tpl
+++ b/themes/default/sitemap.tpl
@@ -31,27 +31,27 @@
 	<div class="sitemap_block">
 		<h3>{l s='Our offers'}</h3>
 		<ul>
-			<li><a href="{$link->getPageLink('new-products')}" title="{l s='View a new product'}">{l s='New products'}</a></li>
+			<li><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='View a new product'}">{l s='New products'}</a></li>
 			{if !$PS_CATALOG_MODE}
-			<li><a href="{$link->getPageLink('best-sales')}" title="{l s='View top-selling products'}">{l s='Best sellers'}</a></li>
-			<li><a href="{$link->getPageLink('prices-drop')}" title="{l s='View products with a price drop'}">{l s='Price drop'}</a></li>
+			<li><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='View top-selling products'}">{l s='Best sellers'}</a></li>
+			<li><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='View products with a price drop'}">{l s='Price drop'}</a></li>
 			{/if}
-			{if $display_manufacturer_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('manufacturer')}" title="{l s='View a list of manufacturers'}">{l s='Manufacturers:'}</a></li>{/if}
-			{if $display_supplier_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('supplier')}" title="{l s='View a list of suppliers'}">{l s='Suppliers:'}</a></li>{/if}
+			{if $display_manufacturer_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('manufacturer')|escape:'html'}" title="{l s='View a list of manufacturers'}">{l s='Manufacturers:'}</a></li>{/if}
+			{if $display_supplier_link OR $PS_DISPLAY_SUPPLIERS}<li><a href="{$link->getPageLink('supplier')|escape:'html'}" title="{l s='View a list of suppliers'}">{l s='Suppliers:'}</a></li>{/if}
 		</ul>
 	</div>
 	<div class="sitemap_block">
 		<h3>{l s='Your Account'}</h3>
 		<ul>
 		{if $logged}
-			<li><a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage your customer account'}" rel="nofollow">{l s='Your Account'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='Manage your personal information'}" rel="nofollow">{l s='Personal information'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='View a list of my addresses'}" rel="nofollow">{l s='Addresses'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='View a list of my discounts'}" rel="nofollow">{l s='Discounts'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('history', true)}" title="{l s='View a list of my orders'}" rel="nofollow">{l s='Order history'}</a></li>
+			<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage your customer account'}" rel="nofollow">{l s='Your Account'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Manage your personal information'}" rel="nofollow">{l s='Personal information'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='View a list of my addresses'}" rel="nofollow">{l s='Addresses'}</a></li>
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='View a list of my discounts'}" rel="nofollow">{l s='Discounts'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='View a list of my orders'}" rel="nofollow">{l s='Order history'}</a></li>
 		{else}
-			<li><a href="{$link->getPageLink('authentication', true)}" title="{l s='Authentication'}" rel="nofollow">{l s='Authentication'}</a></li>
-			<li><a href="{$link->getPageLink('authentication', true)}" title="{l s='Create new account'}" rel="nofollow">{l s='Create new account'}</a></li>
+			<li><a href="{$link->getPageLink('authentication', true)|escape:'html'}" title="{l s='Authentication'}" rel="nofollow">{l s='Authentication'}</a></li>
+			<li><a href="{$link->getPageLink('authentication', true)|escape:'html'}" title="{l s='Create new account'}" rel="nofollow">{l s='Create new account'}</a></li>
 		{/if}
 		{if $logged}
 			<li><a href="{$link->getPageLink('index')}?mylogout" title="{l s='Log out'}" rel="nofollow">{l s='Log out'}</a></li>
@@ -90,8 +90,8 @@
 			{foreach from=$categoriescmsTree.cms item=cms name=cmsTree}
 				<li><a href="{$cms.link|escape:'htmlall':'UTF-8'}" title="{$cms.meta_title|escape:'htmlall':'UTF-8'}">{$cms.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 			{/foreach}
-			<li><a href="{$link->getPageLink('contact', true)}" title="{l s='Contact'}">{l s='Contact'}</a></li>
-			{if $display_store}<li class="last"><a href="{$link->getPageLink('stores')}" title="{l s='List of our stores'}">{l s='Our stores'}</a></li>{/if}
+			<li><a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact'}">{l s='Contact'}</a></li>
+			{if $display_store}<li class="last"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='List of our stores'}">{l s='Our stores'}</a></li>{/if}
 		</ul>
 	</div>
 </div>

From 6222974430a0949d1901cc2af7a9bf1ebe9f8e87 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 6 Jun 2013 15:48:46 +0200
Subject: [PATCH 02/44] // W3C

---
 mails/en/download-product.tpl                      |  2 +-
 modules/blockbestsellers/blockbestsellers-home.tpl |  8 ++++----
 modules/blockbestsellers/blockbestsellers.tpl      |  4 ++--
 modules/blocknewproducts/blocknewproducts.tpl      |  6 +++---
 modules/blocktopmenu/blocktopmenu.php              | 14 +++++++-------
 modules/homefeatured/homefeatured.tpl              | 10 +++++-----
 .../blockbestsellers/blockbestsellers-home.tpl     |  8 ++++----
 .../modules/blockbestsellers/blockbestsellers.tpl  |  4 ++--
 .../modules/blocknewproducts/blocknewproducts.tpl  |  6 +++---
 .../default/modules/homefeatured/homefeatured.tpl  | 10 +++++-----
 10 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/mails/en/download-product.tpl b/mails/en/download-product.tpl
index 69dea48ba..3ad0101b8 100644
--- a/mails/en/download-product.tpl
+++ b/mails/en/download-product.tpl
@@ -1,7 +1,7 @@
 <ul>
 {foreach from=$virtualProducts item=product}
 	<li>
-		<a href="{$product.link}">{$product.name}</a>
+		<a href="{$product.link|escape:'html'}">{$product.name}</a>
 		{if isset($product.deadline)}
 			expires on {$product.deadline}
 		{/if}
diff --git a/modules/blockbestsellers/blockbestsellers-home.tpl b/modules/blockbestsellers/blockbestsellers-home.tpl
index 4999a5b4d..08d1c6818 100644
--- a/modules/blockbestsellers/blockbestsellers-home.tpl
+++ b/modules/blockbestsellers/blockbestsellers-home.tpl
@@ -36,12 +36,12 @@
 			<ul style="height:{$ulHeight}px;">
 			{foreach from=$best_sellers item=product name=myLoop}
 				<li style="border-bottom:0" class="ajax_block_product {if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 1}clear{/if} {if $smarty.foreach.myLoop.iteration > ($smarty.foreach.myLoop.total - ($smarty.foreach.myLoop.total % $nbItemsPerLine))}last_line{/if}">
-					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></h5>
-					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
+					<h5 class="s_title_block"><a href="{$product.link|escape:'html'}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></h5>
+					<div class="product_desc"><a href="{$product.link|escape:'html'}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
+					<a href="{$product.link|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
 					<div>
 						{if !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{$product.price}</span></p>{else}<div style="height:21px;"></div>{/if}			
-						<a class="button" href="{$product.link}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
+						<a class="button" href="{$product.link|escape:'html'}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
 					</div>
 				</li>
 			{/foreach}
diff --git a/modules/blockbestsellers/blockbestsellers.tpl b/modules/blockbestsellers/blockbestsellers.tpl
index 900bd441d..21f1b2176 100644
--- a/modules/blockbestsellers/blockbestsellers.tpl
+++ b/modules/blockbestsellers/blockbestsellers.tpl
@@ -32,12 +32,12 @@
 		<ul class="product_images">
 			{foreach from=$best_sellers item=product name=myLoop}
 			<li class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} clearfix">
-				<a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
+				<a href="{$product.link|escape:'html'}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
 					<span class="number">{$smarty.foreach.myLoop.iteration}</span>
 					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
 				
 				</a>
-				<p><a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
+				<p><a href="{$product.link|escape:'html'}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
 					{$product.name|strip_tags:'UTF-8'|escape:'htmlall':'UTF-8'}<br />
 					<span class="price">{$product.price}</span>
 				</a></p>
diff --git a/modules/blocknewproducts/blocknewproducts.tpl b/modules/blocknewproducts/blocknewproducts.tpl
index 3a5585657..d79ee66d5 100644
--- a/modules/blocknewproducts/blocknewproducts.tpl
+++ b/modules/blocknewproducts/blocknewproducts.tpl
@@ -31,14 +31,14 @@
 		<ul class="product_images clearfix">
 		{foreach from=$new_products item='product' name='newProducts'}
 			{if $smarty.foreach.newProducts.index < 2}
-				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
+				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link|escape:'html'}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
 			{/if}
 		{/foreach}
 		</ul>
 		<dl class="products">
 		{foreach from=$new_products item=newproduct name=myLoop}
-			<dt class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}" title="{$newproduct.name|escape:html:'UTF-8'}">{$newproduct.name|strip_tags|escape:html:'UTF-8'}</a></dt>
-			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
+			<dt class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link|escape:'html'}" title="{$newproduct.name|escape:html:'UTF-8'}">{$newproduct.name|strip_tags|escape:html:'UTF-8'}</a></dt>
+			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link|escape:'html'}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
 		{/foreach}
 		</dl>
 		<p><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
diff --git a/modules/blocktopmenu/blocktopmenu.php b/modules/blocktopmenu/blocktopmenu.php
index a21763b15..9cfd78b2d 100644
--- a/modules/blocktopmenu/blocktopmenu.php
+++ b/modules/blocktopmenu/blocktopmenu.php
@@ -528,21 +528,21 @@ class Blocktopmenu extends Module
 					$selected = ($this->page_name == 'product' && (Tools::getValue('id_product') == $id)) ? ' class="sfHover"' : '';
 					$product = new Product((int)$id, true, (int)$id_lang);
 					if (!is_null($product->id))
-						$this->_menu .= '<li'.$selected.'><a href="'.$product->getLink().'">'.$product->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($product->getLink()).'">'.$product->name.'</a></li>'.PHP_EOL;
 					break;
 
 				case 'CMS':
 					$selected = ($this->page_name == 'cms' && (Tools::getValue('id_cms') == $id)) ? ' class="sfHover"' : '';
 					$cms = CMS::getLinks((int)$id_lang, array($id));
 					if (count($cms))
-						$this->_menu .= '<li'.$selected.'><a href="'.$cms[0]['link'].'">'.$cms[0]['meta_title'].'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($cms[0]['link']).'">'.$cms[0]['meta_title'].'</a></li>'.PHP_EOL;
 					break;
 
 				case 'CMS_CAT':
 					$category = new CMSCategory((int)$id, (int)$id_lang);
 					if (count($category))
 					{
-						$this->_menu .= '<li><a href="'.$category->getLink().'">'.$category->name.'</a>';
+						$this->_menu .= '<li><a href="'.htmlentities($category->getLink()).'">'.$category->name.'</a>';
 						$this->getCMSMenuItems($category->id);
 						$this->_menu .= '</li>'.PHP_EOL;
 					}
@@ -558,7 +558,7 @@ class Blocktopmenu extends Module
 						else
 							$manufacturer->link_rewrite = 0;
 						$link = new Link;
-						$this->_menu .= '<li'.$selected.'><a href="'.$link->getManufacturerLink((int)$id, $manufacturer->link_rewrite).'">'.$manufacturer->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($link->getManufacturerLink((int)$id, $manufacturer->link_rewrite)).'">'.$manufacturer->name.'</a></li>'.PHP_EOL;
 					}
 					break;
 
@@ -568,7 +568,7 @@ class Blocktopmenu extends Module
 					if (!is_null($supplier->id))
 					{
 						$link = new Link;
-						$this->_menu .= '<li'.$selected.'><a href="'.$link->getSupplierLink((int)$id, $supplier->link_rewrite).'">'.$supplier->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($link->getSupplierLink((int)$id, $supplier->link_rewrite)).'">'.$supplier->name.'</a></li>'.PHP_EOL;
 					}
 					break;
 
@@ -578,7 +578,7 @@ class Blocktopmenu extends Module
 					if (Validate::isLoadedObject($shop))
 					{
 						$link = new Link;
-						$this->_menu .= '<li'.$selected.'><a href="'.$shop->getBaseURL().'">'.$shop->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($shop->getBaseURL()).'">'.$shop->name.'</a></li>'.PHP_EOL;
 					}
 					break;
 				case 'LNK':
@@ -590,7 +590,7 @@ class Blocktopmenu extends Module
 							$default_language = Configuration::get('PS_LANG_DEFAULT');
 							$link = MenuTopLinks::get($link[0]['id_linksmenutop'], $default_language, (int)Shop::getContextShopID());
 						}
-						$this->_menu .= '<li><a href="'.$link[0]['link'].'"'.(($link[0]['new_window']) ? ' target="_blank"': '').'>'.$link[0]['label'].'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li><a href="'.htmlentities($link[0]['link']).'"'.(($link[0]['new_window']) ? ' target="_blank"': '').'>'.$link[0]['label'].'</a></li>'.PHP_EOL;
 					}
 					break;
 			}
diff --git a/modules/homefeatured/homefeatured.tpl b/modules/homefeatured/homefeatured.tpl
index b9181b0ac..d668877a2 100644
--- a/modules/homefeatured/homefeatured.tpl
+++ b/modules/homefeatured/homefeatured.tpl
@@ -38,16 +38,16 @@
 				{math equation="(total%perLine)" total=$smarty.foreach.homeFeaturedProducts.total perLine=$nbItemsPerLine assign=totModulo}
 				{if $totModulo == 0}{assign var='totModulo' value=$nbItemsPerLine}{/if}
 				<li class="ajax_block_product {if $smarty.foreach.homeFeaturedProducts.first}first_item{elseif $smarty.foreach.homeFeaturedProducts.last}last_item{else}item{/if} {if $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 1} {/if} {if $smarty.foreach.homeFeaturedProducts.iteration > ($smarty.foreach.homeFeaturedProducts.total - $totModulo)}last_line{/if}">
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
-					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h5>
-					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
+					<a href="{$product.link|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
+					<h5 class="s_title_block"><a href="{$product.link|escape:'html'}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h5>
+					<div class="product_desc"><a href="{$product.link|escape:'html'}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
 					<div>
-						<a class="lnk_more" href="{$product.link}" title="{l s='View' mod='homefeatured'}">{l s='View' mod='homefeatured'}</a>
+						<a class="lnk_more" href="{$product.link|escape:'html'}" title="{l s='View' mod='homefeatured'}">{l s='View' mod='homefeatured'}</a>
 						{if $product.show_price AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{if !$priceDisplay}{convertPrice price=$product.price}{else}{convertPrice price=$product.price_tax_exc}{/if}</span></p>{else}<div style="height:21px;"></div>{/if}
 						
 						{if ($product.id_product_attribute == 0 OR (isset($add_prod_display) AND ($add_prod_display == 1))) AND $product.available_for_order AND !isset($restricted_country_mode) AND $product.minimal_quantity == 1 AND $product.customizable != 2 AND !$PS_CATALOG_MODE}
 							{if ($product.quantity > 0 OR $product.allow_oosp)}
-							<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product.id_product}" href="{$link->getPageLink('cart')}?qty=1&amp;id_product={$product.id_product}&amp;token={$static_token}&amp;add" title="{l s='Add to cart' mod='homefeatured'}">{l s='Add to cart' mod='homefeatured'}</a>
+							<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product.id_product}" href="{$link->getPageLink('cart')|escape:'html'}?qty=1&amp;id_product={$product.id_product}&amp;token={$static_token}&amp;add" title="{l s='Add to cart' mod='homefeatured'}">{l s='Add to cart' mod='homefeatured'}</a>
 							{else}
 							<span class="exclusive">{l s='Add to cart' mod='homefeatured'}</span>
 							{/if}
diff --git a/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl b/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl
index 8ff9cc02b..9aa6884da 100644
--- a/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl
+++ b/themes/default/modules/blockbestsellers/blockbestsellers-home.tpl
@@ -36,12 +36,12 @@
 			<ul style="height:{$ulHeight}px;">
 			{foreach from=$best_sellers item=product name=myLoop}
 				<li style="border-bottom:0" class="ajax_block_product {if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 1}clear{/if} {if $smarty.foreach.myLoop.iteration > ($smarty.foreach.myLoop.total - ($smarty.foreach.myLoop.total % $nbItemsPerLine))}last_line{/if}">
-					<p class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></p>
-					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
+					<p class="s_title_block"><a href="{$product.link|escape:'html'}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></p>
+					<div class="product_desc"><a href="{$product.link|escape:'html'}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
+					<a href="{$product.link|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
 					<div>
 						{if !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{$product.price}</span></p>{else}<div style="height:21px;"></div>{/if}			
-						<a class="button" href="{$product.link}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
+						<a class="button" href="{$product.link|escape:'html'}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
 					</div>
 				</li>
 			{/foreach}
diff --git a/themes/default/modules/blockbestsellers/blockbestsellers.tpl b/themes/default/modules/blockbestsellers/blockbestsellers.tpl
index 17bc2797f..dbc88905c 100644
--- a/themes/default/modules/blockbestsellers/blockbestsellers.tpl
+++ b/themes/default/modules/blockbestsellers/blockbestsellers.tpl
@@ -31,12 +31,12 @@
 		<ul class="product_images">
 			{foreach from=$best_sellers item=product name=myLoop}
 			<li class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} clearfix">
-				<a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
+				<a href="{$product.link|escape:'html'}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
 					<span class="number">{$smarty.foreach.myLoop.iteration}</span>
 					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
 				
 				</a>
-				<p><a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
+				<p><a href="{$product.link|escape:'html'}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
 					{$product.name|strip_tags:'UTF-8'|escape:'htmlall':'UTF-8'}<br />
 					<span class="price">{$product.price}</span>
 				</a></p>
diff --git a/themes/default/modules/blocknewproducts/blocknewproducts.tpl b/themes/default/modules/blocknewproducts/blocknewproducts.tpl
index f7db3c8a6..208e7f63f 100644
--- a/themes/default/modules/blocknewproducts/blocknewproducts.tpl
+++ b/themes/default/modules/blocknewproducts/blocknewproducts.tpl
@@ -31,14 +31,14 @@
 		<ul class="product_images clearfix">
 		{foreach from=$new_products item='product' name='newProducts'}
 			{if $smarty.foreach.newProducts.index < 2}
-				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
+				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link|escape:'html'}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
 			{/if}
 		{/foreach}
 		</ul>
 		<dl class="products">
 		{foreach from=$new_products item=newproduct name=myLoop}
-			<dt class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}" title="{$newproduct.name|escape:html:'UTF-8'}">{$newproduct.name|strip_tags|escape:html:'UTF-8'}</a></dt>
-			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
+			<dt class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link|escape:'html'}" title="{$newproduct.name|escape:html:'UTF-8'}">{$newproduct.name|strip_tags|escape:html:'UTF-8'}</a></dt>
+			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link|escape:'html'}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
 		{/foreach}
 		</dl>
 		<p><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
diff --git a/themes/default/modules/homefeatured/homefeatured.tpl b/themes/default/modules/homefeatured/homefeatured.tpl
index 38fedd873..89b472bf2 100644
--- a/themes/default/modules/homefeatured/homefeatured.tpl
+++ b/themes/default/modules/homefeatured/homefeatured.tpl
@@ -38,16 +38,16 @@
 				{math equation="(total%perLine)" total=$smarty.foreach.homeFeaturedProducts.total perLine=$nbItemsPerLine assign=totModulo}
 				{if $totModulo == 0}{assign var='totModulo' value=$nbItemsPerLine}{/if}
 				<li class="ajax_block_product {if $smarty.foreach.homeFeaturedProducts.first}first_item{elseif $smarty.foreach.homeFeaturedProducts.last}last_item{else}item{/if} {if $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 1} {/if} {if $smarty.foreach.homeFeaturedProducts.iteration > ($smarty.foreach.homeFeaturedProducts.total - $totModulo)}last_line{/if}">
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
-					<p class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></p>
-					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
+					<a href="{$product.link|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
+					<p class="s_title_block"><a href="{$product.link|escape:'html'}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></p>
+					<div class="product_desc"><a href="{$product.link|escape:'html'}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
 					<div>
-						<a class="lnk_more" href="{$product.link}" title="{l s='View' mod='homefeatured'}">{l s='View' mod='homefeatured'}</a>
+						<a class="lnk_more" href="{$product.link|escape:'html'}" title="{l s='View' mod='homefeatured'}">{l s='View' mod='homefeatured'}</a>
 						{if $product.show_price AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{if !$priceDisplay}{convertPrice price=$product.price}{else}{convertPrice price=$product.price_tax_exc}{/if}</span></p>{else}<div style="height:21px;"></div>{/if}
 						
 						{if ($product.id_product_attribute == 0 OR (isset($add_prod_display) AND ($add_prod_display == 1))) AND $product.available_for_order AND !isset($restricted_country_mode) AND $product.minimal_quantity == 1 AND $product.customizable != 2 AND !$PS_CATALOG_MODE}
 							{if ($product.quantity > 0 OR $product.allow_oosp)}
-							<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product.id_product}" href="{$link->getPageLink('cart')}?qty=1&amp;id_product={$product.id_product}&amp;token={$static_token}&amp;add" title="{l s='Add to cart' mod='homefeatured'}">{l s='Add to cart' mod='homefeatured'}</a>
+							<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product.id_product}" href="{$link->getPageLink('cart')|escape:'html'}?qty=1&amp;id_product={$product.id_product}&amp;token={$static_token}&amp;add" title="{l s='Add to cart' mod='homefeatured'}">{l s='Add to cart' mod='homefeatured'}</a>
 							{else}
 							<span class="exclusive">{l s='Add to cart' mod='homefeatured'}</span>
 							{/if}

From b51641ca49aff8ffdc18d41e0676d339939345e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Thu, 6 Jun 2013 16:59:03 +0200
Subject: [PATCH 03/44] [-] WS: Fix memory leak when getting synopsis

---
 classes/webservice/WebserviceRequest.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/classes/webservice/WebserviceRequest.php b/classes/webservice/WebserviceRequest.php
index a4f5ee6b5..f4126a194 100644
--- a/classes/webservice/WebserviceRequest.php
+++ b/classes/webservice/WebserviceRequest.php
@@ -1218,6 +1218,11 @@ class WebserviceRequestCore
 	{
 		$objects = array();
 		$filters = $this->manageFilters();
+
+		/* If we only need to display the synopsis, analyzing the first row is sufficient */
+		if (isset($this->urlFragments['schema']) && $this->urlFragments['schema'] == 'synopsis')
+			$filters = array('sql_join' => '', 'sql_filter' => '', 'sql_sort' => '', 'sql_limit' => ' LIMIT 1');
+			
 		$this->resourceConfiguration['retrieveData']['params'][] = $filters['sql_join'];
 		$this->resourceConfiguration['retrieveData']['params'][] = $filters['sql_filter'];
 		$this->resourceConfiguration['retrieveData']['params'][] = $filters['sql_sort'];

From 0e75dbdbf8a225b9b541104ebaf73d3a52455fbe Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 6 Jun 2013 18:53:35 +0200
Subject: [PATCH 04/44] [*] BO : attributes taken into account for the language
 entity in the localization packs

---
 classes/LocalizationPack.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classes/LocalizationPack.php b/classes/LocalizationPack.php
index 133ad8534..bfa03e301 100644
--- a/classes/LocalizationPack.php
+++ b/classes/LocalizationPack.php
@@ -294,7 +294,7 @@ class LocalizationPackCore
 				// if we are not in an installation context or if the pack is not available in the local directory
 				if (Language::getIdByIso($attributes['iso_code']) && !$install_mode)
 					continue;
-				$errors = Language::downloadAndInstallLanguagePack($attributes['iso_code'], $attributes['version']);
+				$errors = Language::downloadAndInstallLanguagePack($attributes['iso_code'], $attributes['version'], $attributes);
 				if ($errors !== true && is_array($errors))
 					$this->_errors = array_merge($this->_errors, $errors);
 			}

From aa41d6b762adc894423c6839c8f7ef301165b85c Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Fri, 7 Jun 2013 12:33:44 +0200
Subject: [PATCH 05/44] // No escape in JS links

---
 .../controllers/access/helpers/form/form.tpl  |  6 ++--
 .../employees/helpers/form/form.tpl           |  2 +-
 .../information/helpers/view/view.tpl         |  2 +-
 .../template/controllers/orders/form.tpl      | 30 +++++++++----------
 .../template/controllers/products/prices.tpl  |  4 +--
 .../template/controllers/shop/tree.tpl        |  2 +-
 6 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
index 3036068fd..532b87e80 100644
--- a/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
@@ -52,7 +52,7 @@
 				checked = enabled ? 'checked': '';
 				$(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').attr('checked', checked);
 				$.ajax({
-					url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
+					url: "{$link->getAdminLink('AdminAccess')|addslashes}",
 					cache: false,
 					data : {
 						ajaxMode : '1',
@@ -85,7 +85,7 @@
 			perfect_access_js_gestion(this, perm, id_tab, tabsize, tabnumber, table);
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
+				url: "{$link->getAdminLink('AdminAccess')|addslashes}",
 				cache: false,
 				data : {
 					ajaxMode : '1',
@@ -134,7 +134,7 @@
 				});
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
+				url: "{$link->getAdminLink('AdminAccess')|addslashes}",
 				cache: false,
 				data : {
 					ajaxMode: '1',
diff --git a/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl
index 38830a614..e9a05e5f1 100644
--- a/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl
@@ -60,7 +60,7 @@
 			ifSuperAdmin($(this));
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminEmployees')|escape:'html'}",
+				url: "{$link->getAdminLink('AdminEmployees')|addslashes}",
 				cache: false,
 				data : {
 					ajax : '1',
diff --git a/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl b/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl
index 91375363a..d11e4721c 100644
--- a/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl
+++ b/admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl
@@ -32,7 +32,7 @@
 		{
 			$.ajax({
 				type: 'GET',
-				url: '{$link->getAdminLink('AdminInformation')|escape:'html'}',
+				url: '{$link->getAdminLink('AdminInformation')|addslashes}',
 				data: {
 					'action': 'checkFiles',
 					'ajax': 1
diff --git a/admin-dev/themes/default/template/controllers/orders/form.tpl b/admin-dev/themes/default/template/controllers/orders/form.tpl
index 334cf4c9b..ca178d9a5 100755
--- a/admin-dev/themes/default/template/controllers/orders/form.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/form.tpl
@@ -157,7 +157,7 @@
 				free_shipping = 1;
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+				url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -217,7 +217,7 @@
 			e.preventDefault();
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+				url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -254,7 +254,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -288,7 +288,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -324,7 +324,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -351,7 +351,7 @@
 		$('#id_cart').val(id_cart);
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -378,7 +378,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -401,7 +401,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -534,7 +534,7 @@
 		$('#products_part').show();
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminOrders')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -766,7 +766,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -822,7 +822,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -845,7 +845,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -868,7 +868,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -899,7 +899,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminOrders')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -957,7 +957,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
diff --git a/admin-dev/themes/default/template/controllers/products/prices.tpl b/admin-dev/themes/default/template/controllers/products/prices.tpl
index 8ff16424f..5018acdf2 100644
--- a/admin-dev/themes/default/template/controllers/products/prices.tpl
+++ b/admin-dev/themes/default/template/controllers/products/prices.tpl
@@ -25,7 +25,7 @@
 
 <script type="text/javascript">
 var Customer = new Object();
-var product_url = '{$link->getAdminLink('AdminProducts', true)|escape:'html'}';
+var product_url = '{$link->getAdminLink('AdminProducts', true)|addslashes}';
 var ecotax_tax_excl = parseFloat({$ecotax_tax_excl});
 $(document).ready(function () {
 	Customer = {
@@ -56,7 +56,7 @@ $(document).ready(function () {
 			Customer.showLoader();
 			jQuery.ajax({
 				"type": "POST",
-				"url": "{$link->getAdminLink('AdminCustomers')|escape:'html'}",
+				"url": "{$link->getAdminLink('AdminCustomers')|addslashes}",
 				"async": true,
 				"dataType": "json",
 				"data": {
diff --git a/admin-dev/themes/default/template/controllers/shop/tree.tpl b/admin-dev/themes/default/template/controllers/shop/tree.tpl
index 50c27446f..8019d0174 100644
--- a/admin-dev/themes/default/template/controllers/shop/tree.tpl
+++ b/admin-dev/themes/default/template/controllers/shop/tree.tpl
@@ -186,7 +186,7 @@ $("#multishop-tree").jstree({
 	'plugins': ["themes","json_data","cookies","contextmenu"],
 	'json_data': {
 		'ajax': {
-			'url': "{$link->getAdminLink('AdminShop')|escape:'html'}",
+			'url': "{$link->getAdminLink('AdminShop')|addslashes}",
 			'data': function(n)
 			{
 				return {

From 1688c7b0e6db3b856767bd4a267ca2a91d9c1955 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Fri, 7 Jun 2013 15:37:38 +0200
Subject: [PATCH 06/44] [-] FO: Fix no image displayed for products in the cart
 when it was added from another store in multishop #PSCFV-9385

---
 classes/Cart.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/classes/Cart.php b/classes/Cart.php
index e10cb4834..385745061 100644
--- a/classes/Cart.php
+++ b/classes/Cart.php
@@ -631,8 +631,8 @@ class CartCore extends ObjectModel
 			{
 				$row2 = Db::getInstance()->getRow('
 					SELECT image_shop.`id_image` id_image, il.`legend`
-					FROM `'._DB_PREFIX_.'image` i'.
-					Shop::addSqlAssociation('image', 'i', false, 'image_shop.cover=1').'
+					FROM `'._DB_PREFIX_.'image` i
+					JOIN `'._DB_PREFIX_.'image_shop` image_shop ON (i.id_image = image_shop.id_image AND image_shop.cover=1 AND image_shop.id_shop='.(int)$row['id_shop'].')
 					LEFT JOIN `'._DB_PREFIX_.'image_lang` il ON (image_shop.`id_image` = il.`id_image` AND il.`id_lang` = '.(int)$this->id_lang.')
 					WHERE i.`id_product` = '.(int)$row['id_product'].' AND image_shop.`cover` = 1'
 				);

From 26608cea482dd18d08108239660650f8f6bd65c9 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Fri, 7 Jun 2013 15:52:27 +0200
Subject: [PATCH 07/44] [-] MO : Fixed double creation of vouchers in loyalty
 and some redirections #PNM-1317

---
 modules/loyalty/LoyaltyModule.php             | 13 ++--
 modules/loyalty/controllers/front/default.php |  7 +-
 modules/loyalty/loyalty-program.php           |  5 +-
 modules/loyalty/loyalty.php                   | 67 ++++++++++---------
 4 files changed, 49 insertions(+), 43 deletions(-)

diff --git a/modules/loyalty/LoyaltyModule.php b/modules/loyalty/LoyaltyModule.php
index 6f43551cb..5d8ef5c9a 100644
--- a/modules/loyalty/LoyaltyModule.php
+++ b/modules/loyalty/LoyaltyModule.php
@@ -197,20 +197,23 @@ class LoyaltyModule extends ObjectModel
 		if (!Validate::isLoadedObject($cartRule))
 			die(Tools::displayError('Incorrect object CartRule.'));
 		$items = self::getAllByIdCustomer((int)$cartRule->id_customer, NULL, true);
+		$associated = false;
 		foreach ($items AS $item)
 		{
-			$f = new LoyaltyModule((int)$item['id_loyalty']);
+			$lm = new LoyaltyModule((int)$item['id_loyalty']);
 			
 			/* Check for negative points for this order */
 			$negativePoints = (int)Db::getInstance()->getValue('SELECT SUM(points) points FROM '._DB_PREFIX_.'loyalty WHERE id_order = '.(int)$f->id_order.' AND id_loyalty_state = '.(int)LoyaltyStateModule::getCancelId().' AND points < 0');
 			
-			if ($f->points + $negativePoints <= 0)
+			if ($lm->points + $negativePoints <= 0)
 				continue;
 			
-			$f->id_cart_rule = (int)$cartRule->id;
-			$f->id_loyalty_state = (int)LoyaltyStateModule::getConvertId();
-			$f->save();
+			$lm->id_cart_rule = (int)$cartRule->id;
+			$lm->id_loyalty_state = (int)LoyaltyStateModule::getConvertId();
+			$lm->save();
+			$associated = true;
 		}
+		return $associated;
 	}
 
 	public static function getOrdersByIdDiscount($id_cart_rule)
diff --git a/modules/loyalty/controllers/front/default.php b/modules/loyalty/controllers/front/default.php
index 6f926fadb..9195706c4 100644
--- a/modules/loyalty/controllers/front/default.php
+++ b/modules/loyalty/controllers/front/default.php
@@ -112,10 +112,11 @@ class LoyaltyDefaultModuleFrontController extends ModuleFrontController
 				$cart_rule->add();
 
 			// Register order(s) which contributed to create this voucher
-			LoyaltyModule::registerDiscount($cart_rule);
-
-			Tools::redirect($this->context->link->getModuleLink('loyalty', 'default', array('process' => 'summary')));
+			if (!LoyaltyModule::registerDiscount($cart_rule))
+				$cart_rule->delete();
 		}
+
+		Tools::redirect($this->context->link->getModuleLink('loyalty', 'default', array('process' => 'summary')));
 	}
 
 	/**
diff --git a/modules/loyalty/loyalty-program.php b/modules/loyalty/loyalty-program.php
index 3843add03..08ff17756 100644
--- a/modules/loyalty/loyalty-program.php
+++ b/modules/loyalty/loyalty-program.php
@@ -42,7 +42,7 @@ if (!$context->customer->isLogged())
 
 $context->controller->addJqueryPlugin(array('dimensions', 'cluetip'));
 
-$customerPoints = (int)(LoyaltyModule::getPointsByCustomer((int)($cookie->id_customer)));
+$customerPoints = (int)LoyaltyModule::getPointsByCustomer((int)$cookie->id_customer);
 
 /* transform point into voucher if needed */
 if (Tools::getValue('transform-points') == 'true' AND $customerPoints > 0)
@@ -99,7 +99,8 @@ if (Tools::getValue('transform-points') == 'true' AND $customerPoints > 0)
 		$cartRule->add();
 
 	/* Register order(s) which contributed to create this voucher */
-	LoyaltyModule::registerDiscount($cartRule);
+	if (!LoyaltyModule::registerDiscount($cartRule))
+		$cartRule->delete();
 
 	Tools::redirect('modules/loyalty/loyalty-program.php');
 }
diff --git a/modules/loyalty/loyalty.php b/modules/loyalty/loyalty.php
index 8d63cf678..fc562a5f9 100644
--- a/modules/loyalty/loyalty.php
+++ b/modules/loyalty/loyalty.php
@@ -36,6 +36,8 @@ if (!defined('_PS_VERSION_'))
 	
 class Loyalty extends Module
 {
+	protected $html = '';
+	
 	public function __construct()
 	{
 		$this->name = 'loyalty';
@@ -219,16 +221,15 @@ class Loyalty extends Module
 					$this->loyaltyStateNoneAward->name[$id_lang_default] = ' ';
 				$this->loyaltyStateNoneAward->save();
 
-				echo $this->displayConfirmation($this->l('Settings updated.'));
+				$this->html .= $this->displayConfirmation($this->l('Settings updated.'));
 			}
 			else
 			{
 				$errors = '';
 				foreach ($this->_errors as $error)
 					$errors .= $error.'<br />';
-				echo $this->displayError($errors);
+				$this->html .= $this->displayError($errors);
 			}
-//            redirect($this->context->link);
 		}
 	}
 
@@ -252,7 +253,7 @@ class Loyalty extends Module
 		$languages = Language::getLanguages(false);
 		$languageIds = 'voucher_details¤default_loyalty_state¤none_award_loyalty_state¤convert_loyalty_state¤validation_loyalty_state¤cancel_loyalty_state';
 
-		$html = '
+		$this->html .= '
 		<script type="text/javascript">
 			id_language = Number('.$id_lang_default.');
 		</script>
@@ -274,12 +275,12 @@ class Loyalty extends Module
 				<label>'.$this->l('Voucher details').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="voucher_details_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="voucher_details_'.$language['id_lang'].'" value="'.Configuration::get('PS_LOYALTY_VOUCHER_DETAILS', (int)($language['id_lang'])).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'voucher_details', true);
-		$html .= '	</div>
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'voucher_details', true);
+		$this->html .= '	</div>
 				<div class="clear" style="margin-top: 20px"></div>
 				<label>'.$this->l('Minimum amount in which the voucher can be used').'</label>
 				<div class="margin-form">
@@ -299,12 +300,12 @@ class Loyalty extends Module
 					<select id="id_order_state_validation" name="id_order_state_validation">';
 		foreach ($order_states as $order_state)
 		{
-			$html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
+			$this->html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
 			if ((int)$this->loyaltyStateValidation->id_order_state == $order_state['id_order_state'])
-				$html .= ' selected="selected"';
-			$html .= '>'.$order_state['name'].'</option>';
+				$this->html .= ' selected="selected"';
+			$this->html .= '>'.$order_state['name'].'</option>';
 		}
-		$html .= '</select>
+		$this->html .= '</select>
 				</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Points are cancelled when the order is').'</label>
@@ -312,12 +313,12 @@ class Loyalty extends Module
 					<select id="id_order_state_cancel" name="id_order_state_cancel">';
 		foreach ($order_states as $order_state)
 		{
-			$html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
+			$this->html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
 			if ((int)$this->loyaltyStateCancel->id_order_state == $order_state['id_order_state'])
-				$html .= ' selected="selected"';
-			$html .= '>'.$order_state['name'].'</option>';
+				$this->html .= ' selected="selected"';
+			$this->html .= '>'.$order_state['name'].'</option>';
 		}
-		$html .= '</select>
+		$this->html .= '</select>
 				</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Vouchers created by the loyalty system can be used in the following categories :').'</label>';
@@ -325,67 +326,67 @@ class Loyalty extends Module
 		$indexedCategories = isset($_POST['categoryBox']) ? $_POST['categoryBox'] : $index;
 
 		$helper = new Helper();
-		$html .= '<div class="margin-form">'.$helper->renderCategoryTree(null, $indexedCategories).'</div>';
-		$html .= '
+		$this->html .= '<div class="margin-form">'.$helper->renderCategoryTree(null, $indexedCategories).'</div>';
+		$this->html .= '
 				<p style="padding-left:200px;">'.$this->l('Mark the box(es) of categories in which loyalty vouchers are usable.').'</p>
 				<div class="clear"></div>
 				<h3 style="margin-top:20px">'.$this->l('Loyalty points progression').'</h3>
 				<label>'.$this->l('Initial').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="default_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="default_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateDefault->name[(int)($language['id_lang'])]) ? $this->loyaltyStateDefault->name[(int)($language['id_lang'])] : $this->loyaltyStateDefault->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'default_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'default_loyalty_state', true);
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Unavailable').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="none_award_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="none_award_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateNoneAward->name[(int)($language['id_lang'])]) ? $this->loyaltyStateNoneAward->name[(int)($language['id_lang'])] : $this->loyaltyStateNoneAward->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'none_award_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'none_award_loyalty_state', true);
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Converted').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="convert_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="convert_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateConvert->name[(int)($language['id_lang'])]) ? $this->loyaltyStateConvert->name[(int)($language['id_lang'])] : $this->loyaltyStateConvert->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'convert_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'convert_loyalty_state', true);
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Validation').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="validation_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="validation_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateValidation->name[(int)($language['id_lang'])]) ? $this->loyaltyStateValidation->name[(int)($language['id_lang'])] : $this->loyaltyStateValidation->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'validation_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'validation_loyalty_state', true);
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Cancelled').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="cancel_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="cancel_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateCancel->name[(int)($language['id_lang'])]) ? $this->loyaltyStateCancel->name[(int)($language['id_lang'])] : $this->loyaltyStateCancel->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'cancel_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'cancel_loyalty_state', true);
+		$this->html .= '	</div>
 				<div class="clear center">
 					<input type="submit" style="margin-top:20px" name="submitLoyalty" id="submitLoyalty" value="'.$this->l('   Save   ').'" class="button" />
 				</div>
 			</fieldset>
 		</form>';
 
-		return $html;
+		return $this->html;
 	}
 
 	public static function recurseCategoryForInclude($id_obj, $indexedCategories, $categories, $current, $id_category = 1, $id_category_default = null, $has_suite = array())

From 90530a10f45507a4c011cc0edb4d7559c1737ddc Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Fri, 7 Jun 2013 16:01:43 +0200
Subject: [PATCH 08/44] [-] MO : loyalty small smarty fix #PNM-1305

---
 modules/loyalty/views/templates/front/loyalty.tpl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/loyalty/views/templates/front/loyalty.tpl b/modules/loyalty/views/templates/front/loyalty.tpl
index 7d8be9a88..f7c2862d5 100644
--- a/modules/loyalty/views/templates/front/loyalty.tpl
+++ b/modules/loyalty/views/templates/front/loyalty.tpl
@@ -167,9 +167,9 @@
 				<td class="history_method">
 					<a href="{$smarty.server.SCRIPT_NAME|escape:'htmlall':'UTF-8'}" onclick="return false" class="tips" title="
 					{l s='Generated by these following orders' mod='loyalty'}|{foreach from=$discount->orders item=myorder name=myLoop}
-					{l s='Order #%d' sprintf=$myorder.id_order mod='loyalty'}
+					{$myorder.id_order|string_format:{l s='Order #%d' mod='loyalty'}}
 					({displayPrice price=$myorder.total_paid currency=$myorder.id_currency}) :
-					{if $myorder.points > 0}{l s='%d points.' sprintf=$myorder.points mod='loyalty'}{else}{l s='Cancelled' mod='loyalty'}{/if}
+					{if $myorder.points > 0}{$myorder.points|string_format:{l s='%d points.' mod='loyalty'}}{else}{l s='Cancelled' mod='loyalty'}{/if}
 					{if !$smarty.foreach.myLoop.last}|{/if}{/foreach}" rel="nofollow">{l s='more...' mod='loyalty'}</a></td>
 			</tr>
 		{/foreach}

From 06af6bdfb5ec9d7bd64229ef65241d84c243bdd5 Mon Sep 17 00:00:00 2001
From: sLorenzini <sarah.lorenzini@prestashop.com>
Date: Fri, 7 Jun 2013 16:30:45 +0200
Subject: [PATCH 09/44] [-] FO: some W3C errors corrected

---
 modules/blockcart/blockcart.tpl               | 28 +++++++++----------
 modules/blocktopmenu/blocktopmenu.php         |  2 +-
 .../default/modules/blockcart/blockcart.tpl   | 10 +++----
 3 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/modules/blockcart/blockcart.tpl b/modules/blockcart/blockcart.tpl
index 005bef587..81a08943e 100644
--- a/modules/blockcart/blockcart.tpl
+++ b/modules/blockcart/blockcart.tpl
@@ -118,22 +118,20 @@ var generated_date = {$smarty.now|intval};
 	{/if}
 		<p {if $products}class="hidden"{/if} id="cart_block_no_products">{l s='No products' mod='blockcart'}</p>
 		<table id="vouchers"{if $discounts|@count == 0} style="display:none;"{/if}>
-			<tbody>
-					{foreach from=$discounts item=discount}
-						{if $discount.value_real > 0}
-						<tr class="bloc_cart_voucher" id="bloc_cart_voucher_{$discount.id_discount}">
-							<td class="quantity">1x</td>
-							<td class="name" title="{$discount.description}">{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|escape:'htmlall':'UTF-8'}</td>
-							<td class="price">-{if $priceDisplay == 1}{convertPrice price=$discount.value_tax_exc}{else}{convertPrice price=$discount.value_real}{/if}</td>
-							<td class="delete">
-								{if strlen($discount.code)}
-									<a class="delete_voucher" href="{$link->getPageLink('$order_process', true)}?deleteDiscount={$discount.id_discount}" title="{l s='Delete' mod='blockcart'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete' mod='blockcart'}" class="icon" /></a>
-								{/if}
-							</td>
-						</tr>
+			{foreach from=$discounts item=discount}
+				{if $discount.value_real > 0}
+				<tr class="bloc_cart_voucher" id="bloc_cart_voucher_{$discount.id_discount}">
+					<td class="quantity">1x</td>
+					<td class="name" title="{$discount.description}">{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|escape:'htmlall':'UTF-8'}</td>
+					<td class="price">-{if $priceDisplay == 1}{convertPrice price=$discount.value_tax_exc}{else}{convertPrice price=$discount.value_real}{/if}</td>
+					<td class="delete">
+						{if strlen($discount.code)}
+							<a class="delete_voucher" href="{$link->getPageLink('$order_process', true)}?deleteDiscount={$discount.id_discount}" title="{l s='Delete' mod='blockcart'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete' mod='blockcart'}" class="icon" /></a>
 						{/if}
-					{/foreach}					
-			</tbody>
+					</td>
+				</tr>
+				{/if}
+			{/foreach}					
 		</table>
 		<p id="cart-prices">
 			<span id="cart_block_shipping_cost" class="price ajax_cart_shipping_cost">{$shipping_cost}</span>
diff --git a/modules/blocktopmenu/blocktopmenu.php b/modules/blocktopmenu/blocktopmenu.php
index 9cfd78b2d..eeecaf4d4 100644
--- a/modules/blocktopmenu/blocktopmenu.php
+++ b/modules/blocktopmenu/blocktopmenu.php
@@ -642,7 +642,7 @@ class Blocktopmenu extends Module
 		if (!empty($is_intersected))
 		{
 			$this->_menu .= '<li '.$selected.'>';
-			$this->_menu .= '<a href="'.$category_link.'">'.$category->name.'</a>';
+			$this->_menu .= '<a href="'.htmlentities($category_link).'">'.$category->name.'</a>';
 
 			if (count($children))
 			{
diff --git a/themes/default/modules/blockcart/blockcart.tpl b/themes/default/modules/blockcart/blockcart.tpl
index 9a6c574d3..0e0594955 100644
--- a/themes/default/modules/blockcart/blockcart.tpl
+++ b/themes/default/modules/blockcart/blockcart.tpl
@@ -118,9 +118,8 @@ var generated_date = {$smarty.now|intval};
 	{/if}
 		<p class="cart_block_no_products{if $products} hidden{/if}" id="cart_block_no_products">{l s='No products' mod='blockcart'}</p>
 		<table id="vouchers"{if $discounts|@count == 0} style="display:none;"{/if}>
-			<tbody>
-{foreach from=$discounts item=discount}
-{if $discount.value_real > 0}
+			{foreach from=$discounts item=discount}
+				{if $discount.value_real > 0}
 				<tr class="bloc_cart_voucher" id="bloc_cart_voucher_{$discount.id_discount}">
 					<td class="quantity">1x</td>
 					<td class="name" title="{$discount.description}">{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|escape:'htmlall':'UTF-8'}</td>
@@ -131,9 +130,8 @@ var generated_date = {$smarty.now|intval};
 						{/if}
 					</td>
 				</tr>
-{/if}
-{/foreach}
-			</tbody>
+				{/if}
+			{/foreach}
 		</table>		
 		<p id="cart-prices">
 			<span id="cart_block_shipping_cost" class="price ajax_cart_shipping_cost">{$shipping_cost}</span>

From 35d9d9d979410775b381bcefdd48490b3ab08490 Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Fri, 7 Jun 2013 16:40:37 +0200
Subject: [PATCH 10/44] [-] CORE : fixed bug #PSCFV-9121 - virtual product does
 not have link after upgrade

---
 install-dev/upgrade/sql/1.5.5.0.sql | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/install-dev/upgrade/sql/1.5.5.0.sql b/install-dev/upgrade/sql/1.5.5.0.sql
index e43bee7e7..c0d8d4632 100644
--- a/install-dev/upgrade/sql/1.5.5.0.sql
+++ b/install-dev/upgrade/sql/1.5.5.0.sql
@@ -14,3 +14,6 @@ CHANGE `module_name` `module_name` VARCHAR(64) NULL DEFAULT NULL;
 /* PHP:add_module_to_hook(blocksupplier, actionObjectSupplierDeleteAfter); */;
 /* PHP:add_module_to_hook(blocksupplier, actionObjectSupplierAddAfter); */;
 /* PHP:add_module_to_hook(blocksupplier, actionObjectSupplierUpdateAfter); */;
+/* PHP:fix_download_product_feature_active(); */;
+
+

From 3d614ca8ea8d267f04ac3d6a9b820d8314600699 Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Fri, 7 Jun 2013 16:41:33 +0200
Subject: [PATCH 11/44] [-] CORE : fixed bug #PSCFV-9121 - virtual product does
 not have link after upgrade - part 2

---
 .../fix_download_product_feature_active.php   | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 install-dev/upgrade/php/fix_download_product_feature_active.php

diff --git a/install-dev/upgrade/php/fix_download_product_feature_active.php b/install-dev/upgrade/php/fix_download_product_feature_active.php
new file mode 100644
index 000000000..354b3e5f5
--- /dev/null
+++ b/install-dev/upgrade/php/fix_download_product_feature_active.php
@@ -0,0 +1,31 @@
+<?php
+/*
+* 2007-2013 PrestaShop
+*
+* NOTICE OF LICENSE
+*
+* This source file is subject to the Open Software License (OSL 3.0)
+* that is bundled with this package in the file LICENSE.txt.
+* It is also available through the world-wide-web at this URL:
+* http://opensource.org/licenses/osl-3.0.php
+* If you did not receive a copy of the license and are unable to
+* obtain it through the world-wide-web, please send an email
+* to license@prestashop.com so we can send you a copy immediately.
+*
+* DISCLAIMER
+*
+* Do not edit or add to this file if you wish to upgrade PrestaShop to newer
+* versions in the future. If you wish to customize PrestaShop for your
+* needs please refer to http://www.prestashop.com for more information.
+*
+*  @author PrestaShop SA <contact@prestashop.com>
+*  @copyright  2007-2013 PrestaShop SA
+*  @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+*  International Registered Trademark & Property of PrestaShop SA
+*/
+
+function fix_download_product_feature_active()
+{
+	if (Db::getInstance()->getValue('SELECT COUNT(id_product_download) FROM `'._DB_PREFIX_.'product_download` WHERE `active` = 1 ;') > 0)
+		Configuration::updateGlobaleValue('PS_VIRTUAL_PROD_FEATURE_ACTIVE');
+}
\ No newline at end of file

From b5748e8a4653f206049f47a755d8ffc1849c59a8 Mon Sep 17 00:00:00 2001
From: sLorenzini <sarah.lorenzini@prestashop.com>
Date: Fri, 7 Jun 2013 17:48:48 +0200
Subject: [PATCH 12/44] [-] FO: solved some W3C errors

---
 modules/blockcms/blockcms.tpl                               | 6 +++---
 .../views/templates/hook/blocknewsletter.tpl                | 4 ++--
 modules/blockviewed/blockviewed.tpl                         | 6 +++---
 themes/default/modules/blockcms/blockcms.tpl                | 6 +++---
 themes/default/modules/blocknewsletter/blocknewsletter.tpl  | 4 ++--
 themes/default/modules/blocksocial/blockspecials.tpl        | 4 ++--
 themes/default/modules/blockspecials/blockspecials.tpl      | 4 ++--
 themes/default/modules/blockviewed/blockviewed.tpl          | 6 +++---
 8 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/modules/blockcms/blockcms.tpl b/modules/blockcms/blockcms.tpl
index 6d0484c9d..d57171955 100755
--- a/modules/blockcms/blockcms.tpl
+++ b/modules/blockcms/blockcms.tpl
@@ -27,15 +27,15 @@
 	<!-- Block CMS module -->
 	{foreach from=$cms_titles key=cms_key item=cms_title}
 		<div id="informations_block_left_{$cms_key}" class="block informations_block_left">
-			<h4 class="title_block"><a href="{$cms_title.category_link}">{if !empty($cms_title.name)}{$cms_title.name}{else}{$cms_title.category_name}{/if}</a></h4>
+			<h4 class="title_block"><a href="{$cms_title.category_link|escape:'html'}">{if !empty($cms_title.name)}{$cms_title.name}{else}{$cms_title.category_name}{/if}</a></h4>
 			<ul class="block_content">
 				{foreach from=$cms_title.categories item=cms_page}
 					{if isset($cms_page.link)}<li class="bullet"><b style="margin-left:2em;">
-					<a href="{$cms_page.link}" title="{$cms_page.name|escape:html:'UTF-8'}">{$cms_page.name|escape:html:'UTF-8'}</a>
+					<a href="{$cms_page.link|escape:'html'}" title="{$cms_page.name|escape:html:'UTF-8'}">{$cms_page.name|escape:html:'UTF-8'}</a>
 					</b></li>{/if}
 				{/foreach}
 				{foreach from=$cms_title.cms item=cms_page}
-					{if isset($cms_page.link)}<li><a href="{$cms_page.link}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
+					{if isset($cms_page.link)}<li><a href="{$cms_page.link|escape:'html'}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
 				{/foreach}
 				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
 			</ul>
diff --git a/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl b/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl
index 7da7eca1d..916de1abd 100644
--- a/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl
+++ b/modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl
@@ -33,7 +33,7 @@
 	{/if}
 		<form action="{$link->getPageLink('index')|escape:'html'}" method="post">
 			<p>
-				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}">
+				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}" />
 				<input type="submit" value="ok" class="button_mini" name="submitNewsletter" />
 				<input type="hidden" name="action" value="0" />
 			</p>
@@ -42,7 +42,7 @@
 </div>
 <!-- /Block Newsletter module-->
 
-<script>
+<script type="text/javascript">
     var placeholder = "{l s='your e-mail' mod='blocknewsletter' js=1}";
     {literal}
         $(document).ready(function() {
diff --git a/modules/blockviewed/blockviewed.tpl b/modules/blockviewed/blockviewed.tpl
index 6b01a3967..7ab288c0a 100644
--- a/modules/blockviewed/blockviewed.tpl
+++ b/modules/blockviewed/blockviewed.tpl
@@ -30,12 +30,12 @@
 		<ul class="products clearfix">
 			{foreach from=$productsViewedObj item=viewedProduct name=myLoop}
 				<li class="clearfix{if $smarty.foreach.myLoop.last} last_item{elseif $smarty.foreach.myLoop.first} first_item{else} item{/if}">
-					<a href="{$viewedProduct->product_link}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}" class="content_img">
+					<a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}" class="content_img">
 					<img src="{if isset($viewedProduct->id_image) && $viewedProduct->id_image}{$link->getImageLink($viewedProduct->link_rewrite, $viewedProduct->cover, 'medium_default')}{else}{$img_prod_dir}{$lang_iso}-default-medium_default.jpg{/if}" alt="{$viewedProduct->legend|escape:html:'UTF-8'}" />
 					</a>
 					<div class="text_desc">
-						<h5 class="s_title_block"><a href="{$viewedProduct->product_link}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->name|truncate:14:'...'|escape:html:'UTF-8'}</a></h5>
-						<p><a href="{$viewedProduct->product_link}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->description_short|strip_tags:'UTF-8'|truncate:44}</a></p>
+						<h5 class="s_title_block"><a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->name|truncate:14:'...'|escape:html:'UTF-8'}</a></h5>
+						<p><a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->description_short|strip_tags:'UTF-8'|truncate:44}</a></p>
 					</div>
 				</li>
 			{/foreach}
diff --git a/themes/default/modules/blockcms/blockcms.tpl b/themes/default/modules/blockcms/blockcms.tpl
index 5ae5d7f6c..0f798e729 100644
--- a/themes/default/modules/blockcms/blockcms.tpl
+++ b/themes/default/modules/blockcms/blockcms.tpl
@@ -27,15 +27,15 @@
 	<!-- Block CMS module -->
 	{foreach from=$cms_titles key=cms_key item=cms_title}
 		<div id="informations_block_left_{$cms_key}" class="block informations_block_left">
-			<p class="title_block"><a href="{$cms_title.category_link}">{if !empty($cms_title.name)}{$cms_title.name}{else}{$cms_title.category_name}{/if}</a></p>
+			<p class="title_block"><a href="{$cms_title.category_link|escape:'html'}">{if !empty($cms_title.name)}{$cms_title.name}{else}{$cms_title.category_name}{/if}</a></p>
 			<ul class="block_content">
 				{foreach from=$cms_title.categories item=cms_page}
 					{if isset($cms_page.link)}<li class="bullet"><b style="margin-left:2em;">
-					<a href="{$cms_page.link}" title="{$cms_page.name|escape:html:'UTF-8'}">{$cms_page.name|escape:html:'UTF-8'}</a>
+					<a href="{$cms_page.link|escape:'html'}" title="{$cms_page.name|escape:html:'UTF-8'}">{$cms_page.name|escape:html:'UTF-8'}</a>
 					</b></li>{/if}
 				{/foreach}
 				{foreach from=$cms_title.cms item=cms_page}
-					{if isset($cms_page.link)}<li><a href="{$cms_page.link}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
+					{if isset($cms_page.link)}<li><a href="{$cms_page.link|escape:'html'}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
 				{/foreach}
 				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
 			</ul>
diff --git a/themes/default/modules/blocknewsletter/blocknewsletter.tpl b/themes/default/modules/blocknewsletter/blocknewsletter.tpl
index 28d05af91..af2b41bc4 100644
--- a/themes/default/modules/blocknewsletter/blocknewsletter.tpl
+++ b/themes/default/modules/blocknewsletter/blocknewsletter.tpl
@@ -33,7 +33,7 @@
 	{/if}
 		<form action="{$link->getPageLink('index')|escape:'html'}" method="post">
 			<p>
-				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}">
+				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}" />
 				<input type="submit" value="ok" class="button_mini" name="submitNewsletter" />
 				<input type="hidden" name="action" value="0" />
 			</p>
@@ -42,7 +42,7 @@
 </div>
 <!-- /Block Newsletter module-->
 
-<script>
+<script type="text/javascript">
     var placeholder = "{l s='your e-mail' mod='blocknewsletter' js=1}";
     {literal}
         $(document).ready(function() {
diff --git a/themes/default/modules/blocksocial/blockspecials.tpl b/themes/default/modules/blocksocial/blockspecials.tpl
index da8f71037..b2ba35a35 100644
--- a/themes/default/modules/blocksocial/blockspecials.tpl
+++ b/themes/default/modules/blocksocial/blockspecials.tpl
@@ -31,7 +31,7 @@
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link|escape:'html'}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -43,7 +43,7 @@
 					{/if}
 				{/if}
 
-					<p class="s_title_block"><a href="{$special.link}" title="{$special.name|escape:html:'UTF-8'}">{$special.name|escape:html:'UTF-8'}</a></p>
+					<p class="s_title_block"><a href="{$special.link|escape:'html'}" title="{$special.name|escape:html:'UTF-8'}">{$special.name|escape:html:'UTF-8'}</a></p>
 				{if !$PS_CATALOG_MODE}
 					<span class="price-discount">{if !$priceDisplay}{displayWtPrice p=$special.price_without_reduction}{else}{displayWtPrice p=$priceWithoutReduction_tax_excl}{/if}</span>
 					<span class="price">{if !$priceDisplay}{displayWtPrice p=$special.price}{else}{displayWtPrice p=$special.price_tax_exc}{/if}</span>
diff --git a/themes/default/modules/blockspecials/blockspecials.tpl b/themes/default/modules/blockspecials/blockspecials.tpl
index da8f71037..b2ba35a35 100644
--- a/themes/default/modules/blockspecials/blockspecials.tpl
+++ b/themes/default/modules/blockspecials/blockspecials.tpl
@@ -31,7 +31,7 @@
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link|escape:'html'}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -43,7 +43,7 @@
 					{/if}
 				{/if}
 
-					<p class="s_title_block"><a href="{$special.link}" title="{$special.name|escape:html:'UTF-8'}">{$special.name|escape:html:'UTF-8'}</a></p>
+					<p class="s_title_block"><a href="{$special.link|escape:'html'}" title="{$special.name|escape:html:'UTF-8'}">{$special.name|escape:html:'UTF-8'}</a></p>
 				{if !$PS_CATALOG_MODE}
 					<span class="price-discount">{if !$priceDisplay}{displayWtPrice p=$special.price_without_reduction}{else}{displayWtPrice p=$priceWithoutReduction_tax_excl}{/if}</span>
 					<span class="price">{if !$priceDisplay}{displayWtPrice p=$special.price}{else}{displayWtPrice p=$special.price_tax_exc}{/if}</span>
diff --git a/themes/default/modules/blockviewed/blockviewed.tpl b/themes/default/modules/blockviewed/blockviewed.tpl
index fe6218862..43f60e45a 100644
--- a/themes/default/modules/blockviewed/blockviewed.tpl
+++ b/themes/default/modules/blockviewed/blockviewed.tpl
@@ -30,12 +30,12 @@
 		<ul class="products clearfix">
 			{foreach from=$productsViewedObj item=viewedProduct name=myLoop}
 				<li class="clearfix{if $smarty.foreach.myLoop.last} last_item{elseif $smarty.foreach.myLoop.first} first_item{else} item{/if}">
-					<a href="{$viewedProduct->product_link}" title="{l s='More about' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}" class="content_img">
+					<a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='More about' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}" class="content_img">
 					<img src="{if isset($viewedProduct->id_image) && $viewedProduct->id_image}{$link->getImageLink($viewedProduct->link_rewrite, $viewedProduct->cover, 'medium_default')}{else}{$img_prod_dir}{$lang_iso}-default-medium_default.jpg{/if}" alt="{$viewedProduct->legend|escape:html:'UTF-8'}" />
 					</a>
 					<div class="text_desc">
-						<p class="s_title_block"><a href="{$viewedProduct->product_link}" title="{l s='More about' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->name|truncate:14:'...'|escape:html:'UTF-8'}</a></p>
-						<p><a href="{$viewedProduct->product_link}" title="{l s='More about' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->description_short|strip_tags:'UTF-8'|truncate:44}</a></p>
+						<p class="s_title_block"><a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='More about' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->name|truncate:14:'...'|escape:html:'UTF-8'}</a></p>
+						<p><a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='More about' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->description_short|strip_tags:'UTF-8'|truncate:44}</a></p>
 					</div>
 				</li>
 			{/foreach}

From d441725ccd79e8a1ba253d97af72c634eed41278 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Fri, 7 Jun 2013 18:01:53 +0200
Subject: [PATCH 13/44] // Small improvement on pscleaner

---
 modules/pscleaner/pscleaner.php | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/modules/pscleaner/pscleaner.php b/modules/pscleaner/pscleaner.php
index b3ccae0f0..969c196f3 100644
--- a/modules/pscleaner/pscleaner.php
+++ b/modules/pscleaner/pscleaner.php
@@ -49,7 +49,7 @@ class PSCleaner extends Module
 	{
 		$html = '<h2>'.$this->l('Be really careful with this tool - There is no possible rollback!').'</h2>';
 		if (Tools::isSubmit('submitCheckAndFix'))
-			$html .= (count($logs = self::checkAndFix()) ? print_r($logs, true) : $this->l('Nothing that need to be cleaned')).'<br /><br />';
+			$html .= $this->displayConfirmation((count($logs = self::checkAndFix()) ? '<pre>'.print_r($logs, true).'</pre>' : $this->l('Nothing that need to be cleaned')).'<br /><br />');
 		if (Tools::isSubmit('submitTruncateCatalog'))
 		{
 			self::truncate('catalog');
@@ -291,7 +291,7 @@ class PSCleaner extends Module
 		}
 
 		// _lang table cleaning
-		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'._DB_PREFIX_.'%_\\_lang"');
+		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'.preg_replace('/([%_])/', '\\$1', _DB_PREFIX_).'%_\\_lang"');
 		foreach ($tables as $table)
 		{
 			$table_lang = current($table);
@@ -310,7 +310,7 @@ class PSCleaner extends Module
 		}
 		
 		// _shop table cleaning
-		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'._DB_PREFIX_.'%_\\_shop"');
+		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'.preg_replace('/([%_])/', '\\$1', _DB_PREFIX_).'%_\\_shop"');
 		foreach ($tables as $table)
 		{
 			$table_shop = current($table);
@@ -348,9 +348,9 @@ class PSCleaner extends Module
 			case 'catalog':
 				$id_home = Configuration::get('PS_HOME_CATEGORY');
 				$id_root = Configuration::get('PS_ROOT_CATEGORY');
-				Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'category` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
-				Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'category_lang` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
-				Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'category_shop` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
+				$db->execute('DELETE FROM `'._DB_PREFIX_.'category` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
+				$db->execute('DELETE FROM `'._DB_PREFIX_.'category_lang` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
+				$db->execute('DELETE FROM `'._DB_PREFIX_.'category_shop` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
 				foreach (scandir(_PS_CAT_IMG_DIR_) as $dir)
 					if (preg_match('/^[0-9]+(\-(.*))?\.jpg$/', $dir))
 						unlink(_PS_CAT_IMG_DIR_.$dir);
@@ -494,9 +494,10 @@ class PSCleaner extends Module
 		$this->clearAllCaches();
 	}
 	
+	// Not called yet
 	public static function cleanAndOptimize()
 	{
-		// Clean (carts...)
+		Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'cart` WHERE id_cart NOT IN (SELECT id_cart FROM `'._DB_PREFIX_.'cart`) AND date_add < "'.pSQL(date('Y-m-d', strtotime('-1 month'))).'"');
 	}
 	
 	protected static function bulle($array)
@@ -508,16 +509,13 @@ class PSCleaner extends Module
 			$sorted = true;
 			for ($i = 0; $i < $size - 1; ++$i)
 				for ($j = $i + 1; $j < $size; ++$j)
-				{
 					if ($array[$i][2] == $array[$j][0])
 					{
-						// var_dump(array($array[$i], $array[$j]));
 						$tmp = $array[$i];
 						$array[$i] = $array[$j];
 						$array[$j] = $tmp;
 						$sorted = false;
 					}
-				}
 		}
 		return $array;
 	}

From 2f40c3126bdc2b73d97073caa4e1735420b5e7c9 Mon Sep 17 00:00:00 2001
From: sLorenzini <sarah.lorenzini@prestashop.com>
Date: Fri, 7 Jun 2013 18:06:48 +0200
Subject: [PATCH 14/44] [-] FO: fixed w3c errors

---
 modules/blockcms/blockcms.tpl                | 2 +-
 themes/default/modules/blockcms/blockcms.tpl | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/blockcms/blockcms.tpl b/modules/blockcms/blockcms.tpl
index d57171955..fe80491a5 100755
--- a/modules/blockcms/blockcms.tpl
+++ b/modules/blockcms/blockcms.tpl
@@ -54,7 +54,7 @@
 			<li class="item"><a href="{$link->getPageLink($contact_url, true)|escape:'html'}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
 			{foreach from=$cmslinks item=cmslink}
 				{if $cmslink.meta_title != ''}
-					<li class="item"><a href="{$cmslink.link|addslashes}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
+					<li class="item"><a href="{$cmslink.link|addslashes|escape:'html'}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 				{/if}
 			{/foreach}
 			<li><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
diff --git a/themes/default/modules/blockcms/blockcms.tpl b/themes/default/modules/blockcms/blockcms.tpl
index 0f798e729..a5610bdf0 100644
--- a/themes/default/modules/blockcms/blockcms.tpl
+++ b/themes/default/modules/blockcms/blockcms.tpl
@@ -54,7 +54,7 @@
 			<li class="item"><a href="{$link->getPageLink($contact_url, true)|escape:'html'}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
 			{foreach from=$cmslinks item=cmslink}
 				{if $cmslink.meta_title != ''}
-					<li class="item"><a href="{$cmslink.link|addslashes}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
+					<li class="item"><a href="{$cmslink.link|addslashes|escape:'html'}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 				{/if}
 			{/foreach}
 			<li><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>

From 0334f593dad91db6bc21536fe624f3c1c9350b72 Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Mon, 10 Jun 2013 10:10:56 +0200
Subject: [PATCH 15/44] [-] FO : fixed bug #PSCFV-9092 - conflict on the
 company field during account creation

---
 themes/default/authentication.tpl        | 10 ++++++----
 themes/default/order-opc-new-account.tpl | 10 ++++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/themes/default/authentication.tpl b/themes/default/authentication.tpl
index f6b643463..080f8b778 100644
--- a/themes/default/authentication.tpl
+++ b/themes/default/authentication.tpl
@@ -470,10 +470,12 @@ $(document).ready(function() {
 		<h3>{l s='Your address'}</h3>
 		{foreach from=$dlv_all_fields item=field_name}
 			{if $field_name eq "company"}
-				<p class="text">
-					<label for="company">{l s='Company'}</label>
-					<input type="text" class="text" id="company" name="company" value="{if isset($smarty.post.company)}{$smarty.post.company}{/if}" />
-				</p>
+				{if !$b2b_enable}
+					<p class="text">
+						<label for="company">{l s='Company'}</label>
+						<input type="text" class="text" id="company" name="company" value="{if isset($smarty.post.company)}{$smarty.post.company}{/if}" />
+					</p>
+				{/if}
 			{elseif $field_name eq "vat_number"}
 				<div id="vat_number" style="display:none;">
 					<p class="text">
diff --git a/themes/default/order-opc-new-account.tpl b/themes/default/order-opc-new-account.tpl
index 0e42f8615..1743028be 100644
--- a/themes/default/order-opc-new-account.tpl
+++ b/themes/default/order-opc-new-account.tpl
@@ -180,10 +180,12 @@
 				{$stateExist = false}
 				{foreach from=$dlv_all_fields item=field_name}
 				{if $field_name eq "company"}
-				<p class="text">
-					<label for="company">{l s='Company'}</label>
-					<input type="text" class="text" id="company" name="company" value="{if isset($guestInformations) && $guestInformations.company}{$guestInformations.company}{/if}" />
-				</p>
+				{if $b2b_enable}
+					<p class="text">
+						<label for="company">{l s='Company'}</label>
+						<input type="text" class="text" id="company" name="company" value="{if isset($guestInformations) && $guestInformations.company}{$guestInformations.company}{/if}" />
+					</p>
+				{/if}
 				{elseif $field_name eq "firstname"}
 				<p class="required text">
 					<label for="firstname">{l s='First name'} <sup>*</sup></label>

From a73326bfb2d04c244ab6b776d45165445e7c0529 Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Mon, 10 Jun 2013 10:22:44 +0200
Subject: [PATCH 16/44] [-] FO - fixed bug #PSCFV-9075

---
 themes/default/js/product.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/themes/default/js/product.js b/themes/default/js/product.js
index 5cd19f406..7bea5e445 100644
--- a/themes/default/js/product.js
+++ b/themes/default/js/product.js
@@ -668,7 +668,7 @@ function getProductAttribute()
 		url = url.substring(0, url.indexOf('#'));
 
 	// set ipa to the customization form
-	$('#customizationForm').attr('action', $('#customizationForm').attr('action') + request)
+	$('#customizationForm').attr('action', $('#customizationForm').attr('action') + request);
 	window.location = url + request;
 }
 

From 12872fea651ac8712097c63c0a2262ab700218d9 Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Mon, 10 Jun 2013 10:47:57 +0200
Subject: [PATCH 17/44] [-] BO - fixed bug #PSCFV-9071 - PS_SHOP_DOMAIN and
 PS_SHOP_DOMAIN_SSL have not updated after updated Shop domain and SSL domain
 from Preferences > SEO & URLs

---
 controllers/admin/AdminMetaController.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/controllers/admin/AdminMetaController.php b/controllers/admin/AdminMetaController.php
index 6a08f8bc7..5b87d9d6d 100644
--- a/controllers/admin/AdminMetaController.php
+++ b/controllers/admin/AdminMetaController.php
@@ -529,6 +529,7 @@ class AdminMetaControllerCore extends AdminController
 			{
 				$this->url->domain = $value;
 				$this->url->update();
+				Configuration::updateGlobalValue('PS_SHOP_DOMAIN', $value);
 			}
 			else
 				$this->errors[] = Tools::displayError('This domain is not valid.');
@@ -546,6 +547,7 @@ class AdminMetaControllerCore extends AdminController
 			{
 				$this->url->domain_ssl = $value;
 				$this->url->update();
+				Configuration::updateGlobalValue('PS_SHOP_DOMAIN_SSL', $value);
 			}
 			else
 				$this->errors[] = Tools::displayError('The SSL domain is not valid.');

From 5ec9aa56ac27beae0fd31a2aa5985db37732cd1f Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Mon, 10 Jun 2013 12:15:11 +0200
Subject: [PATCH 18/44] //small fix

---
 controllers/admin/AdminReturnController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/controllers/admin/AdminReturnController.php b/controllers/admin/AdminReturnController.php
index fe51775f9..39866ea4b 100644
--- a/controllers/admin/AdminReturnController.php
+++ b/controllers/admin/AdminReturnController.php
@@ -136,7 +136,7 @@ class AdminReturnControllerCore extends AdminController
 		$this->tpl_form_vars = array(
 			'customer' => new Customer($this->object->id_customer),
 			'url_customer' => 'index.php?tab=AdminCustomers&id_customer='.(int)$this->object->id_customer.'&viewcustomer&token='.Tools::getAdminToken('AdminCustomers'.(int)(Tab::getIdFromClassName('AdminCustomers')).(int)$this->context->employee->id),
-			'text_order' => sprintf($this->l('Order #%1$d from %2$s'), $order->id, Tools::displayDate($order->date_upd, $order->id_lang)),
+			'text_order' => sprintf($this->l('Order #%1$d from %2$s'), $order->id, Tools::displayDate($order->date_upd)),
 			'url_order' => 'index.php?tab=AdminOrders&id_order='.(int)$order->id.'&vieworder&token='.Tools::getAdminToken('AdminOrders'.(int)Tab::getIdFromClassName('AdminOrders').(int)$this->context->employee->id),
 			'picture_folder' => _THEME_PROD_PIC_DIR_,
 			'type_file' => Product::CUSTOMIZE_FILE,

From 433e9338d96f0bbdebb77e2d7684dcab04ea11c2 Mon Sep 17 00:00:00 2001
From: Vincent Augagneur <vincent.augagneur@prestashop.com>
Date: Mon, 10 Jun 2013 12:16:23 +0200
Subject: [PATCH 19/44] //fix notice

---
 classes/Tools.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classes/Tools.php b/classes/Tools.php
index 56e8645b5..8e6c617b4 100644
--- a/classes/Tools.php
+++ b/classes/Tools.php
@@ -1855,7 +1855,7 @@ exit;
 	{
 		$backtrace = debug_backtrace();
 		$callee = next($backtrace);
-		$error = 'Parameter <b>'.$parameter.'</b> in function <b>'.(isset($callee['function']) ? $callee['function'] : '').'()</b> is deprecated in <b>'.$callee['file'].'</b> on line <b>'.$callee['Line'].'</b><br />';
+		$error = 'Parameter <b>'.$parameter.'</b> in function <b>'.(isset($callee['function']) ? $callee['function'] : '').'()</b> is deprecated in <b>'.$callee['file'].'</b> on line <b>'.(isset($callee['Line']) ? $callee['Line'] : '').'</b><br />';
 		$message = 'The parameter '.$parameter.' in function '.$callee['function'].' (Line '.$callee['Line'].') is deprecated and will be removed in the next major version.';
 		$class = isset($callee['class']) ? $callee['class'] : null;
 

From d64b5efd10752d001637cb2a5f229c4d7a31f7f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Mon, 10 Jun 2013 16:23:16 +0200
Subject: [PATCH 20/44] [-] WS: Fix deletion of product_features on product
 update #PSCFI-6740

---
 classes/Product.php | 55 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 48 insertions(+), 7 deletions(-)

diff --git a/classes/Product.php b/classes/Product.php
index 846d0558e..81980af9d 100644
--- a/classes/Product.php
+++ b/classes/Product.php
@@ -394,6 +394,7 @@ class ProductCore extends ObjectModel
 				'resource' => 'product_feature',
 				'fields' => array(
 					'id' => array('required' => true),
+					'custom' => array('required' => false),
 					'id_feature_value' => array(
 						'required' => true,
 						'xlink_resource' => 'product_feature_values'
@@ -3214,8 +3215,9 @@ class ProductCore extends ObjectModel
 			return array();
 		if (!array_key_exists($id_product, self::$_cacheFeatures))
 			self::$_cacheFeatures[$id_product] = Db::getInstance(_PS_USE_SQL_SLAVE_)->executeS('
-				SELECT id_feature, id_product, id_feature_value
-				FROM `'._DB_PREFIX_.'feature_product`
+				SELECT fp.id_feature, fp.id_product, fp.id_feature_value, custom
+				FROM `'._DB_PREFIX_.'feature_product` fp
+				LEFT JOIN `'._DB_PREFIX_.'feature_value` fv ON (fp.id_feature_value = fv.id_feature_value)
 				WHERE `id_product` = '.(int)$id_product
 			);
 		return self::$_cacheFeatures[$id_product];
@@ -4425,12 +4427,51 @@ class ProductCore extends ObjectModel
 	*/
 	public function setWsProductFeatures($product_features)
 	{
-		$this->deleteProductFeatures();
-		foreach ($product_features as $product_feature)
-			$this->addFeaturesToDB($product_feature['id'], $product_feature['id_feature_value']);
-		return true;
-	}
+	
+	$db_features = Db::getInstance()->executeS('
+							SELECT p.*, f.`custom`
+							FROM `'._DB_PREFIX_.'feature_product` p
+							LEFT JOIN `'._DB_PREFIX_.'feature_value` f ON (f.`id_feature_value` = p.`id_feature_value`)
+							WHERE `id_product` = '.(int)$this->id
+						);
 
+
+		$pfa = array();
+		foreach ($product_features as $product_feature)
+			$pfa[$product_feature['id']] = 1;
+
+		foreach ($db_features as $db_feature)
+		{
+			// test if feature should stay in db (if it is part of updated product)
+			if (!isset($pfa[$db_feature['id_feature']]))
+			{
+					// delete only custom features
+					if ($db_feature['custom'])
+					{
+						Db::getInstance()->execute('
+							DELETE FROM `'._DB_PREFIX_.'feature_value_lang`
+							WHERE `id_feature_value` = '.(int)$db_feature['id_feature_value']
+						);
+						Db::getInstance()->execute('
+							DELETE FROM `'._DB_PREFIX_.'feature_value`
+							WHERE `id_feature_value` = '.(int)$db_feature['id_feature_value']
+						);
+
+					}
+			}
+		}
+
+		Db::getInstance()->execute('
+			DELETE FROM `'._DB_PREFIX_.'feature_product`
+			WHERE `id_product` = '.(int)$this->id
+		);
+
+ 		foreach ($product_features as $product_feature)
+ 			$this->addFeaturesToDB($product_feature['id'], $product_feature['id_feature_value'], $product_feature['custom']);
+
+ 		return true;
+	}
+	/*
 	/**
 	* Webservice getter : get virtual field default combination
 	*

From 183800335396221e23fef6a37d3bc96acd5f360e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Mon, 10 Jun 2013 16:59:02 +0200
Subject: [PATCH 21/44] [-] WS: Fix #PSCFI-7009 product prices on orders with
 specific prices

---
 classes/order/Order.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/classes/order/Order.php b/classes/order/Order.php
index 1c0ccd6be..80c9a8dbf 100644
--- a/classes/order/Order.php
+++ b/classes/order/Order.php
@@ -240,6 +240,8 @@ class OrderCore extends ObjectModel
 					'product_quantity' => array('required' => true),
 					'product_name' => array('setter' => false),
 					'product_price' => array('setter' => false),
+					'unit_price_tax_incl' => array('setter' => false),
+					'unit_price_tax_excl' => array('setter' => false),
 				)),
 		),
 
@@ -1287,7 +1289,7 @@ class OrderCore extends ObjectModel
 
 	public function getWsOrderRows()
 	{
-		$query = 'SELECT id_order_detail as `id`, `product_id`, `product_price`, `id_order`, `product_attribute_id`, `product_quantity`, `product_name`
+		$query = 'SELECT id_order_detail as `id`, `product_id`, `product_price`, `id_order`, `product_attribute_id`, `product_quantity`, `product_name`, `unit_price_tax_incl`, `unit_price_tax_excl`
 		FROM `'._DB_PREFIX_.'order_detail`
 		WHERE id_order = '.(int)$this->id;
 		$result = Db::getInstance()->executeS($query);

From 72def39102b88a3db1ab1112f56b6155f38c360c Mon Sep 17 00:00:00 2001
From: Nicolas Sorosac <nsorosac@axome.com>
Date: Mon, 10 Jun 2013 17:43:03 +0200
Subject: [PATCH 22/44] [-] CORE : CartRule::checkProductRestrictions : A gift
 product in the same category as its restrictions causes the gift to stay in
 the cart even if emptied

---
 classes/CartRule.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/classes/CartRule.php b/classes/CartRule.php
index e32bd3451..ab5cef179 100644
--- a/classes/CartRule.php
+++ b/classes/CartRule.php
@@ -637,7 +637,8 @@ class CartRuleCore extends ObjectModel
 							FROM `'._DB_PREFIX_.'cart_product` cp
 							LEFT JOIN `'._DB_PREFIX_.'category_product` catp ON cp.id_product = catp.id_product
 							WHERE cp.`id_cart` = '.(int)$context->cart->id.'
-							AND cp.`id_product` IN ('.implode(array_map('intval', $eligibleProductsList), ',').')');
+							AND cp.`id_product` IN ('.implode(array_map('intval', $eligibleProductsList), ',').')
+							AND cp.`id_product` <> '.(int)$this->gift_product);
 							$countMatchingProducts = 0;
 							$matchingProductsList = array();
 							foreach ($cartCategories as $cartCategory)

From f3000f6c654cf884d7da1ab51178e50976ad1c5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Mon, 10 Jun 2013 18:23:59 +0200
Subject: [PATCH 23/44] [-] BO: Fix #PSCFV-6657 translations of overriden admin
 templates

---
 config/smartyadmin.config.inc.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/config/smartyadmin.config.inc.php b/config/smartyadmin.config.inc.php
index 60d9a149f..f2916819e 100644
--- a/config/smartyadmin.config.inc.php
+++ b/config/smartyadmin.config.inc.php
@@ -57,7 +57,14 @@ function smartyTranslate($params, &$smarty)
 	// If the tpl is used by a Controller
 	else
 	{
-		// Split by \ and / to get the folder tree for the file
+		if (isset(Context::getContext()->controller))
+		{
+			$class_name = get_class(Context::getContext()->controller);
+			$class = substr($class_name, 0, strpos(Tools::strtolower($class_name), 'controller'));
+		}
+		else
+		{
+	// Split by \ and / to get the folder tree for the file
 		$folder_tree = preg_split('#[/\\\]#', $filename);
 		$key = array_search('controllers', $folder_tree);
 
@@ -69,8 +76,8 @@ function smartyTranslate($params, &$smarty)
 			$class = 'Admin'.Tools::toCamelCase($folder_tree[0], true);
 		else
 			$class = null;
+		}
 	}
 
 	return Translate::getAdminTranslation($params['s'], $class, $addslashes, $htmlentities, $sprintf);
-}
-
+}
\ No newline at end of file

From cafbed08ee039277400c8b85e1f53cd153beb6cb Mon Sep 17 00:00:00 2001
From: MatthieuB <perso@matthieu.me>
Date: Mon, 10 Jun 2013 21:13:23 +0200
Subject: [PATCH 24/44] NewProductController: new products page must display
 latest products first.

Override default configuration values: cause the new products page must
display latest products first.
---
 controllers/front/NewProductsController.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/controllers/front/NewProductsController.php b/controllers/front/NewProductsController.php
index 7cf283eba..a438c4826 100644
--- a/controllers/front/NewProductsController.php
+++ b/controllers/front/NewProductsController.php
@@ -47,6 +47,13 @@ class NewProductsControllerCore extends FrontController
 
 		$this->productSort();
 
+		// Override default configuration values: cause the new products page must display latest products first.
+		if (!Tools::getIsset('orderway') || !Tools::getIsset('orderby'))
+		{
+      $this->orderBy = 'date_add';
+      $this->orderWay = 'DESC';
+		}
+
 		$nbProducts = (int)Product::getNewProducts(
 			$this->context->language->id,
 			(isset($this->p) ? (int)($this->p) - 1 : null),

From 7ed9ceb59391e0ede7cbea0edbacbf20569419a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Tue, 11 Jun 2013 12:18:05 +0200
Subject: [PATCH 25/44] [-] BO: Addresses are now totally deleted from the
 database if not used on a order

---
 .../admin/AdminAddressesController.php        | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/controllers/admin/AdminAddressesController.php b/controllers/admin/AdminAddressesController.php
index 959687eef..9c7f49734 100644
--- a/controllers/admin/AdminAddressesController.php
+++ b/controllers/admin/AdminAddressesController.php
@@ -444,4 +444,41 @@ class AdminAddressesControllerCore extends AdminController
 		}
 		die;
 	}
+
+	/**
+	 * Object Delete
+	 */
+	public function processDelete()
+	{
+		if (Validate::isLoadedObject($object = $this->loadObject()))
+			if (!$object->isUsed())
+				$this->deleted = false;
+
+		return parent::processDelete();
+	}
+
+	/**
+	 * Delete multiple items
+	 *
+	 * @return boolean true if succcess
+	 */
+	protected function processBulkDelete()
+	{
+		if (is_array($this->boxes) && !empty($this->boxes))
+		{
+			$deleted = false;
+			foreach ($this->boxes as $id)
+			{
+				$to_delete = new Address((int)$id);
+				if ($to_delete->isUsed())
+				{
+					$deleted = true;
+					break;
+				}
+			}
+			$this->deleted = $deleted;
+		}
+
+		parent::processBulkDelete();
+	}
 }

From 91ececef1a47c6fd188b5cc98d035f9d8fd11d17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Tue, 11 Jun 2013 12:19:04 +0200
Subject: [PATCH 26/44] // missing return statement

---
 controllers/admin/AdminAddressesController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/controllers/admin/AdminAddressesController.php b/controllers/admin/AdminAddressesController.php
index 9c7f49734..9ab026776 100644
--- a/controllers/admin/AdminAddressesController.php
+++ b/controllers/admin/AdminAddressesController.php
@@ -479,6 +479,6 @@ class AdminAddressesControllerCore extends AdminController
 			$this->deleted = $deleted;
 		}
 
-		parent::processBulkDelete();
+		return parent::processBulkDelete();
 	}
 }

From b3a823f876a88884decd5733e18efe92902eb2e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Wed, 12 Jun 2013 17:08:00 +0200
Subject: [PATCH 27/44] [-] BO: Fix #PSCFV-7763 Re-inject quantities after
 deleting a product from a order

---
 controllers/admin/AdminOrdersController.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/controllers/admin/AdminOrdersController.php b/controllers/admin/AdminOrdersController.php
index ace92cb6d..d9704a34d 100755
--- a/controllers/admin/AdminOrdersController.php
+++ b/controllers/admin/AdminOrdersController.php
@@ -1970,8 +1970,8 @@ class AdminOrdersControllerCore extends AdminController
 	{
 		$res = true;
 
-		$order_detail = new OrderDetail(Tools::getValue('id_order_detail'));
-		$order = new Order(Tools::getValue('id_order'));
+		$order_detail = new OrderDetail((int)Tools::getValue('id_order_detail'));
+		$order = new Order((int)Tools::getValue('id_order'));
 
 		$this->doDeleteProductLineValidation($order_detail, $order);
 
@@ -1994,6 +1994,9 @@ class AdminOrdersControllerCore extends AdminController
 		$order->total_products_wt -= $order_detail->total_price_tax_incl;
 
 		$res &= $order->update();
+		
+		// Reinject quantity in stock
+		$this->reinjectQuantity($order_detail, $order_detail->product_quantity);
 
 		// Delete OrderDetail
 		$res &= $order_detail->delete();

From 1cd9d1bb7a09455ebfddc53b31609eb8bb27b5c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Wed, 12 Jun 2013 17:38:46 +0200
Subject: [PATCH 28/44] [-] FO: Fix shop restriction on features #PSCFV-7848

---
 classes/Product.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/classes/Product.php b/classes/Product.php
index 81980af9d..1354df139 100644
--- a/classes/Product.php
+++ b/classes/Product.php
@@ -3265,6 +3265,7 @@ class ProductCore extends ObjectModel
 		LEFT JOIN '._DB_PREFIX_.'feature_lang fl ON (fl.id_feature = pf.id_feature AND fl.id_lang = '.(int)$id_lang.')
 		LEFT JOIN '._DB_PREFIX_.'feature_value_lang fvl ON (fvl.id_feature_value = pf.id_feature_value AND fvl.id_lang = '.(int)$id_lang.')
 		LEFT JOIN '._DB_PREFIX_.'feature f ON (f.id_feature = pf.id_feature)
+		'.Shop::addSqlAssociation('feature', 'f').'
 		WHERE `id_product` IN ('.implode($product_implode, ',').')
 		ORDER BY f.position ASC');
 
@@ -3875,6 +3876,7 @@ class ProductCore extends ObjectModel
 				LEFT JOIN '._DB_PREFIX_.'feature_lang fl ON (fl.id_feature = pf.id_feature AND fl.id_lang = '.(int)$id_lang.')
 				LEFT JOIN '._DB_PREFIX_.'feature_value_lang fvl ON (fvl.id_feature_value = pf.id_feature_value AND fvl.id_lang = '.(int)$id_lang.')
 				LEFT JOIN '._DB_PREFIX_.'feature f ON (f.id_feature = pf.id_feature AND fl.id_lang = '.(int)$id_lang.')
+				'.Shop::addSqlAssociation('feature', 'f').'
 				WHERE pf.id_product = '.(int)$id_product.'
 				ORDER BY f.position ASC'
 			);

From 5d6d06f8fba05e651e88900cb9241f8866e81e2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Wed, 12 Jun 2013 18:24:14 +0200
Subject: [PATCH 29/44] [-] BO: Fix #PSCFV-9428 features duplicated with
 multishop on Feature::getFeatures()

---
 classes/Feature.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classes/Feature.php b/classes/Feature.php
index fbf6af072..38e566ed0 100644
--- a/classes/Feature.php
+++ b/classes/Feature.php
@@ -81,7 +81,7 @@ class FeatureCore extends ObjectModel
 	public static function getFeatures($id_lang, $with_shop = true)
 	{
 		return Db::getInstance()->executeS('
-		SELECT *
+		SELECT DISTINCT f.id_feature, f.*, fl.*
 		FROM `'._DB_PREFIX_.'feature` f
 		'.($with_shop ? Shop::addSqlAssociation('feature', 'f') : '').'
 		LEFT JOIN `'._DB_PREFIX_.'feature_lang` fl ON (f.`id_feature` = fl.`id_feature` AND fl.`id_lang` = '.(int)$id_lang.')

From b401ceb9d9e8b88f525f803346b8f91641db242d Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 08:57:15 +0200
Subject: [PATCH 30/44] [-] MO : do not truncate order return state in
 pscleaner #PSCFV-9431

---
 modules/pscleaner/pscleaner.php | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/pscleaner/pscleaner.php b/modules/pscleaner/pscleaner.php
index 969c196f3..c2f630c74 100644
--- a/modules/pscleaner/pscleaner.php
+++ b/modules/pscleaner/pscleaner.php
@@ -475,8 +475,6 @@ class PSCleaner extends Module
 					'order_payment',
 					'order_return',
 					'order_return_detail',
-					'order_return_state',
-					'order_return_state_lang',
 					'order_slip',
 					'order_slip_detail',
 					'page',

From a4e6ddf29c4d9f7c66af1fc3eb1cf3aceb27982f Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 09:42:34 +0200
Subject: [PATCH 31/44] [*] MO : blocklayered optimization

---
 modules/blocklayered/blocklayered.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/modules/blocklayered/blocklayered.php b/modules/blocklayered/blocklayered.php
index 04f9fbeb9..47ed3bb19 100644
--- a/modules/blocklayered/blocklayered.php
+++ b/modules/blocklayered/blocklayered.php
@@ -2508,6 +2508,7 @@ class BlockLayered extends Module
 		else
 		{
 			$n = (int)Tools::getValue('n', Configuration::get('PS_PRODUCTS_PER_PAGE'));
+			$nb_day_new_product = (Validate::isUnsignedInt(Configuration::get('PS_NB_DAYS_NEW_PRODUCT')) ? Configuration::get('PS_NB_DAYS_NEW_PRODUCT') : 20);
 			$join = '';
 			if (version_compare(_PS_VERSION_,'1.5','>'))
 				$join = Shop::addSqlAssociation('product', 'p');
@@ -2520,12 +2521,12 @@ class BlockLayered extends Module
 				i.id_image,
 				il.legend, 
 				m.name manufacturer_name,
-				DATEDIFF('.$alias_where.'.`date_add`, DATE_SUB(NOW(), INTERVAL '.(Validate::isUnsignedInt(Configuration::get('PS_NB_DAYS_NEW_PRODUCT')) ? Configuration::get('PS_NB_DAYS_NEW_PRODUCT') : 20).' DAY)) > 0 AS new
+				DATEDIFF('.$alias_where.'.`date_add`, DATE_SUB(NOW(), INTERVAL '.(int)$nb_day_new_product.' DAY)) > 0 AS new
 			FROM `'._DB_PREFIX_.'category_product` cp
 			LEFT JOIN '._DB_PREFIX_.'category c ON (c.id_category = cp.id_category)
 			LEFT JOIN `'._DB_PREFIX_.'product` p ON p.`id_product` = cp.`id_product`
 			'.$join.'
-			LEFT JOIN '._DB_PREFIX_.'product_lang pl ON (pl.id_product = p.id_product'.Shop::addSqlRestrictionOnLang('pl').')
+			LEFT JOIN '._DB_PREFIX_.'product_lang pl ON (pl.id_product = p.id_product'.Shop::addSqlRestrictionOnLang('pl').' AND pl.id_lang = '.(int)$cookie->id_lang.')
 			LEFT JOIN '._DB_PREFIX_.'image i ON (i.id_product = p.id_product AND i.cover = 1)
 			LEFT JOIN '._DB_PREFIX_.'image_lang il ON (i.id_image = il.id_image AND il.id_lang = '.(int)($cookie->id_lang).')
 			LEFT JOIN '._DB_PREFIX_.'manufacturer m ON (m.id_manufacturer = p.id_manufacturer)
@@ -2533,9 +2534,9 @@ class BlockLayered extends Module
 			'.(Configuration::get('PS_LAYERED_FULL_TREE') ? 'c.nleft >= '.(int)$parent->nleft.'
 			AND c.nright <= '.(int)$parent->nright : 'c.id_category = '.(int)$id_parent).'
 			AND c.active = 1
-			AND pl.id_lang = '.(int)$cookie->id_lang.'
-			AND p.id_product IN ('.implode(',', $product_id_list).')'
-			.' GROUP BY p.id_product ORDER BY '.Tools::getProductsOrder('by', Tools::getValue('orderby'), true).' '.Tools::getProductsOrder('way', Tools::getValue('orderway')).
+			AND p.id_product IN ('.implode(',', $product_id_list).')
+			GROUP BY cp.id_product
+			ORDER BY '.Tools::getProductsOrder('by', Tools::getValue('orderby'), true).' '.Tools::getProductsOrder('way', Tools::getValue('orderway')).
 			' LIMIT '.(((int)$this->page - 1) * $n.','.$n));
 		}
 		

From e4535e892d5e7662c84a6b3c28efa9be84dbdda1 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 10:31:39 +0200
Subject: [PATCH 32/44] [-] MO : fixed editorial issue when the entity does not
 exist yet for a shop #PSCFV-9442

---
 modules/editorial/EditorialClass.php | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/modules/editorial/EditorialClass.php b/modules/editorial/EditorialClass.php
index ca0b4db60..5b3d05349 100755
--- a/modules/editorial/EditorialClass.php
+++ b/modules/editorial/EditorialClass.php
@@ -68,10 +68,7 @@ class EditorialClass extends ObjectModel
 	static public function getByIdShop($id_shop)
 	{
 		$id = Db::getInstance()->getValue('SELECT `id_editorial` FROM `'._DB_PREFIX_.'editorial` WHERE `id_shop` ='.(int)$id_shop);
-		if ($id)
-			return new EditorialClass((int)$id);
-		else
-			return false;
+		return new EditorialClass($id);
 	}
 
 	public function copyFromPost()

From d6b884b7b57811925c9992bed4fc0deaac6f9440 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 10:34:35 +0200
Subject: [PATCH 33/44] [-] MO : removed doubled "/" in homeslider template
 #PSCFV-9439

---
 modules/homeslider/homeslider.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/homeslider/homeslider.tpl b/modules/homeslider/homeslider.tpl
index e2ba1b74a..fba02d589 100644
--- a/modules/homeslider/homeslider.tpl
+++ b/modules/homeslider/homeslider.tpl
@@ -46,7 +46,7 @@ var homeslider_pause = {$homeslider.pause};
 	{if $slide.active}
 		<li>
 			<a href="{$slide.url|escape:'htmlall':'UTF-8'}" title="{$slide.description|escape:'htmlall':'UTF-8'}">
-			<img src="{$smarty.const._MODULE_DIR_}/homeslider/images/{$slide.image|escape:'htmlall':'UTF-8'}" alt="{$slide.legend|escape:'htmlall':'UTF-8'}" height="{$homeslider.height|intval}" width="{$homeslider.width|intval}" />
+			<img src="{$smarty.const._MODULE_DIR_}homeslider/images/{$slide.image|escape:'htmlall':'UTF-8'}" alt="{$slide.legend|escape:'htmlall':'UTF-8'}" height="{$homeslider.height|intval}" width="{$homeslider.width|intval}" />
 			</a>
 		</li>
 	{/if}

From babfbaa2d2da9052148ce265ce41984ba7b79325 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 11:00:01 +0200
Subject: [PATCH 34/44] // Added missing space in installer

---
 install-dev/langs/pl/language.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install-dev/langs/pl/language.xml b/install-dev/langs/pl/language.xml
index 39b5fd3da..c4fc47528 100644
--- a/install-dev/langs/pl/language.xml
+++ b/install-dev/langs/pl/language.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <language>
-	<name><![CDATA[Polski(Polish)]]></name>
+	<name><![CDATA[Polski (Polish)]]></name>
 	<language_code>pl</language_code>
 	<date_format_lite>m/j/Y</date_format_lite>
 	<date_format_full>m/j/Y H:i:s</date_format_full>

From ecf59957bab931d6a1f08db5ade0d32490617d31 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 11:18:03 +0200
Subject: [PATCH 35/44] [-] FO : fixed pdf template #PSCFV-9430

---
 .../default/template/controllers/orders/helpers/view/view.tpl   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl b/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
index e1e546126..9fc61567f 100755
--- a/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
@@ -59,7 +59,7 @@
 
 	{assign var="hook_invoice" value={hook h="displayInvoice" id_order=$order->id}}
 	{if ($hook_invoice)}
-	<div style="float: right; margin: -40px 40px 10px 0;">{$hook_invoice}</div><br class="clear" />';
+	<div style="float: right; margin: -40px 40px 10px 0;">{$hook_invoice}</div><br class="clear" />
 	{/if}
 
 <div class="bloc-command">

From 5bf4c17f4a9d48851a1cb7102206703285143cf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Thu, 13 Jun 2013 12:01:51 +0200
Subject: [PATCH 36/44] [-] WS: Fix webservice sort for multishop fields
 #PSCFV-5634

---
 classes/ObjectModel.php                  | 5 +++++
 classes/webservice/WebserviceRequest.php | 9 ++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/classes/ObjectModel.php b/classes/ObjectModel.php
index 5b41111ef..f706ca154 100644
--- a/classes/ObjectModel.php
+++ b/classes/ObjectModel.php
@@ -1277,6 +1277,11 @@ abstract class ObjectModelCore
 	{
 		return Shop::isTableAssociated($this->def['table']) || !empty($this->def['multilang_shop']);
 	}
+	
+	public function isMultiShopField($field)
+	{
+		return (isset($this->def['fields'][$field]) && isset($this->def['fields'][$field]['shop']) && $this->def['fields'][$field]['shop']);
+	}
 
 	public function isLangMultishop()
 	{
diff --git a/classes/webservice/WebserviceRequest.php b/classes/webservice/WebserviceRequest.php
index f4126a194..61a0aa0a7 100644
--- a/classes/webservice/WebserviceRequest.php
+++ b/classes/webservice/WebserviceRequest.php
@@ -1184,7 +1184,14 @@ class WebserviceRequestCore
 					$sql_sort .= 'main_i18n.`'.pSQL($this->resourceConfiguration['fields'][$fieldName]['sqlId']).'` '.$direction.', ';// ORDER BY main_i18n.`field` ASC|DESC
 				}
 				else
-					$sql_sort .= (isset($this->resourceConfiguration['retrieveData']['tableAlias']) ? $this->resourceConfiguration['retrieveData']['tableAlias'].'.' : '').'`'.pSQL($this->resourceConfiguration['fields'][$fieldName]['sqlId']).'` '.$direction.', ';// ORDER BY `field` ASC|DESC
+				{
+					$object = new $this->resourceConfiguration['retrieveData']['className']();
+					if ($object->isMultiShopField($this->resourceConfiguration['fields'][$fieldName]['sqlId']))
+						$table_alias = 'multi_shop_'.$this->resourceConfiguration['retrieveData']['table'];
+					else
+						$table_alias = '';
+					$sql_sort .= (isset($this->resourceConfiguration['retrieveData']['tableAlias']) ? '`'.bqSQL($this->resourceConfiguration['retrieveData']['tableAlias']).'`.' : '`'.bqSQL($table_alias).'`.').'`'.pSQL($this->resourceConfiguration['fields'][$fieldName]['sqlId']).'` '.$direction.', ';// ORDER BY `field` ASC|DESC
+				}
 			}
 			$sql_sort = rtrim($sql_sort, ', ')."\n";
 		}

From f5dfb12e4d85e5637f52f0357fd648884a11ecf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Thu, 13 Jun 2013 14:30:21 +0200
Subject: [PATCH 37/44] [-] BO: association of product attributes on
 associating a product to another shop #PSCFV-8735

---
 classes/ObjectModel.php                       |  2 +-
 controllers/admin/AdminProductsController.php | 33 ++++++++++++++++++-
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/classes/ObjectModel.php b/classes/ObjectModel.php
index f706ca154..48fe026e4 100644
--- a/classes/ObjectModel.php
+++ b/classes/ObjectModel.php
@@ -633,7 +633,7 @@ abstract class ObjectModelCore
 				$shop_exists = ObjectModel::$db->getValue('SELECT '.$this->def['primary'].' FROM '._DB_PREFIX_.$this->def['table'].'_shop WHERE '.$where);
 				if ($shop_exists)
 					$result &= ObjectModel::$db->update($this->def['table'].'_shop', $fields, $where, 0, $null_values);
-				else if (Shop::getContext() == Shop::CONTEXT_SHOP)
+				elseif (Shop::getContext() == Shop::CONTEXT_SHOP)
 					$result &= ObjectModel::$db->insert($this->def['table'].'_shop', $all_fields, $null_values);
 			}
 		}
diff --git a/controllers/admin/AdminProductsController.php b/controllers/admin/AdminProductsController.php
index 8a29b9381..ccef97b8f 100644
--- a/controllers/admin/AdminProductsController.php
+++ b/controllers/admin/AdminProductsController.php
@@ -373,7 +373,7 @@ class AdminProductsControllerCore extends AdminController
 				$default_product = new Product((int)$this->object->id, false, null, (int)$this->object->id_shop_default);
 				$def = ObjectModel::getDefinition($this->object);
 				foreach ($def['fields'] as $field_name => $row)
-					$this->object->$field_name = $default_product->$field_name;
+					$this->object->$field_name = ObjectModel::formatValue($default_product->$field_name, $def['fields'][$field_name]['type']);
 			}
 			$this->object->loadStockData();
 		}
@@ -1802,6 +1802,29 @@ class AdminProductsControllerCore extends AdminController
 				if (Shop::isFeatureActive() && Shop::getContext() != Shop::CONTEXT_SHOP)
 					$object->setFieldsToUpdate((array)Tools::getValue('multishop_check'));
 
+				// Duplicate combinations if not associated to shop
+				if ($this->context->shop->getContext() == Shop::CONTEXT_SHOP && !$object->isAssociatedToShop())
+				{
+					$is_associated_to_shop = false;
+					$combinations = Product::getProductAttributesIds($object->id);
+					if ($combinations)
+					{
+						foreach ($combinations as $id_combination)
+						{
+							$combination = new Combination((int)$id_combination['id_product_attribute']);
+							$default_combination = new Combination((int)$id_combination['id_product_attribute'], null, (int)$this->object->id_shop_default);
+
+							$def = ObjectModel::getDefinition($default_combination);
+							foreach ($def['fields'] as $field_name => $row)
+								$combination->$field_name = ObjectModel::formatValue($default_combination->$field_name, $def['fields'][$field_name]['type']);
+
+							$combination->save();
+						}
+					}
+				}
+				else
+					$is_associated_to_shop = true;
+
 				if ($object->update())
 				{
 					if (in_array($this->context->shop->getContext(), array(Shop::CONTEXT_SHOP, Shop::CONTEXT_ALL)))
@@ -1892,7 +1915,15 @@ class AdminProductsControllerCore extends AdminController
 						$this->display = 'edit';
 				}
 				else
+				{
+					if (!$is_associated_to_shop && $combinations)
+						foreach ($combinations as $id_combination)
+						{
+							$combination = new Combination((int)$id_combination['id_product_attribute']);
+							$combination->delete();
+						}
 					$this->errors[] = Tools::displayError('An error occurred while updating an object.').' <b>'.$this->table.'</b> ('.Db::getInstance()->getMsgError().')';
+				}
 			}
 			else
 				$this->errors[] = Tools::displayError('An error occurred while updating an object.').' <b>'.$this->table.'</b> ('.Tools::displayError('The object cannot be loaded. ').')';

From fafb7fdef78300946a3bd63fb2932a93fb87719c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Gaillard?= <remi.gaillard@prestashop.com>
Date: Thu, 13 Jun 2013 15:05:55 +0200
Subject: [PATCH 38/44] [-] BO: Fix #PSCFV-8904 bad id_warehouse is stored on
 ps_address table

---
 controllers/admin/AdminWarehousesController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/controllers/admin/AdminWarehousesController.php b/controllers/admin/AdminWarehousesController.php
index 8628f1f52..dc4d2d1ec 100644
--- a/controllers/admin/AdminWarehousesController.php
+++ b/controllers/admin/AdminWarehousesController.php
@@ -424,7 +424,7 @@ class AdminWarehousesControllerCore extends AdminController
 		$address = new Address($object->id_address);
 		if (Validate::isLoadedObject($address))
 		{
-			$address->id_warehouse = $object->id_address;
+			$address->id_warehouse = (int)$object->id;
 			$address->save();
 		}
 

From 534c10562fee4fba97ac25546454671e35a9a11f Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 15:27:54 +0200
Subject: [PATCH 39/44] [*] Installer : added cookie mode instead of session
 for the installer

---
 classes/Blowfish.php                     |  2 +-
 classes/Cookie.php                       | 34 +++++++--------
 classes/Language.php                     |  2 +-
 config/config.inc.php                    |  6 +--
 install-dev/classes/session.php          | 55 +++++++++++++++++++-----
 install-dev/controllers/http/process.php |  2 +-
 install-dev/theme/js/process.js          | 13 +++---
 install-dev/theme/views/header.phtml     |  5 ++-
 8 files changed, 77 insertions(+), 42 deletions(-)

diff --git a/classes/Blowfish.php b/classes/Blowfish.php
index 1fffd8b73..2fd8e53d5 100644
--- a/classes/Blowfish.php
+++ b/classes/Blowfish.php
@@ -42,7 +42,7 @@ class BlowfishCore extends Crypt_Blowfish
 			$piece = substr($paddedtext, $x, 8);
 			$cipher_piece = parent::encrypt($piece);
 			$encoded = base64_encode($cipher_piece); 
-			$ciphertext = $ciphertext.$encoded;       
+			$ciphertext = $ciphertext.$encoded;
 		}
 	   return $ciphertext.sprintf('%06d', $length);  
 	}
diff --git a/classes/Cookie.php b/classes/Cookie.php
index 655ada642..7fbec5303 100644
--- a/classes/Cookie.php
+++ b/classes/Cookie.php
@@ -44,15 +44,13 @@ class CookieCore
 	/** @var array cipher tool instance */
 	protected $_cipherTool;
 
-	/** @var array cipher tool initialization key */
-	protected $_key;
-
-	/** @var array cipher tool initilization vector */
-	protected $_iv;
-
 	protected $_modified = false;
 	
 	protected $_allow_writing;
+	
+	protected $_salt;
+	
+	protected $_standalone;
 
 	/**
 	 * Get data if the cookie exists and else initialize an new one
@@ -60,24 +58,26 @@ class CookieCore
 	 * @param $name Cookie name before encrypting
 	 * @param $path
 	 */
-	public function __construct($name, $path = '', $expire = null, $shared_urls = null)
+	public function __construct($name, $path = '', $expire = null, $shared_urls = null, $standalone = false)
 	{
 		$this->_content = array();
+		$this->_standalone = $standalone;
 		$this->_expire = is_null($expire) ? time() + 1728000 : (int)$expire;
-		$this->_name = md5(_PS_VERSION_.$name);
-		$this->_path = trim(Context::getContext()->shop->physical_uri.$path, '/\\').'/';
+		$this->_name = md5(($this->_standalone ? '' : _PS_VERSION_).$name);
+		$this->_path = trim(($this->_standalone ? '' : Context::getContext()->shop->physical_uri).$path, '/\\').'/';
 		if ($this->_path{0} != '/') $this->_path = '/'.$this->_path;
 		$this->_path = rawurlencode($this->_path);
 		$this->_path = str_replace('%2F', '/', $this->_path);
 		$this->_path = str_replace('%7E', '~', $this->_path);
-		$this->_key = _COOKIE_KEY_;
-		$this->_iv = _COOKIE_IV_;
 		$this->_domain = $this->getDomain($shared_urls);
 		$this->_allow_writing = true;
-		if (Configuration::get('PS_CIPHER_ALGORITHM'))
-			$this->_cipherTool = new Rijndael(_RIJNDAEL_KEY_, _RIJNDAEL_IV_);
+		$this->_salt = $this->_standalone ? str_pad('', 8, md5('ps'.__FILE__)) : _COOKIE_IV_;
+		if ($this->_standalone)
+			$this->_cipherTool = new Blowfish(str_pad('', 56, md5('ps'.__FILE__)), str_pad('', 56, md5('iv'.__FILE__)));
+		elseif (!Configuration::get('PS_CIPHER_ALGORITHM'))
+			$this->_cipherTool = new Blowfish(_COOKIE_KEY_, _COOKIE_IV_);
 		else
-			$this->_cipherTool = new Blowfish($this->_key, $this->_iv);
+			$this->_cipherTool = new Rijndael(_RIJNDAEL_KEY_, _RIJNDAEL_IV_);
 		$this->update();
 	}
 
@@ -270,7 +270,7 @@ class CookieCore
 			//printf("\$content = %s<br />", $content);
 			
 			/* Get cookie checksum */
-			$checksum = crc32($this->_iv.substr($content, 0, strrpos($content, '¤') + 2));
+			$checksum = crc32($this->_salt.substr($content, 0, strrpos($content, '¤') + 2));
 			//printf("\$checksum = %s<br />", $checksum);
 			
 			/* Unserialize cookie content */
@@ -297,7 +297,7 @@ class CookieCore
 			$this->_content['date_add'] = date('Y-m-d H:i:s');
 
 		//checks if the language exists, if not choose the default language
-		if (!Language::getLanguage((int)$this->id_lang))
+		if (!$this->_standalone && !Language::getLanguage((int)$this->id_lang))
 			$this->id_lang = Configuration::get('PS_LANG_DEFAULT');
 
 	}
@@ -344,7 +344,7 @@ class CookieCore
 			$cookie .= $key.'|'.$value.'¤';
 
 		/* Add checksum to cookie */
-		$cookie .= 'checksum|'.crc32($this->_iv.$cookie);
+		$cookie .= 'checksum|'.crc32($this->_salt.$cookie);
 		$this->_modified = false;
 		/* Cookies are encrypted for evident security reasons */
 		return $this->_setcookie($cookie);
diff --git a/classes/Language.php b/classes/Language.php
index a0683873b..047cca8a0 100644
--- a/classes/Language.php
+++ b/classes/Language.php
@@ -580,7 +580,7 @@ class LanguageCore extends ObjectModel
 
 	public static function getLanguage($id_lang)
 	{
-		if (!array_key_exists((int)($id_lang), self::$_LANGUAGES))
+		if (!array_key_exists((int)$id_lang, self::$_LANGUAGES))
 			return false;
 		return self::$_LANGUAGES[(int)($id_lang)];
 	}
diff --git a/config/config.inc.php b/config/config.inc.php
index 9a8b09a03..637089c22 100644
--- a/config/config.inc.php
+++ b/config/config.inc.php
@@ -53,9 +53,6 @@ require_once(dirname(__FILE__).'/settings.inc.php');
 
 require_once(dirname(__FILE__).'/autoload.php');
 
-if (Tools::isPHPCLI())
-	Tools::argvToGET($argc, $argv);
-
 if (_PS_DEBUG_PROFILING_)
 {
 	include_once(_PS_TOOL_DIR_.'profiling/Controller.php');
@@ -65,6 +62,9 @@ if (_PS_DEBUG_PROFILING_)
 	include_once(_PS_TOOL_DIR_.'profiling/Tools.php');
 }
 
+if (Tools::isPHPCLI())
+	Tools::argvToGET($argc, $argv);
+
 /* Redefine REQUEST_URI if empty (on some webservers...) */
 if (!isset($_SERVER['REQUEST_URI']) || empty($_SERVER['REQUEST_URI']))
 {
diff --git a/install-dev/classes/session.php b/install-dev/classes/session.php
index 27a0506c6..88cd775bf 100644
--- a/install-dev/classes/session.php
+++ b/install-dev/classes/session.php
@@ -30,6 +30,8 @@
 class InstallSession
 {
 	protected static $_instance;
+	protected static $_cookie_mode = false;
+	protected static $_cookie = false;
 
 	public static function getInstance()
 	{
@@ -41,39 +43,72 @@ class InstallSession
 	public function __construct()
 	{
 		session_name('install_'.md5(__PS_BASE_URI__));
-		session_start();
+		if (!session_start() || (!isset($_SESSION['session_mode']) && (count($_POST) || count($_GET))))
+		{
+			InstallSession::$_cookie_mode = true;
+			InstallSession::$_cookie = new Cookie('ps_install', null, time() + 7200, null, true);
+		}
+		else
+			$_SESSION['session_mode'] = 'session';
 	}
 
 	public function clean()
 	{
-		foreach ($_SESSION as $k => $v)
-			unset($_SESSION[$k]);
+		if (InstallSession::$_cookie_mode)
+			InstallSession::$_cookie->logout();
+		else
+			foreach ($_SESSION as $k => $v)
+				unset($_SESSION[$k]);
 	}
 
 	public function &__get($varname)
 	{
-		if (isset($_SESSION[$varname]))
-			$ref = &$_SESSION[$varname];
+		if (InstallSession::$_cookie_mode)
+		{
+			$ref = InstallSession::$_cookie->{$varname};
+			if (0 === strncmp($ref, 'serialized_array:', strlen('serialized_array:')))
+				$ref = unserialize(substr($ref, strlen('serialized_array:')));
+		}
 		else
 		{
-			$null = null;
-			$ref = &$null;
+			if (isset($_SESSION[$varname]))
+				$ref = &$_SESSION[$varname];
+			else
+			{
+				$null = null;
+				$ref = &$null;
+			}
 		}
 		return $ref;
 	}
 
 	public function __set($varname, $value)
 	{
-		$_SESSION[$varname] = $value;
+		if (InstallSession::$_cookie_mode)
+		{
+			if ($varname == 'xml_loader_ids')
+				return;
+			if (is_array($value))
+				$value = 'serialized_array:'.serialize($value);
+			InstallSession::$_cookie->{$varname} = $value;
+		}
+		else
+			$_SESSION[$varname] = $value;
 	}
 
 	public function __isset($varname)
 	{
-		return isset($_SESSION[$varname]);
+		if (InstallSession::$_cookie_mode)
+			return isset(InstallSession::$_cookie->{$varname});
+		else
+			return isset($_SESSION[$varname]);
 	}
 
 	public function __unset($varname)
 	{
-		unset($_SESSION[$varname]);
+		if (InstallSession::$_cookie_mode)
+			unset(InstallSession::$_cookie->{$varname});
+		else
+			unset($_SESSION[$varname]);
 	}
 }
diff --git a/install-dev/controllers/http/process.php b/install-dev/controllers/http/process.php
index 865318ca4..38d497ce2 100644
--- a/install-dev/controllers/http/process.php
+++ b/install-dev/controllers/http/process.php
@@ -78,7 +78,7 @@ class InstallControllerHttpProcess extends InstallControllerHttp
 	public function process()
 	{
 		if (file_exists(_PS_ROOT_DIR_.'/'.self::SETTINGS_FILE))
-			@require_once _PS_ROOT_DIR_.'/'.self::SETTINGS_FILE;
+			require_once _PS_ROOT_DIR_.'/'.self::SETTINGS_FILE;
 
 		if (!$this->session->process_validated)
 			$this->session->process_validated = array();
diff --git a/install-dev/theme/js/process.js b/install-dev/theme/js/process.js
index ffdf34ff2..20246ebcf 100644
--- a/install-dev/theme/js/process.js
+++ b/install-dev/theme/js/process.js
@@ -20,8 +20,8 @@ function start_install()
 	$('.stepList li:last-child').removeClass('ok').removeClass('ko');
 	process_pixel = parseInt($('#progress_bar .total').css('width')) / process_steps.length;
 	$('#tabs li a').each(function() {
-		 this.rel=$(this).attr('href');
-		 this.href='#';
+		 this.rel = $(this).attr('href');
+		 this.href = '#';
 	});
 	process_install();
 }
@@ -31,11 +31,11 @@ function process_install(step)
 	if (!step)
 		step = process_steps[0];
 
-	$('.installing').hide().html(step.lang+' ...').fadeIn('slow');
+	$('.installing').hide().html(step.lang + ' ...').fadeIn('slow');
 
 	$.ajax({
 		url: 'index.php',
-		data: step.key+'=true',
+		data: step.key + '=true',
 		dataType: 'json',
 		cache: false,
 		success: function(json)
@@ -51,10 +51,7 @@ function process_install(step)
 					$('#progress_bar .total span').html('100%');
 
 					// Installation finished
-					setTimeout(function()
-					{
-						install_success();
-					}, 700)
+					setTimeout(function(){install_success();}, 700);
 				}
 				else
 				{
diff --git a/install-dev/theme/views/header.phtml b/install-dev/theme/views/header.phtml
index 1e424f40b..43119205f 100644
--- a/install-dev/theme/views/header.phtml
+++ b/install-dev/theme/views/header.phtml
@@ -83,4 +83,7 @@
 				<li <?php if ($this->isStepFinished($step)): ?>class="ok"<?php endif; ?>><?php echo $this->l('menu_'.$this->step) ?></li>
 			<?php endforeach; ?>
 		</ul>
-	</div>
\ No newline at end of file
+	</div>
+	<noscript>
+		<h3 class="errorBlock" style="margin-bottom:10px"><?php echo $this->l('To install PrestaShop, you need to have JavaScript enabled in your browser.') ?></h3>
+	</noscript>
\ No newline at end of file

From be0d6f1c6c6fc99fb44aa2971b3a0b3716c7b95b Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 15:35:17 +0200
Subject: [PATCH 40/44] // Just to be sure that we will not have any regression

---
 install-dev/classes/session.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/install-dev/classes/session.php b/install-dev/classes/session.php
index 88cd775bf..1bc8fa4d2 100644
--- a/install-dev/classes/session.php
+++ b/install-dev/classes/session.php
@@ -48,8 +48,7 @@ class InstallSession
 			InstallSession::$_cookie_mode = true;
 			InstallSession::$_cookie = new Cookie('ps_install', null, time() + 7200, null, true);
 		}
-		else
-			$_SESSION['session_mode'] = 'session';
+		$_SESSION['session_mode'] = 'session';
 	}
 
 	public function clean()

From 80908e0a6f0c310cc9d95fbd87e3c989c3ff6620 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 16:34:34 +0200
Subject: [PATCH 41/44] [-] MO : do not check the VAT number if the module is
 disabled #PSCFV-9397

---
 classes/Address.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classes/Address.php b/classes/Address.php
index 01a227232..cb1fef134 100644
--- a/classes/Address.php
+++ b/classes/Address.php
@@ -222,7 +222,7 @@ class AddressCore extends ObjectModel
 	public function validateController($htmlentities = true)
 	{
 		$errors = parent::validateController($htmlentities);
-		if (!Configuration::get('VATNUMBER_CHECKING'))
+		if (!Configuration::get('VATNUMBER_MANAGEMENT') || !Configuration::get('VATNUMBER_CHECKING'))
 			return $errors;
 		include_once(_PS_MODULE_DIR_.'vatnumber/vatnumber.php');
 		if (class_exists('VatNumber', false))

From 6a2eddd81f505d7419ccd760102dc4f83b709014 Mon Sep 17 00:00:00 2001
From: Seb <sebastienmonterisi@yahoo.fr>
Date: Thu, 13 Jun 2013 17:59:01 +0200
Subject: [PATCH 42/44] [-] BO : fix require path to config.inc.php

---
 admin-dev/get-file-admin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin-dev/get-file-admin.php b/admin-dev/get-file-admin.php
index b37f691e5..39fcd8a85 100644
--- a/admin-dev/get-file-admin.php
+++ b/admin-dev/get-file-admin.php
@@ -25,5 +25,5 @@
 */
 
 define('_PS_ADMIN_DIR_', getcwd());
-require(_PS_ADMIN_DIR_.'/config/config.inc.php');
+require(_PS_ADMIN_DIR_.'/../config/config.inc.php');
 Controller::getController('GetFileController')->run();
\ No newline at end of file

From cd6f415dc153e821f44bea1b00e5e49a04620d14 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Thu, 13 Jun 2013 18:37:41 +0200
Subject: [PATCH 43/44] [-] BO : fixed link in AdminTracking #PSCFV-7409

---
 controllers/admin/AdminTrackingController.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/controllers/admin/AdminTrackingController.php b/controllers/admin/AdminTrackingController.php
index 2ccb0c6ab..8ba7265a4 100644
--- a/controllers/admin/AdminTrackingController.php
+++ b/controllers/admin/AdminTrackingController.php
@@ -52,6 +52,9 @@ class AdminTrackingControllerCore extends AdminController
 
 	public function initContent()
 	{
+		if ($id_category = Tools::getValue('id_category') && Tools::getIsset('viewcategory'))
+			Tools::redirectAdmin($this->context->link->getAdminLink('AdminProducts').'&id_category='.(int)$id_category.'&viewcategory');
+
 		$this->_helper_list = new HelperList();
 		
 		if (!Configuration::get('PS_STOCK_MANAGEMENT'))

From ff876034b46b26065b06928addef6da2521dd6c7 Mon Sep 17 00:00:00 2001
From: Damien Metzger <damien.metzger@prestashop.com>
Date: Fri, 14 Jun 2013 09:56:41 +0200
Subject: [PATCH 44/44] // Fixed display of the image option "legacy system"

---
 controllers/admin/AdminImagesController.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/controllers/admin/AdminImagesController.php b/controllers/admin/AdminImagesController.php
index 38ecea2e4..22694773d 100644
--- a/controllers/admin/AdminImagesController.php
+++ b/controllers/admin/AdminImagesController.php
@@ -53,7 +53,7 @@ class AdminImagesControllerCore extends AdminController
 		);
 		
 		// No need to display the old image system if the install has been made later than 2013-03-26
-		$this->display_move = (defined('_PS_CREATION_DATE_') && strtotime(_PS_CREATION_DATE_) > strtotime('2013-03-26')) ? false : true;
+		$this->display_move = (!Configuration::get('PS_LEGACY_IMAGES') && defined('_PS_CREATION_DATE_') && strtotime(_PS_CREATION_DATE_) > strtotime('2013-03-26')) ? false : true;
 
 		$this->fields_options = array(
 			'images' => array(
@@ -62,7 +62,7 @@ class AdminImagesControllerCore extends AdminController
 				'top' => '',
 				'bottom' => '',
 				'description' => $this->l('JPEG images have a small file size and standard quality. PNG images have a larger file size, a higher quality and support transparency. Note that in all cases the image files will have the .jpg extension.').'
-								  <br /><br />'.$this->l('WARNING: This feature may not be compatible with your theme, or with some of your modules. In particular, PNG mode is not compatible with the Watermark module. If you encounter any issues, turn it off by selecting "Use JPEG".'),
+					<br /><br />'.$this->l('WARNING: This feature may not be compatible with your theme, or with some of your modules. In particular, PNG mode is not compatible with the Watermark module. If you encounter any issues, turn it off by selecting "Use JPEG".'),
 				'fields' =>	array(
 					'PS_IMAGE_QUALITY' => array(
 						'title' => $this->l('Image quality'),