diff --git a/admin-dev/themes/default/template/controllers/accounting_export/common_form.tpl b/admin-dev/themes/default/template/controllers/accounting_export/common_form.tpl
index 61734178e..ac5db0645 100644
--- a/admin-dev/themes/default/template/controllers/accounting_export/common_form.tpl
+++ b/admin-dev/themes/default/template/controllers/accounting_export/common_form.tpl
@@ -34,7 +34,7 @@
 
 <label for="clientPrefix">{l s='Client prefix:'}</label>
 <div class="margin-form">
-	<input type="text" value="{$clientPrefix}" name="clientPrefix" />
+	<input type="text" value="{$clientPrefix|htmlentities}" name="clientPrefix" />
 	<span class="input-error"></span>
 </div>
 
diff --git a/admin-dev/themes/default/template/controllers/accounting_export/global_export.tpl b/admin-dev/themes/default/template/controllers/accounting_export/global_export.tpl
index 49b7f09d2..22d4c4fa7 100644
--- a/admin-dev/themes/default/template/controllers/accounting_export/global_export.tpl
+++ b/admin-dev/themes/default/template/controllers/accounting_export/global_export.tpl
@@ -31,7 +31,7 @@
 			{include file="controllers/accounting_export/common_form.tpl"}
 			<label for="clientPrefix">{l s='Journal:'}</label>
 			<div class="margin-form">
-				<input type="text" name="journal" value="{$journal}"/>
+				<input type="text" name="journal" value="{$journal|htmlentities}"/>
 			</div>	
 			<div class="margin-form">
 				<input id="submitGlobalExport" type="submit" class="button" name="submitAccountingExportType" />
diff --git a/admin-dev/themes/default/template/controllers/accounting_management/content.tpl b/admin-dev/themes/default/template/controllers/accounting_management/content.tpl
index f427b5af1..fe98ba7f4 100644
--- a/admin-dev/themes/default/template/controllers/accounting_management/content.tpl
+++ b/admin-dev/themes/default/template/controllers/accounting_management/content.tpl
@@ -44,13 +44,13 @@
 		<form id="{$table}_form" method="POST" action="{$smarty.server.REQUEST_URI}">
 			<label>{l s='Default number for this shop'}</label>
 				<div class="margin-form">
-				<input type="text" name="default_account_number" value="{$shop_details['default_account_number']}" />
+				<input type="text" name="default_account_number" value="{$shop_details['default_account_number']|htmlentities}" />
 				<p>{l s='If a zone field is empty it will use this default number.'}</p>
 			</div>
 			{foreach from=$shop_details['zones'] key=id_zone item=currentZone}
 				<label>{$currentZone['name']}</label>
 				<div class="margin-form">
-					<input type="text" name="zone_{$id_zone}" value="{$currentZone['account_number']|escape:htmlall}" />
+					<input type="text" name="zone_{$id_zone}" value="{$currentZone['account_number']|escape:htmlall|htmlentities}" />
 
 				</div>
 			{/foreach}
diff --git a/admin-dev/themes/default/template/controllers/addresses/form.tpl b/admin-dev/themes/default/template/controllers/addresses/form.tpl
index 06bc66c11..7e04c2503 100644
--- a/admin-dev/themes/default/template/controllers/addresses/form.tpl
+++ b/admin-dev/themes/default/template/controllers/addresses/form.tpl
@@ -73,7 +73,7 @@
 			</script>
 			<label>{l s='Customer e-mail'}</label>
 			<div class="margin-form">
-				<input type="text" size="33" name="email" value="{$fields_value[$input.name]|escape:'htmlall':'UTF-8'}" style="text-transform: lowercase;" /> <sup>*</sup>
+				<input type="text" size="33" name="email" value="{$fields_value[$input.name]|escape:'htmlall':'UTF-8'|htmlentities}" style="text-transform: lowercase;" /> <sup>*</sup>
 			</div>
 		{/if}
 	{else} 
diff --git a/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl b/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl
index c81082581..0aad6bc75 100644
--- a/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl
+++ b/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl
@@ -109,7 +109,7 @@
 				</div>
 				<label>{l s='Reference'}</label>
 				<div class="margin-form">
-					<input type="text" size="20" name="reference" value="{$product_reference}"/>
+					<input type="text" size="20" name="reference" value="{$product_reference|htmlentities}"/>
 				</div>
 			</div>
 			<div style="float:left; text-align:center; margin-left:20px;">
diff --git a/admin-dev/themes/default/template/controllers/attributes/list_content.tpl b/admin-dev/themes/default/template/controllers/attributes/list_content.tpl
index 71d3eedb3..67a27d89b 100644
--- a/admin-dev/themes/default/template/controllers/attributes/list_content.tpl
+++ b/admin-dev/themes/default/template/controllers/attributes/list_content.tpl
@@ -91,7 +91,7 @@
 				{$tr.$key}
 			{* If type is 'editable', an input is created *}
 			{elseif isset($params.type) && $params.type == 'editable' && isset($tr.id)}
-				<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key}" class="{$key}" />
+				<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key|htmlentities}" class="{$key}" />
 			{elseif isset($params.callback)}
 				{$tr.$key}
 			{elseif isset($tr.$key) && $key == 'color'}
diff --git a/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl b/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl
index 9b56d434b..17f9ca790 100644
--- a/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl
+++ b/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl
@@ -62,7 +62,7 @@
 		<label>{l s='Product'}</label>
 		<div class="margin-form">
 			<input type="hidden" id="reduction_product" name="reduction_product" value="{$currentTab->getFieldValue($currentObject, 'reduction_product')|intval}" />
-			<input type="text" id="reductionProductFilter" name="reductionProductFilter" value="{$reductionProductFilter}" style="width:400px" />
+			<input type="text" id="reductionProductFilter" name="reductionProductFilter" value="{$reductionProductFilter|htmlentities}" style="width:400px" />
 		</div>
 	</div>
 </div>
@@ -80,6 +80,6 @@
 	<label>{l s='Product'}</label>
 	<div class="margin-form">
 		<input type="hidden" id="gift_product" name="gift_product" value="{$currentTab->getFieldValue($currentObject, 'gift_product')|intval}" />
-		<input type="text" id="giftProductFilter" name="giftProductFilter" value="{$giftProductFilter}" style="width:400px" />
+		<input type="text" id="giftProductFilter" name="giftProductFilter" value="{$giftProductFilter|htmlentities}" style="width:400px" />
 	</div>
 </div>
\ No newline at end of file
diff --git a/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl b/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl
index 0254426ee..540ec770b 100644
--- a/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl
+++ b/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl
@@ -1,7 +1,7 @@
 <label>{l s='Limit to a single customer'}</label>
 <div class="margin-form">
 	<input type="hidden" id="id_customer" name="id_customer" value="{$currentTab->getFieldValue($currentObject, 'id_customer')|intval}" />
-	<input type="text" id="customerFilter" name="customerFilter" value="{$customerFilter}" style="width:400px" />
+	<input type="text" id="customerFilter" name="customerFilter" value="{$customerFilter|htmlentities}" style="width:400px" />
 	<p class="preference_description">{l s='Optional, the cart rule will be available for everyone if you leave this field blank.'}</p>
 </div>
 <label>{l s='Validity'}</label>
diff --git a/admin-dev/themes/default/template/controllers/login/content.tpl b/admin-dev/themes/default/template/controllers/login/content.tpl
index 8c3c700e3..df6c2c9e5 100755
--- a/admin-dev/themes/default/template/controllers/login/content.tpl
+++ b/admin-dev/themes/default/template/controllers/login/content.tpl
@@ -52,7 +52,7 @@
 		<h1>{$shop_name}</h1>
 		<form action="" method="post" id="login_form" onsubmit="doAjaxLogin();return false;">
 			<label for="email">{l s='E-mail address:'}</label><br />
-			<input type="text" id="email" name="email" class="input" value="{if isset($email)}{$email}{/if}" />
+			<input type="text" id="email" name="email" class="input" value="{if isset($email)}{$email|htmlentities}{/if}" />
 			<div style="margin: 1.8em 0 0 0;">
 				<label for="passwd">{l s='Password:'}</label><br />
 				<input id="passwd" type="password" name="passwd" class="input" value="{if isset($password)}{$password}{/if}"/>
diff --git a/admin-dev/themes/default/template/controllers/orders/_product_line.tpl b/admin-dev/themes/default/template/controllers/orders/_product_line.tpl
index a2e57298e..e4debaf25 100755
--- a/admin-dev/themes/default/template/controllers/orders/_product_line.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/_product_line.tpl
@@ -53,7 +53,7 @@
 		<span class="product_quantity_show">{$product['product_quantity']}</span>
 		{if $can_edit}
 		<span class="product_quantity_edit" style="display:none;">
-			<input type="text" name="product_quantity" class="edit_product_quantity" value="{$product['product_quantity']}" size="2" />
+			<input type="text" name="product_quantity" class="edit_product_quantity" value="{$product['product_quantity']|htmlentities}" size="2" />
 		</span>
 		{/if}
 	</td>
diff --git a/admin-dev/themes/default/template/controllers/orders/_shipping.tpl b/admin-dev/themes/default/template/controllers/orders/_shipping.tpl
index 46afe17fd..95e7be3b5 100644
--- a/admin-dev/themes/default/template/controllers/orders/_shipping.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/_shipping.tpl
@@ -60,8 +60,8 @@
 			{if $line.can_edit}
 				<form style="display: inline;" method="POST" action="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$smarty.get.id_order|escape:'htmlall':'UTF-8'}">
 					<span class="shipping_number_edit" style="display:none;">
-						<input type="text" name="id_order_carrier" value="{$line.id_order_carrier}" />
-						<input type="text" name="tracking_number" value="{$line.tracking_number}" />
+						<input type="text" name="id_order_carrier" value="{$line.id_order_carrier|htmlentities}" />
+						<input type="text" name="tracking_number" value="{$line.tracking_number|htmlentities}" />
 						<input type="submit" class="button" name="submitShippingNumber" value="{l s='Update'}" />
 					</span>
 					<a href="#" class="edit_shipping_number_link"><img src="../img/admin/edit.gif" alt="{l s='Edit'}" /></a>
diff --git a/admin-dev/themes/default/template/controllers/orders/view.tpl b/admin-dev/themes/default/template/controllers/orders/view.tpl
index 1d07e203b..050ddc684 100755
--- a/admin-dev/themes/default/template/controllers/orders/view.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/view.tpl
@@ -407,7 +407,7 @@
 								{if $line.can_edit}
 								<form style="display: inline;" method="POST" action="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$smarty.get.id_order|escape:'htmlall':'UTF-8'}&id_order_invoice={if $line.id_order_invoice}{$line.id_order_invoice|escape:'htmlall':'UTF-8'}{else}0{/if}&id_carrier={if $line.id_carrier}{$line.id_carrier|escape:'htmlall':'UTF-8'}{else}0{/if}">
 									<span class="shipping_number_edit" style="display:none;">
-										<input type="text" name="tracking_number" value="{$line.tracking_number}" />
+										<input type="text" name="tracking_number" value="{$line.tracking_number|htmlentities}" />
 										<input type="submit" class="button" name="submitShippingNumber" value="{l s='Update'}" />
 									</span>
 									<a href="#" class="edit_shipping_number_link"><img src="../img/admin/edit.gif" alt="{l s='Edit'}" /></a>
diff --git a/admin-dev/themes/default/template/controllers/preferences/options.tpl b/admin-dev/themes/default/template/controllers/preferences/options.tpl
index 26b87b8aa..b8f0e39c5 100644
--- a/admin-dev/themes/default/template/controllers/preferences/options.tpl
+++ b/admin-dev/themes/default/template/controllers/preferences/options.tpl
@@ -32,7 +32,7 @@
 	{elseif $field['type'] == 'maintenance_ip'}
 		<div class="margin-form">
 			{$field['script_ip']}
-			<input type="text"{if isset($field['id'])} id="{$field['id']}"{/if} size="{if isset($field['size'])}{$field['size']|intval}{else} 5{/if}" name="{$key}" value="{$field['value']|escape:'htmlall':'UTF-8'}" />
+			<input type="text"{if isset($field['id'])} id="{$field['id']}"{/if} size="{if isset($field['size'])}{$field['size']|intval}{else} 5{/if}" name="{$key}" value="{$field['value']|escape:'htmlall':'UTF-8'|htmlentities}" />
 			{$field['link_remove_ip']}
 	{else}
 		<div class="margin-form">
diff --git a/admin-dev/themes/default/template/controllers/products/accounting.tpl b/admin-dev/themes/default/template/controllers/products/accounting.tpl
index 08a9ab1d1..2f26336c7 100644
--- a/admin-dev/themes/default/template/controllers/products/accounting.tpl
+++ b/admin-dev/themes/default/template/controllers/products/accounting.tpl
@@ -45,7 +45,7 @@
 				{foreach from=$productAccountNumberList['zones'] key=id_zone item=currentZone}
 					<label>{$currentZone['name']}</label>
 					<div class="margin-form">
-						<input type="text" name="zone_{$id_zone}" value="{$currentZone['account_number']}" />
+						<input type="text" name="zone_{$id_zone}" value="{$currentZone['account_number']|htmlentities}" />
 					</div>
 				{/foreach}
 			</form>
diff --git a/admin-dev/themes/default/template/controllers/products/attachments.tpl b/admin-dev/themes/default/template/controllers/products/attachments.tpl
index e1c790ad4..17716221e 100644
--- a/admin-dev/themes/default/template/controllers/products/attachments.tpl
+++ b/admin-dev/themes/default/template/controllers/products/attachments.tpl
@@ -33,7 +33,7 @@
 		<div class="margin-form translatable">
 			{foreach $languages as $language}
 				<div class="lang_{$language.id_lang}" style="{if $language.id_lang != $default_form_language}display:none;{/if}float: left;">
-					<input type="text" name="attachment_name_{$language.id_lang}" value="{$attachment_name[$language.id_lang]}" />
+					<input type="text" name="attachment_name_{$language.id_lang}" value="{$attachment_name[$language.id_lang]|htmlentities}" />
 				</div>
 			{/foreach}
 			<sup>&nbsp;*</sup>
@@ -44,7 +44,7 @@
 		<div class="margin-form translatable">
 			{foreach $languages as $language}
 				<div id="attachment_description_{$language.id_lang}" style="display: {if $language.id_lang == $default_form_language}block{else}none{/if}; float: left;">
-					<textarea name="attachment_description_{$language.id_lang}">{$attachment_description[$language.id_lang]}</textarea>
+					<textarea name="attachment_description_{$language.id_lang}">{$attachment_description[$language.id_lang]|htmlentities}</textarea>
 				</div>
 			{/foreach}
 		</div>
diff --git a/admin-dev/themes/default/template/controllers/products/customization.tpl b/admin-dev/themes/default/template/controllers/products/customization.tpl
index c480ac017..eb6cd6730 100644
--- a/admin-dev/themes/default/template/controllers/products/customization.tpl
+++ b/admin-dev/themes/default/template/controllers/products/customization.tpl
@@ -32,14 +32,14 @@
 		<tr>
 			<td style="width:150px;text-align:right;padding-right:10px;font-weight:bold;vertical-align:top;" valign="top">{l s='File fields:'}</td>
 			<td style="padding-bottom:5px;">
-				<input type="text" name="uploadable_files" id="uploadable_files" size="4" value="{$uploadable_files}" />
+				<input type="text" name="uploadable_files" id="uploadable_files" size="4" value="{$uploadable_files|htmlentities}" />
 				<p class="preference_description">{l s='Number of upload file fields displayed'}</p>
 			</td>
 		</tr>
 		<tr>
 			<td style="width:150px;text-align:right;padding-right:10px;font-weight:bold;vertical-align:top;" valign="top">{l s='Text fields:'}</td>
 			<td style="padding-bottom:5px;">
-				<input type="text" name="text_fields" id="text_fields" size="4" value="{$text_fields}" />
+				<input type="text" name="text_fields" id="text_fields" size="4" value="{$text_fields|htmlentities}" />
 				<p class="preference_description">{l s='Number of text fields displayed'}</p>
 			</td>
 		</tr>
diff --git a/admin-dev/themes/default/template/controllers/products/quantities.tpl b/admin-dev/themes/default/template/controllers/products/quantities.tpl
index c808ffd6b..05b77a74c 100644
--- a/admin-dev/themes/default/template/controllers/products/quantities.tpl
+++ b/admin-dev/themes/default/template/controllers/products/quantities.tpl
@@ -131,7 +131,7 @@
 								<tr>
 									<td  class="available_quantity" id="qty_{$attribute['id_product_attribute']}">
 										<span>{$available_quantity[$attribute['id_product_attribute']]}</span>
-										<input type="text" value="{$available_quantity[$attribute['id_product_attribute']]}"/>
+										<input type="text" value="{$available_quantity[$attribute['id_product_attribute']]|htmlentities}"/>
 									</td>
 									<td>{$product_designation[$attribute['id_product_attribute']]}</td>
 								</tr>
diff --git a/admin-dev/themes/default/template/controllers/products/shipping.tpl b/admin-dev/themes/default/template/controllers/products/shipping.tpl
index c4e8d4f90..ca939aa1a 100644
--- a/admin-dev/themes/default/template/controllers/products/shipping.tpl
+++ b/admin-dev/themes/default/template/controllers/products/shipping.tpl
@@ -57,7 +57,7 @@
 	<tr>
 		<td class="col-left"><label>{l s='Additional shipping cost:'}</label></td>
 		<td style="padding-bottom:5px;">{$currency->prefix}<input type="text" name="additional_shipping_cost"
-				value="{$product->additional_shipping_cost}" />{$currency->suffix}
+				value="{$product->additional_shipping_cost|htmlentities}" />{$currency->suffix}
 			{if $country_display_tax_label}{l s='tax excl.'}{/if}
 			<p class="preference_description">{l s='Carrier tax will be applied.'}</p>
 		</td>
diff --git a/admin-dev/themes/default/template/controllers/products/suppliers.tpl b/admin-dev/themes/default/template/controllers/products/suppliers.tpl
index 3252b3b3b..0708e67b1 100644
--- a/admin-dev/themes/default/template/controllers/products/suppliers.tpl
+++ b/admin-dev/themes/default/template/controllers/products/suppliers.tpl
@@ -106,10 +106,10 @@
 						<tr {if $index is odd}class="alt_row"{/if}>
 							<td>{$product_designation[$attribute['id_product_attribute']]}</td>
 							<td>
-								<input type="text" size="10" value="{$reference}" name="supplier_reference_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
+								<input type="text" size="10" value="{$reference|htmlentities}" name="supplier_reference_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
 							</td>
 							<td>
-								<input type="text" size="10" value="{$price_te}" name="product_price_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
+								<input type="text" size="10" value="{$price_te|htmlentities}" name="product_price_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
 							</td>
 							<td>
 								<select name="product_price_currency_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}">
diff --git a/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl b/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl
index 3d4aa1c4e..d4fbe1515 100644
--- a/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl
+++ b/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl
@@ -202,7 +202,7 @@
 
 							<p class="block">
 								<label for="virtual_product_name" class="t">{l s='Filename'}</label>
-								<input type="text" id="virtual_product_name" name="virtual_product_name" style="width:200px" value="{$product->productDownload->display_filename|htmlentitiesUTF8}" />
+								<input type="text" id="virtual_product_name" name="virtual_product_name" style="width:200px" value="{$product->productDownload->display_filename|htmlentities}" />
 								<span class="hint" name="help_box" style="display:none;">{l s='The full filename with its extension (e.g., Book.pdf)'}</span>
 							</p>
 						</div>
@@ -213,7 +213,7 @@
 						<div id="virtual_good_more" style="'.$hidden.'padding:5px;width:40%;float:left;margin-left:10px">
 							<p class="block">
 								<label for="virtual_product_nb_downloable" class="t">{l s='Number of downloads'}</label>
-								<input type="text" id="virtual_product_nb_downloable" name="virtual_product_nb_downloable" value="{$product->productDownload->nb_downloadable}" class="" size="6" />
+								<input type="text" id="virtual_product_nb_downloable" name="virtual_product_nb_downloable" value="{$product->productDownload->nb_downloadable|htmlentities}" class="" size="6" />
 								<span class="hint" name="help_box" style="display:none">{l s='Number of authorized downloads per customer'}</span>
 							</p>
 							<p class="block">
@@ -223,7 +223,7 @@
 							</p>
 							<p class="block">
 								<label for="virtual_product_nb_days" class="t">{l s='Number of days'}</label>
-								<input type="text" id="virtual_product_nb_days" name="virtual_product_nb_days" value="{$product->productDownload->nb_days_accessible}" class="" size="4" /><sup> *</sup>
+								<input type="text" id="virtual_product_nb_days" name="virtual_product_nb_days" value="{$product->productDownload->nb_days_accessible|htmlentities}" class="" size="4" /><sup> *</sup>
 								<span class="hint" name="help_box" style="display:none">{l s='How many days this file can be accessed by customers'} - <em>({l s='set to zero for unlimited access'})</em></span>
 							</p>
 							<p class="block">
diff --git a/admin-dev/themes/default/template/controllers/products/warehouses.tpl b/admin-dev/themes/default/template/controllers/products/warehouses.tpl
index 7bc4812f3..0a19b5b84 100644
--- a/admin-dev/themes/default/template/controllers/products/warehouses.tpl
+++ b/admin-dev/themes/default/template/controllers/products/warehouses.tpl
@@ -67,7 +67,7 @@
 							<td>{$product_designation[$attribute['id_product_attribute']]}</td>
 							<td><input type="text"
 								name="location_warehouse_{$warehouse['id_warehouse']}_{$attribute['id_product']}_{$attribute['id_product_attribute']}"
-								value="{$location}"
+								value="{$location|htmlentities}"
 								size="20" />
 							</td>
 						</tr>
diff --git a/admin-dev/themes/default/template/controllers/stores/form.tpl b/admin-dev/themes/default/template/controllers/stores/form.tpl
index d6c348a0e..1bb953fb3 100644
--- a/admin-dev/themes/default/template/controllers/stores/form.tpl
+++ b/admin-dev/themes/default/template/controllers/stores/form.tpl
@@ -43,13 +43,13 @@
 			{if isset($input.maxlength)}maxlength="{$input.maxlength}"{/if}
 			name="latitude"
 			id="latitude"
-			value="{$fields_value[$input.name]}" /> /
+			value="{$fields_value[$input.name]|htmlentities}" /> /
 		<input type="text"
 			{if isset($input.size)}size="{$input.size}"{/if}
 			{if isset($input.maxlength)}maxlength="{$input.maxlength}"{/if}
 			name="longitude"
 			id="longitude"
-			value="{$fields_value['longitude']}" />
+			value="{$fields_value['longitude']|htmlentities}" />
 	{/if}
 {/block}
 
@@ -84,7 +84,7 @@
 				{foreach $fields_value.days as $k => $value}
 					<tr style="color: #7F7F7F; font-size: 0.85em;">
 						<td>{$value}</td>
-						<td><input type="text" size="25" name="hours_{$k}" value="{if isset($fields_value.hours[$k-1])}{$fields_value.hours[$k-1]}{/if}" /><br /></td>
+						<td><input type="text" size="25" name="hours_{$k}" value="{if isset($fields_value.hours[$k-1])}{$fields_value.hours[$k-1]|htmlentities}{/if}" /><br /></td>
 					</tr>
 				{/foreach}
 			</table>
diff --git a/admin-dev/themes/default/template/controllers/supply_orders/form.tpl b/admin-dev/themes/default/template/controllers/supply_orders/form.tpl
index 73d0f2bbd..59a1654eb 100644
--- a/admin-dev/themes/default/template/controllers/supply_orders/form.tpl
+++ b/admin-dev/themes/default/template/controllers/supply_orders/form.tpl
@@ -94,10 +94,10 @@
 										<input type="hidden" name="input_name_{$product.id_product}_{$product.id_product_attribute}" value="{$product.name}" />
 									</td>
 									<td class="center">
-										{$currency->prefix}&nbsp;<input type="text" name="input_unit_price_te_{$product.id_product}_{$product.id_product_attribute}" value="{$product.unit_price_te}" size="8" />&nbsp;{$currency->suffix}
+										{$currency->prefix}&nbsp;<input type="text" name="input_unit_price_te_{$product.id_product}_{$product.id_product_attribute}" value="{$product.unit_price_te|htmlentities}" size="8" />&nbsp;{$currency->suffix}
 									</td>
 									<td class="center">
-										<input type="text" name="input_quantity_expected_{$product.id_product}_{$product.id_product_attribute}" value="{$product.quantity_expected}" size="5" />
+										<input type="text" name="input_quantity_expected_{$product.id_product}_{$product.id_product_attribute}" value="{$product.quantity_expected|htmlentities}" size="5" />
 									</td>
 									<td class="center">
 										<input type="text" name="input_discount_rate_{$product.id_product}_{$product.id_product_attribute}" value="{round($product.discount_rate, 4)}" size="5" />%
diff --git a/admin-dev/themes/default/template/header.tpl b/admin-dev/themes/default/template/header.tpl
index 8b178f66a..8846a23af 100644
--- a/admin-dev/themes/default/template/header.tpl
+++ b/admin-dev/themes/default/template/header.tpl
@@ -166,7 +166,7 @@
 					<option value="4" {if {$search_type} == 4} selected="selected" {/if}>{l s='invoices'}</option>
 					<option value="5" {if {$search_type} == 5} selected="selected" {/if}>{l s='carts'}</option>
 				</select>
-				<input type="text" name="bo_query" id="bo_query" value="{$bo_query}" />
+				<input type="text" name="bo_query" id="bo_query" value="{$bo_query|htmlentities}" />
 				<input type="submit" id="bo_search_submit" class="button" value="{l s='Search'}"/>
 			</form>
 		</div>
diff --git a/admin-dev/themes/default/template/helper/form/form.tpl b/admin-dev/themes/default/template/helper/form/form.tpl
index 2e5b53f2e..220c67ec8 100644
--- a/admin-dev/themes/default/template/helper/form/form.tpl
+++ b/admin-dev/themes/default/template/helper/form/form.tpl
@@ -67,7 +67,7 @@
 							{/if}
 						{/block}
 						{if $input.type == 'hidden'}
-							<input type="hidden" name="{$input.name}" id="{$input.name}" value="{$fields_value[$input.name]}" />
+							<input type="hidden" name="{$input.name}" id="{$input.name}" value="{$fields_value[$input.name]|htmlentities}" />
 						{else}
 						{block name="start_field_block"}
 							<div class="margin-form">
@@ -94,7 +94,7 @@
 												<input type="text"
 														name="{$input.name}_{$language.id_lang}"
 														id="{if isset($input.id)}{$input.id}_{$language.id_lang}{else}{$input.name}_{$language.id_lang}{/if}"
-														value="{if isset($input.string_format) && $input.string_format}{$value_text|string_format:$input.string_format}{else}{$value_text}{/if}"
+														value="{if isset($input.string_format) && $input.string_format}{$value_text|string_format:$input.string_format|htmlentities}{else}{$value_text}{/if}"
 														class="{if $input.type == 'tags'}tagify {/if}{if isset($input.class)}{$input.class}{/if}"
 														{if isset($input.size)}size="{$input.size}"{/if}
 														{if isset($input.maxlength)}maxlength="{$input.maxlength}"{/if}
@@ -124,7 +124,7 @@
 									<input type="text"
 											name="{$input.name}"
 											id="{if isset($input.id)}{$input.id}{else}{$input.name}{/if}"
-											value="{if isset($input.string_format) && $input.string_format}{$value_text|string_format:$input.string_format}{else}{$value_text}{/if}"
+											value="{if isset($input.string_format) && $input.string_format}{$value_text|string_format:$input.string_format|htmlentities}{else}{$value_text}{/if}"
 											class="{if $input.type == 'tags'}tagify {/if}"
 											{if isset($input.size)}size="{$input.size}"{/if}
 											{if isset($input.maxlength)}maxlength="{$input.maxlength}"{/if}
@@ -199,7 +199,7 @@
 									<input type="radio"
 											name="{$input.name}"
 											id="{$value.id}"
-											value="{$value.value|escape:'htmlall':'UTF-8'}"
+											value="{$value.value|escape:'htmlall':'UTF-8'|htmlentities}"
 											{if $fields_value[$input.name] == $value.value}checked="checked"{/if}
 											{if isset($input.disabled) && $input.disabled}disabled="disabled"{/if} />
 									<label {if isset($input.class)}class="{$input.class}"{/if} for="{$value.id}">
@@ -221,12 +221,12 @@
 									<div class="translatable">
 										{foreach $languages as $language}
 											<div class="lang_{$language.id_lang}" id="{$input.name}_{$language.id_lang}" style="display:{if $language.id_lang == $defaultFormLanguage}block{else}none{/if}; float: left;">
-												<textarea cols="{$input.cols}" rows="{$input.rows}" name="{$input.name}_{$language.id_lang}" {if isset($input.autoload_rte) && $input.autoload_rte}class="rte autoload_rte"{/if} >{$fields_value[$input.name][$language.id_lang]}</textarea>
+												<textarea cols="{$input.cols}" rows="{$input.rows}" name="{$input.name}_{$language.id_lang}" {if isset($input.autoload_rte) && $input.autoload_rte}class="rte autoload_rte"{/if} >{$fields_value[$input.name][$language.id_lang]|htmlentities}</textarea>
 											</div>
 										{/foreach}
 									</div>
 								{else}
-									<textarea name="{$input.name}" id="{$input.name}" cols="{$input.cols}" rows="{$input.rows}">{$fields_value[$input.name]}</textarea>
+									<textarea name="{$input.name}" id="{$input.name}" cols="{$input.cols}" rows="{$input.rows}">{$fields_value[$input.name]|htmlentities}</textarea>
 								{/if}
 							{elseif $input.type == 'checkbox'}
 								{foreach $input.values.query as $value}
@@ -234,7 +234,7 @@
 									<input type="checkbox"
 										name="{$id_checkbox}"
 										id="{$id_checkbox}"
-										{if isset($value.val)}value="{$value.val}"{/if}
+										{if isset($value.val)}value="{$value.val|htmlentities}"{/if}
 										{if isset($fields_value[$id_checkbox]) && $fields_value[$id_checkbox]}checked="checked"{/if} />
 									<label for="{$id_checkbox}" class="t"><strong>{$value[$input.values.name]}</strong></label><br />
 								{/foreach}
@@ -304,7 +304,7 @@
 									{if isset($input.class)}class="{$input.class}"
 									{else}class="color mColorPickerInput"{/if}
 									name="{$input.name}"
-									value="{$fields_value[$input.name]}" />
+									value="{$fields_value[$input.name]|htmlentities}" />
 							{elseif $input.type == 'date'}
 								<input type="text"
 									size="{$input.size}"
@@ -312,7 +312,7 @@
 									{if isset($input.class)}class="{$input.class}"
 									{else}class="datepicker"{/if}
 									name="{$input.name}"
-									value="{$fields_value[$input.name]}" />
+									value="{$fields_value[$input.name]|htmlentities}" />
 							{elseif $input.type == 'free'}
 								{$fields_value[$input.name]}
 							{/if}
diff --git a/admin-dev/themes/default/template/helper/list/list_content.tpl b/admin-dev/themes/default/template/helper/list/list_content.tpl
index 1fb535439..bbe7605bd 100644
--- a/admin-dev/themes/default/template/helper/list/list_content.tpl
+++ b/admin-dev/themes/default/template/helper/list/list_content.tpl
@@ -95,7 +95,7 @@
                 {$tr.$key} {l s='%'}
 			{* If type is 'editable', an input is created *}
 			{elseif isset($params.type) && $params.type == 'editable' && isset($tr.id)}
-				<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key}" class="{$key}" />
+				<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key|htmlentities}" class="{$key}" />
 			{elseif isset($params.callback)}
 				{$tr.$key}
 			{elseif isset($tr.$key) && $key == 'color'}
diff --git a/admin-dev/themes/default/template/helper/options/options.tpl b/admin-dev/themes/default/template/helper/options/options.tpl
index 17ac1f97f..bbd76a343 100644
--- a/admin-dev/themes/default/template/helper/options/options.tpl
+++ b/admin-dev/themes/default/template/helper/options/options.tpl
@@ -133,7 +133,7 @@
 					{if $field['type'] == 'textLang'}
 						{foreach $field['languages'] AS $id_lang => $value}
 							<div id="{$key}_{$id_lang}" style="margin-bottom:8px; display: {if $id_lang == $current_id_lang}block{else}none{/if}; float: left; vertical-align: top;">
-								<input type="text" size="{if isset($field['size'])}{$field['size']|intval}{else}5{/if}" name="{$key}_{$id_lang}" value="{$value}" />
+								<input type="text" size="{if isset($field['size'])}{$field['size']|intval}{else}5{/if}" name="{$key}_{$id_lang}" value="{$value|htmlentities}" />
 							</div>
 						{/foreach}
 					{elseif $field['type'] == 'textareaLang'}