diff --git a/admin-dev/themes/default/template/controllers/referrers/calendar.tpl b/admin-dev/themes/default/template/controllers/referrers/calendar.tpl
index 080bdde32..fe2ed9cbc 100644
--- a/admin-dev/themes/default/template/controllers/referrers/calendar.tpl
+++ b/admin-dev/themes/default/template/controllers/referrers/calendar.tpl
@@ -34,10 +34,10 @@
 					<input type="submit" name="submitDateMonthPrev" class="button submitDateMonthPrev" value="{$translations.Month}-1">
 					<input type="submit" name="submitDateYearPrev" class="button submitDateYearPrev" value="{$translations.Year}-1">
 					<p><span>{if isset($translations.From)}{$translations.From}{else}{l s='From:'}{/if}</span>
-						<input type="text" name="datepickerFrom" id="datepickerFrom" value="{$datepickerFrom}" class="datepicker">
+						<input type="text" name="datepickerFrom" id="datepickerFrom" value="{$datepickerFrom|escape}" class="datepicker">
 					</p>
 					<p><span>{if isset($translations.To)}{$translations.To}{else}<span>{l s='From:'}</span>{/if}</span>
-						<input type="text" name="datepickerTo" id="datepickerTo" value="{$datepickerTo}" class="datepicker">
+						<input type="text" name="datepickerTo" id="datepickerTo" value="{$datepickerTo|escape}" class="datepicker">
 					</p>
 					<input type="submit" name="submitDatePicker" id="submitDatePicker" class="button" value="{if isset($translations.Save)}{$translations.Save}{else}{l s='   Save   '}{/if}" />
 				</form>
diff --git a/modules/blocklink/blocklink.php b/modules/blocklink/blocklink.php
index b56186013..f3292ef1a 100644
--- a/modules/blocklink/blocklink.php
+++ b/modules/blocklink/blocklink.php
@@ -142,18 +142,17 @@ class BlockLink extends Module
 	
 	public function addLink()
 	{
+		if (!($languages = Language::getLanguages()))
+			 return false;
+		$defaultLanguage = (int)(Configuration::get('PS_LANG_DEFAULT'));
+
 		if ($id_link = Tools::getValue('id_link'))
 		{
-			// Url registration
-			if (!Db::getInstance()->execute('UPDATE '._DB_PREFIX_.'blocklink SET `url`=\''.pSQL($_POST['url']).'\', `new_window`='.(isset($_POST['newWindow']) ? 1 : 0).' WHERE `id_blocklink`='.(int)$id_link))
+			if (!Db::getInstance()->execute('UPDATE '._DB_PREFIX_.'blocklink SET `url` = \''.pSQL($_POST['url']).'\', `new_window` = '.(isset($_POST['newWindow']) ? 1 : 0).' WHERE `id_blocklink` = '.(int)$id_link))
 				return false;
-			// Multilingual text
-			$languages = Language::getLanguages();
-			$defaultLanguage = (int)(Configuration::get('PS_LANG_DEFAULT'));
-			if (!$languages)
-				 return false;
 			if (!Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink_lang WHERE `id_blocklink` = '.(int)$id_link))
 				return false;
+				
 			foreach ($languages as $language)
 				if (!empty($_POST['text_'.$language['id_lang']]))
 		 	 	{
@@ -166,16 +165,11 @@ class BlockLink extends Module
 		}
 		else
 		{
-			// Url registration
 			if (!Db::getInstance()->execute('INSERT INTO '._DB_PREFIX_.'blocklink 
 														VALUES (NULL, \''.pSQL($_POST['url']).'\', '.((isset($_POST['newWindow']) && $_POST['newWindow']) == 'on' ? 1 : 0).')') ||
 														!$id_link = Db::getInstance()->Insert_ID())
 				return false;
-			// Multilingual text
-			$languages = Language::getLanguages();
-			$defaultLanguage = (int)(Configuration::get('PS_LANG_DEFAULT'));
-			if (!$languages)
-				return false;
+
 			foreach ($languages as $language)
 				if (!empty($_POST['text_'.$language['id_lang']]))
 				{
@@ -214,9 +208,9 @@ class BlockLink extends Module
 
 	public function deleteLink()
 	{
-		return (Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink WHERE `id_blocklink`='.(int)($_GET['id'])) &&
-					Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink_shop WHERE `id_blocklink`='.(int)($_GET['id'])) &&
-					Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink_lang WHERE `id_blocklink`='.(int)($_GET['id'])));
+		return (Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink WHERE `id_blocklink` = '.(int)$_GET['id']) &&
+					Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink_shop WHERE `id_blocklink` = '.(int)$_GET['id']) &&
+					Db::getInstance()->execute('DELETE FROM '._DB_PREFIX_.'blocklink_lang WHERE `id_blocklink` = '.(int)$_GET['id']));
 	}
 
 	public function updateTitle()
@@ -299,11 +293,11 @@ class BlockLink extends Module
 		{
 			if ($id_link = (int)Tools::getValue('id_link'))
 			{
-				$res = Db::getInstance()->executeS('SELECT *
-																FROM '._DB_PREFIX_.'blocklink b
-																LEFT JOIN '._DB_PREFIX_.'blocklink_lang bl ON (b.id_blocklink = bl.id_blocklink)
-																WHERE b.id_blocklink='.(int)$id_link);
-		
+				$res = Db::getInstance()->executeS('
+				SELECT *
+				FROM '._DB_PREFIX_.'blocklink b
+				LEFT JOIN '._DB_PREFIX_.'blocklink_lang bl ON (b.id_blocklink = bl.id_blocklink)
+				WHERE b.id_blocklink='.(int)$id_link);
 				if ($res)
 					foreach ($res as $row)
 					{
@@ -360,14 +354,14 @@ class BlockLink extends Module
 		foreach ($languages as $language)
 			$this->_html .= '
 					<div id="title_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $defaultLanguage ? 'block' : 'none').'; float: left;">
-						<input type="text" name="title_'.$language['id_lang'].'" value="'.(($this->error && isset($_POST['title'])) ? $_POST['title'] : Configuration::get('PS_BLOCKLINK_TITLE', $language['id_lang'])).'" /><sup> *</sup>
+						<input type="text" name="title_'.$language['id_lang'].'" value="'.Tools::safeOutput(($this->error && isset($_POST['title'])) ? $_POST['title'] : Configuration::get('PS_BLOCKLINK_TITLE', $language['id_lang'])).'" /><sup> *</sup>
 					</div>';
 		$this->_html .= $this->displayFlags($languages, $defaultLanguage, $divLangName, 'title', true);
 		$this->_html .= '
 				<div class="clear"></div>
 				</div>
 				<label>'.$this->l('Block URL:').'</label>
-				<div class="margin-form"><input type="text" name="title_url" value="'.(($this->error && isset($_POST['title_url'])) ? $_POST['title_url'] : $title_url).'" /></div>
+				<div class="margin-form"><input type="text" name="title_url" value="'.Tools::safeOutput(($this->error && isset($_POST['title_url'])) ? $_POST['title_url'] : $title_url).'" /></div>
 				<div class="margin-form"><input type="submit" class="button" name="submitTitle" value="'.$this->l('Update').'" /></div>
 			</form>
 		</fieldset>
@@ -428,12 +422,12 @@ class BlockLink extends Module
 			foreach ($links as $link)
 				$this->_html .= '
 				<tr>
-					<td>'.$link['id'].'</td>
-					<td>'.$link['text_'.$this->context->language->id].'</td>
-					<td>'.$link['url'].'</td>
+					<td>'.(int)$link['id'].'</td>
+					<td>'.Tools::safeOutput($link['text_'.$this->context->language->id]).'</td>
+					<td>'.Tools::safeOutput($link['url']).'</td>
 					<td>
-						<img src="../img/admin/edit.gif" alt="" title="" onclick="linkEdition('.$link['id'].')" style="cursor: pointer" />
-						<img src="../img/admin/delete.gif" alt="" title="" onclick="linkDeletion('.$link['id'].')" style="cursor: pointer" />
+						<img src="../img/admin/edit.gif" alt="" title="" onclick="linkEdition('.(int)$link['id'].')" style="cursor: pointer" />
+						<img src="../img/admin/delete.gif" alt="" title="" onclick="linkDeletion('.(int)$link['id'].')" style="cursor: pointer" />
 					</td>
 				</tr>';
 		$i = 0;
@@ -447,7 +441,7 @@ class BlockLink extends Module
 		}
 		$this->_html .= '
 		</table>
-		<input type="hidden" id="languageFirst" value="'.$languages[0]['id_lang'].'" />
+		<input type="hidden" id="languageFirst" value="'.(int)$languages[0]['id_lang'].'" />
 		<input type="hidden" id="languageNb" value="'.count($languages).'" />';
 	}
 }
diff --git a/modules/blocklink/blocklink.tpl b/modules/blocklink/blocklink.tpl
index 1cce61bec..e55ee670e 100644
--- a/modules/blocklink/blocklink.tpl
+++ b/modules/blocklink/blocklink.tpl
@@ -28,15 +28,15 @@
 <div id="links_block_left" class="block">
 	<h4>
 	{if $url}
-		<a href="{$url}">{$title}</a>
+		<a href="{$url|escape}">{$title|escape}</a>
 	{else}
-		{$title}
+		{$title|escape}
 	{/if}
 	</h4>
 	<ul class="block_content bullet">
 	{foreach from=$blocklink_links item=blocklink_link}
 		{if isset($blocklink_link.$lang)} 
-		<li><a href="{$blocklink_link.url|htmlentities}"{if $blocklink_link.newWindow} onclick="window.open(this.href);return false;"{/if}>{$blocklink_link.$lang}</a></li>
+			<li><a href="{$blocklink_link.url|escape}"{if $blocklink_link.newWindow} onclick="window.open(this.href);return false;"{/if}>{$blocklink_link.$lang|escape}</a></li>
 		{/if}
 	{/foreach}
 	</ul>
diff --git a/modules/productcomments/productcomments.php b/modules/productcomments/productcomments.php
index 5cb1a8502..1bccc23c9 100644
--- a/modules/productcomments/productcomments.php
+++ b/modules/productcomments/productcomments.php
@@ -327,7 +327,7 @@ class ProductComments extends Module
 		$this->_html = '<script type="text/javascript" src="'.$this->_path.'js/moderate.js"></script>
 			<fieldset class="width2">
 				<legend><img src="../img/admin/cog.gif" alt="" title="" />'.$this->l('Configuration').'</legend>
-				<form action="'.$this->_baseUrl.'" method="post" name="comment_configuration">
+				<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="comment_configuration">
 					<label style="padding-top: 0;">'.$this->l('All comments must be validated by an employee').'</label>
 					<div class="margin-form">
 						<input type="radio" name="moderate" id="moderate_on" value="1" '.(Configuration::get('PRODUCT_COMMENTS_MODERATE') ? 'checked="checked" ' : '').'/>
@@ -364,7 +364,7 @@ class ProductComments extends Module
 				if (count($comments))
 				{
 					$this->_html .= '
-					<form action="'.$this->_baseUrl.'" method="post" name="comment_form">
+					<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="comment_form">
 					<input type="hidden" name="id_product_comment[]" id="id_product_comment" />
 					<input type="hidden" name="action" id="action" />
 					<br /><table class="table" border="0" cellspacing="0" cellpadding="0">
@@ -413,7 +413,7 @@ class ProductComments extends Module
 				if (count($comments))
 				{
 					$this->_html .= '
-					<form action="'.$this->_baseUrl.'" method="post" name="comment_form">
+					<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="comment_form">
 					<input type="hidden" name="id_product_comment[]" id="id_product_comment" />
 					<input type="hidden" name="action" id="action" />
 					<br /><table class="table" border="0" cellspacing="0" cellpadding="0">
@@ -461,10 +461,10 @@ class ProductComments extends Module
 		$languageIds = 'criterion';
 		$this->_html .= '
 		<fieldset class="width2">
-			<legend><img src="'.$this->_path.'img/note.png" alt="" />'.$this->l('Add a new comment criterion').'</legend>
+			<legend><img src="'.Tools::safeOutput($this->_path).'img/note.png" alt="" />'.$this->l('Add a new comment criterion').'</legend>
 				<p style="margin-bottom: 20px;">'.$this->l('You can define several criterions to help your customers during their review. For instance: efficiency, lightness, design.').'<br />
 				<br />'.$this->l('You can add a new criterion below:').'</p>
-				<form action="'.$this->_baseUrl.'" method="post" name="criterion_form">
+				<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="criterion_form">
 				<label>'.$this->l('Name').'</label>
 				<div class="margin-form">
 				<input type="hidden" name="id_product_comment_criterion" value="'.(int)$criterion->id.'" />';
@@ -517,8 +517,8 @@ class ProductComments extends Module
 							<td>'.$criterion['name'].'</td>
 							<td>'.$this->_productCommentsCriterionTypes[(int)$criterion['id_product_comment_criterion_type']].'</td>
 							<td style="text-align:center;"><img src="../img/admin/'.($criterion['active'] ? 'enabled' : 'disabled').'.gif" /></td>
-							<td><a href="'.$this->_baseUrl.'&editCriterion='.(int)$criterion['id_product_comment_criterion'].'"><img src="../img/admin/edit.gif" alt="'.$this->l('Edit').'" /></a>
-								<a href="'.$this->_baseUrl.'&deleteCriterion='.(int)$criterion['id_product_comment_criterion'].'"><img src="../img/admin/delete.gif" alt="'.$this->l('Delete').'" /></a></td><tr>';
+							<td><a href="'.Tools::safeOutput($this->_baseUrl).'&editCriterion='.(int)$criterion['id_product_comment_criterion'].'"><img src="../img/admin/edit.gif" alt="'.$this->l('Edit').'" /></a>
+								<a href="'.Tools::safeOutput($this->_baseUrl).'&deleteCriterion='.(int)$criterion['id_product_comment_criterion'].'"><img src="../img/admin/delete.gif" alt="'.$this->l('Delete').'" /></a></td><tr>';
 						}
 					$this->_html .= '</tbody></table>';
 				}
@@ -557,11 +557,11 @@ class ProductComments extends Module
 			<fieldset class="width2">
 				<legend><img src="'.$this->_path.'img/note_go.png" alt="" title="" />'.$this->l('Manage criterions scope').'</legend>
 				<p style="margin-bottom: 15px;">'.$this->l('Only criterions restricted to categories or products can be configured below:').'</p>
-				<form action="'.$this->_baseUrl.'" method="post" name="product_criterion_form">
+				<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="product_criterion_form">
 					<label>'.$this->l('Criterion').'</label>
 					<div class="margin-form">
 ">
-						<select name="id_product_comment_criterion" id="id_product_comment_criterion" onchange="window.location=\''.$this->_baseUrl.'&updateCriterion=\'+$(\'#id_product_comment_criterion option:selected\').val()">
+						<select name="id_product_comment_criterion" id="id_product_comment_criterion" onchange="window.location=\''.Tools::safeOutput($this->_baseUrl).'&updateCriterion=\'+$(\'#id_product_comment_criterion option:selected\').val()">
 							<option value="--">-- '.$this->l('Choose a criterion').' --</option>';
 						foreach ($criterions as $foo)
 								$this->_html .= '<option value="'.(int)($foo['id_product_comment_criterion']).'" '.($foo['id_product_comment_criterion'] == $id_criterion ? 'selected="selected"' : '').'>'.$foo['name'].'</option>';
@@ -572,7 +572,7 @@ class ProductComments extends Module
 			if ($id_criterion && $criterion->id_product_comment_criterion_type != 1)
 			{
 				$this->_html .='<label for="id_product_comment_criterion">'.($criterion->id_product_comment_criterion_type == 3 ? $this->l('Products') : $this->l('Categories')).'</label>
-					<form action="'.$this->_baseUrl.'" method="post" name="comment_form">
+					<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="comment_form">
 						<div id="product_criterions" class="margin-form">
 							<input type="hidden" name="id_criterion" id="id_criterion" value="'.(int)$id_criterion.'" />
 							<br /><table class="table" border="0" cellspacing="0" cellpadding="0">
@@ -617,7 +617,7 @@ class ProductComments extends Module
 				if (count($comments))
 				{
 					$this->_html .= '
-					<form action="'.$this->_baseUrl.'" method="post" name="delete_comment_form">
+					<form action="'.Tools::safeOutput($this->_baseUrl).'" method="post" name="delete_comment_form">
 					<input type="hidden" name="delete_id_product_comment[]" id="delete_id_product_comment" />
 					<input type="hidden" name="delete_action" id="delete_action" />
 					<br /><table class="table" border="0" cellspacing="0" cellpadding="0">