// W3C

admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl

@@ -52,7 +52,7 @@
 				checked = enabled ? 'checked': '';
 				$(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').attr('checked', checked);
 				$.ajax({
-					url: "{$link->getAdminLink('AdminAccess')}",
+					url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
 					cache: false,
 					data : {
 						ajaxMode : '1',
@@ -85,7 +85,7 @@
 			perfect_access_js_gestion(this, perm, id_tab, tabsize, tabnumber, table);
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')}",
+				url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
 				cache: false,
 				data : {
 					ajaxMode : '1',
@@ -134,7 +134,7 @@
 				});
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')}",
+				url: "{$link->getAdminLink('AdminAccess')|escape:'html'}",
 				cache: false,
 				data : {
 					ajaxMode: '1',

admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl

@@ -60,7 +60,7 @@
 			ifSuperAdmin($(this));
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminEmployees')}",
+				url: "{$link->getAdminLink('AdminEmployees')|escape:'html'}",
 				cache: false,
 				data : {
 					ajax : '1',

admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl

@@ -32,7 +32,7 @@
 		{
 			$.ajax({
 				type: 'GET',
-				url: '{$link->getAdminLink('AdminInformation')}',
+				url: '{$link->getAdminLink('AdminInformation')|escape:'html'}',
 				data: {
 					'action': 'checkFiles',
 					'ajax': 1

admin-dev/themes/default/template/controllers/orders/form.tpl

@@ -28,7 +28,7 @@
 	var changed_shipping_price = false;
 	var shipping_price_selected_carrier = '';
 	var current_index = '{$current}&token={$token}';
-	var admin_cart_link = '{$link->getAdminLink('AdminCarts')}';
+	var admin_cart_link = '{$link->getAdminLink('AdminCarts')|escape:'html'}';
 	var cart_quantity = new Array();
 	var currencies = new Array();
 	var id_currency = '';
@@ -100,7 +100,7 @@
 		$('#show_old_carts').click();
 		$('#payment_module_name').change();
 		$.ajaxSetup({ type:"post" });
-		$("#voucher").autocomplete('{$link->getAdminLink('AdminCartRules')}', {
+		$("#voucher").autocomplete('{$link->getAdminLink('AdminCartRules')|escape:'html'}', {
 					minChars: 3,
 					max: 15,
 					width: 250,
@@ -157,7 +157,7 @@
 				free_shipping = 1;
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')}",
+				url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -217,7 +217,7 @@
 			e.preventDefault();
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')}",
+				url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -254,7 +254,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -288,7 +288,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -324,7 +324,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -351,7 +351,7 @@
 		$('#id_cart').val(id_cart);
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -378,7 +378,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -401,7 +401,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -426,7 +426,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url : "{$link->getAdminLink('AdminOrders')}",
+			url : "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -468,7 +468,7 @@
 		$('#new_address').attr('href', address_link.replace(/id_customer=[0-9]+/, 'id_customer='+id_customer));
 		$.ajax({
 			type:"POST",
-			url : "{$link->getAdminLink('AdminCarts')}",
+			url : "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -534,7 +534,7 @@
 		$('#products_part').show();
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')}",
+			url: "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -766,7 +766,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -822,7 +822,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -845,7 +845,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -868,7 +868,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -899,7 +899,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')}",
+			url: "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -957,7 +957,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {

admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl

@@ -27,7 +27,7 @@
 
 {block name="override_tpl"}
 	<script type="text/javascript">
-	var admin_order_tab_link = "{$link->getAdminLink('AdminOrders')}";
+	var admin_order_tab_link = "{$link->getAdminLink('AdminOrders')|escape:'html'}";
 	var id_order = {$order->id};
 	var id_lang = {$current_id_lang};
 	var id_currency = {$order->id_currency};

admin-dev/themes/default/template/controllers/products/informations.tpl

@@ -43,7 +43,7 @@
 				$('document').ready( function() {
 					$(".check_product_name")
 						.autocomplete(
-							'{$link->getAdminLink('AdminProducts', true)}', {
+							'{$link->getAdminLink('AdminProducts', true)|escape:'html'}', {
 								minChars: 3,
 								max: 10,
 								width: $(".check_product_name").width(),

admin-dev/themes/default/template/controllers/products/prices.tpl

@@ -25,7 +25,7 @@
 
 <script type="text/javascript">
 var Customer = new Object();
-var product_url = '{$link->getAdminLink('AdminProducts', true)}';
+var product_url = '{$link->getAdminLink('AdminProducts', true)|escape:'html'}';
 var ecotax_tax_excl = parseFloat({$ecotax_tax_excl});
 $(document).ready(function () {
 	Customer = {
@@ -56,7 +56,7 @@ $(document).ready(function () {
 			Customer.showLoader();
 			jQuery.ajax({
 				"type": "POST",
-				"url": "{$link->getAdminLink('AdminCustomers')}",
+				"url": "{$link->getAdminLink('AdminCustomers')|escape:'html'}",
 				"async": true,
 				"dataType": "json",
 				"data": {

admin-dev/themes/default/template/controllers/shop/tree.tpl

@@ -186,7 +186,7 @@ $("#multishop-tree").jstree({
 	'plugins': ["themes","json_data","cookies","contextmenu"],
 	'json_data': {
 		'ajax': {
-			'url': "{$link->getAdminLink('AdminShop')}",
+			'url': "{$link->getAdminLink('AdminShop')|escape:'html'}",
 			'data': function(n)
 			{
 				return {

modules/bankwire/views/templates/front/payment_execution.tpl

@@ -36,7 +36,7 @@
 {else}
 
 <h3>{l s='Bank-wire payment.' mod='bankwire'}</h3>
-<form action="{$link->getModuleLink('bankwire', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('bankwire', 'validation', [], true)|escape:'html'}" method="post">
 <p>
 	<img src="{$this_path_bw}bankwire.jpg" alt="{l s='Bank wire' mod='bankwire'}" width="86" height="49" style="float:left; margin: 0px 10px 5px 0px;" />
 	{l s='You have chosen to pay by bank wire.' mod='bankwire'}
@@ -73,7 +73,7 @@
 </p>
 <p class="cart_navigation">
 	<input type="submit" name="submit" value="{l s='Place my order' mod='bankwire'}" class="exclusive_large" />
-	<a href="{$link->getPageLink('order', true, NULL, "step=3")}" class="button_large">{l s='Other payment methods' mod='bankwire'}</a>
+	<a href="{$link->getPageLink('order', true, NULL, "step=3")|escape:'html'}" class="button_large">{l s='Other payment methods' mod='bankwire'}</a>
 </p>
 </form>
 {/if}

modules/bankwire/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('bankwire', 'payment')}" title="{l s='Pay by bank wire' mod='bankwire'}">
+	<a href="{$link->getModuleLink('bankwire', 'payment')|escape:'html'}" title="{l s='Pay by bank wire' mod='bankwire'}">
 		<img src="{$this_path_bw}bankwire.jpg" alt="{l s='Pay by bank wire' mod='bankwire'}" width="86" height="49"/>
 		{l s='Pay by bank wire (order process will be longer)' mod='bankwire'}
 	</a>

modules/bankwire/views/templates/hook/payment_return.tpl

@@ -37,11 +37,11 @@
 			<br /><br />- {l s='Do not forget to insert your order reference %s in the subject of your bank wire.' sprintf=$reference mod='bankwire'}
 		{/if}		<br /><br />{l s='An email has been sent with this information.' mod='bankwire'}
 		<br /><br /> <strong>{l s='Your order will be sent as soon as we receive payment.' mod='bankwire'}</strong>
-		<br /><br />{l s='If you have questions, comments or concerns, please contact our' mod='bankwire'} <a href="{$link->getPageLink('contact', true)}">{l s='expert customer support team. ' mod='bankwire'}</a>.
+		<br /><br />{l s='If you have questions, comments or concerns, please contact our' mod='bankwire'} <a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='expert customer support team. ' mod='bankwire'}</a>.
 	</p>
 {else}
 	<p class="warning">
 		{l s='We noticed a problem with your order. If you think this is an error, feel free to contact our' mod='bankwire'} 
-		<a href="{$link->getPageLink('contact', true)}">{l s='expert customer support team. ' mod='bankwire'}</a>.
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='expert customer support team. ' mod='bankwire'}</a>.
 	</p>
 {/if}

modules/blockbestsellers/blockbestsellers-home.tpl

@@ -38,7 +38,7 @@
 				<li style="border-bottom:0" class="ajax_block_product {if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 1}clear{/if} {if $smarty.foreach.myLoop.iteration > ($smarty.foreach.myLoop.total - ($smarty.foreach.myLoop.total % $nbItemsPerLine))}last_line{/if}">
 					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></h5>
 					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
+					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
 					<div>
 						{if !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{$product.price}</span></p>{else}<div style="height:21px;"></div>{/if}			
 						<a class="button" href="{$product.link}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
@@ -46,7 +46,7 @@
 				</li>
 			{/foreach}
 			</ul>
-			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
+			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
 		</div>
 	{else}
 		<p>{l s='No best sellers' mod='blockbestsellers'}</p>

modules/blockbestsellers/blockbestsellers.tpl

@@ -26,7 +26,7 @@
 
 <!-- MODULE Block best sellers -->
 <div id="best-sellers_block_right" class="block products_block">
-	<h4 class="title_block"><a href="{$link->getPageLink('best-sales')}" title="{l s='View a top sellers products' mod='blockbestsellers'}">{l s='Top sellers' mod='blockbestsellers'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='View a top sellers products' mod='blockbestsellers'}">{l s='Top sellers' mod='blockbestsellers'}</a></h4>
 	<div class="block_content">
 	{if $best_sellers|@count > 0}
 		<ul class="product_images">
@@ -34,7 +34,7 @@
 			<li class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} clearfix">
 				<a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
 					<span class="number">{$smarty.foreach.myLoop.iteration}</span>
-					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
+					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
 				
 				</a>
 				<p><a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
@@ -44,7 +44,7 @@
 			</li>
 		{/foreach}
 		</ul>
-		<p class="lnk"><a href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
+		<p class="lnk"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
 	{else}
 		<p>{l s='No best sellers at this time' mod='blockbestsellers'}</p>
 	{/if}

modules/blockcart/blockcart-json.tpl

@@ -83,7 +83,7 @@
 		"description":     "{$discount.description|addslashes|replace:'\\\'':'\''}",
 		"nameDescription": "{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|addslashes|replace:'\\\'':'\''}",
 		"code":            "{$discount.code}",
-		"link":            "{$link->getPageLink("$order_process", true, NULL, "deleteDiscount={$discount.id_discount}")}",
+		"link":            "{$link->getPageLink("$order_process", true, NULL, "deleteDiscount={$discount.id_discount}")|escape:'html'}",
 		"price":           "{if $priceDisplay == 1}{convertPrice|html_entity_decode:2:'UTF-8' price=$discount.value_tax_exc}{else}{convertPrice|html_entity_decode:2:'UTF-8' price=$discount.value_real}{/if}",
 		"price_float":     "{if $priceDisplay == 1}{$discount.value_tax_exc}{else}{$discount.value_real}{/if}"
 	{rdelim}

modules/blockcart/blockcart.tpl

@@ -45,7 +45,7 @@ var generated_date = {$smarty.now|intval};
 <!-- MODULE Block cart -->
 <div id="cart_block" class="block exclusive">
 	<h4 class="title_block">
-		<a href="{$link->getPageLink("$order_process", true)}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>
+		<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>
 		{if $ajax_allowed}
 		<span id="block_cart_expand" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'expanded' || !isset($colapseExpandStatus)}class="hidden"{/if}>&nbsp;</span>
 		<span id="block_cart_collapse" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'collapsed'}class="hidden"{/if}>&nbsp;</span>
@@ -77,9 +77,9 @@ var generated_date = {$smarty.now|intval};
 			{assign var='productAttributeId' value=$product.id_product_attribute}
 			<dt id="cart_block_product_{$product.id_product}_{if $product.id_product_attribute}{$product.id_product_attribute}{else}0{/if}_{if $product.id_address_delivery}{$product.id_address_delivery}{else}0{/if}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
 				<span class="quantity-formated"><span class="quantity">{$product.cart_quantity}</span>x</span>
-				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{$product.name|escape:html:'UTF-8'}">
+				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}">
 				{$product.name|truncate:13:'...'|escape:html:'UTF-8'}</a>
-				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)}" title="{l s='Please remove this product from my cart.' mod='blockcart'}">&nbsp;</a>{/if}</span>
+				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)|escape:'html'}" title="{l s='Please remove this product from my cart.' mod='blockcart'}">&nbsp;</a>{/if}</span>
 				<span class="price">
 					{if !isset($product.is_gift) || !$product.is_gift}
 						{if $priceDisplay == $smarty.const.PS_TAX_EXC}{displayWtPrice p="`$product.total`"}{else}{displayWtPrice p="`$product.total_wt`"}{/if}
@@ -90,7 +90,7 @@ var generated_date = {$smarty.now|intval};
 			</dt>
 			{if isset($product.attributes_small)}
 			<dd id="cart_block_combination_of_{$product.id_product}{if $product.id_product_attribute}_{$product.id_product_attribute}{/if}_{$product.id_address_delivery|intval}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
-				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
+				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
 			{/if}
 
 			<!-- Customizable datas -->
@@ -99,7 +99,7 @@ var generated_date = {$smarty.now|intval};
 				<ul class="cart_block_customizations" id="customization_{$productId}_{$productAttributeId}">
 					{foreach from=$customizedDatas.$productId.$productAttributeId[$product.id_address_delivery] key='id_customization' item='customization' name='customizations'}
 						<li name="customization">
-							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)}" rel="nofollow"> </a></div>
+							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)|escape:'html'}" rel="nofollow"> </a></div>
 							<span class="quantity-formated"><span class="quantity">{$customization.quantity}</span>x</span>{if isset($customization.datas.$CUSTOMIZE_TEXTFIELD.0)}
 							{$customization.datas.$CUSTOMIZE_TEXTFIELD.0.value|replace:"<br />":" "|truncate:28:'...'|escape:html:'UTF-8'}
 							{else}
@@ -166,8 +166,8 @@ var generated_date = {$smarty.now|intval};
 			{/if}
 		{/if}
 		<p id="cart-buttons">
-			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
+			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
-			<a href="{$link->getPageLink("$order_process", true)}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Checkout' mod='blockcart'}" rel="nofollow"><span></span>{l s='Checkout' mod='blockcart'}</a>
+			<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Checkout' mod='blockcart'}" rel="nofollow"><span></span>{l s='Checkout' mod='blockcart'}</a>
 		</p>
 	</div>
 	</div>

modules/blockcms/blockcms.tpl

@@ -37,7 +37,7 @@
 				{foreach from=$cms_title.cms item=cms_page}
 					{if isset($cms_page.link)}<li><a href="{$cms_page.link}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
 				{/foreach}
-				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
 			</ul>
 		</div>
 	{/foreach}
@@ -47,17 +47,17 @@
 	<div class="block_various_links" id="block_various_links_footer">
 		<h4 class="title_block">{l s='Information' mod='blockcms'}</h4>
 		<ul>
-			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
+			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
-			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
+			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
-			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')}" title="{l s='Best sellers' mod='blockcms'}">{l s='Best sellers' mod='blockcms'}</a></li>{/if}
+			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='Best sellers' mod='blockcms'}">{l s='Best sellers' mod='blockcms'}</a></li>{/if}
-			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
-			<li class="item"><a href="{$link->getPageLink($contact_url, true)}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
+			<li class="item"><a href="{$link->getPageLink($contact_url, true)|escape:'html'}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
 			{foreach from=$cmslinks item=cmslink}
 				{if $cmslink.meta_title != ''}
 					<li class="item"><a href="{$cmslink.link|addslashes}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 				{/if}
 			{/foreach}
-			<li><a href="{$link->getPageLink('sitemap')}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
+			<li><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
 			{if $display_poweredby}<li class="last_item">{l s='Powered by' mod='blockcms'} <a class="_blank" href="http://www.prestashop.com">PrestaShop</a>&trade;</li>{/if}
 		</ul>
 	{$footer_text}

modules/blockmanufacturer/blockmanufacturer.tpl

@@ -25,14 +25,14 @@
 
 <!-- Block manufacturers module -->
 <div id="manufacturers_block_left" class="block blockmanufacturer">
-	<h4 class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</h4>
+	<h4 class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')|escape:'html'}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</h4>
 	<div class="block_content">
 {if $manufacturers}
 	{if $text_list}
 	<ul class="bullet">
 	{foreach from=$manufacturers item=manufacturer name=manufacturer_list}
 		{if $smarty.foreach.manufacturer_list.iteration <= $text_list_nb}
-		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}" title="{l s='Learn more about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
+		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}" title="{l s='Learn more about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
 		{/if}
 	{/foreach}
 	</ul>
@@ -43,7 +43,7 @@
 				<select id="manufacturer_list" onchange="autoUrl('manufacturer_list', '');">
 					<option value="0">{l s='All manufacturers' mod='blockmanufacturer'}</option>
 				{foreach from=$manufacturers item=manufacturer}
-					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>

modules/blockmyaccount/blockmyaccount.tpl

@@ -25,18 +25,18 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></h4>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="">{l s='My orders' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="">{l s='My orders' mod='blockmyaccount'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
-		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
+		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
 	</div>
 </div>
 <!-- /Block myaccount module -->

modules/blockmyaccountfooter/blockmyaccountfooter.tpl

@@ -25,15 +25,15 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></h4>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="{l s='My orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='My orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
 		<p class="logout"><a href="{$link->getPageLink('index')}?mylogout" title="{l s='Sign out' mod='blockmyaccountfooter'}" rel="nofollow">{l s='Sign out' mod='blockmyaccount'}</a></p>

modules/blocknewproducts/blocknewproducts.tpl

@@ -25,13 +25,13 @@
 
 <!-- MODULE Block new products -->
 <div id="new-products_block_right" class="block products_block">
-	<h4 class="title_block"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></h4>
 	<div class="block_content">
 	{if $new_products !== false}
 		<ul class="product_images clearfix">
 		{foreach from=$new_products item='product' name='newProducts'}
 			{if $smarty.foreach.newProducts.index < 2}
-				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
+				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
 			{/if}
 		{/foreach}
 		</ul>
@@ -41,7 +41,7 @@
 			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
 		{/foreach}
 		</dl>
-		<p><a href="{$link->getPageLink('new-products')}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
+		<p><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
 	{else}
 		<p>&raquo; {l s='Do not allow new products at this time.' mod='blocknewproducts'}</p>
 	{/if}

modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl

@@ -31,7 +31,7 @@
 	{if isset($msg) && $msg}
 		<p class="{if $nw_error}warning_inline{else}success_inline{/if}">{$msg}</p>
 	{/if}
-		<form action="{$link->getPageLink('index')}" method="post">
+		<form action="{$link->getPageLink('index')|escape:'html'}" method="post">
 			<p>
 				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}">
 				<input type="submit" value="ok" class="button_mini" name="submitNewsletter" />

modules/blockpaymentlogo/blockpaymentlogo.tpl

@@ -25,7 +25,7 @@
 
 <!-- Block payment logo module -->
 <div id="paiement_logo_block_left" class="paiement_logo_block">
-	<a href="{$link->getCMSLink($cms_payement_logo)}">
+	<a href="{$link->getCMSLink($cms_payement_logo)|escape:'html'}">
 		<img src="{$img_dir}logo_paiement_visa.jpg" alt="visa" width="33" height="21" />
 		<img src="{$img_dir}logo_paiement_mastercard.jpg" alt="mastercard" width="32" height="21" />
 		<img src="{$img_dir}logo_paiement_paypal.jpg" alt="paypal" width="61" height="21" />

modules/blockpermanentlinks/blockpermanentlinks-footer.tpl

@@ -27,13 +27,13 @@
 <div id="permanent_links">
 	<!-- Sitemap -->
 	<div class="sitemap">
-		<a href="{$link->getPageLink('sitemap')}"><img src="{$img_dir}icon/sitemap.gif" alt="{l s='Sitemap' mod='blockpermanentlinks'}"/></a>&nbsp;
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}"><img src="{$img_dir}icon/sitemap.gif" alt="{l s='Sitemap' mod='blockpermanentlinks'}"/></a>&nbsp;
-		<a href="{$link->getPageLink('sitemap')}" title="{l s='Sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Contact -->
 	<div class="contact">
-		<a href="{$link->getPageLink('contact', true)}"><img src="{$img_dir}icon/contact.gif" alt="{l s='Contact' mod='blockpermanentlinks'}"/></a>&nbsp;
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}"><img src="{$img_dir}icon/contact.gif" alt="{l s='Contact' mod='blockpermanentlinks'}"/></a>&nbsp;
-		<a href="{$link->getPageLink('contact', true)}" title="{l s='Contact' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Bookmark -->
 	<div class="add_bookmark">

modules/blockpermanentlinks/blockpermanentlinks-header.tpl

@@ -25,8 +25,8 @@
 
 <!-- Block permanent links module HEADER -->
 <ul id="header_links">
-	<li id="header_link_contact"><a href="{$link->getPageLink('contact', true)}" title="{l s='contact' mod='blockpermanentlinks'}">{l s='contact' mod='blockpermanentlinks'}</a></li>
+	<li id="header_link_contact"><a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='contact' mod='blockpermanentlinks'}">{l s='contact' mod='blockpermanentlinks'}</a></li>
-	<li id="header_link_sitemap"><a href="{$link->getPageLink('sitemap')}" title="{l s='sitemap' mod='blockpermanentlinks'}">{l s='sitemap' mod='blockpermanentlinks'}</a></li>
+	<li id="header_link_sitemap"><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='sitemap' mod='blockpermanentlinks'}">{l s='sitemap' mod='blockpermanentlinks'}</a></li>
 	<li id="header_link_bookmark">
 		<script type="text/javascript">writeBookmarkLink('{$come_from}', '{$meta_title|addslashes|addslashes}', '{l s='bookmark' mod='blockpermanentlinks' js=1}');</script>
 	</li>

modules/blockpermanentlinks/blockpermanentlinks.tpl

@@ -27,11 +27,11 @@
 <div id="permanent_links">
 	<!-- Sitemap -->
 	<div class="sitemap">
-		<a href="{$link->getPageLink('sitemap')}" title="{l s='Shop sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Shop sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Contact -->
 	<div class="contact">
-		<a href="{$link->getPageLink('contact', true)}" title="{l s='Contact form' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact form' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Bookmark -->
 	<div class="add_bookmark" style="height:30px;">

modules/blocksearch/blocksearch-top.tpl

@@ -25,7 +25,7 @@
 <!-- block seach mobile -->
 {if isset($hook_mobile)}
 <div class="input_search" data-role="fieldcontain">
-	<form method="get" action="{$link->getPageLink('search')}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<input type="hidden" name="controller" value="search" />
 		<input type="hidden" name="orderby" value="position" />
 		<input type="hidden" name="orderway" value="desc" />
@@ -36,7 +36,7 @@
 <!-- Block search module TOP -->
 <div id="search_block_top">
 
-	<form method="get" action="{$link->getPageLink('search')}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<p>
 			<label for="search_query_top"><!-- image on background --></label>
 			<input type="hidden" name="controller" value="search" />

modules/blocksearch/blocksearch.tpl

@@ -26,7 +26,7 @@
 <!-- Block search module -->
 <div id="search_block_left" class="block exclusive">
 	<h4 class="title_block">{l s='Search' mod='blocksearch'}</h4>
-	<form method="get" action="{$link->getPageLink('search', true)}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search', true)|escape:'html'}" id="searchbox">
 		<p class="block_content">
 			<label for="search_query_block">{l s='Enter a product name or description.' mod='blocksearch'}</label>
 			<input type="hidden" name="orderby" value="position" />

modules/blockspecials/blockspecials.tpl

@@ -25,13 +25,13 @@
 
 <!-- MODULE Block specials -->
 <div id="special_block_right" class="block products_block exclusive blockspecials">
-	<h4 class="title_block"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></h4>
 	<div class="block_content">
 
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -51,7 +51,7 @@
 			</li>
 		</ul>
 		<p>
-			<a href="{$link->getPageLink('prices-drop')}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
+			<a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
 		</p>
 {else}
 		<p>{l s='No product specials are available at this time.' mod='blockspecials'}</p>

modules/blockstore/blockstore.tpl

@@ -25,11 +25,11 @@
 
 <!-- Block stores module -->
 <div id="stores_block_left" class="block">
-	<h4 class="title_block"><a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}">{l s='Our store(s)!' mod='blockstore'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}">{l s='Our store(s)!' mod='blockstore'}</a></h4>
 	<div class="block_content blockstore">
-		<p class="store_image"><a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our store(s)!' mod='blockstore'}" width="174" height="115" /></a></p>
+		<p class="store_image"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our store(s)!' mod='blockstore'}" width="174" height="115" /></a></p>
 		<p>
-			<a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}">&raquo; {l s='Discover our store(s)d!' mod='blockstore'}</a>
+			<a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}">&raquo; {l s='Discover our store(s)d!' mod='blockstore'}</a>
 		</p>
 	</div>
 </div>

modules/blocksupplier/blocksupplier.tpl

@@ -25,7 +25,7 @@
 
 <!-- Block suppliers module -->
 <div id="suppliers_block_left" class="block blocksupplier">
-	<h4 class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</h4>
+	<h4 class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')|escape:'html'}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</h4>
 	<div class="block_content">
 {if $suppliers}
 	{if $text_list}
@@ -33,7 +33,7 @@
 	{foreach from=$suppliers item=supplier name=supplier_list}
 		{if $smarty.foreach.supplier_list.iteration <= $text_list_nb}
 		<li class="{if $smarty.foreach.supplier_list.last}last_item{elseif $smarty.foreach.supplier_list.first}first_item{else}item{/if}">
-			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
 		</li>
 		{/if}
 	{/foreach}
@@ -45,7 +45,7 @@
 				<select id="supplier_list" onchange="autoUrl('supplier_list', '');">
 					<option value="0">{l s='All suppliers' mod='blocksupplier'}</option>
 				{foreach from=$suppliers item=supplier}
-					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>

modules/blocktags/blocktags.tpl

@@ -29,7 +29,7 @@
 	<p class="block_content">
 {if $tags}
 	{foreach from=$tags item=tag name=myLoop}
-		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
+		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")|escape:'html'}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
 	{/foreach}
 {else}
 	{l s='No tags have been specified yet.' mod='blocktags'}

modules/blocktopmenu/blocktopmenu.tpl

@@ -6,7 +6,7 @@
 			{$MENU}
 			{if $MENU_SEARCH}
 				<li class="sf-search noBack" style="float:right">
-					<form id="searchbox" action="{$link->getPageLink('search')}" method="get">
+					<form id="searchbox" action="{$link->getPageLink('search')|escape:'html'}" method="get">
 						<p>
 							<input type="hidden" name="controller" value="search" />
 							<input type="hidden" value="position" name="orderby"/>

modules/blockuserinfo/blockuserinfo.tpl

@@ -28,7 +28,7 @@
 	<ul id="header_nav">
 		{if !$PS_CATALOG_MODE}
 		<li id="shopping_cart">
-			<a href="{$link->getPageLink($order_process, true)}" title="{l s='View my shopping cart' mod='blockuserinfo'}" rel="nofollow">{l s='Cart' mod='blockuserinfo'}
+			<a href="{$link->getPageLink($order_process, true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockuserinfo'}" rel="nofollow">{l s='Cart' mod='blockuserinfo'}
 			<span class="ajax_cart_quantity{if $cart_qties == 0} hidden{/if}">{$cart_qties}</span>
 			<span class="ajax_cart_product_txt{if $cart_qties != 1} hidden{/if}">{l s='Product' mod='blockuserinfo'}</span>
 			<span class="ajax_cart_product_txt_s{if $cart_qties < 2} hidden{/if}">{l s='Products' mod='blockuserinfo'}</span>
@@ -47,15 +47,15 @@
 			</a>
 		</li>
 		{/if}
-		<li id="your_account"><a href="{$link->getPageLink('my-account', true)}" title="{l s='View my customer account' mod='blockuserinfo'}" rel="nofollow">{l s='Your Account' mod='blockuserinfo'}</a></li>
+		<li id="your_account"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" rel="nofollow">{l s='Your Account' mod='blockuserinfo'}</a></li>
 	</ul>
 	<p id="header_user_info">
 		{l s='Welcome' mod='blockuserinfo'}
 		{if $logged}
-			<a href="{$link->getPageLink('my-account', true)}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
+			<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
-			<a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Log out' mod='blockuserinfo'}</a>
+			<a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Log out' mod='blockuserinfo'}</a>
 		{else}
-			<a href="{$link->getPageLink('my-account', true)}" title="{l s='Login to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Login' mod='blockuserinfo'}</a>
+			<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Login to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Login' mod='blockuserinfo'}</a>
 		{/if}
 	</p>
 </div>

modules/blockwishlist/blockwishlist-ajax.tpl

@@ -28,12 +28,12 @@
 	{foreach from=$products item=product name=i}
 		<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 			<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
-			<a class="cart_block_product_name" href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}" style="font-weight:bold;">{$product.name|truncate:13:'...'|escape:'htmlall':'UTF-8'}</a>
+			<a class="cart_block_product_name" href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}" style="font-weight:bold;">{$product.name|truncate:13:'...'|escape:'htmlall':'UTF-8'}</a>
 			<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 		</dt>
 		{if isset($product.attributes_small)}
 		<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}" style="font-style:italic;margin:0 0 0 10px;">
-			<a href="{$link->getProductLink($product.id_product, $product.link_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getProductLink($product.id_product, $product.link_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 		</dd>
 		{/if}
 	{/foreach}

modules/blockwishlist/blockwishlist.tpl

@@ -35,12 +35,12 @@
 				<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 					<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
 					<a class="cart_block_product_name"
-					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
+					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
 					<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0', '{$token}');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 				</dt>
 				{if isset($product.attributes_small)}
 				<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
-					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 				</dd>
 				{/if}
 			{/foreach}

modules/blockwishlist/managewishlist.tpl

@@ -51,15 +51,15 @@
 				<a href="javascript:;" class="lnkdel" onclick="WishlistProductManage('wlp_bought', 'delete', '{$id_wishlist}', '{$product.id_product}', '{$product.id_product_attribute}', $('#quantity_{$product.id_product}_{$product.id_product_attribute}').val(), $('#priority_{$product.id_product}_{$product.id_product_attribute}').val());" title="{l s='Delete' mod='blockwishlist'}">&raquo; {l s='Delete' mod='blockwishlist'}</a>
 				<div class="clearfix">
 					<div class="product_image">
-						<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">
+						<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">
-							<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />
+							<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />
 						</a>
 					</div>
 					<div class="product_infos">
 						<p id="s_title" class="product_name">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</p>
 						<span class="wishlist_product_detail">
 						{if isset($product.attributes_small)}
-							<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+							<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 						{/if}
 							<br />{l s='Quantity' mod='blockwishlist'}:<input type="text" id="quantity_{$product.id_product}_{$product.id_product_attribute}" value="{$product.quantity|intval}" size="3"  />
 							<br /><br />
@@ -116,7 +116,7 @@
 			{if $bought.quantity > 0}
 				<tr>
 					<td class="first_item">
-						<span style="float:left;"><img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'small')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" /></span>			
+						<span style="float:left;"><img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'small')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" /></span>			
 						<span style="float:left;">
 							{$product.name|truncate:40:'...'|escape:'htmlall':'UTF-8'}
 						{if isset($product.attributes_small)}

modules/blockwishlist/view.tpl

@@ -48,12 +48,12 @@
 		<li class="address_title"><a href="{$link->getProductLink($product.id_product,
 		$product.link_rewrite, $product.category_rewrite)}" title="{l s='View' mod='blockwishlist'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a></li>
 		<li class="address_name">
-			<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}" class="product_image"  title="{$product.name|escape:'htmlall':'UTF-8'}">
+			<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}" class="product_image"  title="{$product.name|escape:'htmlall':'UTF-8'}">
-				<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />				
+				<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />				
 			</a>
 		<span class="wishlist_product_detail">
 		{if isset($product.attributes_small)}
-			<br /><a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+			<br /><a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 		{/if}
 			<br />{l s='Quantity:' mod='blockwishlist'}<input type="text" id="{$product.id_product}_{$product.id_product_attribute}" size="3" value="{$product.quantity|intval}" readonly/>
 			<br />{l s='Priority:' mod='blockwishlist'}
@@ -67,10 +67,10 @@
 		</span>
 		</li>
 		<li class="address_address1 clear">
-			<a class="button_small clear" href="{$link->getProductLink($product.id_product,  $product.link_rewrite, $product.category_rewrite)}" title="{l s='View' mod='blockwishlist'}" rel="nofollow">{l s='View' mod='blockwishlist'}</a>
+			<a class="button_small clear" href="{$link->getProductLink($product.id_product,  $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='View' mod='blockwishlist'}" rel="nofollow">{l s='View' mod='blockwishlist'}</a>
 			{if isset($product.attribute_quantity) AND $product.attribute_quantity >= 1 OR !isset($product.attribute_quantity) AND $product.product_quantity >= 1}
 			{if !$ajax}
-			<form id="addtocart_{$product.id_product|intval}_{$product.id_product_attribute|intval}" action="{$link->getPageLink('cart')}" method="post">
+			<form id="addtocart_{$product.id_product|intval}_{$product.id_product_attribute|intval}" action="{$link->getPageLink('cart')|escape:'html'}" method="post">
 			<p class="hidden">
 				<input type="hidden" name="id_product" value="{$product.id_product|intval}" id="product_page_product_id"  />
 				<input type="hidden" name="add" value="1" />

modules/blockwishlist/views/templates/front/mywishlist.tpl

@@ -24,7 +24,7 @@
 *}
 
 <div id="mywishlist">
-	{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account' mod='blockwishlist'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My wishlists' mod='blockwishlist'}{/capture}
+	{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account' mod='blockwishlist'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My wishlists' mod='blockwishlist'}{/capture}
 	{include file="$tpl_dir./breadcrumb.tpl"}
 
 	<h2>{l s='My wishlists' mod='blockwishlist'}</h2>
@@ -93,7 +93,7 @@
 	{/if}
 
 	<ul class="footer_links">
-		<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to Your Account' mod='blockwishlist'}</a></li>
+		<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to Your Account' mod='blockwishlist'}</a></li>
 		<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a><a href="{$base_dir}">{l s='Home' mod='blockwishlist'}</a></li>
 	</ul>
 </div>

modules/cashondelivery/views/templates/front/validation.tpl

@@ -33,7 +33,7 @@
 
 <h3>{l s='Cash on delivery (COD) payment' mod='cashondelivery'}</h3>
 
-<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" method="post">
 	<input type="hidden" name="confirm" value="1" />
 	<p>
 		<img src="{$this_path_cod}cashondelivery.jpg" alt="{l s='Cash on delivery (COD) payment' mod='cashondelivery'}" style="float:left; margin: 0px 10px 5px 0px;" />

modules/cashondelivery/views/templates/hook/confirmation.tpl

@@ -27,5 +27,5 @@
 	<br /><br />
 	{l s='You have chosen the cash on delivery method.' mod='cashondelivery'}
 	<br /><br /><span class="bold">{l s='Your order will be sent very soon.' mod='cashondelivery'}</span>
-	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)}">{l s='customer support' mod='cashondelivery'}</a>.
+	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)|escape:'html'}">{l s='customer support' mod='cashondelivery'}</a>.
 </p>

modules/cashondelivery/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
+	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
 		<img src="{$this_path_cod}cashondelivery.gif" alt="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" style="float:left;" />
 		<br />{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}
 		<br />{l s='You pay for the merchandise upon delivery' mod='cashondelivery'}

modules/cheque/views/templates/front/payment_execution.tpl

@@ -36,7 +36,7 @@
 {else}
 
 <h3>{l s='Check payment' mod='cheque'}</h3>
-<form action="{$link->getModuleLink('cheque', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cheque', 'validation', [], true)|escape:'html'}" method="post">
 	<p>
 		<img src="{$this_path_cheque}cheque.jpg" alt="{l s='Check' mod='cheque'}" width="86" height="49" style="float:left; margin: 0px 10px 5px 0px;" />
 		{l s='You have chosen to pay by check.' mod='cheque'}
@@ -73,7 +73,7 @@
 	</p>
 	<p class="cart_navigation">
 		<input type="submit" name="submit" value="{l s='I confirm my order' mod='cheque'}" class="exclusive_large" />
-		<a href="{$link->getPageLink('order', true, NULL, "step=3")}" class="button_large">{l s='Other payment methods' mod='cheque'}</a>
+		<a href="{$link->getPageLink('order', true, NULL, "step=3")|escape:'html'}" class="button_large">{l s='Other payment methods' mod='cheque'}</a>
 	</p>
 </form>
 {/if}

modules/cheque/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cheque', 'payment', [], true)}" title="{l s='Pay by check.' mod='cheque'}">
+	<a href="{$link->getModuleLink('cheque', 'payment', [], true)|escape:'html'}" title="{l s='Pay by check.' mod='cheque'}">
 		<img src="{$this_path_cheque}cheque.jpg" alt="{l s='Pay by check.' mod='cheque'}" width="86" height="49" />
 		{l s='Pay by check (order processing will take more time).' mod='cheque'}
 	</a>

modules/cheque/views/templates/hook/payment_return.tpl

@@ -37,11 +37,11 @@
 		{/if}
 		<br /><br />{l s='An email has been sent to you with this information.' mod='cheque'}
 		<br /><br /><strong>{l s='Your order will be sent as soon as we receive your payment.' mod='cheque'}</strong>
-		<br /><br />{l s='For any questions or for further information, please contact our' mod='cheque'} <a href="{$link->getPageLink('contact', true)}">{l s='customer service department.' mod='cheque'}</a>.
+		<br /><br />{l s='For any questions or for further information, please contact our' mod='cheque'} <a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='customer service department.' mod='cheque'}</a>.
 	</p>
 {else}
 	<p class="warning">
 		{l s='We have noticed that there is a problem with your order. If you think this is an error, you can contact our' mod='cheque'} 
-		<a href="{$link->getPageLink('contact', true)}">{l s='customer service department.' mod='cheque'}</a>.
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='customer service department.' mod='cheque'}</a>.
 	</p>
 {/if}

modules/editorial/editorial.tpl

@@ -26,7 +26,7 @@
 <!-- Module Editorial -->
 <div id="editorial_block_center" class="editorial_block">
 	{if $editorial->body_home_logo_link}<a href="{$editorial->body_home_logo_link|escape:'htmlall':'UTF-8'}" title="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}">{/if}
-	{if $homepage_logo}<img src="{$link->getMediaLink($image_path)}" alt="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}" {if $image_width}width="{$image_width}"{/if} {if $image_height}height="{$image_height}" {/if}/>{/if}
+	{if $homepage_logo}<img src="{$link->getMediaLink($image_path)|escape:'html'}" alt="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}" {if $image_width}width="{$image_width}"{/if} {if $image_height}height="{$image_height}" {/if}/>{/if}
 	{if $editorial->body_home_logo_link}</a>{/if}
 	{if $editorial->body_logo_subheading}<p id="editorial_image_legend">{$editorial->body_logo_subheading|stripslashes}</p>{/if}
 	{if $editorial->body_title}<h1>{$editorial->body_title|stripslashes}</h1>{/if}

modules/favoriteproducts/views/templates/front/favoriteproducts-account.tpl

@@ -32,7 +32,7 @@ $('document').ready(function()
 		var parent = $(this).parent().parent();
 
 		$.ajax({
-			url: "{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], true)}",
+			url: "{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], true)|escape:'html'}",
 			type: "POST",
 			data: {
 				'id_product': idFavoriteProduct,

modules/favoriteproducts/views/templates/hook/favoriteproducts-header.tpl

@@ -23,8 +23,8 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 <script type="text/javascript">
-	var favorite_products_url_add = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'add'], false)}';
+	var favorite_products_url_add = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'add'], false)|escape:'html'}';
-	var favorite_products_url_remove = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], false)}';
+	var favorite_products_url_remove = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], false)|escape:'html'}';
 {if isset($smarty.get.id_product)}
 	var favorite_products_id_product = '{$smarty.get.id_product|intval}';
 {/if} 

modules/homefeatured/homefeatured.tpl

@@ -38,7 +38,7 @@
 				{math equation="(total%perLine)" total=$smarty.foreach.homeFeaturedProducts.total perLine=$nbItemsPerLine assign=totModulo}
 				{if $totModulo == 0}{assign var='totModulo' value=$nbItemsPerLine}{/if}
 				<li class="ajax_block_product {if $smarty.foreach.homeFeaturedProducts.first}first_item{elseif $smarty.foreach.homeFeaturedProducts.last}last_item{else}item{/if} {if $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 1} {/if} {if $smarty.foreach.homeFeaturedProducts.iteration > ($smarty.foreach.homeFeaturedProducts.total - $totModulo)}last_line{/if}">
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
+					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
 					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h5>
 					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
 					<div>

modules/loyalty/views/templates/front/loyalty.tpl

@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='loyalty'}" rel="nofollow">{l s='My account' mod='loyalty'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My loyalty points' mod='loyalty'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='loyalty'}" rel="nofollow">{l s='My account' mod='loyalty'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My loyalty points' mod='loyalty'}{/capture}
 
 {include file="$tpl_dir./breadcrumb.tpl"}
 
@@ -125,7 +125,7 @@
 
 {if $transformation_allowed}
 <p style="text-align:center; margin-top:20px">
-	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'transformpoints'])}" onclick="return confirm('{l s='Are you sure you want to transform your points into vouchers?' mod='loyalty' js=1}');">{l s='Transform my points into a voucher of' mod='loyalty'} <span class="price">{convertPrice price=$voucher}</span>.</a>
+	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'transformpoints'])|escape:'html'}" onclick="return confirm('{l s='Are you sure you want to transform your points into vouchers?' mod='loyalty' js=1}');">{l s='Transform my points into a voucher of' mod='loyalty'} <span class="price">{convertPrice price=$voucher}</span>.</a>
 </p>
 {/if}
 
@@ -205,8 +205,8 @@ $(document).ready(function()
 
 <ul class="footer_links">
 	<li>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a>
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow">{l s='Back to Your Account' mod='loyalty'}</a>
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow">{l s='Back to Your Account' mod='loyalty'}</a>
 	</li>
 	<li class="f_right">
 		<a href="{$base_dir}" title="{l s='Home' mod='loyalty'}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a>

modules/loyalty/views/templates/hook/my-account.tpl

@@ -25,7 +25,7 @@
 
 <!-- MODULE Loyalty -->
 <li class="loyalty">
-	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'summary'])}" title="{l s='My loyalty points' mod='loyalty'}" rel="nofollow">
+	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'summary'])|escape:'html'}" title="{l s='My loyalty points' mod='loyalty'}" rel="nofollow">
 		<img src="{$module_template_dir}images/loyalty.gif" alt="{l s='My loyalty points' mod='loyalty'}" class="icon" /> {l s='My loyalty points' mod='loyalty'}
 	</a>
 </li>

modules/mailalerts/views/templates/front/mailalerts-account.tpl

@@ -35,7 +35,7 @@ $('document').ready(function()
 		var parent = $(this).parent().parent();
 
 		$.ajax({
-			url: "{$link->getModuleLink('mailalerts', 'actions', ['process' => 'remove'])}",
+			url: "{$link->getModuleLink('mailalerts', 'actions', ['process' => 'remove'])|escape:'html'}",
 			type: "POST",
 			data: {
 				'id_product': id_product_mail_alert,
@@ -56,7 +56,7 @@ $('document').ready(function()
 });
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='mailalerts'}" rel="nofollow">{l s='My account' mod='mailalerts'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My alerts' mod='mailalerts'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='mailalerts'}" rel="nofollow">{l s='My account' mod='mailalerts'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My alerts' mod='mailalerts'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <div id="mailalerts_block_account">
@@ -65,8 +65,8 @@ $('document').ready(function()
 		<div>
 			{foreach from=$mailAlerts item=mailAlert}
 			<div class="mailalert clearfix">
-				<a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}" class="product_img_link"><img src="{$link->getImageLink($mailAlert.link_rewrite, $mailAlert.cover, 'small_default')}" alt=""/></a>
+				<a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}" class="product_img_link"><img src="{$link->getImageLink($mailAlert.link_rewrite, $mailAlert.cover, 'small_default')|escape:'html'}" alt=""/></a>
-				<h3><a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}">{$mailAlert.name|escape:'htmlall':'UTF-8'}</a></h3>
+				<h3><a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)|escape:'html'}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}">{$mailAlert.name|escape:'htmlall':'UTF-8'}</a></h3>
 				<div class="product_desc">{$mailAlert.attributes_small|escape:'htmlall':'UTF-8'}</div>
 
 				<div class="remove">
@@ -80,6 +80,6 @@ $('document').ready(function()
 	{/if}
 
 	<ul class="footer_links">
-		<li class="fleft"><a href="{$link->getPageLink('my-account', true)}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='mailalerts'}">{l s='Back to Your Account' mod='mailalerts'}</a></li>
+		<li class="fleft"><a href="{$link->getPageLink('my-account', true)}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='mailalerts'}">{l s='Back to Your Account' mod='mailalerts'}</a></li>
 	</ul>
 </div>

modules/mailalerts/views/templates/hook/my-account.tpl

@@ -24,7 +24,7 @@
 *}
 
 <li class="mailalerts">
-	<a href="{$link->getModuleLink('mailalerts', 'account')}" title="{l s='My alerts' mod='mailalerts'}" rel="nofollow">
+	<a href="{$link->getModuleLink('mailalerts', 'account')|escape:'html'}" title="{l s='My alerts' mod='mailalerts'}" rel="nofollow">
 		<img src="{$module_template_dir}img/icon-alert.png" class="icon" />
 		{l s='My alerts' mod='mailalerts'}
 	</a>

modules/productcomments/productcomments.tpl

@@ -89,7 +89,7 @@ var productcomments_url_rewrite = '{$productcomments_url_rewriting_activated}';
 		<form action="#">
 			<h2 class="title">{l s='Write your review' mod='productcomments'}</h2>
 			<div class="product clearfix">
-				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
+				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
 				<div class="product_desc">
 					<p class="product_name"><strong>{$product->name}</strong></p>
 					{$product->description_short}

modules/productscategory/productscategory.tpl

@@ -32,9 +32,9 @@
 		<ul {if count($categoryProducts) > 5}style="width: {math equation="width * nbImages" width=107 nbImages=$categoryProducts|@count}px"{/if}>
 			{foreach from=$categoryProducts item='categoryProduct' name=categoryProduct}
 			<li {if count($categoryProducts) < 6}style="width:60px"{/if}>
-				<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" class="lnk_img" title="{$categoryProduct.name|htmlspecialchars}"><img src="{$link->getImageLink($categoryProduct.link_rewrite, $categoryProduct.id_image, 'medium_default')}" alt="{$categoryProduct.name|htmlspecialchars}" /></a>
+				<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" class="lnk_img" title="{$categoryProduct.name|htmlspecialchars}"><img src="{$link->getImageLink($categoryProduct.link_rewrite, $categoryProduct.id_image, 'medium_default')|escape:'html'}" alt="{$categoryProduct.name|htmlspecialchars}" /></a>
 				<p class="product_name">
-					<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" title="{$categoryProduct.name|htmlspecialchars}">{$categoryProduct.name|truncate:14:'...'|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)|escape:'html'}" title="{$categoryProduct.name|htmlspecialchars}">{$categoryProduct.name|truncate:14:'...'|escape:'htmlall':'UTF-8'}</a>
 				</p>
 				{if $ProdDisplayPrice AND $categoryProduct.show_price == 1 AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE}
 				<p class="price_display">

modules/referralprogram/views/templates/front/program.tpl

@@ -31,7 +31,7 @@
 	//]]>
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='referralprogram'}" rel="nofollow">{l s='My account' mod='referralprogram'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Referral Program' mod='referralprogram'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='referralprogram'}" rel="nofollow">{l s='My account' mod='referralprogram'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Referral Program' mod='referralprogram'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h2>{l s='Referral program' mod='referralprogram'}</h2>
@@ -95,7 +95,7 @@
 				{/if},
 				{l s='he or she will receive a %1$d voucher and you will receive your own voucher worth %2$d.' sprintf=[$discount,$discount] mod='referralprogram'}
 			</p>
-			<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)}" class="std">
+			<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" class="std">
 				<table class="std">
 				<thead>
 					<tr>
@@ -122,12 +122,12 @@
 				<p class="checkbox">
 					<input type="checkbox" name="conditionsValided" id="conditionsValided" value="1" {if isset($smarty.post.conditionsValided) AND $smarty.post.conditionsValided eq 1}checked="checked"{/if} />
 					<label for="conditionsValided">{l s='I agree to the terms of service and adhere to them unconditionally.' mod='referralprogram'}</label>
-					<a href="{$link->getModuleLink('referralprogram', 'rules', ['height' => '500', 'width' => '400'], true)}" class="thickbox" title="{l s='Conditions of the referral program' mod='referralprogram'}" rel="nofollow">{l s='Read conditions.' mod='referralprogram'}</a>
+					<a href="{$link->getModuleLink('referralprogram', 'rules', ['height' => '500', 'width' => '400'], true)|escape:'html'}" class="thickbox" title="{l s='Conditions of the referral program' mod='referralprogram'}" rel="nofollow">{l s='Read conditions.' mod='referralprogram'}</a>
 				</p>
 				<p class="see_email">
 					{l s='Preview' mod='referralprogram'} 
 					{assign var="file" value="{$lang_iso}/referralprogram-invitation.html"}
-					<a href="{$link->getModuleLink('referralprogram', 'email', ['height' => '500', 'width' => '600', 'mail' => {$file}], true)}" class="thickbox" title="{l s='Invitation e-mail' mod='referralprogram'}" rel="nofollow">{l s='the default e-mail' mod='referralprogram'}</a> {l s='that will be sent to your friend(s).' mod='referralprogram'}
+					<a href="{$link->getModuleLink('referralprogram', 'email', ['height' => '500', 'width' => '600', 'mail' => {$file}], true)|escape:'html'}" class="thickbox" title="{l s='Invitation e-mail' mod='referralprogram'}" rel="nofollow">{l s='the default e-mail' mod='referralprogram'}</a> {l s='that will be sent to your friend(s).' mod='referralprogram'}
 				</p>
 				<p class="submit">
 					<input type="submit" id="submitSponsorFriends" name="submitSponsorFriends" class="button_large" value="{l s='Validate' mod='referralprogram'}" />
@@ -145,7 +145,7 @@
 		<p>
 			{l s='These friends have not yet placed an order on this Website since you sponsored them, but you can try again! To do so, mark the checkboxes of the friend(s) you want to remind, then click on the button "Remind my friend(s)"' mod='referralprogram'}
 		</p>
-		<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)}" class="std">
+		<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" class="std">
 			<table class="std">
 			<thead>
 				<tr>
@@ -218,7 +218,7 @@
 
 <ul class="footer_links">
 	<li>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='referralprogram'}" rel="nofollow">
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='referralprogram'}" rel="nofollow">
 		<img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account' mod='referralprogram'}</a>
 	</li>
 	<li class="f_right"><a href="{$base_dir}" title="{l s='Home' mod='referralprogram'}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home' mod='referralprogram'}</a></li>

modules/referralprogram/views/templates/hook/my-account.tpl

@@ -25,7 +25,7 @@
 
 <!-- MODULE ReferralProgram -->
 <li class="referralprogram">
-	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">
+	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">
 		<img src="{$module_template_dir}referralprogram.gif" alt="{l s='Referral program' mod='referralprogram'}" class="icon" /> 
 			{l s='Referral program' mod='referralprogram'}
 	</a>

modules/referralprogram/views/templates/hook/shopping-cart.tpl

@@ -28,7 +28,7 @@
 	<img src="{$module_template_dir}referralprogram.gif" alt="{l s='Referral program' mod='referralprogram'}" class="icon" />
 	{l s='You have earned a voucher worth %s thanks to your sponsor!' sprintf=$discount_display mod='referralprogram'}
 	{l s='Enter voucher name %s to receive the reduction on this order.' sprintf=$discount->name mod='referralprogram'}
-	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">{l s='View your referral program.' mod='referralprogram'}</a>
+	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">{l s='View your referral program.' mod='referralprogram'}</a>
 </p>
 <br />
 <!-- END : MODULE ReferralProgram -->

modules/sendtoafriend/sendtoafriend-extra.tpl

@@ -66,7 +66,7 @@ $('document').ready(function(){
 	<div id="send_friend_form">
 			<h2 class="title">{l s='Send to a friend' mod='sendtoafriend'}</h2>
 			<div class="product clearfix">
-				<img src="{$link->getImageLink($stf_product->link_rewrite, $stf_product_cover, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$stf_product->name|escape:html:'UTF-8'}" />
+				<img src="{$link->getImageLink($stf_product->link_rewrite, $stf_product_cover, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$stf_product->name|escape:html:'UTF-8'}" />
 				<div class="product_desc">
 					<p class="product_name"><strong>{$stf_product->name}</strong></p>
 					{$stf_product->description_short}

modules/sendtoafriend/sendtoafriend.tpl

@@ -38,7 +38,7 @@
 			<form method="post" action="{$request_uri}" class="std">
 				<fieldset>
 					<div class="product clearfix">
-						<a href="{$productLink}" class="img_link"><img src="{$link->getImageLink($product->link_rewrite, $cover.id_image, 'small_default')}" alt="" title="{$cover.legend}" /></a>
+						<a href="{$productLink}" class="img_link"><img src="{$link->getImageLink($product->link_rewrite, $cover.id_image, 'small_default')|escape:'html'}" alt="" title="{$cover.legend}" /></a>
 						<a href="{$productLink}" class="product_desc"><br />{$product->name}</a>
 					</div>
 

themes/default/404.tpl

@@ -30,7 +30,7 @@
 	</p>
 
 	<h3>{l s='To find a product, please type its name in the field below.'}</h3>
-	<form action="{$link->getPageLink('search')}" method="post" class="std">
+	<form action="{$link->getPageLink('search')|escape:'html'}" method="post" class="std">
 		<fieldset>
 			<p>
 				<label for="search">{l s='Search our product catalog:'}</label>

themes/default/address.tpl

@@ -75,7 +75,7 @@ $(function(){ldelim}
 	{if isset($smarty.post.alias)}
 		"{$smarty.post.alias}"
 	{else}
-		{if isset($address->alias)}"{$address->alias}"{/if}
+		{if isset($address->alias)}"{$address->alias|escape:'html'}"{/if}
 	{/if}
 {else}
 	{l s='To add a new address, please fill out the form below.'}
@@ -86,12 +86,12 @@ $(function(){ldelim}
 
 <p class="required"><sup>*</sup> {l s='Required field'}</p>
 
-<form action="{$link->getPageLink('address', true)}" method="post" class="std" id="add_address">
+<form action="{$link->getPageLink('address', true)|escape:'html'}" method="post" class="std" id="add_address">
 	<fieldset>
 		<h3>{if isset($id_address)}{l s='Your address'}{else}{l s='New address'}{/if}</h3>
 		<p class="required text dni">
 			<label for="dni">{l s='Identification number'} <sup>*</sup></label>
-			<input type="text" class="text" name="dni" id="dni" value="{if isset($smarty.post.dni)}{$smarty.post.dni}{else}{if isset($address->dni)}{$address->dni}{/if}{/if}" />
+			<input type="text" class="text" name="dni" id="dni" value="{if isset($smarty.post.dni)}{$smarty.post.dni}{else}{if isset($address->dni)}{$address->dni|escape:'html'}{/if}{/if}" />
 			<span class="form_info">{l s='DNI / NIF / NIE'}</span>
 		</p>
 	{assign var="stateExist" value="false"}
@@ -100,7 +100,7 @@ $(function(){ldelim}
 			<p class="text">
 			<input type="hidden" name="token" value="{$token}" />
 			<label for="company">{l s='Company'}</label>
-			<input type="text" id="company" name="company" value="{if isset($smarty.post.company)}{$smarty.post.company}{else}{if isset($address->company)}{$address->company}{/if}{/if}" />
+			<input type="text" id="company" name="company" value="{if isset($smarty.post.company)}{$smarty.post.company}{else}{if isset($address->company)}{$address->company|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'vat_number'}
@@ -108,7 +108,7 @@ $(function(){ldelim}
 				<div id="vat_number">
 					<p class="text">
 						<label for="vat_number">{l s='VAT number'}</label>
-						<input type="text" class="text" name="vat_number" value="{if isset($smarty.post.vat_number)}{$smarty.post.vat_number}{else}{if isset($address->vat_number)}{$address->vat_number}{/if}{/if}" />
+						<input type="text" class="text" name="vat_number" value="{if isset($smarty.post.vat_number)}{$smarty.post.vat_number}{else}{if isset($address->vat_number)}{$address->vat_number|escape:'html'}{/if}{/if}" />
 					</p>
 				</div>
 			</div>
@@ -116,37 +116,37 @@ $(function(){ldelim}
 		{if $field_name eq 'firstname'}
 		<p class="required text">
 			<label for="firstname">{l s='First name'} <sup>*</sup></label>
-			<input type="text" name="firstname" id="firstname" value="{if isset($smarty.post.firstname)}{$smarty.post.firstname}{else}{if isset($address->firstname)}{$address->firstname}{/if}{/if}" />
+			<input type="text" name="firstname" id="firstname" value="{if isset($smarty.post.firstname)}{$smarty.post.firstname}{else}{if isset($address->firstname)}{$address->firstname|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'lastname'}
 		<p class="required text">
 			<label for="lastname">{l s='Last name'} <sup>*</sup></label>
-			<input type="text" id="lastname" name="lastname" value="{if isset($smarty.post.lastname)}{$smarty.post.lastname}{else}{if isset($address->lastname)}{$address->lastname}{/if}{/if}" />
+			<input type="text" id="lastname" name="lastname" value="{if isset($smarty.post.lastname)}{$smarty.post.lastname}{else}{if isset($address->lastname)}{$address->lastname|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'address1'}
 		<p class="required text">
 			<label for="address1">{l s='Address'} <sup>*</sup></label>
-			<input type="text" id="address1" name="address1" value="{if isset($smarty.post.address1)}{$smarty.post.address1}{else}{if isset($address->address1)}{$address->address1}{/if}{/if}" />
+			<input type="text" id="address1" name="address1" value="{if isset($smarty.post.address1)}{$smarty.post.address1}{else}{if isset($address->address1)}{$address->address1|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'address2'}
 		<p class="required text">
 			<label for="address2">{l s='Address (Line 2)'}</label>
-			<input type="text" id="address2" name="address2" value="{if isset($smarty.post.address2)}{$smarty.post.address2}{else}{if isset($address->address2)}{$address->address2}{/if}{/if}" />
+			<input type="text" id="address2" name="address2" value="{if isset($smarty.post.address2)}{$smarty.post.address2}{else}{if isset($address->address2)}{$address->address2|escape:'html'}{/if}{/if}" />
 		</p>
 		{/if}
 		{if $field_name eq 'postcode'}
 		<p class="required postcode text">
 			<label for="postcode">{l s='Zip / Postal Code'} <sup>*</sup></label>
-			<input type="text" id="postcode" name="postcode" value="{if isset($smarty.post.postcode)}{$smarty.post.postcode}{else}{if isset($address->postcode)}{$address->postcode}{/if}{/if}" onkeyup="$('#postcode').val($('#postcode').val().toUpperCase());" />
+			<input type="text" id="postcode" name="postcode" value="{if isset($smarty.post.postcode)}{$smarty.post.postcode}{else}{if isset($address->postcode)}{$address->postcode|escape:'html'}{/if}{/if}" onkeyup="$('#postcode').val($('#postcode').val().toUpperCase());" />
 		</p>
 		{/if}
 		{if $field_name eq 'city'}
 		<p class="required text">
 			<label for="city">{l s='City'} <sup>*</sup></label>
-			<input type="text" name="city" id="city" value="{if isset($smarty.post.city)}{$smarty.post.city}{else}{if isset($address->city)}{$address->city}{/if}{/if}" maxlength="64" />
+			<input type="text" name="city" id="city" value="{if isset($smarty.post.city)}{$smarty.post.city}{else}{if isset($address->city)}{$address->city|escape:'html'}{/if}{/if}" maxlength="64" />
 		</p>
 		{*
 			if customer hasn't update his layout address, country has to be verified
@@ -205,22 +205,22 @@ $(function(){ldelim}
 		{/if}
 		<p class="textarea">
 			<label for="other">{l s='Additional information'}</label>
-			<textarea id="other" name="other" cols="26" rows="3">{if isset($smarty.post.other)}{$smarty.post.other}{else}{if isset($address->other)}{$address->other}{/if}{/if}</textarea>
+			<textarea id="other" name="other" cols="26" rows="3">{if isset($smarty.post.other)}{$smarty.post.other}{else}{if isset($address->other)}{$address->other|escape:'html'}{/if}{/if}</textarea>
 		</p>
 		{if isset($one_phone_at_least) && $one_phone_at_least}
 			<p class="inline-infos required">{l s='You must register at least one phone number.'}</p>
 		{/if}
 		<p class="text">
 			<label for="phone">{l s='Home phone'}</label>
-			<input type="text" id="phone" name="phone" value="{if isset($smarty.post.phone)}{$smarty.post.phone}{else}{if isset($address->phone)}{$address->phone}{/if}{/if}" />
+			<input type="text" id="phone" name="phone" value="{if isset($smarty.post.phone)}{$smarty.post.phone}{else}{if isset($address->phone)}{$address->phone|escape:'html'}{/if}{/if}" />
 		</p>
 		<p class="{if isset($one_phone_at_least) && $one_phone_at_least}required {/if}text">
 			<label for="phone_mobile">{l s='Mobile phone'}{if isset($one_phone_at_least) && $one_phone_at_least} <sup>*</sup>{/if}</label>
-			<input type="text" id="phone_mobile" name="phone_mobile" value="{if isset($smarty.post.phone_mobile)}{$smarty.post.phone_mobile}{else}{if isset($address->phone_mobile)}{$address->phone_mobile}{/if}{/if}" />
+			<input type="text" id="phone_mobile" name="phone_mobile" value="{if isset($smarty.post.phone_mobile)}{$smarty.post.phone_mobile}{else}{if isset($address->phone_mobile)}{$address->phone_mobile|escape:'html'}{/if}{/if}" />
 		</p>
 		<p class="required text" id="adress_alias">
 			<label for="alias">{l s='Please assign an address title for future reference.'} <sup>*</sup></label>
-			<input type="text" id="alias" name="alias" value="{if isset($smarty.post.alias)}{$smarty.post.alias}{else if isset($address->alias)}{$address->alias}{elseif !$select_address}{l s='My address'}{/if}" />
+			<input type="text" id="alias" name="alias" value="{if isset($smarty.post.alias)}{$smarty.post.alias}{else if isset($address->alias)}{$address->alias|escape:'html'}{elseif !$select_address}{l s='My address'}{/if}" />
 		</p>
 	</fieldset>
 	<p class="submit2">

themes/default/addresses.tpl

@@ -86,7 +86,7 @@
 //]]>
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My addresses'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My addresses'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='My addresses'}</h1>
@@ -111,20 +111,20 @@
 				{/foreach}
 				</li>
 			{/foreach}
-			<li class="address_update"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")}" title="{l s='Update'}">&raquo; {l s='Update'}</a></li>
+			<li class="address_update"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")|escape:'html'}" title="{l s='Update'}">&raquo; {l s='Update'}</a></li>
-			<li class="address_delete"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}&delete")}" onclick="return confirm('{l s='Are you sure?' js=1}');" title="{l s='Delete'}">&raquo; {l s='Delete'}</a></li>
+			<li class="address_delete"><a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}&delete")|escape:'html'}" onclick="return confirm('{l s='Are you sure?' js=1}');" title="{l s='Delete'}">&raquo; {l s='Delete'}</a></li>
 		</ul>
 	{/foreach}
 	</div>
 	<p class="clear" />
 </div>
 {else}
-	<p class="warning">{l s='No addresses are available.'}&nbsp;<a href="{$link->getPageLink('address', true)}">{l s='Add a new address'}</a></p>
+	<p class="warning">{l s='No addresses are available.'}&nbsp;<a href="{$link->getPageLink('address', true)|escape:'html'}">{l s='Add a new address'}</a></p>
 {/if}
 
-<div class="clear address_add"><a href="{$link->getPageLink('address', true)}" title="{l s='Add an address'}" class="button_large">{l s='Add an address'}</a></div>
+<div class="clear address_add"><a href="{$link->getPageLink('address', true)|escape:'html'}" title="{l s='Add an address'}" class="button_large">{l s='Add an address'}</a></div>
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>

themes/default/authentication.tpl

@@ -25,7 +25,7 @@
 
 {capture name=path}
 	{if !isset($email_create)}{l s='Authentication'}{else}
-		<a href="{$link->getPageLink('authentication', true)}" rel="nofollow" title="{l s='Authentication'}">{l s='Authentication'}</a>
+		<a href="{$link->getPageLink('authentication', true)|escape:'html'}" rel="nofollow" title="{l s='Authentication'}">{l s='Authentication'}</a>
 		<span class="navigation-pipe">{$navigationPipe}</span>{l s='Create your account'}
 	{/if}
 {/capture}
@@ -155,7 +155,7 @@ $(document).ready(function() {
 		</ol>
 	</div>
 	{/if}-->
-	<form action="{$link->getPageLink('authentication', true)}" method="post" id="create-account_form" class="std">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="create-account_form" class="std">
 		<fieldset>
 			<h3>{l s='Create an account'}</h3>
 			<div class="form_content clearfix">
@@ -174,7 +174,7 @@ $(document).ready(function() {
 		</fieldset>
 	</form>
 
-	<form action="{$link->getPageLink('authentication', true)}" method="post" id="login_form" class="std">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="login_form" class="std">
 		<fieldset>
 			<h3>{l s='Already registered?'}</h3>
 			<div class="form_content clearfix">
@@ -186,7 +186,7 @@ $(document).ready(function() {
 					<label for="passwd">{l s='Password'}</label>
 					<span><input type="password" id="passwd" name="passwd" value="{if isset($smarty.post.passwd)}{$smarty.post.passwd|stripslashes}{/if}" class="account_input" /></span>
 				</p>
-				<p class="lost_password"><a href="{$link->getPageLink('password')}" title="{l s='Recover your forgotten password'}" rel="nofollow">{l s='Forgot your password?'}</a></p>
+				<p class="lost_password"><a href="{$link->getPageLink('password')|escape:'html'}" title="{l s='Recover your forgotten password'}" rel="nofollow">{l s='Forgot your password?'}</a></p>
 				<p class="submit">
 					{if isset($back)}<input type="hidden" class="hidden" name="back" value="{$back|escape:'htmlall':'UTF-8'}" />{/if}
 					<input type="submit" id="SubmitLogin" name="SubmitLogin" class="button" value="{l s='Authentication'}" />
@@ -196,7 +196,7 @@ $(document).ready(function() {
 	</form>
 
 	{if isset($inOrderProcess) && $inOrderProcess && $PS_GUEST_CHECKOUT_ENABLED}
-	<form action="{$link->getPageLink('authentication', true, NULL, "back=$back")}" method="post" id="new_account_form" class="std clearfix">
+	<form action="{$link->getPageLink('authentication', true, NULL, "back=$back")|escape:'html'}" method="post" id="new_account_form" class="std clearfix">
 		<fieldset>
 			<h3>{l s='Instant checkout'}</h3>
 			<div id="opc_account_form" style="display: block; ">
@@ -370,7 +370,7 @@ $(document).ready(function() {
 		</ol>
 	</div>
 	{/if}-->
-<form action="{$link->getPageLink('authentication', true)}" method="post" id="account-creation_form" class="std">
+<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="account-creation_form" class="std">
 	{$HOOK_CREATE_ACCOUNT_TOP}
 	<fieldset class="account_creation">
 		<h3>{l s='Your personal information'}</h3>

themes/default/category.tpl

@@ -50,7 +50,7 @@
 				<!-- Category image -->
 				{if $category->id_image}
 				<div class="align_center">
-					<img src="{$link->getCatImageLink($category->link_rewrite, $category->id_image, 'category_default')}" alt="{$category->name|escape:'htmlall':'UTF-8'}" title="{$category->name|escape:'htmlall':'UTF-8'}" id="categoryImage" width="{$categorySize.width}" height="{$categorySize.height}" />
+					<img src="{$link->getCatImageLink($category->link_rewrite, $category->id_image, 'category_default')|escape:'html'}" alt="{$category->name|escape:'htmlall':'UTF-8'}" title="{$category->name|escape:'htmlall':'UTF-8'}" id="categoryImage" width="{$categorySize.width}" height="{$categorySize.height}" />
 				</div>
 				{/if}
 			{/if}
@@ -77,7 +77,7 @@
 				<li class="clearfix">
 					<a href="{$link->getCategoryLink($subcategory.id_category, $subcategory.link_rewrite)|escape:'htmlall':'UTF-8'}" title="{$subcategory.name|escape:'htmlall':'UTF-8'}" class="img">
 						{if $subcategory.id_image}
-							<img src="{$link->getCatImageLink($subcategory.link_rewrite, $subcategory.id_image, 'medium_default')}" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
+							<img src="{$link->getCatImageLink($subcategory.link_rewrite, $subcategory.id_image, 'medium_default')|escape:'html'}" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 						{else}
 							<img src="{$img_cat_dir}default-medium_default.jpg" alt="" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 						{/if}

themes/default/discount.tpl

@@ -22,7 +22,7 @@
 *  @license    http://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
 *  International Registered Trademark & Property of PrestaShop SA
 *}
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My vouchers'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My vouchers'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='My vouchers'}</h1>
@@ -81,6 +81,6 @@
 {/if}
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>

themes/default/guest-tracking.tpl

@@ -66,7 +66,7 @@
 	{include file="$tpl_dir./errors.tpl"}
 	
 	{if isset($transformSuccess)}
-		<p class="success">{l s='Your guest account has been successfully transformed into a customer account. You can now login as a registered shopper. '} <a href="{$link->getPageLink('authentication', true)}">{l s='page.'}</a></p>
+		<p class="success">{l s='Your guest account has been successfully transformed into a customer account. You can now login as a registered shopper. '} <a href="{$link->getPageLink('authentication', true)|escape:'html'}">{l s='page.'}</a></p>
 	{else}
 		<form method="post" action="{$action|escape:'htmlall':'UTF-8'}#guestToCustomer" class="std">
 			<fieldset class="description_box">
@@ -92,7 +92,7 @@
 {else}
 	{include file="$tpl_dir./errors.tpl"}
 	{if isset($show_login_link) && $show_login_link}
-		<p><img src="{$img_dir}icon/userinfo.gif" alt="{l s='Information'}" class="icon" /><a href="{$link->getPageLink('my-account', true)}">{l s='Click here to login to your customer account.'}</a><br /><br /></p>
+		<p><img src="{$img_dir}icon/userinfo.gif" alt="{l s='Information'}" class="icon" /><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Click here to login to your customer account.'}</a><br /><br /></p>
 	{/if}
 	<form method="post" action="{$action|escape:'htmlall':'UTF-8'}" class="std">
 		<fieldset class="description_box">

themes/default/history.tpl

@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Order history'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Order history'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 {include file="$tpl_dir./errors.tpl"}
 
@@ -51,7 +51,7 @@
 			<tr class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.index % 2}alternate_item{/if}">
 				<td class="history_link bold">
 					{if isset($order.invoice) && $order.invoice && isset($order.virtual) && $order.virtual}<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Products to download'}" title="{l s='Products to download'}" />{/if}
-					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)}');">{Order::getUniqReferenceOf($order.id_order)}</a>
+					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)|escape:'html'}');">{Order::getUniqReferenceOf($order.id_order)}</a>
 				</td>
 				<td class="history_date bold">{dateFormat date=$order.date_add full=0}</td>
 				<td class="history_price"><span class="price">{displayPrice price=$order.total_paid currency=$order.id_currency no_utf8=false convert=false}</span></td>
@@ -59,16 +59,16 @@
 				<td class="history_state">{if isset($order.order_state)}{$order.order_state|escape:'htmlall':'UTF-8'}{/if}</td>
 				<td class="history_invoice">
 				{if (isset($order.invoice) && $order.invoice && isset($order.invoice_number) && $order.invoice_number) && isset($invoiceAllowed) && $invoiceAllowed == true}
-					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")}" title="{l s='Invoice'}" class="_blank"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Invoice'}" class="icon" /></a>
+					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")|escape:'html'}" title="{l s='Invoice'}" class="_blank"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Invoice'}" class="icon" /></a>
-					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")}" title="{l s='Invoice'}" class="_blank">{l s='PDF'}</a>
+					<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")|escape:'html'}" title="{l s='Invoice'}" class="_blank">{l s='PDF'}</a>
 				{else}-{/if}
 				</td>
 				<td class="history_detail">
-					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)}');">{l s='details'}</a>
+					<a class="color-myaccount" href="javascript:showOrder(1, {$order.id_order|intval}, '{$link->getPageLink('order-detail', true)|escape:'html'}');">{l s='details'}</a>
 					{if isset($opc) && $opc}
-					<a href="{$link->getPageLink('order-opc', true, NULL, "submitReorder&id_order={$order.id_order}")}" title="{l s='Reorder'}">
+					<a href="{$link->getPageLink('order-opc', true, NULL, "submitReorder&id_order={$order.id_order}")|escape:'html'}" title="{l s='Reorder'}">
 					{else}
-					<a href="{$link->getPageLink('order', true, NULL, "submitReorder&id_order={$order.id_order}")}" title="{l s='Reorder'}">
+					<a href="{$link->getPageLink('order', true, NULL, "submitReorder&id_order={$order.id_order}")|escape:'html'}" title="{l s='Reorder'}">
 					{/if}
 						<img src="{$img_dir}arrow_rotate_anticlockwise.png" alt="{l s='Reorder'}" title="{l s='Reorder'}" class="icon" />
 					</a>
@@ -84,6 +84,6 @@
 </div>
 
 <ul class="footer_links clearfix">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>

themes/default/identity.tpl

@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Your personal information'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Your personal information'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h1>{l s='Your personal information'}</h1>
@@ -38,7 +38,7 @@
 {else}
 	<h3>{l s='Please be sure to update your personal information if it has changed.'}</h3>
 	<p class="required"><sup>*</sup>{l s='Required field'}</p>
-	<form action="{$link->getPageLink('identity', true)}" method="post" class="std">
+	<form action="{$link->getPageLink('identity', true)|escape:'html'}" method="post" class="std">
 		<fieldset>
 			<p class="radio">
 				<span>{l s='Title'}</span>
@@ -127,6 +127,6 @@
 {/if}
 
 <ul class="footer_links">
-	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to your account'}</a></li>
+	<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to your account'}</a></li>
 	<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home'}</a></li>
 </ul>

themes/default/mobile/404.tpl

@@ -33,7 +33,7 @@
 			<p>{l s='We\'re sorry, but the Web address you\'ve entered is no longer available.'}</p>
 			<p>{l s='To find a product, please type its name in the field below.'}</p>
 			<div data-role="fieldcontain" class="input_search_404">
-				<form action="{$link->getPageLink('search')}" method="post" class="std">
+				<form action="{$link->getPageLink('search')|escape:'html'}" method="post" class="std">
 				<input type="search" name="search_query" id="search_query" value="{l s='Search'}" />
 				</form>
 			</div>

themes/default/mobile/address.tpl

@@ -84,7 +84,7 @@ $(document).ready(function() {
 		{/if}
 		</p>
 		
-		<form action="{$link->getPageLink('address', true)}" method="post" id="add_address" data-ajax="false">
+		<form action="{$link->getPageLink('address', true)|escape:'html'}" method="post" id="add_address" data-ajax="false">
 			<legend><h3>{if isset($id_address) && $id_address != 0}{l s='Your address'}{else}{l s='New address'}{/if}</h3></legend>
 			<div class="required text dni">
 				<label for="dni">{l s='Identification number'}</label>

themes/default/mobile/addresses.tpl

@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 	<p>{l s='Please configure your default billing and delivery addresses when placing an order. You may also add additional addresses, which can be useful for sending gifts or receiving an order at your office.'}</p>
 	<div>
 		{if isset($multipleAddresses) && $multipleAddresses}
@@ -38,7 +38,7 @@
 			<ul data-role="listview" data-theme="g">
 				{foreach from=$multipleAddresses item=address name=myLoop}
 				<li>
-					<a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")}" title="{l s='Update'}" data-ajax="false">
+					<a href="{$link->getPageLink('address', true, null, "id_address={$address.object.id|intval}")|escape:'html'}" title="{l s='Update'}" data-ajax="false">
 						<p class="title_block">{$address.object.alias}</p>
 						{foreach from=$address.ordered name=adr_loop item=pattern}
 							{assign var=addressKey value=" "|explode:$pattern}
@@ -55,7 +55,7 @@
 		{else}
 		<p class="warning">{l s='No addresses are available.'}</p>
 	{/if}
-		<a href="{$link->getPageLink('address', true)}" data-role="button" data-theme="a" data-ajax="false">{l s='Add a new address'}</a>
+		<a href="{$link->getPageLink('address', true)|escape:'html'}" data-role="button" data-theme="a" data-ajax="false">{l s='Add a new address'}</a>
 	</div>
 	
 	{include file='./sitemap.tpl'}

themes/default/mobile/authentication-choice.tpl

@@ -1,6 +1,6 @@
 <div data-role="content" id="content">
 	
-	<form action="{$link->getPageLink('authentication', true)}" method="post" id="create-account_form" class="std login_form" data-ajax="false">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="create-account_form" class="std login_form" data-ajax="false">
 		<h2>{l s='Create an account'}</h2>
 		<div class="form_content clearfix">
 			<p class="title_block">{l s='Enter your email address to create an account'}.</p>
@@ -15,7 +15,7 @@
 
 	<hr/>
 
-	<form action="{$link->getPageLink('authentication', true)}" method="post" class="login_form">
+	<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" class="login_form">
 		<h2>{l s='Already registered?'}</h2>
 		<fieldset>
 			<input type="email" id="email" name="email" placeholder="{l s='Email address'}" value="{if isset($smarty.post.email)}{$smarty.post.email|escape:'htmlall':'UTF-8'|stripslashes}{/if}" class="account_input" />
@@ -23,7 +23,7 @@
 		
 		<fieldset>
 			<input type="password" id="passwd" name="passwd" placeholder="{l s='Password'}" value="{if isset($smarty.post.passwd)}{$smarty.post.passwd|escape:'htmlall':'UTF-8'|stripslashes}{/if}" class="account_input" />
-			<p class="forget_pwd"><a href="{$link->getPageLink('password')}" data-ajax="false">{l s='Forgot your password?'}</a></p>
+			<p class="forget_pwd"><a href="{$link->getPageLink('password')|escape:'html'}" data-ajax="false">{l s='Forgot your password?'}</a></p>
 		</fieldset>
 		<button type="submit" class="ui-btn-hidden submit_button" id="SubmitLogin" name="SubmitLogin" aria-disabled="false" data-theme="a">{l s='Login'}</button>
 	</form> 

themes/default/mobile/authentication-create-account.tpl

@@ -1,4 +1,4 @@
-<form action="{$link->getPageLink('authentication', true)}" method="post" id="account-creation_form" class="std">
+<form action="{$link->getPageLink('authentication', true)|escape:'html'}" method="post" id="account-creation_form" class="std">
 	{$HOOK_CREATE_ACCOUNT_TOP}
 	<fieldset class="account_creation">
 		<h3>{l s='Your personal information'}</h3>

themes/default/mobile/category-product-list.tpl

@@ -28,7 +28,7 @@
 	{foreach from=$products item=product name=products}
 		<li class="ui-block-{if $smarty.foreach.products.index % 2}b{else}a{/if} product-list-row">
 			<a href="{$product.link|escape:'htmlall':'UTF-8'}" data-ajax="false">
-				<div class="product_img_wrapper"><img class="ui-li-thumb" src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" /></div>
+				<div class="product_img_wrapper"><img class="ui-li-thumb" src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" /></div>
 				<h3 class="ui-li-heading">{$product.name|escape:'htmlall':'UTF-8'}</h3>
 				{if (!$PS_CATALOG_MODE AND ((isset($product.show_price) && $product.show_price) || (isset($product.available_for_order) && $product.available_for_order)))}
 					<p class="ui-li-price">

themes/default/mobile/discount.tpl

@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 	
 	{if isset($discount) && count($discount) && $nbDiscounts}
 	<table class="discount std table_block">

themes/default/mobile/footer.tpl

@@ -35,11 +35,11 @@
 				<div data-role="footer" data-theme="a" id="bar_footer">
 					<div id="link_bar_footer" class="ui-grid-a">
 						<div class="ui-block-a">
-							<a href="{$link->getPageLink('index', true)}" data-ajax="false">{$PS_SHOP_NAME}</a>
+							<a href="{$link->getPageLink('index', true)|escape:'html'}" data-ajax="false">{$PS_SHOP_NAME}</a>
 						</div>
 						{if $conditions}
 						<div class="ui-block-b">
-							<a href="{$link->getCMSLink($id_cgv)}" data-ajax="false">{l s='Terms of service'}</a>
+							<a href="{$link->getCMSLink($id_cgv)|escape:'html'}" data-ajax="false">{l s='Terms of service'}</a>
 						</div>
 						{/if}
 					</div>

themes/default/mobile/header.tpl

@@ -69,12 +69,12 @@
 				<div class="ui-block-b">
 					<div id="block_cart" class="clearfix">
 						{if !$PS_CATALOG_MODE}
-						<a href="{$link->getPageLink('order-opc', true)}" class="link_cart" data-ajax="false">{l s='Cart'}</a>
+						<a href="{$link->getPageLink('order-opc', true)|escape:'html'}" class="link_cart" data-ajax="false">{l s='Cart'}</a>
 						{/if}
 						{if $logged}
-							<a href="{$link->getPageLink('my-account', true)}" class="link_account" data-ajax="false">{l s='My account'}</a>
+							<a href="{$link->getPageLink('my-account', true)|escape:'html'}" class="link_account" data-ajax="false">{l s='My account'}</a>
 						{else}
-							<a href="{$link->getPageLink('authentication', true)}" class="link_account" data-ajax="false">{l s='Authentication'}</a>
+							<a href="{$link->getPageLink('authentication', true)|escape:'html'}" class="link_account" data-ajax="false">{l s='Authentication'}</a>
 						{/if}
 					</div>
 					{hook h="displayMobileTop"}

themes/default/mobile/history.tpl

@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 {include file="$tpl_dir./errors.tpl"}
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 	<p>{l s='Here are the orders you\'ve placed since your account was created.'}.</p>
 
@@ -39,7 +39,7 @@
 		{foreach from=$orders item=order name=myLoop}
 			<li>
 				{assign var="id_order" value={$order.id_order|intval}}
-				<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")}" data-ajax="false">
+				<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")|escape:'html'}" data-ajax="false">
 					{if isset($order.invoice) && $order.invoice && isset($order.virtual) && $order.virtual}<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Products to download'}" title="{l s='Products to download'}" />{/if}
 					<h3>{l s='#'}{$order.id_order|string_format:"%06d"}</h3>
 					<p><strong>{l s='Total price'}</strong> {displayPrice price=$order.total_paid currency=$order.id_currency no_utf8=false convert=false}</p>
@@ -48,7 +48,7 @@
 					<span class="ui-li-aside">{dateFormat date=$order.date_add full=0}</span>
 				</a>
 				{if (isset($order.invoice) && $order.invoice && isset($order.invoice_number) && $order.invoice_number) && isset($invoiceAllowed) && $invoiceAllowed == true}
-				<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")}" title="{l s='Invoice'}" data-ajax="false">
+				<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order.id_order}")|escape:'html'}" title="{l s='Invoice'}" data-ajax="false">
 					{l s='PDF'}
 				</a>
 				{/if}

themes/default/mobile/identity.tpl

@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 {include file="./errors.tpl"}
 
@@ -39,7 +39,7 @@
 {else}
 	<h3>{l s='Please be sure to update your personal information if it has changed.'}</h3>
 	<p class="required bold"><sup>*</sup>{l s='Required field'}</p>
-	<form action="{$link->getPageLink('identity', true)}" method="post" class="std">
+	<form action="{$link->getPageLink('identity', true)|escape:'html'}" method="post" class="std">
 		<label>{l s='Title'}</label>
 		<fieldset data-role="controlgroup">
 		{foreach from=$genders key=k item=gender}

themes/default/mobile/manufacturer.tpl

@@ -31,7 +31,7 @@
 {if !isset($errors) OR !sizeof($errors)}
 
 <div data-role="content" id="content">
-	<p><a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('manufacturer', true)}" data-ajax="false">{l s='Manufacturers:'}</a></p>
+	<p><a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('manufacturer', true)|escape:'html'}" data-ajax="false">{l s='Manufacturers:'}</a></p>
 	{if !empty($manufacturer->description) || !empty($manufacturer->short_description)}
 		<div class="category_desc clearfix">
 			{if !empty($manufacturer->short_description)}

themes/default/mobile/my-account.tpl

@@ -32,47 +32,47 @@
 		<ul data-role="listview" data-inset="true" id="list_myaccount">
 			{if $has_customer_an_address}
 			<li>
-				<a href="{$link->getPageLink('address', true)}" title="{l s='Add my first address'}" data-ajax="false">
+				<a href="{$link->getPageLink('address', true)|escape:'html'}" title="{l s='Add my first address'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/addrbook.png" alt="{l s='Addresses'}" class="ui-li-icon ui-li-thumb" />
 					{l s='Add my first address'}
 				</a>
 			</li>
 			{/if}
 			<li>
-				<a href="{$link->getPageLink('history', true)}" title="{l s='Orders'}" data-ajax="false">
+				<a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='Orders'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/order.png" alt="{l s='Orders'}" class="ui-li-icon ui-li-thumb" />
 					{l s='Order history and details '}
 				</a>
 			</li>
 			{if $returnAllowed}
 			<li>
-				<a href="{$link->getPageLink('order-follow', true)}" title="{l s='Merchandise returns'}" data-ajax="false">
+				<a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='Merchandise returns'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/return.png" alt="{l s='Merchandise returns'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My merchandise returns'}
 				</a>
 			</li>
 			{/if}
 			<li>
-				<a href="{$link->getPageLink('order-slip', true)}" title="{l s='Credit slips'}" data-ajax="false">
+				<a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='Credit slips'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/slip.png" alt="{l s='Credit slips'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My credit slips'}
 				</a>
 			</li>
 			<li>
-				<a href="{$link->getPageLink('addresses', true)}" title="{l s='Addresses'}" data-ajax="false">
+				<a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='Addresses'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/addrbook.png" alt="{l s='Addresses'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My addresses'}
 				</a>
 			</li>
 			<li>
-				<a href="{$link->getPageLink('identity', true)}" title="{l s='Information'}" data-ajax="false">
+				<a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Information'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/userinfos.png" alt="{l s='Information'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My personal information'}
 				</a>
 			</li>
 			{if $voucherAllowed}
 			<li>
-				<a href="{$link->getPageLink('discount', true)}" title="{l s='Vouchers'}" data-ajax="false">
+				<a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='Vouchers'}" data-ajax="false">
 					<img src="{$img_mobile_dir}icon/voucher.png" alt="{l s='Vouchers'}" class="ui-li-icon ui-li-thumb" />
 					{l s='My vouchers'}
 				</a>

themes/default/mobile/order-address.tpl

@@ -16,8 +16,8 @@
 	var txtProducts = "{l s='products' js=1}";
 	{/if}
 	
-	var addressMultishippingUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")}";
+	var addressMultishippingUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{'&multi-shipping=1'|urlencode}{if $back}&mod={$back|urlencode}{/if}")|escape:'html'}";
-	var addressUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}";
+	var addressUrl = "{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}";
 
 	var formatedAddressFieldsValuesList = new Array();
 
@@ -59,7 +59,7 @@
 		dest_comp.html('');
 
 		li_content['title'] = adr_titles_vals[address_type];
-		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")}'+id_address+'&amp;back={$back_order_page}?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}" style="font-size:.9em;font-weight:normal;padding:8px 0;display:block;text-align:right">&raquo; {l s='Update' js=1}</a>';
+		li_content['update'] = '<a href="{$link->getPageLink('address', true, NULL, "id_address")|escape:'html'}'+id_address+'&amp;back={$back_order_page}?step=1{if $back}&mod={$back}{/if}" title="{l s='Update' js=1}" style="font-size:.9em;font-weight:normal;padding:8px 0;display:block;text-align:right">&raquo; {l s='Update' js=1}</a>';
 
 		appendAddressList(dest_comp, li_content, ordered_fields_name);
 	}
@@ -118,13 +118,13 @@
 				<div class="button_multishipping_mode" id="multishipping_mode_box">
 					<div class="title">{l s='Multi-shipping'}</div>
 					<div class="description">
-						<a href="{$link->getPageLink('order', true, NULL, 'step=1&multi-shipping=1')}"/>
+						<a href="{$link->getPageLink('order', true, NULL, 'step=1&multi-shipping=1')|escape:'html'}"/>
 							{l s='Specify a delivery address for each product ordered.'}
 						</a>
 					</div>
 				</div>
 			{/if}
-		<form action="{$link->getPageLink($back_order_page, true)}" method="post" data-ajax="false">
+		<form action="{$link->getPageLink($back_order_page, true)|escape:'html'}" method="post" data-ajax="false">
 		{else}
 			{if {Configuration::get('PS_ALLOW_MULTISHIPPING')} && !$cart->isVirtualCart()}
 				<div class="address-form-multishipping">
@@ -134,7 +134,7 @@
 							<input type="checkbox" id="multishipping_mode_checkbox" onchange="multishippingMode(this); return false;"/><label for="multishipping_mode_checkbox">{l s='I\'d like to specify a delivery address for each product ordered.'}</label>
 						</div>
 						<div class="description_off">
-							<a href="{$link->getPageLink('order-opc', true, NULL, 'ajax=1&multi-shipping=1&method=multishipping')}" id="link_multishipping_form" title="{l s='Choose the delivery address(es)'}">
+							<a href="{$link->getPageLink('order-opc', true, NULL, 'ajax=1&multi-shipping=1&method=multishipping')|escape:'html'}" id="link_multishipping_form" title="{l s='Choose the delivery address(es)'}">
 								{l s='Specify a delivery address for each product.'}
 							</a>
 						</div>
@@ -178,7 +178,7 @@
 					{/section}
 					</select>
 					{else}
-						<a style="margin-left: 221px;" href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1&select_address=1{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
+						<a style="margin-left: 221px;" href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1&select_address=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large">{l s='Add a new address'}</a>
 					{/if}
 				</p>
 			</div>
@@ -196,7 +196,7 @@
 					</div>
 				</div>
 				<p class="address_add submit">
-					<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}" title="{l s='Add'}" class="button_large" data-role="button" data-icon="plus">{l s='Add a new address'}</a>
+					<a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add'}" class="button_large" data-role="button" data-icon="plus">{l s='Add a new address'}</a>
 				</p>
 				{if !$opc}
 				<div id="ordermsg" class="clearfix">
@@ -209,7 +209,7 @@
 			<fieldset class="cart_navigation submit ui-grid-a">
 				<input type="hidden" class="hidden" name="step" value="2" />
 				<input type="hidden" name="back" value="{$back}" />
-				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=0{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
+				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=0{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
 				<div class="ui-block-b"><input type="submit" name="processAddress" value="{l s='Next'}" class="exclusive" data-icon="check" data-iconpos="right" data-theme="b" /></div>
 			</fieldset>
 		</form>

themes/default/mobile/order-carrier.tpl

@@ -14,7 +14,7 @@
 		var currencyBlank = '{$currencyBlank|intval}';
 		var txtProduct = "{l s='product' js=1}";
 		var txtProducts = "{l s='products' js=1}";
-		var orderUrl = '{$link->getPageLink("order", true)}';
+		var orderUrl = '{$link->getPageLink("order", true)|escape:'html'}';
 	
 		var msg = "{l s='You must agree to the terms of service before continuing.' js=1}";
 		{literal}
@@ -67,7 +67,7 @@
 			{assign var='current_step' value='shipping'}
 			{include file="$tpl_dir./errors.tpl"}
 			
-			<form id="form" action="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")}" method="post" onsubmit="return acceptCGV();" data-ajax="false">
+			<form id="form" action="{$link->getPageLink('order', true, NULL, "multi-shipping={$multi_shipping}")|escape:'html'}" method="post" onsubmit="return acceptCGV();" data-ajax="false">
 		{else}
 			<div id="opc_delivery_methods" class="opc-main-block">
 			<div id="opc_delivery_methods-overlay" class="opc-overlay" style="display: none;"></div>
@@ -237,7 +237,7 @@
 			<fieldset class="cart_navigation submit ui-grid-a">
 				<input type="hidden" class="hidden" name="step" value="3" />
 				<input type="hidden" name="back" value="{$back}" />
-				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=1{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
+				<div class="ui-block-a"><a href="{$link->getPageLink($back_order_page, true, NULL, "step=1{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></div>
 				<div class="ui-block-b"><input type="submit" name="processCarrier" value="{l s='Next'}" class="exclusive" data-icon="check" data-iconpos="right" data-theme="b" data-ajax="false" /></div>
 			</fieldset>
 		</form>

themes/default/mobile/order-detail-product-li.tpl

@@ -89,9 +89,9 @@
 		<h3>
 			{if $product.download_hash && $invoice && $product.display_filename != ''}
 				{if isset($is_guest) && $is_guest}
-				<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&amp;id_order={$order->id}&secure_key={$order->secure_key}")}" title="{l s='Download this product'}" data-ajax="false">
+				<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}&amp;id_order={$order->id}&secure_key={$order->secure_key}")|escape:'html'}" title="{l s='Download this product'}" data-ajax="false">
 				{else}
-					<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")}" title="{l s='Download this product'}" data-ajax="false">
+					<a href="{$link->getPageLink('get-file', true, NULL, "key={$product.filename|escape:'htmlall':'UTF-8'}-{$product.download_hash|escape:'htmlall':'UTF-8'}")|escape:'html'}" title="{l s='Download this product'}" data-ajax="false">
 				{/if}
 					<img src="{$img_dir}icon/download_product.gif" class="icon" alt="{l s='Download product'}" />
 					{$product.product_name|escape:'htmlall':'UTF-8'}

themes/default/mobile/order-detail.tpl

@@ -35,7 +35,7 @@
 		{if isset($opc) && $opc}
 			{assign var='type_order' value="order-opc"}
 		{/if}
-		<a data-icon="refresh" data-role="button" data-theme="e" href="{$link->getPageLink({$type_order}, true, NULL, "submitReorder&id_order={$order->id|intval}")}" title="{l s='Reorder'}" data-ajax="false">
+		<a data-icon="refresh" data-role="button" data-theme="e" href="{$link->getPageLink({$type_order}, true, NULL, "submitReorder&id_order={$order->id|intval}")|escape:'html'}" title="{l s='Reorder'}" data-ajax="false">
 		{l s='Reorder'}
 		</a>
 	</div>
@@ -91,9 +91,9 @@
 <p>
 	<img src="{$img_dir}icon/pdf.gif" alt="" class="icon" />
 	{if $is_guest}
-		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}&amp;secure_key=$order->secure_key")}" >{l s='Download your invoice as a PDF file.'}</a>
+		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}&amp;secure_key=$order->secure_key")|escape:'html'}" >{l s='Download your invoice as a PDF file.'}</a>
 	{else}
-		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}")}" >{l s='Download your invoice as a PDF file.'}</a>
+		<a href="{$link->getPageLink('pdf-invoice', true, NULL, "id_order={$order->id}")|escape:'html'}" >{l s='Download your invoice as a PDF file.'}</a>
 	{/if}
 </p>
 {/if}
@@ -143,7 +143,7 @@
 {*$HOOK_ORDERDETAILDISPLAYED*}
 {* / TO CHECK ==========================*}
 {if $return_allowed}<p>{l s='If you wish to return one or more products, please mark the corresponding boxes and provide an explanation for the return. When complete, click the button below.'}</p>{/if}
-{if !$is_guest}<form action="{$link->getPageLink('order-follow', true)}" method="post">{/if}
+{if !$is_guest}<form action="{$link->getPageLink('order-follow', true)|escape:'html'}" method="post">{/if}
 <ul data-role="listview" data-inset="true">
 {foreach from=$products item=product name=products}
 	{if !isset($product.deleted)}
@@ -273,7 +273,7 @@
 		</div>
 	{/if}
 	{* / TO CHECK ==========================*}
-	<form action="{$link->getPageLink('order-detail', true)}" method="post" class="std" id="sendOrderMessage">
+	<form action="{$link->getPageLink('order-detail', true)|escape:'html'}" method="post" class="std" id="sendOrderMessage">
 		<h3 class="bg">{l s='Add a message'}</h3>
 		<p>{l s='If you would like to add a comment about your order, please write it in the field below.'}</p>
 		<fieldset>

themes/default/mobile/order-follow.tpl

@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 	{if isset($errorQuantity) && $errorQuantity}<p class="error">{l s='You do not have enough products to request an additional merchandise return.'}</p>{/if}
 	{if isset($errorMsg) && $errorMsg}<p class="error">{l s='Please provide an explanation for your RMA.'}</p>{/if}
@@ -51,14 +51,14 @@
 			<tbody>
 			{foreach from=$ordersReturn item=return name=myLoop}
 				<tr class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.index % 2}alternate_item{/if}">
-					<td class="bold"><a class="color-myaccount" href="javascript:showOrder(0, {$return.id_order_return|intval}, '{$link->getPageLink('order-return')}');" data-ajax="false">{l s='#'}{$return.id_order_return|string_format:"%06d"}</a></td>
+					<td class="bold"><a class="color-myaccount" href="javascript:showOrder(0, {$return.id_order_return|intval}, '{$link->getPageLink('order-return')|escape:'html'}');" data-ajax="false">{l s='#'}{$return.id_order_return|string_format:"%06d"}</a></td>
-					<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$return.id_order|intval}, '{$link->getPageLink('order-detail')}');" data-ajax="false">{l s='#'}{$return.id_order|string_format:"%06d"}</a></td>
+					<td class="history_method"><a class="color-myaccount" href="javascript:showOrder(1, {$return.id_order|intval}, '{$link->getPageLink('order-detail')|escape:'html'}');" data-ajax="false">{l s='#'}{$return.id_order|string_format:"%06d"}</a></td>
 					<td class="history_method"><span class="bold">{$return.state_name|escape:'htmlall':'UTF-8'}</span></td>
 					<td class="bold">{dateFormat date=$return.date_add full=0}</td>
 					<td class="history_invoice">
 					{if $return.state == 2}
-						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" class="icon" /></a>
+						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")|escape:'html'}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false"><img src="{$img_dir}icon/pdf.gif" alt="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" class="icon" /></a>
-						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false">{l s='Print out'}</a>
+						<a href="{$link->getPageLink('pdf-order-return', true, NULL, "id_order_return={$return.id_order_return|intval}")|escape:'html'}" title="{l s='Order return'} {l s='#'}{$return.id_order_return|string_format:"%06d"}" data-ajax="false">{l s='Print out'}</a>
 					{else}
 						--
 					{/if}

themes/default/mobile/order-opc-address.tpl

@@ -96,6 +96,6 @@
 		{assign var="back_order_page" value="order.php"}
 	{/if}
 
-	<p><a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")}" title="{l s='Add a new address'}" data-role="button" data-theme="e" data-icon="plus" data-ajax="false">{l s='Add a new address'}</a><br /></p>
+	<p><a href="{$link->getPageLink('address', true, NULL, "back={$back_order_page}?step=1{if $back}&mod={$back}{/if}")|escape:'html'}" title="{l s='Add a new address'}" data-role="button" data-theme="e" data-icon="plus" data-ajax="false">{l s='Add a new address'}</a><br /></p>
 
 </div>

themes/default/mobile/order-opc-carrier.tpl

@@ -36,7 +36,7 @@
 	var currencyBlank = '{$currencyBlank|intval}';
 	var txtProduct = "{l s='product' js=1}";
 	var txtProducts = "{l s='products' js=1}";
-	var orderUrl = '{$link->getPageLink("order", true)}';
+	var orderUrl = '{$link->getPageLink("order", true)|escape:'html'}';
 
 	var msg = "{l s='You must agree to the terms of service before continuing.' js=1}";
 	{literal}

themes/default/mobile/order-opc.tpl

@@ -33,11 +33,11 @@
 <script type="text/javascript">
 	// <![CDATA[
 	var imgDir = '{$img_dir}';
-	var authenticationUrl = '{$link->getPageLink("authentication", true)}';
+	var authenticationUrl = '{$link->getPageLink("authentication", true)|escape:'html'}';
-	var orderOpcUrl = '{$link->getPageLink("order-opc", true)}';
+	var orderOpcUrl = '{$link->getPageLink("order-opc", true)|escape:'html'}';
-	var historyUrl = '{$link->getPageLink("history", true)}';
+	var historyUrl = '{$link->getPageLink("history", true)|escape:'html'}';
-	var guestTrackingUrl = '{$link->getPageLink("guest-tracking", true)}';
+	var guestTrackingUrl = '{$link->getPageLink("guest-tracking", true)|escape:'html'}';
-	var addressUrl = '{$link->getPageLink("address", true)}';
+	var addressUrl = '{$link->getPageLink("address", true)|escape:'html'}';
 	var orderProcess = 'order-opc';
 	var guestCheckoutEnabled = {$PS_GUEST_CHECKOUT_ENABLED|intval};
 	var currencySign = '{$currencySign|html_entity_decode:2:"UTF-8"}';

themes/default/mobile/order-payment.tpl

@@ -255,12 +255,12 @@
 											<span style="float:left">{if $quantityDisplayed == 0 AND isset($customizedDatas.$productId.$productAttributeId)}{$customizedDatas.$productId.$productAttributeId|@count}{else}{$product.cart_quantity-$quantityDisplayed}{/if}</span>
 										{else}
 											<div style="float:right">
-												<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" title="{l s='Delete this customization'}" width="11" height="13" class="icon" /></a>
+												<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete'}" title="{l s='Delete this customization'}" width="11" height="13" class="icon" /></a>
 											</div>
 											<div id="cart_quantity_button" style="float:left">
-											<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+											<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 											{if $product.minimal_quantity < ($customization.quantity -$quantityDisplayed) OR $product.minimal_quantity <= 1}
-											<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+											<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_{$id_customization}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 												<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 											</a>
 											{else}
@@ -325,7 +325,7 @@
 			{/if}
 			
 			{if !$opc}
-				<p class="cart_navigation"><a href="{$link->getPageLink('order', true, NULL, "step=2{if $back}&back={$back}{/if}")}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></p>
+				<p class="cart_navigation"><a href="{$link->getPageLink('order', true, NULL, "step=2{if $back}&back={$back}{/if}")|escape:'html'}" title="{l s='Previous'}" data-role="button" data-icon="back" data-ajax="false">&laquo; {l s='Previous'}</a></p>
 			{else}
 				</div>
 			{/if}

themes/default/mobile/order-slip.tpl

@@ -27,7 +27,7 @@
 {include file='./page-title.tpl'}
 
 <div data-role="content" id="content">
-	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a>
+	<a data-role="button" data-icon="arrow-l" data-theme="a" data-mini="true" data-inline="true" href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a>
 
 	<p>{l s='Credit slips you have received after cancelled orders'}.</p>
 	<div class="block-center" id="block-history">
@@ -36,12 +36,12 @@
 			{foreach from=$ordersSlip item=slip name=myLoop}
 				<li>
 					{assign var="id_order" value={$slip.id_order|intval}}
-					<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")}" data-ajax="false">
+					<a class="color-myaccount" id="order-{$id_order}" href="{$link->getPageLink('order-detail', true, null, "id_order=$id_order")|escape:'html'}" data-ajax="false">
 						<h3>{l s='Credit slip'} {l s='#'}{$slip.id_order_slip|string_format:"%06d"}</h3>
 						<p>{l s='Order'} {l s='#'}{$slip.id_order|string_format:"%06d"}</p>
 						<span class="ui-li-aside">{dateFormat date=$slip.date_add full=0}</span>
 					</a>
-					<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")}" title="{l s='Credit slip'} {l s='#'}{$slip.id_order_slip|string_format:"%06d"}" data-ajax="false">
+					<a rel="external" data-iconshadow="false" href="{$link->getPageLink('pdf-order-slip', true, NULL, "id_order_slip={$slip.id_order_slip|intval}")|escape:'html'}" title="{l s='Credit slip'} {l s='#'}{$slip.id_order_slip|string_format:"%06d"}" data-ajax="false">
 						{l s='PDF'}
 					</a>
 				</li>

themes/default/mobile/pages-list.tpl

@@ -26,14 +26,14 @@
 		<hr/>
 		<h2 class="site_map">{l s='Sitemap'}</h2>
 		<ul data-role="listview" data-inset="true" id="category">
-			{if $controller_name != 'index'}<li><a href="{$link->getPageLink('index', true)}" data-ajax="false">Accueil</a></li>{/if}
+			{if $controller_name != 'index'}<li><a href="{$link->getPageLink('index', true)|escape:'html'}" data-ajax="false">Accueil</a></li>{/if}
 			
 			{* need to set a Hook : hookMobilePagesList *}
 			{* ===================================== *}
-			<li><a href="{$link->getCategoryLink(3, false)}" data-ajax="false">IPod</a></li>
+			<li><a href="{$link->getCategoryLink(3, false)|escape:'html'}" data-ajax="false">IPod</a></li>
-			<li><a href="{$link->getCategoryLink(4, false)}" data-ajax="false">Accessoires</a></li>
+			<li><a href="{$link->getCategoryLink(4, false)|escape:'html'}" data-ajax="false">Accessoires</a></li>
 			{* ===================================== *}
 			
-			{if $controller_name != 'my-account'}<li><a href="{$link->getPageLink('my-account', true)}" data-ajax="false">{l s='My account'}</a></li>{/if}
+			{if $controller_name != 'my-account'}<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}" data-ajax="false">{l s='My account'}</a></li>{/if}
-			{if $controller_name != 'contact'}<li><a href="{$link->getPageLink('contact', true)}" data-ajax="false">{l s='Contact'}</a></li>{/if}
+			{if $controller_name != 'contact'}<li><a href="{$link->getPageLink('contact', true)|escape:'html'}" data-ajax="false">{l s='Contact'}</a></li>{/if}
 		</ul>

themes/default/mobile/pagination.tpl

@@ -59,19 +59,19 @@
 			<a {$no_follow_text} class="button_prev{if $p == 1} disabled{/if}" data-role="button" data-icon="arrow-l" data-iconpos="left" href="{if isset($p_previous)}{$link->goPage($requestPage, $p_previous)}{/if}" data-ajax="false">{l s='Previous'}</a>
 		</li>
 		{if $start>3}
-			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)}" data-ajax="false">1</a></li>
+			<li><a {$no_follow_text}  href="{$link->goPage($requestPage, 1)|escape:'html'}" data-ajax="false">1</a></li>
 			<li class="truncate">...</li>
 		{/if}
 		{section name=pagination start=$start loop=$stop+1 step=1}
 			{if $p == $smarty.section.pagination.index}
 				<li class="current"><a href="#" data-role="button" class="ui-btn-active" data-ajax="false">{$p|escape:'htmlall':'UTF-8'}</a></li>
 			{else}
-				<li><a data-role="button" {$no_follow_text} href="{$link->goPage($requestPage, $smarty.section.pagination.index)}" data-ajax="false">{$smarty.section.pagination.index|escape:'htmlall':'UTF-8'}</a></li>
+				<li><a data-role="button" {$no_follow_text} href="{$link->goPage($requestPage, $smarty.section.pagination.index)|escape:'html'}" data-ajax="false">{$smarty.section.pagination.index|escape:'htmlall':'UTF-8'}</a></li>
 			{/if}
 		{/section}
 		{if $pages_nb>$stop+2}
 			<li class="truncate">...</li>
-			<li><a href="{$link->goPage($requestPage, $pages_nb)}" data-ajax="false">{$pages_nb|intval}</a></li>
+			<li><a href="{$link->goPage($requestPage, $pages_nb)|escape:'html'}" data-ajax="false">{$pages_nb|intval}</a></li>
 		{/if}
 		{if $pages_nb > 1 AND $p != $pages_nb}
 			{assign var='p_next' value=$p+1}

themes/default/mobile/password.tpl

@@ -42,6 +42,6 @@
 	</form>
 	{/if}
 	<p class="clear">
-		<a href="{$link->getPageLink('authentication', true)}" title="{l s='Return to Login'}"><img src="{$img_dir}icon/my-account.gif" alt="{l s='Return to Login'}" class="icon" /></a><a href="{$link->getPageLink('authentication')}" title="{l s='Back to Login'}" data-ajax="false">{l s='Back to Login'}</a>
+		<a href="{$link->getPageLink('authentication', true)}" title="{l s='Return to Login'}"><img src="{$img_dir}icon/my-account.gif" alt="{l s='Return to Login'}" class="icon" /></a><a href="{$link->getPageLink('authentication')|escape:'html'}" title="{l s='Back to Login'}" data-ajax="false">{l s='Back to Login'}</a>
 	</p>
 </div><!-- /content -->

themes/default/mobile/product-desc-features.tpl

@@ -29,7 +29,7 @@
 			<h3>{l s='Download'}</h3>
 			<ul>
 				{foreach from=$attachments item=attachment}
-					<li><a href="{$link->getPageLink('attachment', true, NULL, "id_attachment={$attachment.id_attachment}")}" data-ajax="false">{$attachment.name|escape:'htmlall':'UTF-8'}</a><br />{$attachment.description|escape:'htmlall':'UTF-8'}</li>
+					<li><a href="{$link->getPageLink('attachment', true, NULL, "id_attachment={$attachment.id_attachment}")|escape:'html'}" data-ajax="false">{$attachment.name|escape:'htmlall':'UTF-8'}</a><br />{$attachment.description|escape:'htmlall':'UTF-8'}</li>
 				{/foreach}
 			</ul>
 		</div>
@@ -46,7 +46,7 @@
 						<a href="{$accessoryLink|escape:'htmlall':'UTF-8'}" data-ajax="false">
 							<div class="clearfix" >
 								<div class="col-left" style="width:{$mediumSize.width+10}px;">
-									<img src="{$link->getImageLink($accessory.link_rewrite, $accessory.id_image, 'medium_default')}" alt="{$accessory.legend|escape:'htmlall':'UTF-8'}" width="{$mediumSize.width}" height="{$mediumSize.height}" />
+									<img src="{$link->getImageLink($accessory.link_rewrite, $accessory.id_image, 'medium_default')|escape:'html'}" alt="{$accessory.legend|escape:'htmlall':'UTF-8'}" width="{$mediumSize.width}" height="{$mediumSize.height}" />
 								</div><!-- .col-left -->
 								<div class="col-right">
 									<div class="inner">

themes/default/mobile/product-images.tpl

@@ -29,13 +29,13 @@
 	<div data-role="header" class="ui-bar-a list_view">
 		{assign var=image_cover value=$product->getCover($product->id)}
 		{assign var=imageIds value="`$product->id`-`$image_cover.id_image`"}
-		<img id="bigpic" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'large_default')}" alt="{$product->name|escape:'htmlall':'UTF-8'}" />
+		<img id="bigpic" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'large_default')|escape:'html'}" alt="{$product->name|escape:'htmlall':'UTF-8'}" />
 		<div class="thumbs_list">
 			<ul id="gallery" class="thumbs_list_frame clearfix">
 			{foreach from=$images item=image name=thumbnails}
 				{assign var=imageIds value="`$product->id`-`$image.id_image`"}
 				<li id="thumbnail_{$image.id_image}">
-					<img id="thumb_{$image.id_image}" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'medium_default')}" alt="{$image.legend|htmlspecialchars}" height="{$mediumSize.height}" width="{$mediumSize.width}" data-large="{$link->getImageLink($product->link_rewrite, $imageIds, 'thickbox_default')}" />
+					<img id="thumb_{$image.id_image}" src="{$link->getImageLink($product->link_rewrite, $imageIds, 'medium_default')}" alt="{$image.legend|htmlspecialchars}" height="{$mediumSize.height}" width="{$mediumSize.width}" data-large="{$link->getImageLink($product->link_rewrite, $imageIds, 'thickbox_default')|escape:'html'}" />
 				</li>
 			{/foreach}
 			</ul>

themes/default/mobile/product.tpl

@@ -49,7 +49,7 @@
 			<h3>{l s='Pack content'}</h3>
 			{foreach from=$packItems item=packItem}
 			<div class="pack_content">
-				{$packItem.pack_quantity} x <a href="{$link->getProductLink($packItem.id_product, $packItem.link_rewrite, $packItem.category)}" data-ajax="false">{$packItem.name|escape:'htmlall':'UTF-8'}</a>
+				{$packItem.pack_quantity} x <a href="{$link->getProductLink($packItem.id_product, $packItem.link_rewrite, $packItem.category)|escape:'html'}" data-ajax="false">{$packItem.name|escape:'htmlall':'UTF-8'}</a>
 				<p>{$packItem.description_short}</p>
 			</div>
 			{/foreach}
@@ -57,7 +57,7 @@
 	{/if}
 	
 	{if ($product->show_price AND !isset($restricted_country_mode)) OR isset($groups) OR $product->reference}
-	<form id="buy_block" {if $PS_CATALOG_MODE AND !isset($groups) AND $product->quantity > 0}class="hidden"{/if} action="{$link->getPageLink('cart')}" method="post" data-ajax="false">
+	<form id="buy_block" {if $PS_CATALOG_MODE AND !isset($groups) AND $product->quantity > 0}class="hidden"{/if} action="{$link->getPageLink('cart')|escape:'html'}" method="post" data-ajax="false">
 
 			<!-- hidden datas -->
 			<p class="hidden">

themes/default/mobile/shopping-cart-gift-line.tpl

@@ -28,7 +28,7 @@
 <input type="hidden" id="cart_product_address_delivery_id_{$product.id_product}" value="{$product.id_address_delivery}"/>
 
 <div class="fl width-20">
-	<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" class="img_product_cart" />
+	<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" class="img_product_cart" />
 </div>
 <div class="fl width-60 padding-left-5px">
 	<h3>{$product.name}</h3>

themes/default/mobile/shopping-cart-product-line.tpl

@@ -25,7 +25,7 @@
 
 <tr id="product_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}{if !empty($product.gift)}_gift{/if}" class="{if isset($productLast) && $productLast && (!isset($ignoreProductLast) || !$ignoreProductLast)}last_item{elseif isset($productFirst) && $productFirst}first_item{/if} {if isset($customizedDatas.$productId.$productAttributeId) AND $quantityDisplayed == 0}alternate_item{/if} cart_item address_{$product.id_address_delivery|intval} {if $odd}odd{else}even{/if}">
 	<td class="cart_product">
-		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
+		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" {if isset($smallSize)}width="{$smallSize.width}" height="{$smallSize.height}" {/if} /></a>
 	</td>
 	<td class="cart_description">
 		<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'htmlall':'UTF-8'}">{$product.name|escape:'htmlall':'UTF-8'}</a>
@@ -62,9 +62,9 @@
 			{/if}
 			{if !isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed > 0}
 				<div class="cart_quantity_button">
-				<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
+				<a rel="nofollow" class="cart_quantity_up" id="cart_quantity_up_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" title="{l s='Add'}"><img src="{$img_dir}icon/quantity_up.gif" alt="{l s='Add'}" width="14" height="9" /></a><br />
 				{if $product.minimal_quantity < ($product.cart_quantity-$quantityDisplayed) OR $product.minimal_quantity <= 1}
-				<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")}" title="{l s='Subtract'}">
+				<a rel="nofollow" class="cart_quantity_down" id="cart_quantity_down_{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "add=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;op=down&amp;token={$token_cart}")|escape:'html'}" title="{l s='Subtract'}">
 					<img src="{$img_dir}icon/quantity_down.gif" alt="{l s='Subtract'}" width="14" height="9" />
 				</a>
 				{else}
@@ -96,7 +96,7 @@
 		<td class="cart_delete">
 		{if (!isset($customizedDatas.$productId.$productAttributeId) OR $quantityDisplayed) > 0 && empty($product.gift)}
 			<div>
-				<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}">{l s='Delete'}</a>
+				<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}">{l s='Delete'}</a>
 			</div>
 		{/if}
 		</td>

themes/default/mobile/shopping-cart.tpl

@@ -20,7 +20,7 @@
 						<input type="hidden" id="cart_product_address_delivery_id_{$product.id_product}" value="{$product.id_address_delivery}"/>
 
 						<div class="fl width-20">
-							<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" class="img_product_cart" />
+							<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" class="img_product_cart" />
 						</div>
 						<div class="fl width-60 padding-left-5px">
 							<h3>{$product.name}</h3>
@@ -58,7 +58,7 @@
 							</tbody>
 						</table>
 					</a>
-					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" data-ajax="false">{l s='Delete'}</a>
+					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" data-ajax="false">{l s='Delete'}</a>
 				</li>
 			{/foreach}
 			{assign var='last_was_odd' value=$product@iteration%2}
@@ -74,7 +74,7 @@
 						{* Display the gift product line *}
 						{include file="./shopping-cart-gift-line.tpl" productLast=$product@last productFirst=$product@first}
 					</a>
-					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")}" data-ajax="false" style="display:none">{l s='Delete'}</a>
+					<a rel="nofollow" class="cart_quantity_delete" id="{$product.id_product}_{$product.id_product_attribute}_0_{$product.id_address_delivery|intval}" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_address_delivery={$product.id_address_delivery|intval}&amp;token={$token_cart}")|escape:'html'}" data-ajax="false" style="display:none">{l s='Delete'}</a>
 				</li>
 			{/foreach}
 		</ul>
@@ -205,11 +205,11 @@
 		</div><!-- /grid-a -->
 		<br />
 		{if $opc && $isLogged && !$isGuest}
-			<a href="{$link->getPageLink('index', true)}" data-role="button" data-theme="a" data-icon="back" data-ajax="false">{l s='Continue shopping'}</a>
+			<a href="{$link->getPageLink('index', true)|escape:'html'}" data-role="button" data-theme="a" data-icon="back" data-ajax="false">{l s='Continue shopping'}</a>
 		{else}
 			<ul data-role="listview" data-inset="true" id="list_myaccount">
 				<li data-theme="a" data-icon="back">
-					<a href="{$link->getPageLink('index', true)}" data-ajax="false">{l s='Continue shopping'}</a>
+					<a href="{$link->getPageLink('index', true)|escape:'html'}" data-ajax="false">{l s='Continue shopping'}</a>
 				</li>
 				<li data-theme="b" data-icon="check">
 					<a href="{if $back}{$link->getPageLink('order', true, NULL, 'step=1&amp;back={$back}')}{else}{$link->getPageLink('order', true, NULL, 'step=1')}{/if}" data-ajax="false">{l s='Confirm order'}</a>