diff --git a/admin-dev/themes/default/template/controllers/carts/helpers/view/view.tpl b/admin-dev/themes/default/template/controllers/carts/helpers/view/view.tpl
index 2a683185d..82956455a 100755
--- a/admin-dev/themes/default/template/controllers/carts/helpers/view/view.tpl
+++ b/admin-dev/themes/default/template/controllers/carts/helpers/view/view.tpl
@@ -36,7 +36,7 @@
 		<h2><img src="../img/admin/vcard.png" />{l s='Customer information'}</h2>
 		<span style="font-size: 14px;">
 		{if $customer->id}
-			<a href="{$link->getAdminLink('AdminCustomers')}&id_customer={$customer->id}&viewcustomer">{$customer->firstname} {$customer->lastname}</a></span>
+			<a href="{$link->getAdminLink('AdminCustomers')|escape:'htmlall':'UTF-8'}&id_customer={$customer->id}&viewcustomer">{$customer->firstname} {$customer->lastname}</a></span>
 			{l s='#'}{$customer->id}<br />
 			<a style="text-decoration: underline; color:#268CCD;" href="mailto:{$customer->email}">{$customer->email}</a>	<br /><br />
 			{l s='Account registration date:'} {dateFormat date=$customer->date_add}<br />
@@ -51,12 +51,12 @@
 		<h2><img src="../img/admin/cart.gif" /> {l s='Order information'}</h2>
 		<span>
 		{if $order->id}
-			<a href="{$link->getAdminLink('AdminOrders')}&id_order={$order->id}&vieworder"> {l s='Order #%d' sprintf=$order->id|string_format:"%06d"}</a></span>
+			<a href="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&id_order={$order->id}&vieworder"> {l s='Order #%d' sprintf=$order->id|string_format:"%06d"}</a></span>
 			<br /><br />
 			{l s='Made on:'} {dateFormat date=$order->date_add}<br /><br /><br /><br />
 		{else}
 			{l s='No order created from this cart'}</span>
-			<p><a class="button" href="{$link->getAdminLink('AdminOrders')}&id_cart={$cart->id}&addorder">{l s='Create an order with from cart'}</a></p>
+			<p><a class="button" href="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&id_cart={$cart->id}&addorder">{l s='Create an order with from cart'}</a></p>
 		{/if}
 	</div>
 	<br style="clear:both;" />
@@ -80,7 +80,7 @@
 			{if isset($customized_datas[$product.id_product][$product.id_product_attribute])}
 				<tr>
 					<td align="center">{$product.image}</td>
-					<td><a href="{$link->getAdminLink('AdminProducts')}&id_product={$product.id_product}&updateproduct">
+					<td><a href="{$link->getAdminLink('AdminProducts')|escape:'htmlall':'UTF-8'}&id_product={$product.id_product}&updateproduct">
 								<span class="productName">{$product.name}</span>{if isset($product.attributes)}<br />{$product.attributes}{/if}<br />
 							{if $product.reference}$this->l('Ref:') {$product.reference}{/if}
 							{if $product.reference && $product.supplier_reference} / {$product.supplier_reference}{/if}
@@ -125,7 +125,7 @@
 				<tr>
 					<td align="center">{$product.image}</td>
 					<td>
-						<a href="{$link->getAdminLink('AdminProducts')}&id_product={$product.id_product}&updateproduct">
+						<a href="{$link->getAdminLink('AdminProducts')|escape:'htmlall':'UTF-8'}&id_product={$product.id_product}&updateproduct">
 						<span class="productName">{$product.name}</span>{if isset($product.attributes)}<br />{$product.attributes}{/if}<br />
 						{if $product.reference}{l s='Ref:'} {$product.reference}{/if}
 						{if $product.reference && $product.supplier_reference} / {$product.supplier_reference}{/if}
@@ -175,7 +175,7 @@
 		</tr>
 		{foreach from=$discounts item='discount'}
 			<tr>
-				<td><a href="{$link->getAdminLink('AdminDiscounts')}&id_discount={$discount.id_discount}&updatediscount">{$discount.name}</a></td>
+				<td><a href="{$link->getAdminLink('AdminDiscounts')|escape:'htmlall':'UTF-8'}&id_discount={$discount.id_discount}&updatediscount">{$discount.name}</a></td>
 				<td align="center">- {displayWtPriceWithCurrency price=$discount.value_real currency=$currency}</td>
 			</tr>
 		{/foreach}
diff --git a/admin-dev/themes/default/template/controllers/orders/_documents.tpl b/admin-dev/themes/default/template/controllers/orders/_documents.tpl
index b6e87bcd9..11826dd10 100644
--- a/admin-dev/themes/default/template/controllers/orders/_documents.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/_documents.tpl
@@ -60,12 +60,12 @@
 		<td class="document_number">
 			{if get_class($document) eq 'OrderInvoice'}
 				{if isset($document->is_delivery)}
-					<a target="_blank" href="{$link->getAdminLink('AdminPdf')}&submitAction=generateDeliverySlipPDF&id_order_invoice={$document->id}">
+					<a target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order_invoice={$document->id}">
 			   	{else}
-					<a target="_blank" href="{$link->getAdminLink('AdminPdf')}&submitAction=generateInvoicePDF&id_order_invoice={$document->id}">
+					<a target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order_invoice={$document->id}">
 			   {/if}
 			{elseif get_class($document) eq 'OrderSlip'}
-				<a target="_blank" href="{$link->getAdminLink('AdminPdf')}&submitAction=generateOrderSlipPDF&id_order_slip={$document->id}">
+				<a target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateOrderSlipPDF&id_order_slip={$document->id}">
 			{/if}
 			{if get_class($document) eq 'OrderInvoice'}
 				{if isset($document->is_delivery)}
diff --git a/admin-dev/themes/default/template/controllers/orders/_print_pdf_icon.tpl b/admin-dev/themes/default/template/controllers/orders/_print_pdf_icon.tpl
index 14edc0b8a..412411841 100644
--- a/admin-dev/themes/default/template/controllers/orders/_print_pdf_icon.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/_print_pdf_icon.tpl
@@ -27,7 +27,7 @@
 {* Generate HTML code for printing Invoice Icon with link *}
 <span style="width:20px; margin-right:5px;">
 {if ($order_state->invoice || $order->invoice_number)}
-	<a target="_blank" href="{$link->getAdminLink('AdminPdf')}&submitAction=generateInvoicePDF&id_order={$order->id}"><img src="../img/admin/tab-invoice.gif" alt="invoice" /></a>
+	<a target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order={$order->id}"><img src="../img/admin/tab-invoice.gif" alt="invoice" /></a>
 {else}
 	-
 {/if}
@@ -36,7 +36,7 @@
 {* Generate HTML code for printing Delivery Icon with link *}
 <span style="width:20px;">
 {if ($order_state->delivery || $order->delivery_number)}
-	<a target="_blank" href="{$link->getAdminLink('AdminPdf')}&submitAction=generateDeliverySlipPDF&id_order={$order->id}"><img src="../img/admin/delivery.gif" alt="delivery" /></a>
+	<a target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order={$order->id}"><img src="../img/admin/delivery.gif" alt="delivery" /></a>
 {else}
 	-
 {/if}
diff --git a/admin-dev/themes/default/template/controllers/orders/_shipping.tpl b/admin-dev/themes/default/template/controllers/orders/_shipping.tpl
index dcbfb358c..c2aa56d31 100644
--- a/admin-dev/themes/default/template/controllers/orders/_shipping.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/_shipping.tpl
@@ -58,7 +58,7 @@
 		<td>
 			<span id="shipping_number_show">{if $line.url && $line.tracking_number}<a href="{$line.url|replace:'@':$line.tracking_number}">{$line.tracking_number}</a>{else}{$line.tracking_number}{/if}</span>
 			{if $line.can_edit}
-				<form style="display: inline;" method="post" action="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$order->id|escape:'htmlall':'UTF-8'}">
+				<form style="display: inline;" method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id|escape:'htmlall':'UTF-8'}">
 					<span class="shipping_number_edit" style="display:none;">
 						<input type="hidden" name="id_order_carrier" value="{$line.id_order_carrier|htmlentities}" />
 						<input type="text" name="tracking_number" value="{$line.tracking_number|htmlentities}" />
diff --git a/admin-dev/themes/default/template/controllers/orders/form.tpl b/admin-dev/themes/default/template/controllers/orders/form.tpl
index 25596401e..c381d70ae 100755
--- a/admin-dev/themes/default/template/controllers/orders/form.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/form.tpl
@@ -950,14 +950,14 @@
 	<div class="margin-form">
 		<input type="text" id="customer" value="" />
 		<p>{l s='Search a customer by tapping the first letters of his name'}</p>
-		<a class="fancybox button" href="{$link->getAdminLink('AdminCustomers')}&addcustomer&liteDisplaying=1&submitFormAjax=1#">
+		<a class="fancybox button" href="{$link->getAdminLink('AdminCustomers')|escape:'htmlall':'UTF-8'}&addcustomer&liteDisplaying=1&submitFormAjax=1#">
 			<img src="../img/admin/add.gif" title="new"/><span>{l s='Add new customer'}</span>
 		</a>
 	</div>
 	<div id="customers">
 	</div>
 </fieldset><br />
-<form action="{$link->getAdminLink('AdminOrders')}&submitAdd{$table}=1" method="post" autocomplete="off">
+<form action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&submitAdd{$table}=1" method="post" autocomplete="off">
 <fieldset id="products_part" style="display:none;"><legend><img src="../img/t/AdminCatalog.gif" />{l s='Cart'}</legend>
 	<div>
 		<label>{l s='Search a product:'} </label>
@@ -1099,7 +1099,7 @@
 	<p>
 		<label>{l s='Search a voucher:'} </label>
 		<input type="text" id="voucher" value="" />
-		<a class="fancybox button" href="{$link->getAdminLink('AdminCartRules')}&addcart_rule&liteDisplaying=1&submitFormAjax=1#"><img src="../img/admin/add.gif" title="new"/>{l s='Add new voucher'}</a>
+		<a class="fancybox button" href="{$link->getAdminLink('AdminCartRules')|escape:'htmlall':'UTF-8'}&addcart_rule&liteDisplaying=1&submitFormAjax=1#"><img src="../img/admin/add.gif" title="new"/>{l s='Add new voucher'}</a>
 	</p>
 	<div class="margin-form">
 		<table cellspacing="0" cellpadding="0" class="table" id="voucher_list">
@@ -1135,7 +1135,7 @@
 		<div id="address_invoice_detail">
 		</div>
 	</div>
-<a class="fancybox button" id="new_address" href="{$link->getAdminLink('AdminAddresses')}&addaddress&id_customer=42&liteDisplaying=1&submitFormAjax=1#"><img src="../img/admin/add.gif" title="new"/>{l s='Add new address'}</a>
+<a class="fancybox button" id="new_address" href="{$link->getAdminLink('AdminAddresses')|escape:'htmlall':'UTF-8'}&addaddress&id_customer=42&liteDisplaying=1&submitFormAjax=1#"><img src="../img/admin/add.gif" title="new"/>{l s='Add new address'}</a>
 </fieldset>
 <br />
 <fieldset id="carriers_part" style="display:none;">
diff --git a/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl b/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
index 45999ec3f..b14b0b7ed 100755
--- a/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
@@ -64,7 +64,7 @@
 <div class="bloc-command">
 	<div class="button-command">
 			{if (count($invoices_collection))}
-				<a class="button" href="{$link->getAdminLink('AdminPdf')}&submitAction=generateInvoicePDF&id_order={$order->id}" target="_blank">
+				<a class="button" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order={$order->id}" target="_blank">
 					<img src="../img/admin/charged_ok.gif" alt="{l s='View invoice'}" /> {l s='View invoice'}
 				</a>
 			{else}
@@ -72,7 +72,7 @@
 			{/if}
 			 |
 			{if (($currentState && $currentState->delivery) || $order->delivery_number)}
-				<a class="button"  href="{$link->getAdminLink('AdminPdf')}&submitAction=generateDeliverySlipPDF&id_order={$order->id}" target="_blank">
+				<a class="button"  href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order={$order->id}" target="_blank">
 					<img src="../img/admin/delivery.gif" alt="{l s='View delivery slip'}" /> {l s='View delivery slip'}
 				</a>
 			{else}
@@ -198,8 +198,8 @@
 		<div style="width: 49%; float:right;">
 			<div class="button-command-prev-next">
 				<b>{l s='Orders'}</b> :
-				{if $previousOrder}<a class="button" href="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$previousOrder}">{l s='< Prev'}</a>{/if}
-				{if $nextOrder}<a class="button" href="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$nextOrder}">{l s='Next >'}</a>{/if}
+				{if $previousOrder}<a class="button" href="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$previousOrder}">{l s='< Prev'}</a>{/if}
+				{if $nextOrder}<a class="button" href="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$nextOrder}">{l s='Next >'}</a>{/if}
 			</div>
 			<div class="clear"></div>
 			
@@ -473,7 +473,7 @@
 								<td>
 									<span id="shipping_number_show">{if isset($line.url) && isset($line.tracking_number)}<a href="{$line.url|replace:'@':$line.tracking_number}">{$line.tracking_number}</a>{elseif isset($line.tracking_number)}{$line.tracking_number}{/if}</span>
 									{if $line.can_edit}
-									<form style="display: inline;" method="post" action="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$order->id}&id_order_invoice={if $line.id_order_invoice}{$line.id_order_invoice|escape:'htmlall':'UTF-8'}{else}0{/if}&id_carrier={if $line.id_carrier}{$line.id_carrier|escape:'htmlall':'UTF-8'}{else}0{/if}">
+									<form style="display: inline;" method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id}&id_order_invoice={if $line.id_order_invoice}{$line.id_order_invoice|escape:'htmlall':'UTF-8'}{else}0{/if}&id_carrier={if $line.id_carrier}{$line.id_carrier|escape:'htmlall':'UTF-8'}{else}0{/if}">
 										<span class="shipping_number_edit" style="display:none;">
 											<input type="text" name="tracking_number" value="{$line.tracking_number|htmlentities}" />
 											<input type="submit" class="button" name="submitShippingNumber" value="{l s='Update'}" />
@@ -510,7 +510,7 @@
 					<legend><img src="../img/admin/delivery.gif" alt="{l s='Shipping address'}" />{l s='Shipping address'}</legend>
 
 					{if $can_edit}
-					<form method="post" action="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$order->id}">
+					<form method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id}">
 						<div style="margin-bottom:5px;">
 							<p>
 								<select name="id_address">
@@ -540,7 +540,7 @@
 				<legend><img src="../img/admin/invoice.gif" alt="{l s='Invoice address'}" />{l s='Invoice address'}</legend>
 
 				{if $can_edit}
-				<form method="post" action="{$link->getAdminLink('AdminOrders')}&vieworder&id_order={$order->id}">
+				<form method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id}">
 					<div style="margin-bottom:5px;">
 						<p>
 							<select name="id_address">
@@ -745,7 +745,7 @@
 			<div id="message_m" style="display: {if Tools::getValue('message')}none{else}block{/if}; overflow: auto; width: 400px;">
 				<a href="#" onclick="$('#message').slideToggle();$('#message_m').slideToggle();return false"><b>{l s='Click here'}</b> {l s='to add a comment or send a message to the customer'}</a>
 			</div>
-			<a href="{$link->getAdminLink('AdminCustomerThreads')}"><b>{l s='Click here'}</b> {l s='to see all messages'}</a><br>
+			<a href="{$link->getAdminLink('AdminCustomerThreads')|escape:'htmlall':'UTF-8'}"><b>{l s='Click here'}</b> {l s='to see all messages'}</a><br>
 			<div id="message" style="display: {if Tools::getValue('message')}block{else}none{/if}">
 						<select name="order_message" id="order_message" onchange="orderOverwriteMessage(this, '{l s='Do you want to overwrite your existing message?'}')">
 							<option value="0" selected="selected">-- {l s='Choose a standard message'} --</option>
diff --git a/admin-dev/themes/default/template/controllers/outstanding/_print_pdf_icon.tpl b/admin-dev/themes/default/template/controllers/outstanding/_print_pdf_icon.tpl
index e8b1b2541..31b042325 100644
--- a/admin-dev/themes/default/template/controllers/outstanding/_print_pdf_icon.tpl
+++ b/admin-dev/themes/default/template/controllers/outstanding/_print_pdf_icon.tpl
@@ -26,5 +26,5 @@
 
 {* Generate HTML code for printing Invoice Icon with link *}
 <span style="width:20px; margin-right:5px;">
-	<a href="{$link->getAdminLink('AdminPdf')}&submitAction=generateInvoicePDF&id_order_invoice={$id_invoice}"><img src="../img/admin/tab-invoice.gif" alt="invoice" /></a>
+	<a href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order_invoice={$id_invoice}"><img src="../img/admin/tab-invoice.gif" alt="invoice" /></a>
 </span>
\ No newline at end of file
diff --git a/admin-dev/themes/default/template/controllers/products/associations.tpl b/admin-dev/themes/default/template/controllers/products/associations.tpl
index 748a05392..b19104252 100644
--- a/admin-dev/themes/default/template/controllers/products/associations.tpl
+++ b/admin-dev/themes/default/template/controllers/products/associations.tpl
@@ -51,7 +51,7 @@
 		<tr>
 			<td></td>
 			<td class="col-right">
-					<a class="button bt-icon confirm_leave" href="{$link->getAdminLink('AdminCategories')}&addcategory">
+					<a class="button bt-icon confirm_leave" href="{$link->getAdminLink('AdminCategories')|escape:'htmlall':'UTF-8'}&addcategory">
 						<img src="../img/admin/add.gif" alt="{l s='Create new category'}" title="{l s='Create new category'}" />
 						<span>{l s='Create new category'}</span>
 					</a>
@@ -110,7 +110,7 @@
 				{/if}
 				<option disabled="disabled">----------</option>
 			</select>&nbsp;&nbsp;&nbsp;
-			<a class="button bt-icon confirm_leave" style="margin-bottom:0" href="{$link->getAdminLink('AdminManufacturers')}&addmanufacturer">
+			<a class="button bt-icon confirm_leave" style="margin-bottom:0" href="{$link->getAdminLink('AdminManufacturers')|escape:'htmlall':'UTF-8'}&addmanufacturer">
 				<img src="../img/admin/add.gif" alt="{l s='Create new manufacturer'}" title="{l s='Create new manufacturer'}" />
 				<span>{l s='Create new manufacturer'}</span>
 			</a>
diff --git a/admin-dev/themes/default/template/controllers/products/features.tpl b/admin-dev/themes/default/template/controllers/products/features.tpl
index 0aa9b4c1a..56aca05bb 100644
--- a/admin-dev/themes/default/template/controllers/products/features.tpl
+++ b/admin-dev/themes/default/template/controllers/products/features.tpl
@@ -72,7 +72,7 @@
 		{else}
 			<input type="hidden" name="feature_{$available_feature.id_feature}_value" value="0" />
 				<span>{l s='N/A'} -
-				<a href="{$link->getAdminLink('AdminFeatures')}&amp;addfeature_value&id_feature={$available_feature.id_feature}"
+				<a href="{$link->getAdminLink('AdminFeatures')|escape:'htmlall':'UTF-8'}&amp;addfeature_value&id_feature={$available_feature.id_feature}"
 				 class="confirm_leave button"><img src="../img/admin/add.gif" alt="values_first" title="{l s='Add pre-defined values first'}" />&nbsp;{l s='Add pre-defined values first'}</a>
 			</span>
 		{/if}
@@ -94,7 +94,7 @@
 	</table>
 	<div class="separation"></div>
 	<div>
-		<a href="{$link->getAdminLink('AdminFeatures')}&amp;addfeature" class="confirm_leave button">
+		<a href="{$link->getAdminLink('AdminFeatures')|escape:'htmlall':'UTF-8'}&amp;addfeature" class="confirm_leave button">
 			<img src="../img/admin/add.gif" alt="new_features" title="{l s='Add a new feature'}" />&nbsp;{l s='Add a new feature'}
 		</a>
 	</div>
diff --git a/admin-dev/themes/default/template/controllers/products/prices.tpl b/admin-dev/themes/default/template/controllers/products/prices.tpl
index 1b87e07e2..32f86e61e 100644
--- a/admin-dev/themes/default/template/controllers/products/prices.tpl
+++ b/admin-dev/themes/default/template/controllers/products/prices.tpl
@@ -166,12 +166,12 @@ $(document).ready(function () {
 						</option>
 					{/foreach}
 				</select>
-				<a class="button" href="{$link->getAdminLink('AdminTaxRulesGroup')}&addtax_rules_group&id_product={$product->id}" class="confirm_leave">
+				<a class="button" href="{$link->getAdminLink('AdminTaxRulesGroup')|escape:'htmlall':'UTF-8'}&addtax_rules_group&id_product={$product->id}" class="confirm_leave">
 				<img src="../img/admin/add.gif" alt="{l s='Create'}" title="{l s='Create'}" /> {l s='Create'}
 				</a>
 			</span>
 			{if $tax_exclude_taxe_option}
-				<span style="margin-left:10px; color:red;">{l s='Taxes are currently disabled'}</span> (<b><a href="{$link->getAdminLink('AdminTaxes')}">{l s='Tax options'}</a></b>)
+				<span style="margin-left:10px; color:red;">{l s='Taxes are currently disabled'}</span> (<b><a href="{$link->getAdminLink('AdminTaxes')|escape:'htmlall':'UTF-8'}">{l s='Tax options'}</a></b>)
 				<input type="hidden" value="{$product->getIdTaxRulesGroup()}" name="id_tax_rules_group" />
 			{/if}
 		</td>
diff --git a/admin-dev/themes/default/template/controllers/products/suppliers.tpl b/admin-dev/themes/default/template/controllers/products/suppliers.tpl
index cf410257c..d6ec9ec1a 100644
--- a/admin-dev/themes/default/template/controllers/products/suppliers.tpl
+++ b/admin-dev/themes/default/template/controllers/products/suppliers.tpl
@@ -36,7 +36,7 @@
 		<p>{l s='When using the advanced stock management (see Preferences/Products), the values you fill here (prices, references) will be used in the supply orders.'}</p>
 	</div>
 	<p>{l s='Please choose the suppliers associated with this product, and the default one.'}</p>
-	<a class="button bt-icon confirm_leave" href="{$link->getAdminLink('AdminSuppliers')}&addsupplier">
+	<a class="button bt-icon confirm_leave" href="{$link->getAdminLink('AdminSuppliers')|escape:'htmlall':'UTF-8'}&addsupplier">
 		<img src="../img/admin/add.gif" alt="{l s='Create new supplier'}" title="{l s='Create new supplier'}" /><span>{l s='Create new supplier'}</span>
 	</a>
 	<table cellpadding="5" style="width:100%">
diff --git a/admin-dev/themes/default/template/controllers/products/warehouses.tpl b/admin-dev/themes/default/template/controllers/products/warehouses.tpl
index 47db895ce..2c218035f 100644
--- a/admin-dev/themes/default/template/controllers/products/warehouses.tpl
+++ b/admin-dev/themes/default/template/controllers/products/warehouses.tpl
@@ -35,7 +35,7 @@
 	</div>
 	<p>{l s='Please choose the warehouses associated with this product, and the default one.'}</p>
 
-	<a class="button bt-icon confirm_leave" href="{$link->getAdminLink('AdminWarehouses')}&addwarehouse">
+	<a class="button bt-icon confirm_leave" href="{$link->getAdminLink('AdminWarehouses')|escape:'htmlall':'UTF-8'}&addwarehouse">
 		<img src="../img/admin/add.gif" alt="{l s='Create new warehouse'}" title="{l s='Create new warehouse'}" /><span>{l s='Create new warehouse'}</span>
 	</a>
 
diff --git a/admin-dev/themes/default/template/controllers/shop/helpers/list/list_content.tpl b/admin-dev/themes/default/template/controllers/shop/helpers/list/list_content.tpl
index b87591aa0..008271889 100644
--- a/admin-dev/themes/default/template/controllers/shop/helpers/list/list_content.tpl
+++ b/admin-dev/themes/default/template/controllers/shop/helpers/list/list_content.tpl
@@ -31,7 +31,7 @@
 		{if isset($tr.$key)}
 			<a href="{$tr.$key}" onmouseover="$(this).css('text-decoration', 'underline')" onmouseout="$(this).css('text-decoration', 'none')" target="_blank">{$tr.$key}</a>
 		{else}
-			<a href="{$link->getAdminLink('AdminShopUrl')}&id_shop={$tr.$identifier}&addshop_url" class="multishop_warning">{l s='Click here to set an URL for this shop'}</a>
+			<a href="{$link->getAdminLink('AdminShopUrl')|escape:'htmlall':'UTF-8'}&id_shop={$tr.$identifier}&addshop_url" class="multishop_warning">{l s='Click here to set an URL for this shop'}</a>
 		{/if}
 	{else}
 		{$smarty.block.parent}
diff --git a/admin-dev/themes/default/template/controllers/supply_orders_change_state/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/supply_orders_change_state/helpers/form/form.tpl
index cf12cf1dd..2b970091d 100644
--- a/admin-dev/themes/default/template/controllers/supply_orders_change_state/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/supply_orders_change_state/helpers/form/form.tpl
@@ -68,7 +68,7 @@ $(document).ready(function() {
 	<img src="../img/admin/pdf.gif" alt="{l s='Supply Order State'}">
 	{l s='Print the supply order form'}
 </legend>
-<a href="{$link->getAdminLink('AdminPdf')}&submitAction=generateSupplyOrderFormPDF&id_supply_order={$supply_order->id}" target="_blank" title="Export as PDF">{l s='Click here to download the supply order form'}.</a>
+<a href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateSupplyOrderFormPDF&id_supply_order={$supply_order->id}" target="_blank" title="Export as PDF">{l s='Click here to download the supply order form'}.</a>
 </fieldset>
 {/if}
 
diff --git a/admin-dev/themes/default/template/header.tpl b/admin-dev/themes/default/template/header.tpl
index 5899a52fb..afc3beedc 100644
--- a/admin-dev/themes/default/template/header.tpl
+++ b/admin-dev/themes/default/template/header.tpl
@@ -88,9 +88,7 @@
 	<link type="text/css" rel="stylesheet" href="{$base_url}css/admin-ie.css" />
 	<![endif]-->
 	<style type="text/css">
-		div#header_infos, div#header_infos a#header_shopname, div#header_infos a#header_logout, div#header_infos a#header_foaccess {
-		color:{$brightness}
-		}
+		div#header_infos, div#header_infos a#header_shopname, div#header_infos a#header_logout, div#header_infos a#header_foaccess {ldelim}color:{$brightness}{rdelim}
 	</style>
 </head>
 <body style="{if isset($bo_color) && $bo_color}background:{$bo_color};{/if}{if isset($bo_width) && $bo_width > 0}text-align:center;{/if}">
@@ -102,7 +100,7 @@
 {* begin  HEADER *}
 	<div id="header">
 		<div id="header_infos">
-			<a id="header_shopname" href="{$link->getAdminLink('AdminHome')}"><span>{$shop_name}</span></a><div id="notifs_icon_wrapper">
+			<a id="header_shopname" href="{$link->getAdminLink('AdminHome')|escape:'htmlall':'UTF-8'}"><span>{$shop_name}</span></a><div id="notifs_icon_wrapper">
 			{if {$show_new_orders} == 1}
 				<div id="orders_notif" class="notifs">
 						<span id="orders_notif_number_wrapper" class="number_wrapper">
@@ -112,7 +110,7 @@
 						<h3>{l s='Last orders'}</h3>
 						<p class="no_notifs">{l s='No new orders has been placed on your shop'}</p>
 						<ul id="list_orders_notif"></ul>
-						<p><a href="index.php?controller=AdminOrders&token={getAdminToken tab='AdminOrders'}">{l s='Show all orders'}</a></p>
+						<p><a href="index.php?controller=AdminOrders&amp;token={getAdminToken tab='AdminOrders'}">{l s='Show all orders'}</a></p>
 					</div>
 				</div>
 			{/if}
@@ -125,7 +123,7 @@
 						<h3>{l s='Last customers'}</h3>
 						<p class="no_notifs">{l s='No new customers registered on your shop'}</p>
 						<ul id="list_customers_notif"></ul>
-						<p><a href="index.php?controller=AdminCustomers&token={getAdminToken tab='AdminCustomers'}">{l s='Show all customers'}</a></p>
+						<p><a href="index.php?controller=AdminCustomers&amp;token={getAdminToken tab='AdminCustomers'}">{l s='Show all customers'}</a></p>
 					</div>
 				</div>
 			{/if}
@@ -138,81 +136,84 @@
 						<h3>{l s='Last messages'}</h3>
 						<p class="no_notifs">{l s='No new messages posted on your shop'}</p>
 						<ul id="list_customer_messages_notif"></ul>
-						<p><a href="index.php?tab=AdminCustomerThreads&token={getAdminToken tab='AdminCustomerThreads'}">{l s='Show all messages'}</a></p>
+						<p><a href="index.php?tab=AdminCustomerThreads&amp;token={getAdminToken tab='AdminCustomerThreads'}">{l s='Show all messages'}</a></p>
 					</div>
 				</div>
 			{/if}
 		</div>
-				<span id="employee_links">
-				<span class="employee_name">{$first_name}&nbsp;{$last_name}</span>
-						<span class="separator"></span>
-						<a class="employee" href="index.php?controller=AdminEmployees&id_employee={$employee->id}&updateemployee&token={getAdminToken tab='AdminEmployees'}"  alt="" /> {l s='My preferences'}</a>
-					<span class="separator"></span><a href="index.php?logout" id="header_logout">
-					<span>{l s='logout'}</span>
-				</a>
-					{if {$base_url}}
-						<span class="separator"></span> <a href="{$base_url}" id="header_foaccess" target="_blank" title="{l s='View my shop'}"><span>{l s='View my shop'}</span></a>
-					{/if}
-			</span>
-			<div id="header_search">
-				<form method="post" action="index.php?controller=AdminSearch&token={getAdminToken tab='AdminSearch'}">
-					<input type="text" name="bo_query" id="bo_query" value="{$bo_query}" />
-					<select name="bo_search_type" id="bo_search_type" class="chosen no-search">
-						<option value="0">{l s='everywhere'}</option>
-						<option value="1" {if {$search_type} == 1} selected="selected" {/if}>{l s='catalog'}</option>
-						<optgroup label="{l s='customers'}:">
-							<option value="2" {if {$search_type} == 2} selected="selected" {/if}>{l s='by name'}</option>
-							<option value="6" {if {$search_type} == 6} selected="selected" {/if}>{l s='by ip address'}</option>
-						</optgroup>
-						<option value="3" {if {$search_type} == 3} selected="selected" {/if}>{l s='orders'}</option>
-						<option value="4" {if {$search_type} == 4} selected="selected" {/if}>{l s='invoices'}</option>
-						<option value="5" {if {$search_type} == 5} selected="selected" {/if}>{l s='carts'}</option>
-					</select>
-					<input type="submit" id="bo_search_submit" class="button" value="{l s='Search'}"/>
-				</form>
-			</div>
-
-			{if count($quick_access) > 0}
-			<div id="header_quick">
-				<script type="text/javascript">
-					function quickSelect(elt)
-					{
-						var eltVal = $(elt).val();
-						if (eltVal == "0") return false;
-						else if (eltVal.substr(eltVal.length - 6) == '_blank') window.open(eltVal.substr(0, eltVal.length - 6), '_blank');
-						else location.href = eltVal;
-					}
-				</script>
-				<select onchange="quickSelect(this);" id="quick_select" class="chosen no-search">
-					<option value="0">{l s='Quick Access'}</option>
-					{foreach $quick_access as $quick}
-						<option value="{$quick.link}{if $quick.new_window}_blank{/if}">&raquo; {$quick.name}</option>
-					{/foreach}
-				</select>
-			</div>
+		<div id="employee_links">
+			<span class="employee_name">{$first_name}&nbsp;{$last_name}</span>
+			<span class="separator">&nbsp;</span>
+			<a class="employee" href="index.php?controller=AdminEmployees&amp;id_employee={$employee->id}&amp;updateemployee&amp;token={getAdminToken tab='AdminEmployees'}" alt="">{l s='My preferences'}</a>
+			<span class="separator">&nbsp;</span>
+			<a href="index.php?logout" id="header_logout">{l s='logout'}</a>
+			{if {$base_url}}
+				<span class="separator">&nbsp;</span>
+				<a href="{$base_url}" id="header_foaccess" target="_blank" title="{l s='View my shop'}">{l s='View my shop'}</a>
 			{/if}
-
-			{hook h="displayBackOfficeTop"}
 		</div>
-		<ul id="menu">
-			{if !$tab}
-				<div class="mainsubtablist" style="display:none">
-				</div>
-			{/if}
-			{foreach $tabs AS $t}
-				<li class="submenu_size maintab {if $t.current}active{/if}" id="maintab{$t.id_tab}">
-			<span class="title">
-				<img src="{$t.img}" alt="" />{if $t.name eq ''}{$t.class_name}{else}{$t.name}{/if}
-			</span>
-					<ul class="submenu">
-						{foreach from=$t.sub_tabs item=t2}
-							<li><a href="{$t2.href}">{if $t2.name eq ''}{$t2.class_name}{else}{$t2.name}{/if}</a></li>
-						{/foreach}
-					</ul>
-				</li>
-			{/foreach}
-		</ul>
+		<div id="header_search">
+			<form method="post" action="index.php?controller=AdminSearch&amp;token={getAdminToken tab='AdminSearch'}">
+				<input type="text" name="bo_query" id="bo_query" value="{$bo_query}" />
+				<select name="bo_search_type" id="bo_search_type" class="chosen no-search">
+					<option value="0">{l s='everywhere'}</option>
+					<option value="1" {if {$search_type} == 1} selected="selected" {/if}>{l s='catalog'}</option>
+					<optgroup label="{l s='customers'}:">
+						<option value="2" {if {$search_type} == 2} selected="selected" {/if}>{l s='by name'}</option>
+						<option value="6" {if {$search_type} == 6} selected="selected" {/if}>{l s='by ip address'}</option>
+					</optgroup>
+					<option value="3" {if {$search_type} == 3} selected="selected" {/if}>{l s='orders'}</option>
+					<option value="4" {if {$search_type} == 4} selected="selected" {/if}>{l s='invoices'}</option>
+					<option value="5" {if {$search_type} == 5} selected="selected" {/if}>{l s='carts'}</option>
+				</select>
+				<input type="submit" id="bo_search_submit" class="button" value="{l s='Search'}"/>
+			</form>
+		</div>
+
+		{if count($quick_access) > 0}
+		<div id="header_quick">
+			<script type="text/javascript">
+				function quickSelect(elt)
+				{
+					var eltVal = $(elt).val();
+					if (eltVal == "0")
+						return false;
+					else if (eltVal.substr(eltVal.length - 6) == '_blank')
+						window.open(eltVal.substr(0, eltVal.length - 6), '_blank');
+					else
+						location.href = eltVal;
+				}
+			</script>
+			<select onchange="quickSelect(this);" id="quick_select" class="chosen no-search">
+				<option value="0">{l s='Quick Access'}</option>
+				{foreach $quick_access as $quick}
+					<option value="{$quick.link|escape:'htmlall':'UTF-8'}{if $quick.new_window}_blank{/if}">&raquo; {$quick.name}</option>
+				{/foreach}
+			</select>
+		</div>
+		{/if}
+
+		{hook h="displayBackOfficeTop"}
 	</div> {* end header *}
+
+	<ul id="menu">
+		{if !$tab}
+			<div class="mainsubtablist" style="display:none">
+			</div>
+		{/if}
+		{foreach $tabs AS $t}
+			<li class="submenu_size maintab {if $t.current}active{/if}" id="maintab{$t.id_tab}">
+		<span class="title">
+			<img src="{$t.img}" alt="" />{if $t.name eq ''}{$t.class_name}{else}{$t.name}{/if}
+		</span>
+				<ul class="submenu">
+					{foreach from=$t.sub_tabs item=t2}
+						<li><a href="{$t2.href|escape:'htmlall':'UTF-8'}">{if $t2.name eq ''}{$t2.class_name}{else}{$t2.name|escape:'htmlall':'UTF-8'}{/if}</a></li>
+					{/foreach}
+				</ul>
+			</li>
+		{/foreach}
+	</ul>
 {/if}
 	<div id="main">
 		<div id="content">
diff --git a/admin-dev/themes/default/template/toolbar.tpl b/admin-dev/themes/default/template/toolbar.tpl
index 71f8e9087..5928139b0 100644
--- a/admin-dev/themes/default/template/toolbar.tpl
+++ b/admin-dev/themes/default/template/toolbar.tpl
@@ -38,7 +38,7 @@
 				{/foreach}
 			</ul>
 
-			<script language="javascript" type="text/javascript">
+			<script language="javascript" type="text/javascript"><![CDATA[
 				var submited = false
 				$(function() {
 					//get reference on save link
@@ -108,7 +108,7 @@
 						{/block}
 					}
 				});
-			</script>
+			]]></script>
 		{/block}
 		<div class="pageTitle">
 			<h3>{block name=pageTitle}
@@ -118,7 +118,7 @@
 							{* Use strip_tags because if the string already has been through htmlentities using escape will break it *}
 							<span class="breadcrumb item-{$key} ">{$item|strip_tags}
 								{if !$smarty.foreach.title.last}
-									<img alt="&gt;" style="margin-right:5px" src="../img/admin/separator_breadcrum.png">
+									<img alt="&gt;" style="margin-right:5px" src="../img/admin/separator_breadcrumb.png" />
 								{/if}
 							</span>
 						{/foreach}
diff --git a/controllers/admin/AdminRequestSqlController.php b/controllers/admin/AdminRequestSqlController.php
index e7d5b688c..588ca9276 100644
--- a/controllers/admin/AdminRequestSqlController.php
+++ b/controllers/admin/AdminRequestSqlController.php
@@ -107,15 +107,13 @@ class AdminRequestSqlControllerCore extends AdminController
 
 		$this->displayWarning($this->l('When saving the query, only the request type "SELECT" are allowed.'));
 		$this->displayInformation('
-			<strong>'.$this->l('How to create a new sql query?').'</strong>
-			<br />
-			<ul>
-				<li>'.$this->l('Click "Add new".').'<br /></li>
-				<li>'.$this->l('Fill in the fields and click "Save".').'</li>
-				<li>'.$this->l('You can then view the query results by clicking on the tab:').' <img src="../img/admin/details.gif"></li>
-				<li>'.$this->l('You can then export the query results as CSV file by clicking on the tab:').' <img src="../img/admin/export.gif"></li>
-			</ul>
-		');
+		<strong>'.$this->l('How to create a new sql query?').'</strong><br />
+		<ul>
+			<li>'.$this->l('Click "Add new".').'</li>
+			<li>'.$this->l('Fill in the fields and click "Save".').'</li>
+			<li>'.$this->l('You can then view the query results by clicking on the tab:').' <img src="../img/admin/details.gif" /></li>
+			<li>'.$this->l('You can then export the query results as CSV file by clicking on the tab:').' <img src="../img/admin/export.gif" /></li>
+		</ul>');
 
 		$this->addRowAction('export');
 		$this->addRowAction('view');
diff --git a/img/admin/separator_breadcrum.png b/img/admin/separator_breadcrumb.png
similarity index 100%
rename from img/admin/separator_breadcrum.png
rename to img/admin/separator_breadcrumb.png