[core] From echo to p

9 files changed, 177 insertions, 177 deletions

diff --git a/settings/apps.php b/settings/apps.php
index b9ed2cac93a..44cfff7e3f1 100644
--- a/settings/apps.php
+++ b/settings/apps.php
@@ -49,7 +49,7 @@ usort( $combinedApps, 'app_sort' );
 
 $tmpl = new OC_Template( "settings", "apps", "user" );
 
-$tmpl->assign('apps', $combinedApps, false);
+$tmpl->assign('apps', $combinedApps);
 
 $appid = (isset($_GET['appid'])?strip_tags($_GET['appid']):'');
 
diff --git a/settings/templates/admin.php b/settings/templates/admin.php
index f3dc9154bbd..dd5e89b8f82 100644
--- a/settings/templates/admin.php
+++ b/settings/templates/admin.php
@@ -12,10 +12,10 @@ $levels = array('Debug', 'Info', 'Warning', 'Error', 'Fatal');
 if (!$_['htaccessworking']) {
 	?>
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Security Warning');?></strong></legend>
+	<legend><strong><?php p($l->t('Security Warning'));?></strong></legend>
 
 	<span class="securitywarning">
-		<?php echo $l->t('Your data directory and your files are probably accessible from the internet. The .htaccess file that ownCloud provides is not working. We strongly suggest that you configure your webserver in a way that the data directory is no longer accessible or you move the data directory outside the webserver document root.'); ?>
+		<?php p($l->t('Your data directory and your files are probably accessible from the internet. The .htaccess file that ownCloud provides is not working. We strongly suggest that you configure your webserver in a way that the data directory is no longer accessible or you move the data directory outside the webserver document root.')); ?>
 	</span>
 
 </fieldset>
@@ -26,11 +26,11 @@ if (!$_['htaccessworking']) {
 if (!$_['isWebDavWorking']) {
 	?>
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Setup Warning');?></strong></legend>
+	<legend><strong><?php p($l->t('Setup Warning'));?></strong></legend>
 
 	<span class="securitywarning">
-		<?php echo $l->t('Your web server is not yet properly setup to allow files synchronization because the WebDAV interface seems to be broken.'); ?>
-		<?php echo $l->t('Please double check the <a href=\'%s\'>installation guides</a>.', 'http://doc.owncloud.org/server/5.0/admin_manual/installation.html'); ?>
+		<?php p($l->t('Your web server is not yet properly setup to allow files synchronization because the WebDAV interface seems to be broken.')); ?>
+		<?php print_unescaped($l->t('Please double check the <a href=\'%s\'>installation guides</a>.', 'http://doc.owncloud.org/server/5.0/admin_manual/installation.html')); ?>
 	</span>
 
 </fieldset>
@@ -41,10 +41,10 @@ if (!$_['isWebDavWorking']) {
 if (!$_['has_fileinfo']) {
 	?>
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Module \'fileinfo\' missing');?></strong></legend>
+	<legend><strong><?php p($l->t('Module \'fileinfo\' missing'));?></strong></legend>
 
 		<span class="connectionwarning">
-		<?php echo $l->t('The PHP module \'fileinfo\' is missing. We strongly recommend to enable this module to get best results with mime-type detection.'); ?>
+		<?php p($l->t('The PHP module \'fileinfo\' is missing. We strongly recommend to enable this module to get best results with mime-type detection.')); ?>
 	</span>
 
 </fieldset>
@@ -55,12 +55,12 @@ if (!$_['has_fileinfo']) {
 if (!$_['islocaleworking']) {
 	?>
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Locale not working');?></strong></legend>
+	<legend><strong><?php p($l->t('Locale not working'));?></strong></legend>
 
 		<span class="connectionwarning">
 		<?php
 			$locales = 'en_US.UTF-8/en_US.UTF8';
-			echo $l->t('This ownCloud server can\'t set system locale to %s. This means that there might be problems with certain characters in file names. We strongly suggest to install the required packages on your system to support %s.', array($locales, $locales));
+			p($l->t('This ownCloud server can\'t set system locale to %s. This means that there might be problems with certain characters in file names. We strongly suggest to install the required packages on your system to support %s.', array($locales, $locales)));
 			?>
 	</span>
 
@@ -72,10 +72,10 @@ if (!$_['islocaleworking']) {
 if (!$_['internetconnectionworking']) {
 	?>
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Internet connection not working');?></strong></legend>
+	<legend><strong><?php p($l->t('Internet connection not working'));?></strong></legend>
 
 		<span class="connectionwarning">
-		<?php echo $l->t('This ownCloud server has no working internet connection. This means that some of the features like mounting of external storage, notifications about updates or installation of 3rd party apps don´t work. Accessing files from remote and sending of notification emails might also not work. We suggest to enable internet connection for this server if you want to have all features of ownCloud.'); ?>
+		<?php p($l->t('This ownCloud server has no working internet connection. This means that some of the features like mounting of external storage, notifications about updates or installation of 3rd party apps don´t work. Accessing files from remote and sending of notification emails might also not work. We suggest to enable internet connection for this server if you want to have all features of ownCloud.')); ?>
 	</span>
 
 </fieldset>
@@ -84,106 +84,106 @@ if (!$_['internetconnectionworking']) {
 ?>
 
 <?php foreach ($_['forms'] as $form) {
-	echo $form;
+	print_unescaped($form);
 }
 ;?>
 
 <fieldset class="personalblock" id="backgroundjobs">
-	<legend><strong><?php echo $l->t('Cron');?></strong></legend>
+	<legend><strong><?php p($l->t('Cron'));?></strong></legend>
 	<table class="nostyle">
 		<tr>
 			<td>
 				<input type="radio" name="mode" value="ajax"
 					   id="backgroundjobs_ajax" <?php if ($_['backgroundjobs_mode'] == "ajax") {
-					echo 'checked="checked"';
+					print_unescaped('checked="checked"');
 				} ?>>
 				<label for="backgroundjobs_ajax">AJAX</label><br/>
-				<em><?php echo $l->t("Execute one task with each page loaded"); ?></em>
+				<em><?php p($l->t("Execute one task with each page loaded")); ?></em>
 			</td>
 		</tr>
 		<tr>
 			<td>
 				<input type="radio" name="mode" value="webcron"
 					   id="backgroundjobs_webcron" <?php if ($_['backgroundjobs_mode'] == "webcron") {
-					echo 'checked="checked"';
+					print_unescaped('checked="checked"');
 				} ?>>
 				<label for="backgroundjobs_webcron">Webcron</label><br/>
-				<em><?php echo $l->t("cron.php is registered at a webcron service. Call the cron.php page in the owncloud root once a minute over http."); ?></em>
+				<em><?php p($l->t("cron.php is registered at a webcron service. Call the cron.php page in the owncloud root once a minute over http.")); ?></em>
 			</td>
 		</tr>
 		<tr>
 			<td>
 				<input type="radio" name="mode" value="cron"
 					   id="backgroundjobs_cron" <?php if ($_['backgroundjobs_mode'] == "cron") {
-					echo 'checked="checked"';
+					print_unescaped('checked="checked"');
 				} ?>>
 				<label for="backgroundjobs_cron">Cron</label><br/>
-				<em><?php echo $l->t("Use systems cron service. Call the cron.php file in the owncloud folder via a system cronjob once a minute."); ?></em>
+				<em><?php p($l->t("Use systems cron service. Call the cron.php file in the owncloud folder via a system cronjob once a minute.")); ?></em>
 			</td>
 		</tr>
 	</table>
 </fieldset>
 
 <fieldset class="personalblock" id="shareAPI">
-	<legend><strong><?php echo $l->t('Sharing');?></strong></legend>
+	<legend><strong><?php p($l->t('Sharing'));?></strong></legend>
 	<table class="shareAPI nostyle">
 		<tr>
 			<td id="enable">
 				<input type="checkbox" name="shareapi_enabled" id="shareAPIEnabled"
-					   value="1" <?php if ($_['shareAPIEnabled'] == 'yes') echo 'checked="checked"'; ?> />
-				<label for="shareAPIEnabled"><?php echo $l->t('Enable Share API');?></label><br/>
-				<em><?php echo $l->t('Allow apps to use the Share API'); ?></em>
+					   value="1" <?php if ($_['shareAPIEnabled'] == 'yes') print_unescaped('checked="checked"'); ?> />
+				<label for="shareAPIEnabled"><?php p($l->t('Enable Share API'));?></label><br/>
+				<em><?php p($l->t('Allow apps to use the Share API')); ?></em>
 			</td>
 		</tr>
 		<tr>
-			<td <?php if ($_['shareAPIEnabled'] == 'no') echo 'style="display:none"';?>>
+			<td <?php if ($_['shareAPIEnabled'] == 'no') print_unescaped('style="display:none"');?>>
 				<input type="checkbox" name="shareapi_allow_links" id="allowLinks"
-					   value="1" <?php if ($_['allowLinks'] == 'yes') echo 'checked="checked"'; ?> />
-				<label for="allowLinks"><?php echo $l->t('Allow links');?></label><br/>
-				<em><?php echo $l->t('Allow users to share items to the public with links'); ?></em>
+					   value="1" <?php if ($_['allowLinks'] == 'yes') print_unescaped('checked="checked"'); ?> />
+				<label for="allowLinks"><?php p($l->t('Allow links'));?></label><br/>
+				<em><?php p($l->t('Allow users to share items to the public with links')); ?></em>
 			</td>
 		</tr>
 		<tr>
-			<td <?php if ($_['shareAPIEnabled'] == 'no') echo 'style="display:none"';?>>
+			<td <?php if ($_['shareAPIEnabled'] == 'no') print_unescaped('style="display:none"');?>>
 				<input type="checkbox" name="shareapi_allow_resharing" id="allowResharing"
-					   value="1" <?php if ($_['allowResharing'] == 'yes') echo 'checked="checked"'; ?> />
-				<label for="allowResharing"><?php echo $l->t('Allow resharing');?></label><br/>
-				<em><?php echo $l->t('Allow users to share items shared with them again'); ?></em>
+					   value="1" <?php if ($_['allowResharing'] == 'yes') print_unescaped('checked="checked"'); ?> />
+				<label for="allowResharing"><?php p($l->t('Allow resharing'));?></label><br/>
+				<em><?php p($l->t('Allow users to share items shared with them again')); ?></em>
 			</td>
 		</tr>
 		<tr>
-			<td <?php if ($_['shareAPIEnabled'] == 'no') echo 'style="display:none"';?>>
+			<td <?php if ($_['shareAPIEnabled'] == 'no') print_unescaped('style="display:none"');?>>
 				<input type="radio" name="shareapi_share_policy" id="sharePolicyGlobal"
-					   value="global" <?php if ($_['sharePolicy'] == 'global') echo 'checked="checked"'; ?> />
-				<label for="sharePolicyGlobal"><?php echo $l->t('Allow users to share with anyone'); ?></label><br/>
+					   value="global" <?php if ($_['sharePolicy'] == 'global') print_unescaped('checked="checked"'); ?> />
+				<label for="sharePolicyGlobal"><?php p($l->t('Allow users to share with anyone')); ?></label><br/>
 				<input type="radio" name="shareapi_share_policy" id="sharePolicyGroupsOnly"
-					   value="groups_only" <?php if ($_['sharePolicy'] == 'groups_only') echo 'checked="checked"'; ?> />
-				<label for="sharePolicyGroupsOnly"><?php echo $l->t('Allow users to only share with users in their groups');?></label><br/>
+					   value="groups_only" <?php if ($_['sharePolicy'] == 'groups_only') print_unescaped('checked="checked"'); ?> />
+				<label for="sharePolicyGroupsOnly"><?php p($l->t('Allow users to only share with users in their groups'));?></label><br/>
 			</td>
 		</tr>
 	</table>
 </fieldset>
 
 <fieldset class="personalblock" id="security">
-	<legend><strong><?php echo $l->t('Security');?></strong></legend>
+	<legend><strong><?php p($l->t('Security'));?></strong></legend>
 	<table class="nostyle">
 		<tr>
 			<td id="enable">
 				<input type="checkbox" name="forcessl"  id="enforceHTTPSEnabled"
 					<?php if ($_['enforceHTTPSEnabled']) {
-						echo 'checked="checked" ';
-						echo 'value="false"';
+						print_unescaped('checked="checked" ');
+						print_unescaped('value="false"');
 					}  else {
-						echo 'value="true"';
+						print_unescaped('value="true"');
 					}
 					?>
-					<?php if (!$_['isConnectedViaHTTPS']) echo 'disabled'; ?> />
-				<label for="forcessl"><?php echo $l->t('Enforce HTTPS');?></label><br/>
-				<em><?php echo $l->t('Enforces the clients to connect to ownCloud via an encrypted connection.'); ?></em>
+					<?php if (!$_['isConnectedViaHTTPS']) p('disabled'); ?> />
+				<label for="forcessl"><?php p($l->t('Enforce HTTPS'));?></label><br/>
+				<em><?php p($l->t('Enforces the clients to connect to ownCloud via an encrypted connection.')); ?></em>
 				<?php if (!$_['isConnectedViaHTTPS']) {
-					echo "<br/><em>";
-					echo $l->t('Please connect to this ownCloud instance via HTTPS to enable or disable the SSL enforcement.');
-					echo "</em>";
+					print_unescaped("<br/><em>");
+					p($l->t('Please connect to this ownCloud instance via HTTPS to enable or disable the SSL enforcement.'));
+					print_unescaped("</em>");
 				}
 				?>
 			</td>
@@ -192,12 +192,12 @@ if (!$_['internetconnectionworking']) {
 </fieldset>
 
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Log');?></strong></legend>
-	<?php echo $l->t('Log level');?> <select name='loglevel' id='loglevel'>
-	<option value='<?php echo $_['loglevel']?>'><?php echo $levels[$_['loglevel']]?></option>
+	<legend><strong><?php p($l->t('Log'));?></strong></legend>
+	<?php p($l->t('Log level'));?> <select name='loglevel' id='loglevel'>
+	<option value='<?php p($_['loglevel'])?>'><?php p($levels[$_['loglevel']])?></option>
 	<?php for ($i = 0; $i < 5; $i++):
 	if ($i != $_['loglevel']):?>
-		<option value='<?php echo $i?>'><?php echo $levels[$i]?></option>
+		<option value='<?php p($i)?>'><?php p($levels[$i])?></option>
 		<?php endif;
 endfor;?>
 </select>
@@ -205,31 +205,31 @@ endfor;?>
 		<?php foreach ($_['entries'] as $entry): ?>
 		<tr>
 			<td>
-				<?php echo $levels[$entry->level];?>
+				<?php p($levels[$entry->level]);?>
 			</td>
 			<td>
-				<?php echo $entry->app;?>
+				<?php p($entry->app);?>
 			</td>
 			<td>
-				<?php echo $entry->message;?>
+				<?php p($entry->message);?>
 			</td>
 			<td>
-				<?php echo OC_Util::formatDate($entry->time);?>
+				<?php p(OC_Util::formatDate($entry->time));?>
 			</td>
 		</tr>
 		<?php endforeach;?>
 	</table>
 	<?php if ($_['entriesremain']): ?>
-	<input id='moreLog' type='button' value='<?php echo $l->t('More');?>...'>
+	<input id='moreLog' type='button' value='<?php p($l->t('More'));?>...'>
 	<?php endif; ?>
 
 </fieldset>
 
 
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Version');?></strong></legend>
-	<strong>ownCloud</strong> <?php echo(OC_Util::getVersionString()); ?> <?php echo(OC_Util::getEditionString()); ?>
-	(<?php echo(OC_Updater::ShowUpdatingHint()); ?>)<br/>
-	<?php echo $l->t('Developed by the <a href="http://ownCloud.org/contact" target="_blank">ownCloud community</a>, the <a href="https://github.com/owncloud" target="_blank">source code</a> is licensed under the <a href="http://www.gnu.org/licenses/agpl-3.0.html" target="_blank"><abbr title="Affero General Public License">AGPL</abbr></a>.'); ?>
+	<legend><strong><?php p($l->t('Version'));?></strong></legend>
+	<strong>ownCloud</strong> <?php p(OC_Util::getVersionString()); ?> <?php p(OC_Util::getEditionString()); ?>
+	(<?php p(OC_Updater::ShowUpdatingHint()); ?>)<br/>
+	<?php print_unescaped($l->t('Developed by the <a href="http://ownCloud.org/contact" target="_blank">ownCloud community</a>, the <a href="https://github.com/owncloud" target="_blank">source code</a> is licensed under the <a href="http://www.gnu.org/licenses/agpl-3.0.html" target="_blank"><abbr title="Affero General Public License">AGPL</abbr></a>.')); ?>
 </fieldset>
 
diff --git a/settings/templates/apps.php b/settings/templates/apps.php
index b6e98c41bd9..d3639cbab34 100644
--- a/settings/templates/apps.php
+++ b/settings/templates/apps.php
@@ -4,37 +4,37 @@
  * See the COPYING-README file.
  */?>
  <script type="text/javascript"
-	src="<?php echo OC_Helper::linkToRoute('apps_custom');?>?appid=<?php echo $_['appid']; ?>"></script>
- <script type="text/javascript" src="<?php echo OC_Helper::linkTo('settings/js', 'apps.js');?>"></script>
+	src="<?php print_unescaped(OC_Helper::linkToRoute('apps_custom'));?>?appid=<?php p($_['appid']); ?>"></script>
+ <script type="text/javascript" src="<?php print_unescaped(OC_Helper::linkTo('settings/js', 'apps.js'));?>"></script>
 
 <div id="controls">
-	<a class="button" target="_blank" href="http://owncloud.org/dev"><?php echo $l->t('Add your App');?></a>
-	<a class="button" target="_blank" href="http://apps.owncloud.com"><?php echo $l->t('More Apps');?></a>
+	<a class="button" target="_blank" href="http://owncloud.org/dev"><?php p($l->t('Add your App'));?></a>
+	<a class="button" target="_blank" href="http://apps.owncloud.com"><?php p($l->t('More Apps'));?></a>
 </div>
 <ul id="leftcontent" class="applist hascontrols">
 	<?php foreach($_['apps'] as $app):?>
-	<li <?php if($app['active']) echo 'class="active"'?> data-id="<?php echo $app['id'] ?>"
-		<?php if ( isset( $app['ocs_id'] ) ) { echo "data-id-ocs=\"{$app['ocs_id']}\""; } ?>
-			data-type="<?php echo $app['internal'] ? 'internal' : 'external' ?>" data-installed="1">
-		<a class="app<?php if(!$app['internal']) echo ' externalapp' ?>"
-			href="?appid=<?php echo $app['id'] ?>"><?php echo htmlentities($app['name']) ?></a>
+	<li <?php if($app['active']) print_unescaped('class="active"')?> data-id="<?php p($app['id']) ?>"
+		<?php if ( isset( $app['ocs_id'] ) ) { print_unescaped("data-id-ocs=\"{".OC_Util::sanitizeHTML($app['ocs_id'])."}\""); } ?>
+			data-type="<?php p($app['internal'] ? 'internal' : 'external') ?>" data-installed="1">
+		<a class="app<?php if(!$app['internal']) p(' externalapp') ?>"
+			href="?appid=<?php p($app['id']) ?>"><?php p($app['name']) ?></a>
 		<?php  if(!$app['internal'])
-			echo '<small class="'.$app['internalclass'].' list">'.$app['internallabel'].'</small>' ?>
+			print_unescaped('<small class="'.OC_Util::sanitizeHTML($app['internalclass']).' list">'.OC_Util::sanitizeHTML($app['internallabel']).'</small>') ?>
 	</li>
 	<?php endforeach;?>
 </ul>
 <div id="rightcontent">
 	<div class="appinfo">
-	<h3><strong><span class="name"><?php echo $l->t('Select an App');?></span></strong><span
+	<h3><strong><span class="name"><?php p($l->t('Select an App'));?></span></strong><span
 		class="version"></span><small class="externalapp" style="visibility:hidden;"></small></h3>
 	<span class="score"></span>
 	<p class="description"></p>
 	<img src="" class="preview" />
 	<p class="appslink hidden"><a href="#" target="_blank"><?php
-		echo $l->t('See application page at apps.owncloud.com');?></a></p>
+		p($l->t('See application page at apps.owncloud.com'));?></a></p>
 	<p class="license hidden"><?php
-		echo $l->t('<span class="licence"></span>-licensed by <span class="author"></span>');?></p>
+		print_unescaped($l->t('<span class="licence"></span>-licensed by <span class="author"></span>'));?></p>
 	<input class="enable hidden" type="submit" />
-	<input class="update hidden" type="submit" value="<?php echo($l->t('Update')); ?>" />
+	<input class="update hidden" type="submit" value="<?php p($l->t('Update')); ?>" />
 	</div>
 </div>
diff --git a/settings/templates/help.php b/settings/templates/help.php
index 7b2a3321c29..3d227817e63 100644
--- a/settings/templates/help.php
+++ b/settings/templates/help.php
@@ -1,21 +1,21 @@
 <div id="controls">
 	<?php if($_['admin']) { ?>
-		<a class="button newquestion <?php echo($_['style1']); ?>"
-			href="<?php echo($_['url1']); ?>"><?php echo $l->t( 'User Documentation' ); ?></a>
-		<a class="button newquestion <?php echo($_['style2']); ?>"
-			href="<?php echo($_['url2']); ?>"><?php echo $l->t( 'Administrator Documentation' ); ?></a>
+		<a class="button newquestion <?php p($_['style1']); ?>"
+			href="<?php print_unescaped($_['url1']); ?>"><?php p($l->t( 'User Documentation' )); ?></a>
+		<a class="button newquestion <?php p($_['style2']); ?>"
+			href="<?php print_unescaped($_['url2']); ?>"><?php p($l->t( 'Administrator Documentation' )); ?></a>
 	<?php } ?>
 	<a class="button newquestion" href="http://owncloud.org/support" target="_blank"><?php
-		echo $l->t( 'Online Documentation' ); ?></a>
+		p($l->t( 'Online Documentation' )); ?></a>
 	<a class="button newquestion" href="http://forum.owncloud.org" target="_blank"><?php
-		echo $l->t( 'Forum' ); ?></a>
+		p($l->t( 'Forum' )); ?></a>
 	<?php if($_['admin']) { ?>
 		<a class="button newquestion" href="https://github.com/owncloud/core/issues" target="_blank"><?php
-			echo $l->t( 'Bugtracker' ); ?></a>
+			p($l->t( 'Bugtracker' )); ?></a>
 	<?php } ?>
 	<a class="button newquestion" href="http://owncloud.com" target="_blank"><?php
-		echo $l->t( 'Commercial Support' ); ?></a>
+		p($l->t( 'Commercial Support' )); ?></a>
 </div>
 <div class="help-includes">
-	<iframe src="<?php echo($_['url']); ?>" class="help-iframe">abc</iframe>
+	<iframe src="<?php print_unescaped($_['url']); ?>" class="help-iframe">abc</iframe>
 </div>
diff --git a/settings/templates/oauth-required-apps.php b/settings/templates/oauth-required-apps.php
index d4fce54c59c..3660f423423 100644
--- a/settings/templates/oauth-required-apps.php
+++ b/settings/templates/oauth-required-apps.php
@@ -6,14 +6,14 @@
  */
 ?>
 <div id="oauth-request" class="guest-container">
-	<p><strong><?php echo $_['consumer']['name'].'</strong> '.$_['message']; ?></p>
+	<p><strong><?php print_unescaped(OC_Util::sanitizeHTML($_['consumer']['name']).'</strong> '.OC_Util::sanitizeHTML($_['message'])); ?></p>
 	<ul>
 		<?php
 		// Foreach requested scope
 		foreach($_['requiredapps'] as $requiredapp){
-			echo '<li>'.$requiredapp.'</li>';
+			print_unescaped('<li>'.OC_Util::sanitizeHTML($requiredapp).'</li>');
 		}
 		?>
 	</ul>
-	<a href="<?php echo OC::$WEBROOT; ?>" id="back-home" class="button">Back to ownCloud</a>
+	<a href="<?php print_unescaped(OC::$WEBROOT); ?>" id="back-home" class="button">Back to ownCloud</a>
 </div>
diff --git a/settings/templates/oauth.php b/settings/templates/oauth.php
index 053a8aee6d3..34831ba0284 100644
--- a/settings/templates/oauth.php
+++ b/settings/templates/oauth.php
@@ -6,12 +6,12 @@
  */
 ?>
 <div id="oauth-request" class="guest-container">
-	<p><strong><?php echo $_['consumer']['name']; ?></strong> is requesting your permission to read, write, modify and delete data from the following apps:</p>
+	<p><strong><?php p($_['consumer']['name']); ?></strong> is requesting your permission to read, write, modify and delete data from the following apps:</p>
 	<ul>
 		<?php
 		// Foreach requested scope
 		foreach($_['consumer']['scopes'] as $app){
-			echo '<li>'.$app.'</li>';
+			print_unescaped('<li>'.OC_Util:sanitzeHTML($app).'</li>)';
 		}
 		?>
 	</ul>
diff --git a/settings/templates/personal.php b/settings/templates/personal.php
index 3a4a6093e77..f3fd3f1010d 100644
--- a/settings/templates/personal.php
+++ b/settings/templates/personal.php
@@ -4,26 +4,26 @@
  * See the COPYING-README file.
  */?>
 
-<div id="quota" class="personalblock"><div style="width:<?php echo $_['usage_relative'];?>%;">
-	<p id="quotatext"><?php echo $l->t('You have used <strong>%s</strong> of the available <strong>%s</strong>',
-		array($_['usage'], $_['total_space']));?></p>
+<div id="quota" class="personalblock"><div style="width:<?php p($_['usage_relative']);?>%;">
+	<p id="quotatext"><?php print_unescaped($l->t('You have used <strong>%s</strong> of the available <strong>%s</strong>',
+		array($_['usage'], $_['total_space'])));?></p>
 </div></div>
 
 
 
 <div class="clientsbox">
-	<h2><?php echo $l->t('Get the apps to sync your files');?></h2>
-	<a href="<?php echo $_['clients']['desktop']; ?>" target="_blank">
-		<img src="<?php echo OCP\Util::imagePath('core', 'desktopapp.png'); ?>" />
+	<h2><?php p($l->t('Get the apps to sync your files'));?></h2>
+	<a href="<?php p($_['clients']['desktop']); ?>" target="_blank">
+		<img src="<?php print_unescaped(OCP\Util::imagePath('core', 'desktopapp.png')); ?>" />
 	</a>
-	<a href="<?php echo $_['clients']['android']; ?>" target="_blank">
-		<img src="<?php echo OCP\Util::imagePath('core', 'googleplay.png'); ?>" />
+	<a href="<?php p($_['clients']['android']); ?>" target="_blank">
+		<img src="<?php print_unescaped(OCP\Util::imagePath('core', 'googleplay.png')); ?>" />
 	</a>
-	<a href="<?php echo $_['clients']['ios']; ?>" target="_blank">
-		<img src="<?php echo OCP\Util::imagePath('core', 'appstore.png'); ?>" />
+	<a href="<?php p($_['clients']['ios']); ?>" target="_blank">
+		<img src="<?php print_unescaped(OCP\Util::imagePath('core', 'appstore.png')); ?>" />
 	</a>
 	<?php if(OC_APP::isEnabled('firstrunwizard')) {?>
-	<center><a class="button" href="#" id="showWizard"><?php echo $l->t('Show First Run Wizard again');?></a></center>
+	<center><a class="button" href="#" id="showWizard"><?php p($l->t('Show First Run Wizard again'));?></a></center>
 	<?php }?>
 </div>
 
@@ -34,7 +34,7 @@ if($_['passwordChangeSupported']) {
 ?>
 <form id="passwordform">
 	<fieldset class="personalblock">
-		<legend><strong><?php echo $l->t('Password');?></strong></legend>
+		<legend><strong><?php p($l->t('Password'));?></strong></legend>
 		<div id="passwordchanged"><?php echo $l->t('Your password was changed');?></div>
 		<div id="passworderror"><?php echo $l->t('Unable to change your password');?></div>
 		<input type="password" id="pass1" name="oldpassword" placeholder="<?php echo $l->t('Current password');?>" />
@@ -54,11 +54,11 @@ if($_['displayNameChangeSupported']) {
 <form id="displaynameform">
 	<fieldset class="personalblock">
 		<legend><strong><?php echo $l->t('Display Name');?></strong></legend>
-		<div id="displaynamechanged"><?php echo $l->t('Your display name was changed');?></div>
-		<div id="displaynameerror"><?php echo $l->t('Unable to change your display name');?></div>
-		<input type="text" id="displayName" name="displayName" value="<?php echo $_['displayName']?>" />
-		<input type="hidden" id="oldDisplayName" name="oldDisplayName" value="<?php echo $_['displayName']?>" />
-		<input id="displaynamebutton" type="submit" value="<?php echo $l->t('Change display name');?>" />
+		<div id="displaynamechanged"><?php p($l->t('Your display name was changed'));?></div>
+		<div id="displaynameerror"><?php p($l->t('Unable to change your display name'));?></div>
+		<input type="text" id="displayName" name="displayName" value="<?php p($_['displayName'])?>" />
+		<input type="hidden" id="oldDisplayName" name="oldDisplayName" value="<?php p($_['displayName'])?>" />
+		<input id="displaynamebutton" type="submit" value="<?php p($l->t('Change display name'));?>" />
 	</fieldset>
 </form>
 <?php
@@ -67,42 +67,42 @@ if($_['displayNameChangeSupported']) {
 
 <form id="lostpassword">
 	<fieldset class="personalblock">
-		<legend><strong><?php echo $l->t('Email');?></strong></legend>
-		<input type="text" name="email" id="email" value="<?php echo $_['email']; ?>"
-			placeholder="<?php echo $l->t('Your email address');?>" /><span class="msg"></span><br />
-		<em><?php echo $l->t('Fill in an email address to enable password recovery');?></em>
+		<legend><strong><?php p($l->t('Email'));?></strong></legend>
+		<input type="text" name="email" id="email" value="<?php p($_['email']); ?>"
+			placeholder="<?php p($l->t('Your email address'));?>" /><span class="msg"></span><br />
+		<em><?php p($l->t('Fill in an email address to enable password recovery'));?></em>
 	</fieldset>
 </form>
 
 <form>
 	<fieldset class="personalblock">
-		<legend><strong><?php echo $l->t('Language');?></strong></legend>
-		<select id="languageinput" class="chzen-select" name="lang" data-placeholder="<?php echo $l->t('Language');?>">
+		<legend><strong><?php p($l->t('Language'));?></strong></legend>
+		<select id="languageinput" class="chzen-select" name="lang" data-placeholder="<?php p($l->t('Language'));?>">
 		<?php foreach($_['languages'] as $language):?>
-			<option value="<?php echo $language['code'];?>"><?php echo $language['name'];?></option>
+			<option value="<?php p($language['code']);?>"><?php p($language['name']);?></option>
 		<?php endforeach;?>
 		</select>
-		<a href="https://www.transifex.net/projects/p/owncloud/team/<?php echo $_['languages'][0]['code'];?>/"
-			target="_blank"><em><?php echo $l->t('Help translate');?></em></a>
+		<a href="https://www.transifex.net/projects/p/owncloud/team/<?php p($_['languages'][0]['code']);?>/"
+			target="_blank"><em><?php p($l->t('Help translate'));?></em></a>
 	</fieldset>
 </form>
 
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('WebDAV');?></strong></legend>
-	<code><?php echo OC_Helper::linkToRemote('webdav'); ?></code><br />
-	<em><?php echo $l->t('Use this address to connect to your ownCloud in your file manager');?></em>
+	<legend><strong><?php p($l->t('WebDAV'));?></strong></legend>
+	<code><?php print_unescaped(OC_Helper::linkToRemote('webdav')); ?></code><br />
+	<em><?php p($l->t('Use this address to connect to your ownCloud in your file manager'));?></em>
 </fieldset>
 
 <?php foreach($_['forms'] as $form) {
-	echo $form;
+	print_unescaped($form);
 };?>
 
 
 <fieldset class="personalblock">
-	<legend><strong><?php echo $l->t('Version');?></strong></legend>
-	<strong>ownCloud</strong> <?php echo(OC_Util::getVersionString()); ?>
-	<?php echo(OC_Util::getEditionString()); ?> <br />
-	<?php echo $l->t('Developed by the <a href="http://ownCloud.org/contact" target="_blank">ownCloud community</a>, the <a href="https://github.com/owncloud" target="_blank">source code</a> is licensed under the <a href="http://www.gnu.org/licenses/agpl-3.0.html" target="_blank"><abbr title="Affero General Public License">AGPL</abbr></a>.'); ?>
+	<legend><strong><?php p($l->t('Version'));?></strong></legend>
+	<strong>ownCloud</strong> <?php p(OC_Util::getVersionString()); ?>
+	<?php p(OC_Util::getEditionString()); ?> <br />
+	<?php print_unescaped($l->t('Developed by the <a href="http://ownCloud.org/contact" target="_blank">ownCloud community</a>, the <a href="https://github.com/owncloud" target="_blank">source code</a> is licensed under the <a href="http://www.gnu.org/licenses/agpl-3.0.html" target="_blank"><abbr title="Affero General Public License">AGPL</abbr></a>.')); ?>
 </fieldset>
 
 
diff --git a/settings/templates/settings.php b/settings/templates/settings.php
index de8092eeaff..48b4e6b3234 100644
--- a/settings/templates/settings.php
+++ b/settings/templates/settings.php
@@ -5,5 +5,5 @@
  */?>
 
 <?php foreach($_['forms'] as $form) {
-	echo $form;
+	print_unescaped($form);
 };
diff --git a/settings/templates/users.php b/settings/templates/users.php
index 53a66fb4686..deffe168323 100644
--- a/settings/templates/users.php
+++ b/settings/templates/users.php
@@ -14,49 +14,49 @@ unset($items['admin']);
 $_['subadmingroups'] = array_flip($items);
 ?>
 
-<script type="text/javascript" src="<?php echo OC_Helper::linkToRoute('isadmin');?>"></script>
+<script type="text/javascript" src="<?php print_unescaped(OC_Helper::linkToRoute('isadmin'));?>"></script>
 
 <div id="controls">
 	<form id="newuser" autocomplete="off">
-		<input id="newusername" type="text" placeholder="<?php echo $l->t('Login Name')?>" /> <input
+		<input id="newusername" type="text" placeholder="<?php p($l->t('Login Name'))?>" /> <input
 			type="password" id="newuserpassword"
-			placeholder="<?php echo $l->t('Password')?>" /> <select
+			placeholder="<?php p($l->t('Password'))?>" /> <select
 			class="groupsselect"
 			id="newusergroups" data-placeholder="groups"
-			title="<?php echo $l->t('Groups')?>" multiple="multiple">
+			title="<?php p($l->t('Groups'))?>" multiple="multiple">
 			<?php foreach($_["groups"] as $group): ?>
-			<option value="<?php echo $group['name'];?>">
-				<?php echo $group['name'];?>
+			<option value="<?php p($group['name']);?>">
+				<?php p($group['name']);?>
 			</option>
 			<?php endforeach;?>
-		</select> <input type="submit" value="<?php echo $l->t('Create')?>" />
+		</select> <input type="submit" value="<?php p($l->t('Create'))?>" />
 	</form>
 	<div class="quota">
-		<span><?php echo $l->t('Default Storage');?></span>
+		<span><?php p($l->t('Default Storage'));?></span>
 			<?php if((bool) $_['isadmin']): ?>
 			<select class='quota'>
 				<option
-					<?php if($_['default_quota']=='none') echo 'selected="selected"';?>
+					<?php if($_['default_quota']=='none') print_unescaped('selected="selected"');?>
 						value='none'>
-					<?php echo $l->t('Unlimited');?>
+					<?php p($l->t('Unlimited'));?>
 				</option>
 				<?php foreach($_['quota_preset'] as $preset):?>
 				<?php if($preset!='default'):?>
 				<option
-				<?php if($_['default_quota']==$preset) echo 'selected="selected"';?>
-					value='<?php echo $preset;?>'>
-					<?php echo $preset;?>
+				<?php if($_['default_quota']==$preset) print_unescaped('selected="selected"');?>
+					value='<?php p($preset);?>'>
+					<?php p($preset);?>
 				</option>
 				<?php endif;?>
 				<?php endforeach;?>
 				<?php if($_['defaultQuotaIsUserDefined']):?>
 				<option selected="selected"
-					value='<?php echo $_['default_quota'];?>'>
-					<?php echo $_['default_quota'];?>
+					value='<?php p($_['default_quota']);?>'>
+					<?php p($_['default_quota']);?>
 				</option>
 				<?php endif;?>
 				<option value='other'>
-					<?php echo $l->t('Other');?>
+					<?php p($l->t('Other'));?>
 					...
 				</option>
 			</select>
@@ -64,49 +64,49 @@ $_['subadmingroups'] = array_flip($items);
 			<?php if((bool) !$_['isadmin']): ?>
 				<select class='quota' disabled="disabled">
 					<option selected="selected">
-				<?php echo $_['default_quota'];?>
+				<?php p($_['default_quota']);?>
 					</option>
 				</select>
 			<?php endif; ?>
 	</div>
 </div>
 
-<table class="hascontrols" data-groups="<?php echo implode(', ', $allGroups);?>">
+<table class="hascontrols" data-groups="<?php p(implode(', ', $allGroups));?>">
 	<thead>
 		<tr>
-			<th id='headerName'><?php echo $l->t('Login Name')?></th>
-			<th id="headerDisplayName"><?php echo $l->t( 'Display Name' ); ?></th>
-			<th id="headerPassword"><?php echo $l->t( 'Password' ); ?></th>
-			<th id="headerGroups"><?php echo $l->t( 'Groups' ); ?></th>
+			<th id='headerName'><?php p($l->t('Login Name'))?></th>
+			<th id="headerDisplayName"><?php p($l->t( 'Display Name' )); ?></th>
+			<th id="headerPassword"><?php p($l->t( 'Password' )); ?></th>
+			<th id="headerGroups"><?php p($l->t( 'Groups' )); ?></th>
 			<?php if(is_array($_['subadmins']) || $_['subadmins']): ?>
-			<th id="headerSubAdmins"><?php echo $l->t('Group Admin'); ?></th>
+			<th id="headerSubAdmins"><?php p($l->t('Group Admin')); ?></th>
 			<?php endif;?>
-			<th id="headerQuota"><?php echo $l->t('Storage'); ?></th>
+			<th id="headerQuota"><?php p($l->t('Storage')); ?></th>
 			<th id="headerRemove">&nbsp;</th>
 		</tr>
 	</thead>
 	<tbody>
 		<?php foreach($_["users"] as $user): ?>
-		<tr data-uid="<?php echo $user["name"] ?>"
-			data-displayName="<?php echo $user["displayName"] ?>">
-			<td class="name"><?php echo $user["name"]; ?></td>
-			<td class="displayName"><span><?php echo $user["displayName"]; ?></span> <img class="svg action"
-				src="<?php echo image_path('core', 'actions/rename.svg')?>"
-				alt="<?php echo $l->t("change display name")?>" title="<?php echo $l->t("change display name")?>"/>
+		<tr data-uid="<?php p($user["name"]) ?>"
+			data-displayName="<?php p($user["displayName"]) ?>">
+			<td class="name"><?php p($user["name"]); ?></td>
+			<td class="displayName"><span><?php p($user["displayName"]); ?></span> <img class="svg action"
+				src="<?php p(image_path('core', 'actions/rename.svg'))?>"
+				alt="<?php p($l->t("change display name"))?>" title="<?php p($l->t("change display name"))?>"/>
 			</td>
 			<td class="password"><span>●●●●●●●</span> <img class="svg action"
-				src="<?php echo image_path('core', 'actions/rename.svg')?>"
-				alt="<?php echo $l->t("set new password")?>" title="<?php echo $l->t("set new password")?>"/>
+				src="<?php print_unescaped(image_path('core', 'actions/rename.svg'))?>"
+				alt="<?php p($l->t("set new password"))?>" title="<?php p($l->t("set new password"))?>"/>
 			</td>
 			<td class="groups"><select
 				class="groupsselect"
-				data-username="<?php echo $user['name'] ;?>"
-				data-user-groups="<?php echo $user['groups'] ;?>"
-				data-placeholder="groups" title="<?php echo $l->t('Groups')?>"
+				data-username="<?php p($user['name']) ;?>"
+				data-user-groups="<?php p($user['groups']) ;?>"
+				data-placeholder="groups" title="<?php p($l->t('Groups'))?>"
 				multiple="multiple">
 					<?php foreach($_["groups"] as $group): ?>
-					<option value="<?php echo $group['name'];?>">
-						<?php echo $group['name'];?>
+					<option value="<?php p($group['name']);?>">
+						<?php p($group['name']);?>
 					</option>
 					<?php endforeach;?>
 			</select>
@@ -114,13 +114,13 @@ $_['subadmingroups'] = array_flip($items);
 			<?php if(is_array($_['subadmins']) || $_['subadmins']): ?>
 			<td class="subadmins"><select
 				class="subadminsselect"
-				data-username="<?php echo $user['name'] ;?>"
-				data-subadmin="<?php echo $user['subadmin'] ;?>"
-				data-placeholder="subadmins" title="<?php echo $l->t('Group Admin')?>"
+				data-username="<?php p($user['name']) ;?>"
+				data-subadmin="<?php p($user['subadmin']);?>"
+				data-placeholder="subadmins" title="<?php p($l->t('Group Admin'))?>"
 				multiple="multiple">
 					<?php foreach($_["subadmingroups"] as $group): ?>
-					<option value="<?php echo $group;?>">
-						<?php echo $group;?>
+					<option value="<?php p($group);?>">
+						<?php p($group);?>
 					</option>
 					<?php endforeach;?>
 			</select>
@@ -129,37 +129,37 @@ $_['subadmingroups'] = array_flip($items);
 			<td class="quota">
 				<select class='quota-user'>
 					<option
-						<?php if($user['quota']=='default') echo 'selected="selected"';?>
+						<?php if($user['quota']=='default') print_unescaped('selected="selected"');?>
 							value='default'>
-						<?php echo $l->t('Default');?>
+						<?php p($l->t('Default'));?>
 					</option>
 					<option
-					<?php if($user['quota']=='none') echo 'selected="selected"';?>
+					<?php if($user['quota']=='none') print_unescaped('selected="selected"');?>
 							value='none'>
-						<?php echo $l->t('Unlimited');?>
+						<?php p($l->t('Unlimited'));?>
 					</option>
 					<?php foreach($_['quota_preset'] as $preset):?>
 					<option
-					<?php if($user['quota']==$preset) echo 'selected="selected"';?>
-						value='<?php echo $preset;?>'>
-						<?php echo $preset;?>
+					<?php if($user['quota']==$preset) print_unescaped('selected="selected"');?>
+						value='<?php p($preset);?>'>
+						<?php p($preset);?>
 					</option>
 					<?php endforeach;?>
 					<?php if($user['isQuotaUserDefined']):?>
-					<option selected="selected" value='<?php echo $user['quota'];?>'>
-						<?php echo $user['quota'];?>
+					<option selected="selected" value='<?php p($user['quota']);?>'>
+						<?php p($user['quota']);?>
 					</option>
 					<?php endif;?>
 					<option value='other' data-new>
-						<?php echo $l->t('Other');?>
+						<?php p($l->t('Other'));?>
 						...
 					</option>
 				</select>
 			</td>
 			<td class="remove">
 				<?php if($user['name']!=OC_User::getUser()):?>
-					<a href="#" class="action delete" original-title="<?php echo $l->t('Delete')?>">
-						<img src="<?php echo image_path('core', 'actions/delete.svg') ?>" class="svg" />
+					<a href="#" class="action delete" original-title="<?php p($l->t('Delete'))?>">
+						<img src="<?php print_unescaped(image_path('core', 'actions/delete.svg')) ?>" class="svg" />
 					</a>
 				<?php endif;?>
 			</td>