CVE-2018-11688: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-06-13T16:29Z
Repository: https://github.com/igniterealtime/Openfire
Language: Other
Files changed: src/web/audit-policy.jsp, src/web/available-plugins.jsp, src/web/clearspace-status.jsp, src/web/component-session-details.jsp, src/web/component-session-summary.jsp, src/web/error.jsp, src/web/external-components-settings.jsp, src/web/group-create.jsp, src/web/group-delete.jsp, src/web/group-edit.jsp, src/web/group-summary.jsp, src/web/http-bind.jsp, src/web/import-certificate.jsp, src/web/log.jsp, src/web/login.jsp, src/web/logviewer.jsp, src/web/manage-updates.jsp, src/web/media-proxy.jsp, src/web/muc-create-permission.jsp, src/web/muc-default-settings.jsp, src/web/muc-history-settings.jsp, src/web/muc-room-affiliations.jsp, src/web/muc-room-delete.jsp, src/web/muc-room-edit-form.jsp, src/web/muc-room-occupants.jsp, src/web/muc-room-summary.jsp, src/web/muc-service-delete.jsp, src/web/muc-service-edit-form.jsp, src/web/muc-service-summary.jsp, src/web/muc-sysadmins.jsp, src/web/muc-tasks.jsp, src/web/security-audit-viewer.jsp, src/web/server-properties.jsp, src/web/server-session-row.jspf, src/web/session-details.jsp, src/web/session-row.jspf, src/web/session-summary.jsp, src/web/ssl-certificates.jsp, src/web/ssl-signing-request.jsp, src/web/system-cache.jsp, src/web/system-clustering.jsp, src/web/system-email.jsp, src/web/system-emailtest.jsp, src/web/user-create.jsp, src/web/user-delete.jsp, src/web/user-edit-form.jsp, src/web/user-lockout.jsp, src/web/user-message.jsp, src/web/user-password.jsp, src/web/user-properties.jsp, src/web/user-roster-add.jsp, src/web/user-roster-delete.jsp, src/web/user-roster-edit.jsp, src/web/user-roster-view.jsp, src/web/user-roster.jsp, src/web/user-search.jsp, src/web/user-summary.jsp
Commit date: 2014-04-15 06:01:46 +0200
Commit message: xss filter

Diff: diff --git a/src/web/audit-policy.jsp b/src/web/audit-policy.jsp
index 2fa8f48cf..bc8afa3e6 100644
--- a/src/web/audit-policy.jsp
+++ b/src/web/audit-policy.jsp
@@ -15,13 +15,14 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
-                   org.jivesoftware.openfire.XMPPServer,
-                   org.jivesoftware.openfire.audit.AuditManager,
+                 org.jivesoftware.openfire.XMPPServer,
+                 org.jivesoftware.openfire.audit.AuditManager,
                  org.jivesoftware.openfire.user.UserNotFoundException,
+                 org.jivesoftware.util.StringUtils,
                  org.xmpp.packet.JID,
                  java.io.File"
     errorPage="error.jsp"
 %>
 <%@ page import="java.util.*"%>
@@ -224,11 +225,11 @@
 						<td width="1%" nowrap class="c1">
 							<fmt:message key="audit.policy.log_directory" />
 						</td>
 						<td width="99%">
 							<input type="text" size="50" maxlength="150" name="logDir"
-							 value="<%= ((logDir != null) ? logDir : "") %>">
+							 value="<%= ((logDir != null) ? StringUtils.escapeForXML(logDir) : "") %>">
 
 						<%  if (errors.get("logDir") != null) { %>
 
 							<span class="jive-error-text">
 							<fmt:message key="audit.policy.valid_log_directory" />
@@ -359,11 +360,11 @@
 					<tr valign="top">
 						<td width="1%" nowrap class="c1">
 							<fmt:message key="audit.policy.ignore" />
 						</td>
 						<td width="99%">
-							<textarea name="ignore" cols="40" rows="3" wrap="virtual"><%= ((ignore != null) ? ignore : "") %></textarea>
+							<textarea name="ignore" cols="40" rows="3" wrap="virtual"><%= ((ignore != null) ? StringUtils.escapeHTMLTags(ignore) : "") %></textarea>
 							<%  if (errors.get("ignore") != null) { %>
 
 								<span class="jive-error-text">
 								<fmt:message key="audit.policy.validignore" />
 								</span>
@@ -391,6 +392,6 @@
 </form>
 <!-- END 'Set Message Audit Policy' -->
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/available-plugins.jsp b/src/web/available-plugins.jsp
index 835d6ff51..f530954a2 100644
--- a/src/web/available-plugins.jsp
+++ b/src/web/available-plugins.jsp
@@ -13,11 +13,12 @@
 --%>
 
 <%@ page errorPage="error.jsp" import="org.jivesoftware.util.ByteFormat,
                                        org.jivesoftware.util.Version,
                                        org.jivesoftware.openfire.XMPPServer,
-                                       org.jivesoftware.openfire.container.Plugin"
+                                       org.jivesoftware.openfire.container.Plugin,
+                                       org.jivesoftware.util.StringUtils"
     %>
 <%@ page import="org.jivesoftware.openfire.container.PluginManager" %>
 <%@ page import="org.jivesoftware.openfire.update.AvailablePlugin" %>
 <%@ page import="org.jivesoftware.openfire.update.UpdateManager" %>
 <%@ page import="java.io.File" %>
@@ -282,42 +283,42 @@
         }
 %>
 <tr id="<%= plugin.hashCode()%>">
     <td width="1%" class="line-bottom-border">
         <% if (plugin.getIcon() != null) { %>
-        <img src="<%= plugin.getIcon() %>" width="16" height="16" alt="Plugin">
+        <img src="<%= StringUtils.escapeForXML(plugin.getIcon()) %>" width="16" height="16" alt="Plugin">
         <% }
         else { %>
         <img src="images/plugin-16x16.gif" width="16" height="16" alt="Plugin">
         <% } %>
     </td>
     <td width="20%" nowrap class="line-bottom-border">
-        <%= (pluginName != null ? pluginName : "") %> &nbsp;
+        <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %> &nbsp;
     </td>
     <td nowrap valign="top" class="line-bottom-border">
         <% if (plugin.getReadme() != null) { %>
-        <a href="<%= plugin.getReadme() %>"
+        <a href="<%= StringUtils.escapeForXML(plugin.getReadme()) %>"
             ><img src="images/doc-readme-16x16.gif" width="16" height="16" border="0" alt="README"></a>
         <% }
         else { %> &nbsp; <% } %>
         <% if (plugin.getChangelog() != null) { %>
-        <a href="<%= plugin.getChangelog() %>"
+        <a href="<%= StringUtils.escapeForXML(plugin.getChangelog()) %>"
             ><img src="images/doc-changelog-16x16.gif" width="16" height="16" border="0" alt="changelog"></a>
         <% }
         else { %> &nbsp; <% } %>
     </td>
     <td width="60%" class="line-bottom-border">
-        <%= pluginDescription != null ? pluginDescription : "" %>
+        <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %>
     </td>
     <td width="5%" align="center" valign="top" class="line-bottom-border">
-        <%= pluginVersion != null ? pluginVersion : "" %>
+        <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %>
     </td>
     <td width="15%" nowrap valign="top" class="line-bottom-border">
-        <%= pluginAuthor != null ? pluginAuthor : "" %>  &nbsp;
+        <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>  &nbsp;
     </td>
     <td width="15%" nowrap valign="top" class="line-bottom-border" align="right">
-        <%= fileSize %>
+        <%= StringUtils.escapeHTMLTags(fileSize) %>
     </td>
     <td width="1%" align="center" valign="top" class="line-bottom-border">
         <%
             String updateURL = plugin.getURL();
             if (updateManager.isPluginDownloaded(updateURL)) {
@@ -326,21 +327,21 @@
         <%  }
         else { %>
         <%
 
         %>
-        <a href="javascript:downloadPlugin('<%=updateURL%>', '<%= plugin.hashCode()%>')"><span id="<%= plugin.hashCode() %>-image"><img src="images/add-16x16.gif" width="16" height="16" border="0"
+        <a href="javascript:downloadPlugin('<%=StringUtils.escapeForXML(updateURL)%>', '<%= plugin.hashCode()%>')"><span id="<%= plugin.hashCode() %>-image"><img src="images/add-16x16.gif" width="16" height="16" border="0"
                                                                                                                                         alt="<fmt:message key="plugin.available.download" />"></span></a>
 
         <% } %>
     </td>
 </tr>
 <tr id="<%= plugin.hashCode()%>-row" style="display:none;background: #E7FBDE;">
     <td width="1%" class="line-bottom-border">
-        <img src="<%= plugin.getIcon()%>" width="16" height="16" alt=""/>
+        <img src="<%= StringUtils.escapeForXML(plugin.getIcon())%>" width="16" height="16" alt=""/>
     </td>
-    <td colspan="6" nowrap class="line-bottom-border"><%= plugin.getName()%> <fmt:message key="plugin.available.installation.success" /></td>
+    <td colspan="6" nowrap class="line-bottom-border"><%= StringUtils.escapeHTMLTags(plugin.getName())%> <fmt:message key="plugin.available.installation.success" /></td>
     <td class="line-bottom-border" align="center">
         <img src="images/success-16x16.gif" height="16" width="16" alt=""/>
     </td>
 </tr>
 <%
@@ -365,62 +366,62 @@
         }
 %>
 <tr id="<%= plugin.hashCode()%>">
     <td width="1%" class="line-bottom-border">
         <% if (plugin.getIcon() != null) { %>
-        <img src="<%= plugin.getIcon() %>" width="16" height="16" alt="Plugin">
+        <img src="<%= StringUtils.escapeForXML(plugin.getIcon()) %>" width="16" height="16" alt="Plugin">
         <% }
         else { %>
         <img src="images/plugin-16x16.gif" width="16" height="16" alt="Plugin">
         <% } %>
     </td>
     <td width="20%" nowrap class="line-bottom-border">
-        <%= (pluginName != null ? pluginName : "") %> &nbsp;
+        <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %> &nbsp;
     </td>
     <td nowrap valign="top" class="line-bottom-border">
         <% if (plugin.getReadme() != null) { %>
-        <a href="<%= plugin.getReadme() %>"
+        <a href="<%= StringUtils.escapeForXML(plugin.getReadme()) %>"
             ><img src="images/doc-readme-16x16.gif" width="16" height="16" border="0" alt="README"></a>
         <% }
         else { %> &nbsp; <% } %>
         <% if (plugin.getChangelog() != null) { %>
-        <a href="<%= plugin.getChangelog() %>"
+        <a href="<%= StringUtils.escapeForXML(plugin.getChangelog()) %>"
             ><img src="images/doc-changelog-16x16.gif" width="16" height="16" border="0" alt="changelog"></a>
         <% }
         else { %> &nbsp; <% } %>
     </td>
     <td width="60%" class="line-bottom-border">
-        <%= pluginDescription != null ? pluginDescription : "" %>
+        <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %>
     </td>
     <td width="5%" align="center" valign="top" class="line-bottom-border">
-        <%= pluginVersion != null ? pluginVersion : "" %>
+        <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %>
     </td>
     <td width="15%" nowrap valign="top" class="line-bottom-border">
-        <%= pluginAuthor != null ? pluginAuthor : "" %>  &nbsp;
+        <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>  &nbsp;
     </td>
     <td width="15%" nowrap valign="top" class="line-bottom-border">
-        <%= fileSize  %>
+        <%= StringUtils.escapeHTMLTags(fileSize)  %>
     </td>
     <td width="1%" align="center" valign="top" class="line-bottom-border">
         <%
             String updateURL = plugin.getURL();
             if (updateManager.isPluginDownloaded(updateURL)) {
         %>
         &nbsp;
         <%  }
         else { %>
 
-        <span id="<%= plugin.hashCode() %>-image"><a href="javascript:downloadPlugin('<%=updateURL%>', '<%= plugin.hashCode()%>')"><img src="images/add-16x16.gif" width="16" height="16" border="0"
+        <span id="<%= plugin.hashCode() %>-image"><a href="javascript:downloadPlugin('<%=StringUtils.escapeForXML(updateURL) %>', '<%= plugin.hashCode() %>')"><img src="images/add-16x16.gif" width="16" height="16" border="0"
                                                                                                                                         alt="<fmt:message key="plugin.available.download" />"></a></span>
         <% } %>
     </td>
 </tr>
 <tr id="<%= plugin.hashCode()%>-row" style="display:none;background: #E7FBDE;">
      <td width="1%" class="line-bottom-border">
-        <img src="<%= plugin.getIcon()%>" width="16" height="16" alt=""/>
+        <img src="<%= StringUtils.escapeForXML(plugin.getIcon())%>" width="16" height="16" alt=""/>
     </td>
-    <td colspan="6" nowrap class="line-bottom-border"><%= plugin.getName()%> <fmt:message key="plugin.available.installation.success" /></td>
+    <td colspan="6" nowrap class="line-bottom-border"><%= StringUtils.escapeHTMLTags(plugin.getName())%> <fmt:message key="plugin.available.installation.success" /></td>
     <td class="line-bottom-border" align="center">
         <img src="images/success-16x16.gif" height="16" width="16" alt=""/>
     </td>
 </tr>
 <%
@@ -491,17 +492,17 @@
                         ><img src="images/doc-changelog-16x16.gif" width="16" height="16" border="0" alt="changelog"></a>
                     <% }
                     else { %> &nbsp; <% } %></p>
             </td>
             <td class="line-bottom-border">
-                <%= pluginDescription %>
+                <%= StringUtils.escapeHTMLTags(pluginDescription) %>
             </td>
             <td class="line-bottom-border">
-                <%= pluginVersion%>
+                <%= StringUtils.escapeHTMLTags(pluginVersion) %>
             </td>
             <td class="line-bottom-border">
-                <%= pluginAuthor%>
+                <%= StringUtils.escapeHTMLTags(pluginAuthor) %>
             </td>
         </tr>
         <% }%>
   </table>
 
@@ -527,6 +528,6 @@
            &nbsp;<span id="reloader2"><a href="javascript:updatePluginsListNow()"><fmt:message key="plugin.available.manual.update" /></a></span>
         </p>
            <% } %>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/clearspace-status.jsp b/src/web/clearspace-status.jsp
index 775663327..d61dde43d 100644
--- a/src/web/clearspace-status.jsp
+++ b/src/web/clearspace-status.jsp
@@ -18,10 +18,11 @@
     errorPage="error.jsp"
 %>
 <%@ page import="org.jivesoftware.openfire.clearspace.ClearspaceManager" %>
 <%@ page import="org.jivesoftware.openfire.session.ComponentSession" %>
 <%@ page import="org.jivesoftware.util.JiveGlobals" %>
+<%@ page import="org.jivesoftware.util.StringUtils" %>
 <%@ page import="java.text.NumberFormat" %>
 <%@ page import="java.util.Collection" %>
 <%@ page import="java.util.Date" %>
 
 <%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c" %>
@@ -187,21 +188,21 @@
     <tr>
         <td rowsapn="<%= componentSessions.size() %>" class="c1">
             <fmt:message key="clearspace.status.connected.table.label.hostname" />
         </td>
         <td>
-            <%= cs.getHostAddress() %>
+            <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %>
             /
-            <%= cs.getHostName() %>
+            <%= StringUtils.escapeHTMLTags(cs.getHostName()) %>
         </td>
     </tr>
         <% } else { %>
     <tr>
         <td>
-            <%= cs.getHostAddress() %>
+            <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %>
             /
-            <%= cs.getHostName() %>
+            <%= StringUtils.escapeHTMLTags(cs.getHostName()) %>
         </td>
     </tr>
         <% } %>
 </tbody>
 </table>
@@ -266,6 +267,6 @@
 </form>
 
 <% } %>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/component-session-details.jsp b/src/web/component-session-details.jsp
index 991899fa4..bedc9723b 100644
--- a/src/web/component-session-details.jsp
+++ b/src/web/component-session-details.jsp
@@ -19,10 +19,11 @@
 --%>
 
 <%@ page import="org.jivesoftware.openfire.SessionManager,
                  org.jivesoftware.openfire.session.ComponentSession,
                  org.jivesoftware.util.JiveGlobals,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.util.ParamUtils"
     errorPage="error.jsp"
 %>
 <%@ page import="java.text.NumberFormat" %>
 
@@ -84,19 +85,19 @@
     <tr>
         <td class="c1">
             <fmt:message key="component.session.label.name" />
         </td>
         <td>
-            <%= componentSession.getExternalComponent().getName() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %>
         </td>
     </tr>
     <tr>
         <td class="c1">
             <fmt:message key="component.session.label.category" />:
         </td>
         <td>
-            <%= componentSession.getExternalComponent().getCategory() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %>
         </td>
     </tr>
     <tr>
         <td class="c1">
             <fmt:message key="component.session.label.type" />:
@@ -115,11 +116,11 @@
                 else if ("icq".equals(componentSession.getExternalComponent().getType())) { %>
                 <img src="images/icq.gif" width="16" height="16" border="0" alt="ICQ">&nbsp;
              <% }
             }
             %>
-            <%= componentSession.getExternalComponent().getType() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %>
         </td>
     </tr>
     <tr>
         <td class="c1">
             <fmt:message key="component.session.label.creation" />
@@ -148,13 +149,13 @@
     <tr>
         <td class="c1">
             <fmt:message key="session.details.hostname" />
         </td>
         <td>
-            <%= componentSession.getHostAddress() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getHostAddress()) %>
             /
-            <%= componentSession.getHostName() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getHostName()) %>
         </td>
     </tr>
 </tbody>
 </table>
 </div>
@@ -165,6 +166,6 @@
 <input type="submit" name="back" value="<fmt:message key="session.details.back_button" />">
 </center>
 </form>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/component-session-summary.jsp b/src/web/component-session-summary.jsp
index 465587928..f3a72f6c8 100644
--- a/src/web/component-session-summary.jsp
+++ b/src/web/component-session-summary.jsp
@@ -20,10 +20,11 @@
 
 <%@ page import="org.jivesoftware.openfire.SessionManager,
                  org.jivesoftware.openfire.session.ComponentSession,
                  org.jivesoftware.openfire.session.Session,
                  org.jivesoftware.util.JiveGlobals,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.util.ParamUtils,
                  java.net.URLEncoder"
     errorPage="error.jsp"
 %>
 <%@ page import="java.util.ArrayList"%>
@@ -185,14 +186,14 @@
         <td width="1%" nowrap><%= count %></td>
         <td width="43%" nowrap>
             <a href="component-session-details.jsp?jid=<%= URLEncoder.encode(componentSession.getAddress().toString(), "UTF-8") %>" title="<fmt:message key="session.row.cliked" />"><%= componentSession.getAddress() %></a>
         </td>
         <td align="center" width="15%" nowrap>
-            <%= componentSession.getExternalComponent().getName() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %>
         </td>
         <td align="center" width="10%" nowrap>
-            <%= componentSession.getExternalComponent().getCategory() %>
+            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %>
         </td>
         <td align="center" width="10%" nowrap>
             <table border="0">
             <tr valign="center">
             <% if ("gateway".equals(componentSession.getExternalComponent().getCategory())) {
@@ -216,11 +217,11 @@
                 if ("clearspace".equals(componentSession.getExternalComponent().getType().toLowerCase())) { %>
                 <td><img src="images/clearspace.gif" width="16" height="16" border="0" alt="Clearspace"></td> 
              <% }
                }
             %>
-            <td><%= componentSession.getExternalComponent().getType() %></td>
+            <td><%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %></td>
             </tr></table>
         </td>
         <%  Date creationDate = componentSession.getCreationDate();
             Calendar creationCal = Calendar.getInstance();
             creationCal.setTime(creationDate);
@@ -277,6 +278,6 @@
 <p>
 <fmt:message key="component.session.summary.last_update" />: <%= JiveGlobals.formatDateTime(new Date()) %>
 </p>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/error.jsp b/src/web/error.jsp
index 7c8f67da6..b4e143a85 100644
--- a/src/web/error.jsp
+++ b/src/web/error.jsp
@@ -5,10 +5,11 @@
 --%>
 
 <%@ page import="java.io.*,
                  org.jivesoftware.util.ParamUtils,
                  org.jivesoftware.util.JiveGlobals,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.openfire.auth.UnauthorizedException,
                  org.jivesoftware.openfire.user.UserNotFoundException,
                  org.jivesoftware.openfire.group.GroupNotFoundException"
     isErrorPage="true"
 %>
@@ -52,9 +53,9 @@
         PrintWriter pout = new PrintWriter(sout);
         exception.printStackTrace(pout);
 %>
     <fmt:message key="error.exception" />
     <pre>
-<%= sout.toString() %>
+<%= StringUtils.escapeHTMLTags(sout.toString()) %>
     </pre>
 
-<%  } %>
\ No newline at end of file
+<%  } %>
diff --git a/src/web/external-components-settings.jsp b/src/web/external-components-settings.jsp
index ea46958d7..f6c32196d 100644
--- a/src/web/external-components-settings.jsp
+++ b/src/web/external-components-settings.jsp
@@ -23,12 +23,14 @@
 
 <%@ page import="org.jivesoftware.openfire.XMPPServer,
                  org.jivesoftware.openfire.component.ExternalComponentConfiguration,
                  org.jivesoftware.openfire.component.ExternalComponentManager,
                  org.jivesoftware.util.ModificationNotAllowedException,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.util.ParamUtils,
-                 java.util.Collection"
+                 java.util.Collection,
+                 java.net.URLEncoder"
     errorPage="error.jsp"
 %>
 <%@ page import="java.util.HashMap" %>
 <%@ page import="java.util.Iterator" %>
 <%@ page import="java.util.Map" %>
@@ -241,11 +243,11 @@
     <table cellpadding="0" cellspacing="0" border="0">
     <tbody>
         <tr>
             <td class="jive-icon"><img src="images/error-16x16.gif" width="16" height="16" border="0" alt=""/></td>
             <td class="jive-icon-label">
-                <fmt:message key="component.settings.modification.denied" /> <%= operationFailedDetail != null ? operationFailedDetail : ""%>
+                <fmt:message key="component.settings.modification.denied" /> <%= operationFailedDetail != null ? StringUtils.escapeHTMLTags(operationFailedDetail) : ""%>
             </td>
         </tr>
     </tbody>
     </table>
     </div>
@@ -326,11 +328,11 @@
 						<td width="1%" nowrap class="c1">
 							<fmt:message key="component.settings.defaultSecret" />
 						</td>
 						<td width="99%">
 							<input type="text" size="15" maxlength="70" name="defaultSecret"
-							 value="<%= ((defaultSecret != null) ? defaultSecret : "") %>">
+							 value="<%= ((defaultSecret != null) ? StringUtils.escapeForXML(defaultSecret) : "") %>">
 						</td>
 					</tr>
 					</table>
 				</td>
 			</tr>
@@ -406,17 +408,17 @@
 			<tr class="jive-<%= (((count%2)==0) ? "even" : "odd") %>">
 				<td>
 					<%= count %>
 				</td>
 				<td>
-					<%= configuration.getSubdomain() %>
+					<%= StringUtils.escapeHTMLTags(configuration.getSubdomain()) %>
 				</td>
 				<td>
 					<%= configuration.getSecret() %>
 				</td>
 				<td align="center" style="border-right:1px #ccc solid;">
-					<a href="#" onclick="if (confirm('<fmt:message key="component.settings.confirm_delete" />')) { location.replace('external-components-settings.jsp?deleteConf=<%= configuration.getSubdomain() %>'); } "
+					<a href="#" onclick="if (confirm('<fmt:message key="component.settings.confirm_delete" />')) { location.replace('external-components-settings.jsp?deleteConf=<%= URLEncoder.encode(configuration.getSubdomain(),"UTF-8") %>'); } "
 					 title="<fmt:message key="global.click_delete" />"
 					 ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
 				</td>
 			</tr>
 		   <% }
diff --git a/src/web/group-create.jsp b/src/web/group-create.jsp
index fc6214a78..4cae3c419 100644
--- a/src/web/group-create.jsp
+++ b/src/web/group-create.jsp
@@ -18,10 +18,11 @@
 --%>
 
 <%@ page import="org.jivesoftware.openfire.group.Group,
                  org.jivesoftware.openfire.group.GroupAlreadyExistsException,
                  org.jivesoftware.openfire.security.SecurityAuditManager,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.util.Log"
     errorPage="error.jsp"
 %>
 <%@ page import="org.jivesoftware.util.ParamUtils"%>
 <%@ page import="java.net.URLEncoder"%>
@@ -186,11 +187,11 @@
 </p>
 
 <form name="f" action="group-create.jsp" method="post">
 
    <% if (groupName != null) { %>
-    <input type="hidden" name="group" value="<%= groupName %>" id="existingName">
+    <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>" id="existingName">
    <% } %>
 
     <!-- BEGIN create group -->
 	<div class="jive-contentBoxHeader">
         <%
@@ -211,11 +212,11 @@
         <td width="1%" nowrap>
             <label for="gname"><fmt:message key="group.create.group_name" /></label> *
         </td>
         <td width="99%">
             <input type="text" name="name" size="30" maxlength="75"
-             value="<%= ((name != null) ? name : "") %>" id="gname">
+             value="<%= ((name != null) ? StringUtils.escapeForXML(name) : "") %>" id="gname">
         </td>
     </tr>
 
     <%  if (errors.get("name") != null || errors.get("groupAlreadyExists") != null) { %>
 
@@ -236,11 +237,11 @@
         <td width="1%" nowrap>
             <label for="gdesc"><fmt:message key="group.create.label_description" /></label>
         </td>
         <td width="99%">
             <textarea name="description" cols="30" rows="3" id="gdesc"
-             ><%= ((description != null) ? description : "") %></textarea>
+             ><%= ((description != null) ? StringUtils.escapeHTMLTags(description) : "") %></textarea>
         </td>
     </tr>
 
     <%  if (errors.get("description") != null) { %>
 
@@ -296,6 +297,6 @@ for (i=0;i<limit;i++) {
   disable();
 </script>
 <% } %>
 
 </body>
-</html>%>
\ No newline at end of file
+</html>%>
diff --git a/src/web/group-delete.jsp b/src/web/group-delete.jsp
index e124db79a..e60cf553a 100644
--- a/src/web/group-delete.jsp
+++ b/src/web/group-delete.jsp
@@ -79,11 +79,11 @@
 <b><a href="group-edit.jsp?group=<%= URLEncoder.encode(group.getName(), "UTF-8")%>"><%= group.getName() %></a></b>
 <fmt:message key="group.delete.hint_info1" />
 </p>
 
 <form action="group-delete.jsp">
-<input type="hidden" name="group" value="<%= groupName %>">
+<input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
 <input type="submit" name="delete" value="<fmt:message key="group.delete.delete" />">
 <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 </form>
 
     <%  // Disable the form if a read-only user provider.
@@ -99,6 +99,6 @@
   disable();
 </script>
     <% } %>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/group-edit.jsp b/src/web/group-edit.jsp
index 8ebd07677..0516ceb0a 100644
--- a/src/web/group-edit.jsp
+++ b/src/web/group-edit.jsp
@@ -312,22 +312,22 @@
     <tbody>
         <tr><td class="jive-icon"><img src="images/error-16x16.gif" width="16" height="16" border="0" alt=""></td>
         <td class="jive-icon-label">
         <% if(add) { %>
         <fmt:message key="group.edit.not_update" />
-        <%= errorBuf %>
+        <%= StringUtils.escapeHTMLTags(errorBuf.toString()) %>
         <% } %>
         </td></tr>
     </tbody>
     </table>
     </div><br>
 <% } %>
 
 	<div class="jive-horizontalRule"></div>
 
 <form name="ff" action="group-edit.jsp">
-<input type="hidden" name="group" value="<%= groupName %>"/>
+<input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>"/>
 
 
 	<!-- BEGIN group name and description -->
 	<div class="jive-contentBox-plain">
         <%  // Only show edit and delete options if the groups aren't read-only.
@@ -385,11 +385,11 @@
             <td width="99%">
                 <label for="rb202"><fmt:message key="group.edit.share_in_rosters" /></label>
 
                 <div id="jive-roster" style="display: <%= !enableRosterGroups ? "none" : "block"  %>;">
 	               <b><fmt:message key="group.edit.share_display_name" /></b>
-	               <input type="text" name="groupDisplayName" size="30" maxlength="100" value="<%= (groupDisplayName != null ? groupDisplayName : "") %>"><br>
+	               <input type="text" name="groupDisplayName" size="30" maxlength="100" value="<%= (groupDisplayName != null ? StringUtils.escapeForXML(groupDisplayName) : "") %>"><br>
                        <%  if (errors.get("groupDisplayName") != null) { %>
                            <span class="jive-error-text"><fmt:message key="group.edit.share_display_name" /></span><br/>
                        <%  } %>
 	                   <script type="text/javascript" language="JavaScript">
 		                   function toggleRosterShare() {
@@ -487,11 +487,11 @@
         <p>
 			<fmt:message key="group.edit.members_description" />
 		</p>
 
         <form action="group-edit.jsp" method="post" name="f">
-        <input type="hidden" name="group" value="<%= groupName %>">
+        <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
         <input type="hidden" name="add" value="Add"/>
         <table cellpadding="3" cellspacing="1" border="0" style="margin: 0 0 8px 0;">
             <tr>
                 <td nowrap width="1%">
                     <fmt:message key="group.edit.add_user" />
@@ -505,11 +505,11 @@
         </form>
 
         <% } %>
 
         <form action="group-edit.jsp" method="post" name="main">
-        <input type="hidden" name="group" value="<%= groupName %>">
+        <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
         <table class="jive-table" cellpadding="3" cellspacing="0" border="0" width="435">
             <tr>
 	            <th>&nbsp;</th>
                 <th nowrap><fmt:message key="group.edit.username" /></th>
                 <%  // Only show if the group isn't read-only.
@@ -579,11 +579,11 @@
                     <img src="images/im_unavailable.gif" width="16" height="16" border="0" title="<fmt:message key="user.properties.offline" />" alt="<fmt:message key="user.properties.offline" />">
                     <%  } %>
 
                     </td>
                     <% if (user != null) { %>
-                    <td><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(user.getUsername()) %></a><% if (!isLocal) { showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font><%}%></td>
+                    <td><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a><% if (!isLocal) { showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font><%}%></td>
                     <% } else { %>
                     <td><%= jid %><% showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font></td>
                     <% } %>
                     <%  // Only show if the group isn't read-only.
                     if (!webManager.getGroupManager().isReadOnly()) { %>
@@ -670,6 +670,6 @@
                 return true;
             }
         }
         return false;
     }
-%>
\ No newline at end of file
+%>
diff --git a/src/web/group-summary.jsp b/src/web/group-summary.jsp
index 49ddcd3fc..80c87b7f0 100644
--- a/src/web/group-summary.jsp
+++ b/src/web/group-summary.jsp
@@ -176,11 +176,11 @@ document.searchForm.search.focus();
     <tr class="jive-<%= (((i%2)==0) ? "even" : "odd") %>">
         <td width="1%" valign="top">
             <%= i %>
         </td>
         <td width="60%">
-            <a href="group-edit.jsp?group=<%= groupName %>"><%= StringUtils.escapeHTMLTags(group.getName()) %></a>
+            <a href="group-edit.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"><%= StringUtils.escapeHTMLTags(group.getName()) %></a>
             <% if (group.getDescription() != null) { %>
             <br>
                 <span class="jive-description">
                 <%= StringUtils.escapeHTMLTags(group.getDescription()) %>
                 </span>
@@ -193,16 +193,16 @@ document.searchForm.search.focus();
             <%= group.getAdmins().size() %>
         </td>
         <%  // Only show edit and delete options if the groups aren't read-only.
             if (!webManager.getGroupManager().isReadOnly()) { %>
         <td width="1%" align="center">
-            <a href="group-edit.jsp?group=<%= groupName %>"
+            <a href="group-edit.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"
              title=<fmt:message key="global.click_edit" />
             ><img src="images/edit-16x16.gif" width="16" height="16" border="0" alt=""></a>
         </td>
         <td width="1%" align="center" style="border-right:1px #ccc solid;">
-            <a href="group-delete.jsp?group=<%= groupName %>"
+            <a href="group-delete.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"
              title=<fmt:message key="global.click_delete" />
              ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
         </td>
         <% } %>
     </tr>
@@ -232,6 +232,6 @@ document.searchForm.search.focus();
     </p>
 
 <%  } %>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/http-bind.jsp b/src/web/http-bind.jsp
index 90f0a81bc..ebc74e50e 100644
--- a/src/web/http-bind.jsp
+++ b/src/web/http-bind.jsp
@@ -15,10 +15,11 @@
   - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 <%@ page import="org.jivesoftware.util.ParamUtils" %>
+<%@ page import="org.jivesoftware.util.StringUtils" %>
 <%@ page import="java.io.File" %>
 <%@ page import="java.util.Map" %>
 <%@ page import="java.util.HashMap" %>
 <%@ page import="org.jivesoftware.util.Log" %>
 <%@ page import="org.jivesoftware.util.StringUtils" %>
@@ -259,11 +260,11 @@
 								</label>
 							</td>
 						</tr>
                         <tr>
                             <td>
-                                <input id="CORSDomains" type="text" size="80" name="CORSDomains" value="<%= serverManager.getCORSAllowOrigin() %>">
+                                <input id="CORSDomains" type="text" size="80" name="CORSDomains" value="<%= StringUtils.escapeForXML(serverManager.getCORSAllowOrigin()) %>">
                             </td>
                         </tr>
                     </table>
 				</td>
 			</tr>
@@ -301,35 +302,35 @@
 						<tr>
 							<td>
 								<label for="XFFHeader"><fmt:message key="httpbind.settings.xff.forwarded_for"/></label>
 							</td>
                             <td>
-                                <input id="XFFHeader" type="text" size="40" name="XFFHeader"  value="<%= xffHeader == null ? "" : xffHeader %>">
+                                <input id="XFFHeader" type="text" size="40" name="XFFHeader"  value="<%= xffHeader == null ? "" : StringUtils.escapeForXML(xffHeader) %>">
                             </td>
 						</tr>
 						<tr>
 							<td>
 								<label for="XFFServerHeader"><fmt:message key="httpbind.settings.xff.forwarded_server"/></label>
 							</td>
                             <td>
-                                <input id="XFFServerHeader" type="text" size="40" name="XFFServerHeader" value="<%= xffServerHeader == null ? "" : xffServerHeader %>">
+                                <input id="XFFServerHeader" type="text" size="40" name="XFFServerHeader" value="<%= xffServerHeader == null ? "" : StringUtils.escapeForXML(xffServerHeader) %>">
                             </td>
 						</tr>
 						<tr>
 							<td>
 								<label for="XFFHostHeader"><fmt:message key="httpbind.settings.xff.forwarded_host"/></label>
 							</td>
                             <td>
-                                <input id="XFFHostHeader" type="text" size="40" name="XFFHostHeader" value="<%= xffHostHeader == null ? "" : xffHostHeader %>">
+                                <input id="XFFHostHeader" type="text" size="40" name="XFFHostHeader" value="<%= xffHostHeader == null ? "" : StringUtils.escapeForXML(xffHostHeader) %>">
                             </td>
 						</tr>
 						<tr>
 							<td>
 								<label for="XFFHostName"><fmt:message key="httpbind.settings.xff.host_name"/></label>
 							</td>
                             <td>
-                                <input id="XFFHostName" type="text" size="40" name="XFFHostName" value="<%= xffHostName == null ? "" : xffHostName %>">
+                                <input id="XFFHostName" type="text" size="40" name="XFFHostName" value="<%= xffHostName == null ? "" : StringUtils.escapeForXML(xffHostName) %>">
                             </td>
 						</tr>
                     </table>
 				</td>
 			</tr>
@@ -361,6 +362,6 @@
     
     <input type="submit" id="settingsUpdate" name="update"
                value="<fmt:message key="global.save_settings" />">
 </form>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/import-certificate.jsp b/src/web/import-certificate.jsp
index 863b732e0..c27b8410c 100644
--- a/src/web/import-certificate.jsp
+++ b/src/web/import-certificate.jsp
@@ -1,7 +1,8 @@
 <%@ page import="org.jivesoftware.util.CertificateManager,
                 org.jivesoftware.util.ParamUtils,
+                org.jivesoftware.util.StringUtils,
                 org.jivesoftware.openfire.XMPPServer,
                 org.jivesoftware.openfire.net.SSLConfig,
                 java.io.ByteArrayInputStream,
                 java.util.HashMap,
                 java.util.Map"
@@ -112,11 +113,11 @@
       <tbody>
           <tr><td class="jive-icon"><img src="images/error-16x16.gif" width="16" height="16" border="0" alt=""></td>
           <td class="jive-icon-label">
           <fmt:message key="ssl.import.certificate.error.import" />
           <%  if (e != null && e.getMessage() != null) { %>
-              <fmt:message key="ssl.certificates.error_messenge" />: <%= e.getMessage() %>
+              <fmt:message key="ssl.certificates.error_messenge" />: <%= StringUtils.escapeHTMLTags(e.getMessage()) %>
           <%  } %>
           </td></tr>
       </tbody>
       </table>
       </div><br>
diff --git a/src/web/log.jsp b/src/web/log.jsp
index f99dac87e..34ed1a59b 100644
--- a/src/web/log.jsp
+++ b/src/web/log.jsp
@@ -154,11 +154,11 @@
     }
 %>
 
 <html>
 <head>
-    <title><%= log %></title>
+    <title><%= StringUtils.escapeHTMLTags(log) %></title>
     <meta name="decorator" content="none"/>
     <style type="text/css">
     .log TABLE {
         border : 1px #ccc solid;
     }
@@ -237,6 +237,6 @@
 </tr>
 </table>
 </div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/login.jsp b/src/web/login.jsp
index 7a78c717f..21afe347c 100644
--- a/src/web/login.jsp
+++ b/src/web/login.jsp
@@ -189,11 +189,11 @@
 
 <form action="login.jsp" name="loginForm" method="post">
 
 <%  if (url != null) { try { %>
 
-    <input type="hidden" name="url" value="<%= url %>">
+    <input type="hidden" name="url" value="<%= StringUtils.escapeForXML(url) %>">
 
 <%  } catch (Exception e) { Log.error(e); } } %>
 
 <input type="hidden" name="login" value="true">
 
diff --git a/src/web/logviewer.jsp b/src/web/logviewer.jsp
index 607ac4161..ca2f558ef 100644
--- a/src/web/logviewer.jsp
+++ b/src/web/logviewer.jsp
@@ -19,10 +19,11 @@
 --%>
 
 <%@ page import="java.io.*,
                  org.jivesoftware.util.*,
                  java.text.*,
+                 java.net.URLEncoder,
                  org.jivesoftware.util.JiveGlobals,
                  org.jivesoftware.openfire.user.*,
                  java.util.*"
 %>
 
@@ -248,11 +249,11 @@ IFRAME {
     border : 1px #666 solid;
 }
 </style>
 
 <form action="logviewer.jsp" name="logViewer" method="get">
-<input type="hidden" name="log" value="<%= log %>">
+<input type="hidden" name="log" value="<%= StringUtils.escapeForXML(log) %>">
 
 <div class="logviewer">
 <table cellpadding="0" cellspacing="0" border="0" width="100%">
 <tbody>
     <tr>
@@ -307,11 +308,11 @@ IFRAME {
     <tr>
         <td>
             <table cellpadding="3" cellspacing="0" border="0" width="100%">
             <tr>
                 <td nowrap><fmt:message key="logviewer.log" /></td>
-                <td nowrap><b><%= logFile.getName() %></b> (<%= byteFormatter.format(logFile.length()) %>)</td>
+                <td nowrap><b><%= StringUtils.escapeHTMLTags(logFile.getName()) %></b> (<%= byteFormatter.format(logFile.length()) %>)</td>
                 <td width="96%" rowspan="3">&nbsp;</td>
                 <td nowrap><fmt:message key="logviewer.order" /></td>
                 <td nowrap>
                     <input type="radio" name="mode" value="asc"<%= ("asc".equals(mode)?" checked":"") %>
                      onclick="this.form.submit();" id="rb01"
@@ -444,14 +445,14 @@ IFRAME {
 <fmt:message key="logviewer.log_dir" />: <%= JiveGlobals.getHomeDirectory() %><%= File.separator %>logs
 </span>
 
 <br><br>
 
-<iframe src="log.jsp?log=<%= log %>&mode=<%= mode %>&lines=<%= ("All".equals(numLinesParam) ? "All" : String.valueOf(numLines)) %>"
+<iframe src="log.jsp?log=<%= URLEncoder.encode(log) %>&mode=<%= URLEncoder.encode(mode) %>&lines=<%= ("All".equals(numLinesParam) ? "All" : String.valueOf(numLines)) %>"
     frameborder="0" height="400" width="100%" marginheight="0" marginwidth="0" scrolling="auto"></iframe>
 
 </form>
 
 </div>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/manage-updates.jsp b/src/web/manage-updates.jsp
index cf2acb46c..20ca2d45a 100644
--- a/src/web/manage-updates.jsp
+++ b/src/web/manage-updates.jsp
@@ -21,10 +21,11 @@
 
 <%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c" %>
 <%@ taglib uri="http://java.sun.com/jstl/fmt_rt" prefix="fmt" %>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.openfire.XMPPServer,
                  org.jivesoftware.openfire.update.UpdateManager,
                  java.util.HashMap,
                  java.util.Map"
          errorPage="error.jsp"
@@ -231,11 +232,11 @@ else if (updateSucess) { %>
 							<td width="1%" nowrap align="right" class="c1">
 								<fmt:message key="manage-updates.proxy.host" />
 							</td>
 							<td width="99%">
 								<input type="text" size="15" maxlength="70" name="proxyHost"
-								 value="<%= ((proxyHost != null) ? proxyHost : "") %>">
+								 value="<%= ((proxyHost != null) ? StringUtils.escapeForXML(proxyHost) : "") %>">
 							</td>
 						</tr>
 						<tr valign="top">
 							<td width="1%" align="right" nowrap class="c1">
 								<fmt:message key="manage-updates.proxy.port" />
diff --git a/src/web/media-proxy.jsp b/src/web/media-proxy.jsp
index 29fc0234e..b49f25b37 100644
--- a/src/web/media-proxy.jsp
+++ b/src/web/media-proxy.jsp
@@ -18,10 +18,11 @@
 
 --%>
 
 <%@ page import="org.jivesoftware.util.JiveGlobals" %>
 <%@ page import="org.jivesoftware.util.ParamUtils" %>
+<%@ page import="org.jivesoftware.util.StringUtils" %>
 <%@ page import="org.jivesoftware.openfire.XMPPServer" %>
 <%@ page import="org.jivesoftware.openfire.mediaproxy.MediaProxyService" %>
 <%@ page import="org.jivesoftware.openfire.mediaproxy.MediaProxySession" %>
 <%@ page import="org.jivesoftware.openfire.mediaproxy.RelaySession" %>
 <%@ page import="java.util.Collection" %>
@@ -290,11 +291,11 @@
             <tr class="jive-<%= (((i%2)==0) ? "even" : "odd") %>">
                 <td width="1%">
                     <%= i %>
                 </td>
                 <td width="10%" align="left" valign="middle">
-                    <%=proxySession.getCreator()%>
+                    <%= StringUtils.escapeHTMLTags(proxySession.getCreator())%>
                 </td>
                 <td width="15%" align="left" valign="middle">
                     <%=proxySession.getHostA()%>:<%=proxySession.getLocalPortA()%>
                 </td>
                 <td width="15%" align="left" valign="middle">
@@ -326,6 +327,6 @@
 </div>
 
 <% } // end enabled check %>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-create-permission.jsp b/src/web/muc-create-permission.jsp
index d326c2ac3..6d94bdc2d 100644
--- a/src/web/muc-create-permission.jsp
+++ b/src/web/muc-create-permission.jsp
@@ -119,11 +119,11 @@
 </head>
 <body>
 
 <p>
 <fmt:message key="muc.create.permission.info" />
-<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
+<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
 </p>
 
 <%  if (errors.size() > 0) { %>
 
     <div class="jive-error">
@@ -164,11 +164,11 @@
 
 <%  } %>
 
 <!-- BEGIN 'Permission Policy' -->
 <form action="muc-create-permission.jsp?save" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
 		<fmt:message key="muc.create.permission.policy" />
 	</div>
 	<div class="jive-contentBox">
 		<table cellpadding="3" cellspacing="0" border="0">
@@ -203,11 +203,11 @@
 
 
 <%  if (mucService.isRoomCreationRestricted()) { %>
 <!-- BEGIN 'Allowed Users' -->
 <form action="muc-create-permission.jsp?add" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
 		<fmt:message key="muc.create.permission.allowed_users" />
 	</div>
 	<div class="jive-contentBox">
 		<p>
@@ -260,6 +260,6 @@
 
 <%  } %>
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-default-settings.jsp b/src/web/muc-default-settings.jsp
index 150061ee4..9dba42c05 100644
--- a/src/web/muc-default-settings.jsp
+++ b/src/web/muc-default-settings.jsp
@@ -147,11 +147,11 @@
 </head>
 <body>
 
 <p>
 <fmt:message key="muc.default.settings.info" />
-<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
+<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
 </p>
 
 <%  if (errors.size() > 0) { %>
 
     <div class="jive-error">
@@ -180,11 +180,11 @@
 
 <%  } %>
 
 <!-- BEGIN 'Default Room Settings' -->
 <form action="muc-default-settings.jsp?save" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
         <fmt:message key="muc.default.settings.title" />
     </div>
     <div class="jive-contentBox">
         <table cellpadding="3" cellspacing="0" border="0">
diff --git a/src/web/muc-history-settings.jsp b/src/web/muc-history-settings.jsp
index c03da2862..9b5d4398d 100644
--- a/src/web/muc-history-settings.jsp
+++ b/src/web/muc-history-settings.jsp
@@ -113,11 +113,11 @@
 </head>
 <body>
 
 <p>
 <fmt:message key="groupchat.history.settings.introduction" />
-<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
+<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
 </p>
 
 <%  if ("true".equals(request.getParameter("success"))) { %>
 
     <div class="jive-success">
@@ -133,11 +133,11 @@
 
 <%  } %>
 
 <!-- BEGIN 'History Settings' -->
 <form action="muc-history-settings.jsp" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
 		<fmt:message key="groupchat.history.settings.legend" />
 	</div>
 	<div class="jive-contentBox">
 		<table cellpadding="3" cellspacing="0" border="0" >
@@ -185,6 +185,6 @@
 </form>
 <!-- END 'History Settings' -->
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-room-affiliations.jsp b/src/web/muc-room-affiliations.jsp
index aa6df471b..dc451de20 100644
--- a/src/web/muc-room-affiliations.jsp
+++ b/src/web/muc-room-affiliations.jsp
@@ -21,10 +21,11 @@
 <%@ page import="org.dom4j.Element,
                  org.jivesoftware.openfire.muc.ConflictException,
                  org.jivesoftware.openfire.muc.MUCRoom,
                  org.jivesoftware.openfire.muc.NotAllowedException,
                  org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  org.xmpp.packet.IQ"
     errorPage="error.jsp"
 %>
 <%@ page import="org.xmpp.packet.JID" %>
 <%@ page import="java.net.URLEncoder" %>
@@ -248,14 +249,14 @@
                     String userDisplay = username + '@' + user.getDomain();
         %>
             <tr>
                 <td>&nbsp;</td>
                 <td>
-                    <%= userDisplay %>
+                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                 </td>
                 <td width="1%" align="center">
-                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=owner"
+                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=owner"
                      title="<fmt:message key="global.click_delete" />"
                      onclick="return confirm('<fmt:message key="muc.room.affiliations.confirm_removed" />');"
                      ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
                 </td>
             </tr>
@@ -280,14 +281,14 @@
                     String userDisplay = username + '@' + user.getDomain();
         %>
             <tr>
                 <td>&nbsp;</td>
                 <td>
-                    <%= userDisplay %>
+                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                 </td>
                 <td width="1%" align="center">
-                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=admin"
+                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=admin"
                      title="<fmt:message key="global.click_delete" />"
                      onclick="return confirm('<fmt:message key="muc.room.affiliations.confirm_removed" />');"
                      ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
                 </td>
             </tr>
@@ -314,14 +315,14 @@
                     nickname = (nickname == null ? "" : " (" + nickname + ")");
         %>
             <tr>
                 <td>&nbsp;</td>
                 <td>
-                    <%= userDisplay %><%=  nickname %>
+                    <%= StringUtils.escapeHTMLTags(userDisplay) %><%=  StringUtils.escapeHTMLTags(nickname) %>
                 </td>
                 <td width="1%" align="center">
-                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=member"
+                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=member"
                      title="<fmt:message key="global.click_delete" />"
                      onclick="return confirm('<fmt:message key="muc.room.affiliations.confirm_removed" />');"
                      ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
                 </td>
             </tr>
@@ -346,14 +347,14 @@
                     String userDisplay = username + '@' + user.getDomain();
         %>
             <tr>
                 <td>&nbsp;</td>
                 <td>
-                    <%= userDisplay %>
+                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                 </td>
                 <td width="1%" align="center">
-                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=outcast"
+                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=outcast"
                      title="<fmt:message key="global.click_delete" />"
                      onclick="return confirm('<fmt:message key="muc.room.affiliations.confirm_removed" />');"
                      ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
                 </td>
             </tr>
diff --git a/src/web/muc-room-delete.jsp b/src/web/muc-room-delete.jsp
index 450717e73..767f2d041 100644
--- a/src/web/muc-room-delete.jsp
+++ b/src/web/muc-room-delete.jsp
@@ -86,16 +86,16 @@
     </head>
     <body>
 
 <p>
 <fmt:message key="muc.room.delete.info" />
-<b><a href="muc-room-edit-form.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>"><%= room.getJID().toBareJID() %></a></b>
+<b><a href="muc-room-edit-form.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %></a></b>
 <fmt:message key="muc.room.delete.detail" />
 </p>
 
 <form action="muc-room-delete.jsp">
-<input type="hidden" name="roomJID" value="<%= roomJID.toBareJID() %>">
+<input type="hidden" name="roomJID" value="<%= StringUtils.escapeForXML(roomJID.toBareJID()) %>">
 
 <fieldset>
     <legend><fmt:message key="muc.room.delete.destructon_title" /></legend>
     <div>
     <table cellpadding="3" cellspacing="0" border="0" width="100%">
@@ -103,11 +103,11 @@
         <tr>
             <td class="c1">
                 <fmt:message key="muc.room.delete.room_id" />
             </td>
             <td>
-                <%= room.getJID().toBareJID() %>
+                <%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="muc.room.delete.reason" />
@@ -134,6 +134,6 @@
 <input type="submit" name="delete" value="<fmt:message key="muc.room.delete.destroy_room" />">
 <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 </form>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-room-edit-form.jsp b/src/web/muc-room-edit-form.jsp
index 5cf2eb889..d5f7c9055 100644
--- a/src/web/muc-room-edit-form.jsp
+++ b/src/web/muc-room-edit-form.jsp
@@ -16,10 +16,11 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  java.text.DateFormat,
                  java.util.*,
                  org.jivesoftware.openfire.muc.MUCRoom,
                  org.jivesoftware.openfire.forms.spi.*,
                  org.jivesoftware.openfire.forms.*,
@@ -422,11 +423,11 @@
             <th scope="col"><fmt:message key="muc.room.edit.form.modified" /></th>
         </tr>
     </thead>
     <tbody>
         <tr>
-            <td><%= room.getName() %></td>
+            <td><%= StringUtils.escapeHTMLTags(room.getName()) %></td>
             <% if (room.getOccupantsCount() == 0) { %>
             <td><%= room.getOccupantsCount() %> / <%= room.getMaxUsers() %></td>
             <% } else { %>
             <td><a href="muc-room-occupants.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8")%>"><%= room.getOccupantsCount() %> / <%= room.getMaxUsers() %></a></td>
             <% } %>
@@ -441,11 +442,11 @@
 <%  } else { %>
     <p><fmt:message key="muc.room.edit.form.persistent_room" /></p>
 <%  } %>
 <form action="muc-room-edit-form.jsp">
 <% if (!create) { %>
-    <input type="hidden" name="roomJID" value="<%= roomJID.toBareJID() %>">
+    <input type="hidden" name="roomJID" value="<%= StringUtils.escapeForXML(roomJID.toBareJID()) %>">
 <% } %>
 <input type="hidden" name="save" value="true">
 <input type="hidden" name="create" value="<%= create %>">
 <input type="hidden" name="roomconfig_persistentroom" value="<%= persistentRoom %>">
 
@@ -454,52 +455,52 @@
             <table width="100%" border="0">
                 <tbody>
                 <% if (create) { %>
                 <tr>
                     <td><fmt:message key="muc.room.edit.form.room_id" />:</td>
-                    <td><input type="text" name="roomName" value="<%= roomName %>">
+                    <td><input type="text" name="roomName" value="<%= StringUtils.escapeForXML(roomName) %>">
                         <% if (webManager.getMultiUserChatManager().getMultiUserChatServicesCount() > 1) { %>
                         @<select name="mucName">
                         <% for (MultiUserChatService service : webManager.getMultiUserChatManager().getMultiUserChatServices()) { %>
                         <%      if (service.isHidden()) continue; %>
-                        <option value="<%= service.getServiceDomain() %>"<%= service.getServiceDomain().equals(mucName) ? " selected='selected'" : "" %>><%= service.getServiceDomain() %></option>
+                        <option value="<%= StringUtils.escapeForXML(service.getServiceDomain()) %>"<%= service.getServiceDomain().equals(mucName) ? " selected='selected'" : "" %>><%= StringUtils.escapeHTMLTags(service.getServiceDomain()) %></option>
                         <% } %>
                         </select>
                         <% } else { %>
                         @<%
                             // We only have one service, none-the-less, we have to run through the list to get the first
                             for (MultiUserChatService service : webManager.getMultiUserChatManager().getMultiUserChatServices()) {
                                 if (service.isHidden()) {
                                     // Private and hidden, skip it.
                                     continue;
                                 }
-                                out.print("<input type='hidden' name='mucName' value='"+service.getServiceDomain()+"'/>"+service.getServiceDomain());
+                                out.print("<input type='hidden' name='mucName' value='"+StringUtils.escapeForXML(service.getServiceDomain())+"'/>"+StringUtils.escapeHTMLTags(service.getServiceDomain()));
                                 break;
                             }
                         %>
                         <% } %>
                     </td>
                 </tr>
                 <% } else { %>
                 <tr>
                    <td><fmt:message key="muc.room.edit.form.service" />:</td>
-                   <td><%= roomJID.getDomain() %></td>
+                   <td><%= StringUtils.escapeHTMLTags(roomJID.getDomain()) %></td>
                </tr>
                 <% } %>
                  <tr>
                     <td><fmt:message key="muc.room.edit.form.room_name" />:</td>
-                    <td><input type="text" name="roomconfig_roomname" value="<%= (naturalName == null ? "" : naturalName) %>">
+                    <td><input type="text" name="roomconfig_roomname" value="<%= (naturalName == null ? "" : StringUtils.escapeForXML(naturalName)) %>">
                     </td>
                 </tr>
                  <tr>
                     <td><fmt:message key="muc.room.edit.form.description" />:</td>
-                    <td><input name="roomconfig_roomdesc" value="<%= (description == null ? "" : description) %>" type="text" size="40">
+                    <td><input name="roomconfig_roomdesc" value="<%= (description == null ? "" : StringUtils.escapeForXML(description)) %>" type="text" size="40">
                     </td>
                 </tr>
                  <tr>
                     <td><fmt:message key="muc.room.edit.form.topic" />:</td>
-                    <td><input name="room_topic" value="<%= (roomSubject == null ? "" : roomSubject) %>" type="text" size="40">
+                    <td><input name="room_topic" value="<%= (roomSubject == null ? "" : StringUtils.escapeForXML(roomSubject)) %>" type="text" size="40">
                     </td>
                 </tr>
                  <tr>
                     <td><fmt:message key="muc.room.edit.form.max_room" />:</td>
                     <td><select name="roomconfig_maxusers">
diff --git a/src/web/muc-room-occupants.jsp b/src/web/muc-room-occupants.jsp
index d54ae0b03..db5ef249b 100644
--- a/src/web/muc-room-occupants.jsp
+++ b/src/web/muc-room-occupants.jsp
@@ -18,13 +18,13 @@
 --%>
 
 <%@ page import="org.jivesoftware.openfire.muc.MUCRole,
                  org.jivesoftware.openfire.muc.MUCRoom,
                  org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  java.net.URLEncoder,
-                 java.text.DateFormat,
-                 java.util.List"
+                 java.text.DateFormat"
     errorPage="error.jsp"
 %>
 <%@ page import="org.jivesoftware.openfire.XMPPServer" %>
 <%@ page import="org.jivesoftware.openfire.muc.NotAllowedException" %>
 <%@ page import="org.xmpp.packet.JID" %>
@@ -48,27 +48,23 @@
         return;
     }
 
     // Kick nick specified
     if (kick != null) {
-        List<MUCRole> roles = room.getOccupantsByNickname(nickName);
-        if (roles != null && roles.size() > 0) {
+        MUCRole role = room.getOccupant(nickName);
+        if (role != null) {
             try {
-            	for (MUCRole role : roles) {
-                    room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), "");
-            	}
+                room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), "");
                 // Log the event
                 webManager.logEvent("kicked MUC occupant "+nickName+" from "+roomName, null);
                 // Done, so redirect
-                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+
-                	"&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletesuccess=true");
+                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletesuccess=true");
                 return;
             }
             catch (NotAllowedException e) {
                 // Done, so redirect
-                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+
-                	"&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletefailed=true");
+                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletefailed=true");
                 return;
             }
         }
     }
 
@@ -94,11 +90,11 @@
         <table cellpadding="0" cellspacing="0" border="0">
         <tbody>
             <tr><td class="jive-icon"><img src="images/success-16x16.gif" width="16" height="16" border="0" alt=""></td>
             <td class="jive-icon-label">
             <fmt:message key="muc.room.occupants.kicked">
-                <fmt:param value="<%= nickName %>"/>
+                <fmt:param value="<%= StringUtils.escapeForXML(nickName) %>"/>
             </fmt:message>
             </td></tr>
         </tbody>
         </table>
         </div><br>
@@ -111,11 +107,11 @@
         <table cellpadding="0" cellspacing="0" border="0">
         <tbody>
             <tr><td class="jive-icon"><img src="images/error-16x16.gif" width="16" height="16" border="0" alt=""></td>
             <td class="jive-icon-label">
             <fmt:message key="muc.room.occupants.kickfailed">
-                <fmt:param value="<%= nickName %>"/>
+                <fmt:param value="<%= StringUtils.escapeForXML(nickName) %>"/>
             </fmt:message>
             </td></tr>
         </tbody>
         </table>
         </div><br>
@@ -132,11 +128,11 @@
             <th scope="col"><fmt:message key="muc.room.edit.form.modified" /></th>
         </tr>
     </thead>
     <tbody>
         <tr>
-            <td><%= room.getName() %></td>
+            <td><%= StringUtils.escapeHTMLTags(room.getName()) %></td>
             <td><%= room.getOccupantsCount() %> / <%= room.getMaxUsers() %></td>
             <td><%= dateFormatter.format(room.getCreationDate()) %></td>
             <td><%= dateFormatter.format(room.getModificationDate()) %></td>
         </tr>
     </tbody>
@@ -160,14 +156,14 @@
         </tr>
     </thead>
     <tbody>
         <% for (MUCRole role : room.getOccupants()) { %>
         <tr>
-            <td><%= role.getUserAddress() %></td>
-            <td><%= role.getNickname() %></td>
-            <td><%= role.getRole() %></td>
-            <td><%= role.getAffiliation() %></td>
+            <td><%= StringUtils.escapeHTMLTags(role.getUserAddress().toString()) %></td>
+            <td><%= StringUtils.escapeHTMLTags(role.getNickname().toString()) %></td>
+            <td><%= StringUtils.escapeHTMLTags(role.getRole().toString()) %></td>
+            <td><%= StringUtils.escapeHTMLTags(role.getAffiliation().toString()) %></td>
             <td><a href="muc-room-occupants.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>&nickName=<%= URLEncoder.encode(role.getNickname(), "UTF-8") %>&kick=1" title="<fmt:message key="muc.room.occupants.kick"/>"><img src="images/delete-16x16.gif" alt="<fmt:message key="muc.room.occupants.kick"/>" border="0" width="16" height="16"/></a></td>
         </tr>
         <% } %>
     </tbody>
     </table>
diff --git a/src/web/muc-room-summary.jsp b/src/web/muc-room-summary.jsp
index 6b31449e6..cfd14f24d 100644
--- a/src/web/muc-room-summary.jsp
+++ b/src/web/muc-room-summary.jsp
@@ -89,11 +89,11 @@
     </head>
     <body>
 
 <p>
 <fmt:message key="muc.room.summary.info" />
-<a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucService.getServiceName(), "UTF-8")%>"><%= mucService.getServiceDomain() %></a>
+<a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucService.getServiceName(), "UTF-8")%>"><%= StringUtils.escapeHTMLTags(mucService.getServiceDomain()) %></a>
 <fmt:message key="muc.room.summary.info2" />
 </p>
 
 <%  if (request.getParameter("deletesuccess") != null) { %>
 
@@ -126,11 +126,11 @@
     if (service.isHidden()) {
         // Private and hidden, skip it.
         continue;
     }
 %>
-    <option value="<%= service.getServiceName() %>"<%= mucService.getServiceName().equals(service.getServiceName()) ? " selected='selected'" : "" %>><%= service.getServiceDomain() %></option>
+    <option value="<%= StringUtils.escapeForXML(service.getServiceName()) %>"<%= mucService.getServiceName().equals(service.getServiceName()) ? " selected='selected'" : "" %>><%= StringUtils.escapeHTMLTags(service.getServiceDomain()) %></option>
 <% } %>
     </select>
 <% } %>
 
 </p>
@@ -142,11 +142,11 @@
     [
     <%  for (int i=0; i<numPages; i++) {
             String sep = ((i+1)<numPages) ? " " : "";
             boolean isCurrent = (i+1) == curPage;
     %>
-        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : mucname %>&start=<%= (i*range) %>"
+        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : URLEncoder.encode(mucname) %>&start=<%= (i*range) %>"
          class="<%= ((isCurrent) ? "jive-current" : "") %>"
          ><%= (i+1) %></a><%= sep %>
 
     <%  } %>
     ]
@@ -246,17 +246,17 @@
     [
     <%  for (i=0; i<numPages; i++) {
             String sep = ((i+1)<numPages) ? " " : "";
             boolean isCurrent = (i+1) == curPage;
     %>
-        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : mucname %>&start=<%= (i*range) %>"
+        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : URLEncoder.encode(mucname) %>&start=<%= (i*range) %>"
          class="<%= ((isCurrent) ? "jive-current" : "") %>"
          ><%= (i+1) %></a><%= sep %>
 
     <%  } %>
     ]
     </p>
 
 <%  } %>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-service-delete.jsp b/src/web/muc-service-delete.jsp
index f1d8416f2..89f0b655a 100644
--- a/src/web/muc-service-delete.jsp
+++ b/src/web/muc-service-delete.jsp
@@ -71,16 +71,16 @@
     </head>
     <body>
 
 <p>
 <fmt:message key="muc.service.delete.info" />
-<b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
+<b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
 <fmt:message key="muc.service.delete.detail" />
 </p>
 
 <form action="muc-service-delete.jsp">
-<input type="hidden" name="mucname" value="<%= mucname %>">
+<input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>">
 
 <fieldset>
     <legend><fmt:message key="muc.service.delete.destructon_title" /></legend>
     <div>
     <table cellpadding="3" cellspacing="0" border="0" width="100%">
@@ -88,11 +88,11 @@
         <tr>
             <td class="c1">
                 <fmt:message key="muc.service.delete.service_name" />
             </td>
             <td>
-                <%= mucname %>
+                <%= StringUtils.escapeHTMLTags(mucname) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="muc.service.delete.reason" />
@@ -111,6 +111,6 @@
 <input type="submit" name="delete" value="<fmt:message key="muc.service.delete.destroy_service" />">
 <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 </form>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-service-edit-form.jsp b/src/web/muc-service-edit-form.jsp
index 3cfbf1327..f3c0608d9 100644
--- a/src/web/muc-service-edit-form.jsp
+++ b/src/web/muc-service-edit-form.jsp
@@ -15,11 +15,12 @@
   - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
-<%@ page import="org.jivesoftware.util.ParamUtils,
+<%@ page import="org.jivesoftware.util.StringUtils,
+                 org.jivesoftware.util.ParamUtils,
                  org.jivesoftware.util.AlreadyExistsException,
                  java.util.*"
     errorPage="error.jsp"
 %>
 <%@ page import="java.net.URLEncoder" %>
@@ -145,11 +146,11 @@
 
 <!-- BEGIN 'Service Name'-->
 <form action="muc-service-edit-form.jsp" method="post">
 <input type="hidden" name="save" value="true">
 <% if (!create) { %>
-<input type="hidden" name="mucname" value="<%= mucname %>">
+<input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>">
 <% } else { %>
 <input type="hidden" name="create" value="true" />
 <% } %>
 
     <div class="jive-contentBoxHeader">
@@ -161,36 +162,36 @@
                 <td class="c1">
                    <fmt:message key="groupchat.service.properties.label_service_name" />
                 </td>
                 <td>
                     <% if (create) { %>
-                    <input type="text" size="30" maxlength="150" name="mucname" value="<%= (mucname != null ? mucname : "") %>">
+                    <input type="text" size="30" maxlength="150" name="mucname" value="<%= (mucname != null ? StringUtils.escapeForXML(mucname) : "") %>">
 
                     <%  if (errors.get("mucname") != null) { %>
 
                     <span class="jive-error-text">
                     <br><fmt:message key="groupchat.service.properties.error_service_name" />
                     </span>
 
                     <%  } %>
                     <% } else { %>
-                    <%= mucname %>
+                    <%= StringUtils.escapeHTMLTags(mucname) %>
                     <% } %>
                 </td>
             </tr>
             <tr>
                 <td class="c1">
                    <fmt:message key="groupchat.service.properties.label_service_description" />
                 </td>
                 <td>
-                    <input type="text" size="30" maxlength="150" name="mucdesc" value="<%= (mucdesc != null ? mucdesc : "") %>">
+                    <input type="text" size="30" maxlength="150" name="mucdesc" value="<%= (mucdesc != null ? StringUtils.escapeForXML(mucdesc) : "") %>">
                 </td>
             </tr>
         </table>
 	</div>
     <input type="submit" value="<fmt:message key="groupchat.service.properties.save" />">
 </form>
 <!-- END 'Service Name'-->
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-service-summary.jsp b/src/web/muc-service-summary.jsp
index 2c6ef73c4..0ccd59dda 100644
--- a/src/web/muc-service-summary.jsp
+++ b/src/web/muc-service-summary.jsp
@@ -17,11 +17,12 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.LocaleUtils,
-                 org.jivesoftware.util.ParamUtils"
+                 org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils"
 %><%@ page import="org.xmpp.packet.JID"%>
 <%@ page import="java.net.URLEncoder" %>
 <%@ page import="org.jivesoftware.openfire.muc.MultiUserChatService" %>
 <%@ page import="java.util.List" %>
 
@@ -194,11 +195,11 @@
     <tr class="jive-<%= (((i%2)==0) ? "even" : "odd") %>">
         <td width="1%">
             <%= i %>
         </td>
         <td width="23%">
-            <a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(service.getServiceName(), "UTF-8") %>"><%= JID.unescapeNode(service.getServiceName()) %></a>
+            <a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(service.getServiceName(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(service.getServiceName())) %></a>
         </td>
         <td width="33%">
             <%= service.getDescription() %> &nbsp;
         </td>
         <td width="5%">
diff --git a/src/web/muc-sysadmins.jsp b/src/web/muc-sysadmins.jsp
index 9a0cfa1d2..02dc90db4 100644
--- a/src/web/muc-sysadmins.jsp
+++ b/src/web/muc-sysadmins.jsp
@@ -86,11 +86,11 @@
 </head>
 <body>
 
 <p>
 <fmt:message key="groupchat.admins.introduction" />
-<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
+<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
 </p>
 
 <%  if ("true".equals(request.getParameter("deletesuccess"))) { %>
 
     <div class="jive-success">
@@ -133,17 +133,17 @@
 <%  } %>
 
 
 <!-- BEGIN 'Administrators' -->
 <form action="muc-sysadmins.jsp?add" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
 		<fmt:message key="groupchat.admins.legend" />
 	</div>
 	<div class="jive-contentBox">
 		<label for="userJIDtf"><fmt:message key="groupchat.admins.label_add_admin" /></label>
-		<input type="text" name="userJID" size="30" maxlength="100" value="<%= (userJID != null ? userJID : "") %>"
+		<input type="text" name="userJID" size="30" maxlength="100" value="<%= (userJID != null ? StringUtils.escapeForXML(userJID) : "") %>"
 		 id="userJIDtf">
 		<input type="submit" value="<fmt:message key="groupchat.admins.add" />">
 		<br><br>
 
 		<div class="jive-table" style="width:400px;">
@@ -169,14 +169,14 @@
 	                	String username = JID.unescapeNode(user.getNode());
 	                    String userDisplay = username + '@' + user.getDomain();
 	            %>
 					<tr>
 						<td width="99%">
-							<%= userDisplay %>
+							<%= StringUtils.escapeHTMLTags(userDisplay) %>
 						</td>
 						<td width="1%" align="center">
-							<a href="muc-sysadmins.jsp?userJID=<%= user.toString() %>&delete=true&mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"
+							<a href="muc-sysadmins.jsp?userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"
 							 title="<fmt:message key="groupchat.admins.dialog.title" />"
 							 onclick="return confirm('<fmt:message key="groupchat.admins.dialog.text" />');"
 							 ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
 						</td>
 					</tr>
@@ -189,6 +189,6 @@
 </form>
 <!-- END 'Administrators' -->
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/muc-tasks.jsp b/src/web/muc-tasks.jsp
index d81fcd0f9..fc144eeee 100644
--- a/src/web/muc-tasks.jsp
+++ b/src/web/muc-tasks.jsp
@@ -135,11 +135,11 @@
 </head>
 <body>
 
 <p>
 <fmt:message key="muc.tasks.info" />
-<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
+<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
 </p>
 
 <%  if (kickSettingSuccess || logSettingSuccess) { %>
 
     <div class="jive-success">
@@ -185,11 +185,11 @@
 <% } %>
 
 
 <!-- BEGIN 'Idle User Settings' -->
 <form action="muc-tasks.jsp?kickSettings" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
 		<fmt:message key="muc.tasks.user_setting" />
 	</div>
 	<div class="jive-contentBox">
 		<table cellpadding="3" cellspacing="0" border="0">
@@ -226,11 +226,11 @@
 
 <br>
 
 <!-- BEGIN 'Conversation Logging' -->
 <form action="muc-tasks.jsp?logSettings" method="post">
-    <input type="hidden" name="mucname" value="<%= mucname %>" />
+    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
     <div class="jive-contentBoxHeader">
 		<fmt:message key="muc.tasks.conversation.logging" />
 	</div>
 	<div class="jive-contentBox">
 		<table cellpadding="3" cellspacing="0" border="0" >
@@ -259,6 +259,6 @@
 </form>
 <!-- END 'Conversation Logging' -->
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/security-audit-viewer.jsp b/src/web/security-audit-viewer.jsp
index c59449734..634c61efe 100644
--- a/src/web/security-audit-viewer.jsp
+++ b/src/web/security-audit-viewer.jsp
@@ -114,11 +114,11 @@
     <% } %>
 
     </select>
     &nbsp;&nbsp;
     <strong><fmt:message key="security.audit.viewer.username" /></strong>:
-    <input type="text" size="30" maxlength="150" name="username" value="<%= username != null ? username : "" %>"/>
+    <input type="text" size="30" maxlength="150" name="username" value="<%= username != null ? StringUtils.escapeForXML(username) : "" %>"/>
     <br/>
     <strong><fmt:message key="security.audit.viewer.date_range"/></strong>:
     <fmt:message key="security.audit.viewer.date_range.start"/>:
     <input type="text" size="15" maxlength="15" name="startdate" value="<%= startDateSetting != null ? startDateSetting : "" %>"/> (<fmt:message key="security.audit.viewer.date_range.use"/>)
     &nbsp;
@@ -162,11 +162,11 @@
     <tr class="jive-<%= (((i%2)==0) ? "even" : "odd") %>" valign="top">
         <td width="1%">
             <%= event.getMsgID() %>
         </td>
         <td width="10%">
-            <a href="user-properties.jsp?username=<%= URLEncoder.encode(event.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(event.getUsername()) %></a>
+            <a href="user-properties.jsp?username=<%= URLEncoder.encode(event.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(event.getUsername())) %></a>
         </td>
         <td width="15%">
             <%= event.getNode() %>
         </td>
         <td width="59%">
diff --git a/src/web/server-properties.jsp b/src/web/server-properties.jsp
index 8323e9887..d1cfe3bd7 100644
--- a/src/web/server-properties.jsp
+++ b/src/web/server-properties.jsp
@@ -296,11 +296,11 @@ function dodelete(propName) {
     %>
     <tr class="<%= (n.equals(propName) ? "hilite" : "") %>">
 
         <td>
             <div class="hidebox" style="width:200px;">
-                <span title="<%= StringUtils.escapeHTMLTags(n) %>">
+                <span title="<%= StringUtils.escapeForXML(n) %>">
                 <%= StringUtils.escapeHTMLTags(n) %>
                 </span>
             </div>
         </td>
         <td>
@@ -366,16 +366,16 @@ function dodelete(propName) {
             <fmt:message key="server.properties.name" />:
         </td>
         <td>
             <%  if (edit) { %>
 
-                <input type="hidden" name="propName" value="<%= StringUtils.escapeHTMLTags(propName) %>">
+                <input type="hidden" name="propName" value="<%= StringUtils.escapeForXML(propName) %>">
                 <%= StringUtils.escapeHTMLTags(propName) %>
 
             <%  } else { %>
 
-                <input type="text" name="propName" size="40" maxlength="100" value="<%= (propName != null ? StringUtils.escapeHTMLTags(propName) : "") %>">
+                <input type="text" name="propName" size="40" maxlength="100" value="<%= (propName != null ? StringUtils.escapeForXML(propName) : "") %>">
 
                 <%  if (errors.containsKey("propName")) { %>
 
                     <br><span class="jive-error-text"><fmt:message key="server.properties.enter_property_name" /></span>
 
@@ -430,6 +430,6 @@ function dodelete(propName) {
 <br><br><br><br><br><br>
 <br><br><br><br><br><br>
 <br><br><br><br><br><br>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/server-session-row.jspf b/src/web/server-session-row.jspf
index f32d6d4c9..9b3014931 100644
--- a/src/web/server-session-row.jspf
+++ b/src/web/server-session-row.jspf
@@ -3,10 +3,11 @@
   -	$Date$
 --%>
 
 <%@ page import="org.jivesoftware.openfire.session.IncomingServerSession,
                  org.jivesoftware.util.JiveGlobals,
+                 org.jivesoftware.util.StringUtils,
                  java.net.URLEncoder,
                  java.util.Calendar,
                  java.util.Date"%>
 
  <%@ taglib uri="http://java.sun.com/jstl/fmt_rt" prefix="fmt" %>
@@ -36,12 +37,12 @@
 <tr class="jive-<%= (((count % 2) == 0) ? "even" : "odd") %>">
     <td width="1%" nowrap><%= count %></td>
     <td width="47%" nowrap>
         <table cellpadding="0" cellspacing="0" border="0">
             <tr>
-            <td width="1%" ><img src="getFavicon?host=<%=host%>" width="16" height="16" alt=""></td>
-            <td><a href="server-session-details.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"><%= host %></a></td>
+            <td width="1%" ><img src="getFavicon?host=<%=URLEncoder.encode(host, "UTF-8")%>" width="16" height="16" alt=""></td>
+            <td><a href="server-session-details.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"><%= StringUtils.escapeHTMLTags(host) %></a></td>
             </tr>
         </table>
     </td>
     <%  if (isSecured) { %>
     <td width="1%">
@@ -122,6 +123,6 @@
         <a href="server-session-summary.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>&close=true"
          title="<fmt:message key="session.row.cliked_kill_session" />"
          onclick="return confirm('<fmt:message key="session.row.confirm_close" />');"
          ><img src="images/delete-16x16.gif" width="16" height="16" border="0"></a>
     </td>
-</tr>
\ No newline at end of file
+</tr>
diff --git a/src/web/session-details.jsp b/src/web/session-details.jsp
index 2bb7fb3bf..185ae9c13 100644
--- a/src/web/session-details.jsp
+++ b/src/web/session-details.jsp
@@ -23,10 +23,11 @@
                  org.jivesoftware.openfire.session.LocalClientSession,
                  org.jivesoftware.openfire.user.User,
                  org.jivesoftware.openfire.user.UserManager,
                  org.jivesoftware.util.JiveGlobals,
                  org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  java.text.NumberFormat,
                  java.util.Collection"
     errorPage="error.jsp"
 %>
 
@@ -112,26 +113,26 @@
     <tr>
         <td class="c1">
             <fmt:message key="session.details.session_id" />
         </td>
         <td>
-            <%= StringUtils.escapeForXML(address.toString()) %>
+            <%= StringUtils.escapeHTMLTags(address.toString()) %>
         </td>
     </tr>
     <tr>
         <td class="c1">
             <fmt:message key="session.details.username" />
         </td>
         <td>
             <%  String n = address.getNode(); %>
             <%  if (isAnonymous) { %>
 
-                <i> <fmt:message key="session.details.anonymous" /> </i> - <%= address.getResource()==null?"":StringUtils.escapeForXML(address.getResource()) %>
+                <i> <fmt:message key="session.details.anonymous" /> </i> - <%= address.getResource()==null?"":StringUtils.escapeHTMLTags(address.getResource()) %>
 
             <%  } else { %>
 
-                <a href="user-properties.jsp?username=<%= URLEncoder.encode(n, "UTF-8") %>"><%= JID.unescapeNode(n) %></a>
+                <a href="user-properties.jsp?username=<%= URLEncoder.encode(n, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(n)) %></a>
                 - <%= address.getResource()==null?"":StringUtils.escapeForXML(address.getResource()) %>
 
             <%  } %>
         </td>
     </tr>
@@ -188,11 +189,11 @@
         <td>
             <%
                 Presence.Show show = currentSess.getPresence().getShow();
                 String statusTxt = currentSess.getPresence().getStatus();
                 if (statusTxt != null) {
-                    statusTxt = " -- " + StringUtils.escapeForXML(statusTxt);
+                    statusTxt = " -- " + StringUtils.escapeHTMLTags(statusTxt);
                 }
                 else {
                     statusTxt = "";
                 }
                 if (!currentSess.getPresence().isAvailable()) {
@@ -358,6 +359,6 @@
 <input type="submit" name="back" value="<fmt:message key="session.details.back_button" />">   
 </center>
 </form>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/session-row.jspf b/src/web/session-row.jspf
index dc895efcb..bb6cf21ef 100644
--- a/src/web/session-row.jspf
+++ b/src/web/session-row.jspf
@@ -37,11 +37,11 @@
         <%  String name = sess.getAddress().getNode(); %>
             <a href="session-details.jsp?jid=<%= URLEncoder.encode(sess.getAddress().toString(), "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"
             ><%= ((!sessionManager.isAnonymousRoute(sess.getUsername())) ? JID.unescapeNode(name): "<i>"+LocaleUtils.getLocalizedString("session.details.anonymous")+"</i>") %></a>
     </td>
     <td width="15%" nowrap>
-        <%= StringUtils.escapeForXML(sess.getAddress().getResource()) %>
+        <%= StringUtils.escapeHTMLTags(sess.getAddress().getResource()) %>
     </td>
     <td nowrap>
             <% if (sess instanceof LocalClientSession) { %>
              <fmt:message key="session.details.local" />
             <% } else { %>
@@ -92,11 +92,11 @@
             ><img src="images/im_away.gif" width="16" height="16" border="0" title="<fmt:message key='session.details.away' />" alt="<fmt:message key='session.details.away' />"
             ></td>
         <td width="46%">
             <%  if (_stat != null) { %>
 
-                <%= _stat %>
+                <%= StringUtils.escapeHTMLTags(_stat) %>
 
             <%  } else { %>
 
                 <fmt:message key="session.details.away" />
 
@@ -118,11 +118,11 @@
             ><img src="images/im_dnd.gif" width="16" height="16" border="0" title="<fmt:message key='session.details.not_disturb' />" alt="<fmt:message key='session.details.not_disturb' />"
             ></td>
         <td width="46%">
             <%  if (_stat != null) { %>
 
-                <%= sess.getPresence().getStatus() %>
+                <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %>
 
             <%  } else { %>
 
                 <fmt:message key="session.details.not_disturb" />
 
@@ -144,11 +144,11 @@
             ><img src="images/im_away.gif" width="16" height="16" border="0" title="<fmt:message key='session.details.extended' />" alt="<fmt:message key='session.details.extended' />"
             ></td>
         <td width="46%">
             <%  if (_stat != null) { %>
 
-                <%= sess.getPresence().getStatus() %>
+                <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %>
 
             <%  } else { %>
 
                 <fmt:message key="session.details.extended" />
 
@@ -175,6 +175,6 @@
         <a href="session-summary.jsp?jid=<%= URLEncoder.encode(sess.getAddress().toString(), "UTF-8") %>&close=true"
          title="<fmt:message key="session.row.cliked_kill_session" />"
          onclick="return confirm('<fmt:message key="session.row.confirm_close" />');"
          ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
     </td>
-</tr>
\ No newline at end of file
+</tr>
diff --git a/src/web/session-summary.jsp b/src/web/session-summary.jsp
index 2b8694e8d..de90708c8 100644
--- a/src/web/session-summary.jsp
+++ b/src/web/session-summary.jsp
@@ -288,6 +288,6 @@
 <p>
 <fmt:message key="session.summary.last_update" />: <%= JiveGlobals.formatDateTime(new Date()) %>
 </p>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/ssl-certificates.jsp b/src/web/ssl-certificates.jsp
index 05805fe5b..7e12294ec 100644
--- a/src/web/ssl-certificates.jsp
+++ b/src/web/ssl-certificates.jsp
@@ -12,10 +12,11 @@
 <%@ page import="java.util.Date" %>
 <%@ page import="java.util.Enumeration" %>
 <%@ page import="java.util.HashMap" %>
 <%@ page import="java.util.LinkedHashMap" %>
 <%@ page import="java.util.Map" %>
+<%@ page import="java.net.URLEncoder" %>
 <%@ page import="org.jivesoftware.openfire.container.PluginManager" %>
 <%@ page import="org.jivesoftware.openfire.container.AdminConsolePlugin" %>
 <%@ page import="java.io.IOException" %>
 
 <%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c" %>
@@ -354,11 +355,11 @@
               }
   %>
       <tr valign="top">
           <td id="rs<%=i%>" width="1" rowspan="1"><%= (i) %>.</td>
           <td>
-              <%= identities.toString() %> (<%= a %>)
+              <%= StringUtils.escapeHTMLTags(identities.toString()) %> (<%= StringUtils.escapeHTMLTags(a) %>)
           </td>
           <td>
               <% boolean expired = c.getNotAfter().before(new Date());
                   if (expired) { %>
                   <font color="red">
@@ -386,20 +387,20 @@
           <% } %>
           <td width="2%">
               <%= c.getPublicKey().getAlgorithm() %>
           </td>
           <td width="1" align="center">
-              <a href="ssl-certificates.jsp?alias=<%= a %>&type=server&delete=true"
+              <a href="ssl-certificates.jsp?alias=<%= URLEncoder.encode(a) %>&type=server&delete=true"
                title="<fmt:message key="global.click_delete" />"
                onclick="return confirm('<fmt:message key="ssl.certificates.confirm_delete" />');"
                ><img src="images/delete-16x16.gif" width="16" height="16" border="0" alt=""></a>
           </td>
       </tr>
       <% if (isSigningPending) { %>
       <form action="ssl-certificates.jsp" method="post">
       <input name="importReply" type="hidden" value="true">
-      <input name="alias" type="hidden" value="<%= a%>">
+      <input name="alias" type="hidden" value="<%= StringUtils.escapeForXML(a)%>">
       <tr id="pk<%=i%>">
           <td colspan="6">
               <span class="jive-description">
               <fmt:message key="ssl.certificates.ca-reply" />
               </span>
diff --git a/src/web/ssl-signing-request.jsp b/src/web/ssl-signing-request.jsp
index 71642ef8c..d3c18af2c 100644
--- a/src/web/ssl-signing-request.jsp
+++ b/src/web/ssl-signing-request.jsp
@@ -1,7 +1,8 @@
 <%@ page import="org.jivesoftware.util.CertificateManager" %>
 <%@ page import="org.jivesoftware.util.ParamUtils" %>
+<%@ page import="org.jivesoftware.util.StringUtils" %>
 <%@ page import="org.jivesoftware.openfire.XMPPServer" %>
 <%@ page import="org.jivesoftware.openfire.net.SSLConfig" %>
 <%@ page import="java.security.KeyStore" %>
 <%@ page import="java.security.cert.X509Certificate" %>
 <%@ page import="java.util.Enumeration" %>
@@ -202,46 +203,46 @@
                             <fmt:message key="ssl.signing-request.name"/>
                             :</label>
                     </td>
                     <td width="99%">
                         <input type="text" name="name" size="50" maxlength="75"
-                               value="<%= ((name!=null) ? name : "") %>" id="namef">
+                               value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>" id="namef">
                     </td>
                 </tr>
                 <tr>
                     <td width="1%" nowrap>
                         <label for="ouf"><fmt:message key="ssl.signing-request.organizational_unit"/>:</label></td>
                     <td width="99%">
-                        <input type="text" name="ou" size="50" maxlength="75" value="<%= ((organizationalUnit!=null) ? organizationalUnit : "") %>" id="ouf">
+                        <input type="text" name="ou" size="50" maxlength="75" value="<%= ((organizationalUnit!=null) ? StringUtils.escapeForXML(organizationalUnit) : "") %>" id="ouf">
                     </td>
                 </tr>
                 <tr>
                     <td width="1%" nowrap>
                         <label for="of"><fmt:message key="ssl.signing-request.organization"/>:</label></td>
                     <td width="99%">
-                        <input type="text" name="o" size="50" maxlength="75" value="<%= ((organization!=null) ? organization : "") %>" id="of">
+                        <input type="text" name="o" size="50" maxlength="75" value="<%= ((organization!=null) ? StringUtils.escapeForXML(organization) : "") %>" id="of">
                     </td>
                 </tr>
                 <tr>
                     <td width="1%" nowrap>
                         <label for="cityf"><fmt:message key="ssl.signing-request.city"/>:</label></td>
                     <td width="99%">
-                        <input type="text" name="city" size="50" maxlength="75" value="<%= ((city!=null) ? city : "") %>" id="cityf">
+                        <input type="text" name="city" size="50" maxlength="75" value="<%= ((city!=null) ? StringUtils.escapeForXML(city) : "") %>" id="cityf">
                     </td>
                 </tr>
                 <tr>
                     <td width="1%" nowrap>
                         <label for="statef"><fmt:message key="ssl.signing-request.state"/>:</label></td>
                     <td width="99%">
-                        <input type="text" name="state" size="30" maxlength="75" value="<%= ((state!=null) ? state : "") %>" id="statef">
+                        <input type="text" name="state" size="30" maxlength="75" value="<%= ((state!=null) ? StringUtils.escapeForXML(state) : "") %>" id="statef">
                     </td>
                 </tr>
                 <tr>
                     <td width="1%" nowrap>
                         <label for="countryf"><fmt:message key="ssl.signing-request.country"/>:</label></td>
                     <td width="99%">
-                        <input type="text" name="country" size="2" maxlength="2" value="<%= ((countryCode!=null) ? countryCode : "") %>" id="countryf">
+                        <input type="text" name="country" size="2" maxlength="2" value="<%= ((countryCode!=null) ? StringUtils.escapeForXML(countryCode) : "") %>" id="countryf">
                     </td>
                 </tr>
               <tr>
                   <td colspan="2">
                       <br>
@@ -252,6 +253,6 @@
           </table>
       </div>
   </form>
   <!-- END 'Issuer information form' -->
   </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/system-cache.jsp b/src/web/system-cache.jsp
index 50b7c65c2..8eee0410d 100644
--- a/src/web/system-cache.jsp
+++ b/src/web/system-cache.jsp
@@ -1,7 +1,8 @@
 <%@ page import="org.jivesoftware.util.cache.Cache"%>
 <%@ page import="org.jivesoftware.util.ParamUtils"%>
+<%@ page import="org.jivesoftware.util.StringUtils"%>
 <%@ page import="java.text.DecimalFormat"%>
 <%--
   -	$RCSfile$
   -	$Revision: $
   -	$Date: $
@@ -191,11 +192,11 @@
     <tr class="<%= (lowEffec ? "jive-error" : "") %>">
         <td class="c1">
             <table cellpadding="0" cellspacing="0" border="0">
             <tr>
                 <td class="icon"><img src="images/cache-16x16.gif" width="16" height="16" alt="" border="0"></td>
-                <td><%= cache.getName() %></td>
+                <td><%= StringUtils.escapeHTMLTags(cache.getName()) %></td>
             </tr>
             </table>
         </td>
         <td class="c2">
             <% if (cache.getMaxCacheSize() != -1 && cache.getMaxCacheSize() != Integer.MAX_VALUE) { %>
diff --git a/src/web/system-clustering.jsp b/src/web/system-clustering.jsp
index f13aa0357..8a7fa4f24 100644
--- a/src/web/system-clustering.jsp
+++ b/src/web/system-clustering.jsp
@@ -35,10 +35,11 @@
 <%@ page import="java.text.DecimalFormat" %>
 <%@ page import="java.util.Arrays" %>
 <%@ page import="java.util.Collection" %>
 <%@ page import="java.util.Date" %>
 <%@ page import="java.util.Map" %>
+<%@ page import="java.net.URLEncoder" %>
 <%@ page import="org.jivesoftware.util.Base64" %>
 
 <jsp:useBean id="webManager" class="org.jivesoftware.util.WebManager" />
 <% webManager.init(request, response, session, application, out ); %>
 
@@ -280,16 +281,16 @@
                         }
                     }
             %>
               <tr class="<%= (isLocalMember ? "local" : "") %>" valign="middle">
                   <td align="center" width="1%">
-                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= nodeID %>"
+                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= URLEncoder.encode(nodeID) %>"
                        title="Click for more details"
                        ><img src="images/server-network-24x24.gif" width="24" height="24" border="0" alt=""></a>
                   </td>
                   <td class="jive-description" nowrap width="1%" valign="middle">
-                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= nodeID %>">
+                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= URLEncoder.encode(nodeID) %>">
                       <%  if (isLocalMember) { %>
                           <b><%= nodeInfo.getHostName() %></b>
                       <%  } else { %>
                           <%= nodeInfo.getHostName() %>
                       <%  } %></a>
diff --git a/src/web/system-email.jsp b/src/web/system-email.jsp
index fe7b124e1..1c92ad486 100644
--- a/src/web/system-email.jsp
+++ b/src/web/system-email.jsp
@@ -154,11 +154,11 @@
 		<tr>
 			<td width="30%" nowrap>
 				<fmt:message key="system.email.mail_host" />:
 			</td>
 			<td nowrap>
-				<input type="text" name="host" value="<%= (host != null)?host:"" %>" size="40" maxlength="150">
+				<input type="text" name="host" value="<%= (host != null)? StringUtils.escapeForXML(host):"" %>" size="40" maxlength="150">
 			</td>
 		</tr>
 
 		<%  if (errors.containsKey("host")) { %>
 
@@ -199,11 +199,11 @@
 		<tr>
 			<td nowrap>
 				<fmt:message key="system.email.server_username" />:
 			</td>
 			<td nowrap>
-				<input type="text" name="server_username" value="<%= (username != null) ? username : "" %>" size="40" maxlength="150">
+				<input type="text" name="server_username" value="<%= (username != null) ? StringUtils.escapeForXML(username) : "" %>" size="40" maxlength="150">
 			</td>
 		</tr>
 		<tr>
 			<td nowrap>
 				<fmt:message key="system.email.server_password" />:
@@ -228,6 +228,6 @@
 <input type="submit" name="test" value="<fmt:message key="system.email.send_test" />">
 </form>
 <!-- END SMTP settings -->
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/system-emailtest.jsp b/src/web/system-emailtest.jsp
index 0e908e94c..b5dc51f44 100644
--- a/src/web/system-emailtest.jsp
+++ b/src/web/system-emailtest.jsp
@@ -15,10 +15,11 @@
 --%>
 
 <%@ page import="org.jivesoftware.util.*,
                  org.jivesoftware.openfire.user.*,
                  java.util.*,
+                 java.net.URLEncoder,
                  javax.mail.*,
                  javax.mail.internet.*"
     errorPage="error.jsp"
 %>
 <%@ page import="java.text.SimpleDateFormat"%>
@@ -197,11 +198,11 @@ function checkClick(el) {
                 <fmt:message key="system.emailtest.failure" />
                 <%  if (mex != null) { %>
                     <%  if (mex instanceof AuthenticationFailedException) { %>
                     	<fmt:message key="system.emailtest.failure_authentication" />                        
                     <%  } else { %>
-                        (Message: <%= mex.getMessage() %>)
+                        (Message: <%= StringUtils.escapeHTMLTags(mex.getMessage()) %>)
                     <%  } %>
                 <%  } %>
             </td></tr>
         </tbody>
         </table>
@@ -227,11 +228,11 @@ function checkClick(el) {
             %>
                 <i><fmt:message key="system.emailtest.host_not_set" /></i>
             <%
                 } else {
             %>
-                <%= host %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25)  %>
+                <%= StringUtils.escapeHTMLTags(host) %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25)  %>
 
                 <%  if (JiveGlobals.getBooleanProperty("mail.smtp.ssl", false)) { %>
 
                     (<fmt:message key="system.emailtest.ssl" />)
 
@@ -242,41 +243,41 @@ function checkClick(el) {
     <tr>
         <td>
             <fmt:message key="system.emailtest.from" />:
         </td>
         <td>
-            <input type="hidden" name="from" value="<%= from %>">
+            <input type="hidden" name="from" value="<%= StringUtils.escapeForXML(from) %>">
             <%= StringUtils.escapeHTMLTags(from) %>
             <span class="jive-description">
-            (<a href="user-edit-form.jsp?username=<%=user.getUsername()%>">Update Address</a>)
+            (<a href="user-edit-form.jsp?username=<%= URLEncoder.encode(user.getUsername())%>">Update Address</a>)
             </span>
         </td>
     </tr>
     <tr>
         <td>
             <fmt:message key="system.emailtest.to" />:
         </td>
         <td>
-            <input type="text" name="to" value="<%= ((to != null) ? to : "") %>"
+            <input type="text" name="to" value="<%= ((to != null) ? StringUtils.escapeForXML(to) : "") %>"
              size="40" maxlength="100">
         </td>
     </tr>
     <tr>
         <td>
             <fmt:message key="system.emailtest.subject" />:
         </td>
         <td>
-            <input type="text" name="subject" value="<%= ((subject != null) ? subject : "") %>"
+            <input type="text" name="subject" value="<%= ((subject != null) ? StringUtils.escapeForXML(subject) : "") %>"
              size="40" maxlength="100">
         </td>
     </tr>
     <tr valign="top">
         <td>
             <fmt:message key="system.emailtest.body" />:
         </td>
         <td>
-            <textarea name="body" cols="45" rows="5" wrap="virtual"><%= body %></textarea>
+            <textarea name="body" cols="45" rows="5" wrap="virtual"><%= StringUtils.escapeHTMLTags(body) %></textarea>
         </td>
     </tr>
     <tr>
         <td colspan="2">
             <br>
@@ -288,6 +289,6 @@ function checkClick(el) {
 </table>
 
 </form>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-create.jsp b/src/web/user-create.jsp
index 14dfc1271..08e35f685 100644
--- a/src/web/user-create.jsp
+++ b/src/web/user-create.jsp
@@ -211,26 +211,26 @@
 		<table cellpadding="3" cellspacing="0" border="0">
 		<tbody>
 		<tr>
 			<td width="1%" nowrap><label for="usernametf"><fmt:message key="user.create.username" />:</label> *</td>
 			<td width="99%">
-				<input type="text" name="username" size="30" maxlength="75" value="<%= ((username!=null) ? username : "") %>"
+				<input type="text" name="username" size="30" maxlength="75" value="<%= ((username!=null) ? StringUtils.escapeForXML(username) : "") %>"
 				 id="usernametf" autocomplete="off">
 			</td>
 		</tr>
 		<tr>
 			<td width="1%" nowrap><label for="nametf"><fmt:message key="user.create.name" />:</label> <%= UserManager.getUserProvider().isNameRequired() ? "*" : "" %></td>
 			<td width="99%">
-				<input type="text" name="name" size="30" maxlength="75" value="<%= ((name!=null) ? name : "") %>"
+				<input type="text" name="name" size="30" maxlength="75" value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>"
 				 id="nametf">
 			</td>
 		</tr>
 		<tr>
 			<td width="1%" nowrap>
 				<label for="emailtf"><fmt:message key="user.create.email" />:</label> <%= UserManager.getUserProvider().isEmailRequired() ? "*" : "" %></td>
 			<td width="99%">
-				<input type="text" name="email" size="30" maxlength="75" value="<%= ((email!=null) ? email : "") %>"
+				<input type="text" name="email" size="30" maxlength="75" value="<%= ((email!=null) ? StringUtils.escapeForXML(email) : "") %>"
 				 id="emailtf">
 			</td>
 		</tr>
 		<tr>
 			<td nowrap>
@@ -297,6 +297,6 @@ if (UserManager.getUserProvider().isReadOnly()) { %>
   disable();
 </script>
     <% } %>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-delete.jsp b/src/web/user-delete.jsp
index 31331eb95..c5b61b90b 100644
--- a/src/web/user-delete.jsp
+++ b/src/web/user-delete.jsp
@@ -22,10 +22,11 @@
                  org.jivesoftware.openfire.user.User"
     errorPage="error.jsp"
 %>
 <%@ page import="org.jivesoftware.openfire.user.UserManager" %>
 <%@ page import="org.jivesoftware.util.ParamUtils" %>
+<%@ page import="org.jivesoftware.util.StringUtils" %>
 <%@ page import="org.xmpp.packet.JID" %>
 <%@ page import="org.xmpp.packet.StreamError" %>
 <%@ page import="java.net.URLEncoder" %>
 
 <%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c" %>
@@ -93,22 +94,22 @@
 </div>
 <% } %>
 
 <p>
 <fmt:message key="user.delete.info" />
-<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(user.getUsername()) %></a></b>
+<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a></b>
 <fmt:message key="user.delete.info1" />
 </p>
 
 <c:if test="${webManager.user.username == param.username}">
     <p class="jive-warning-text">
     <fmt:message key="user.delete.warning" /> <b><fmt:message key="user.delete.warning2" /></b> <fmt:message key="user.delete.warning3" />
     </p>
 </c:if>
 
 <form action="user-delete.jsp">
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
 <input type="submit" name="delete" value="<fmt:message key="user.delete.delete" />">
 <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 </form>
 
 <%  // Disable the form if a read-only user provider.
diff --git a/src/web/user-edit-form.jsp b/src/web/user-edit-form.jsp
index 79cbbcd9a..8fcc32d37 100644
--- a/src/web/user-edit-form.jsp
+++ b/src/web/user-edit-form.jsp
@@ -16,10 +16,11 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.openfire.user.*,
                  java.net.URLEncoder"
     errorPage="error.jsp"
 %><%@ page import="org.xmpp.packet.JID"%>
 <%@ page import="org.jivesoftware.openfire.security.SecurityAuditManager" %>
@@ -139,11 +140,11 @@
 <fmt:message key="user.edit.form.info" />
 </p>
 
 <form action="user-edit-form.jsp">
 
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
 <input type="hidden" name="save" value="true">
 
 <fieldset>
     <legend><fmt:message key="user.edit.form.property" /></legend>
     <div>
@@ -152,29 +153,29 @@
         <tr>
             <td class="c1">
                 <fmt:message key="user.create.username" />:
             </td>
             <td>
-                <%= JID.unescapeNode(user.getUsername()) %>
+                <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.create.name" />: <%= UserManager.getUserProvider().isNameRequired() ? "*" : "" %>
             </td>
             <td>
                 <input type="text" size="30" maxlength="150" name="name"
-                 value="<%= user.getName() %>">
+                 value="<%= StringUtils.escapeForXML(user.getName()) %>">
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.create.email" />: <%= UserManager.getUserProvider().isEmailRequired() ? "*" : "" %>
             </td>
             <td>
                 <input type="text" size="30" maxlength="150" name="email"
-                 value="<%= ((user.getEmail()!=null) ? user.getEmail() : "") %>">
+                 value="<%= ((user.getEmail()!=null) ? StringUtils.escapeForXML(user.getEmail()) : "") %>">
             </td>
         </tr>
         <% if (!AdminManager.getAdminProvider().isReadOnly()) { %>
         <tr>
             <td class="c1">
diff --git a/src/web/user-lockout.jsp b/src/web/user-lockout.jsp
index 8b4924d1b..5d50133ac 100644
--- a/src/web/user-lockout.jsp
+++ b/src/web/user-lockout.jsp
@@ -22,10 +22,11 @@
 %>
 <%@ page import="org.jivesoftware.openfire.lockout.LockOutManager" %>
 <%@ page import="org.jivesoftware.openfire.security.SecurityAuditManager" %>
 <%@ page import="org.jivesoftware.openfire.session.ClientSession" %>
 <%@ page import="org.jivesoftware.util.ParamUtils" %>
+<%@ page import="org.jivesoftware.util.StringUtils" %>
 <%@ page import="org.xmpp.packet.JID" %>
 <%@ page import="org.xmpp.packet.StreamError" %>
 <%@ page import="java.net.URLEncoder" %>
 <%@ page import="java.util.Date" %>
 
@@ -131,19 +132,19 @@
         // User is locked out
 %>
 
 <p>
 <fmt:message key="user.lockout.locked">
-    <fmt:param value="<%= "<b><a href='user-properties.jsp?username="+URLEncoder.encode(username, "UTF-8")+"'>"+JID.unescapeNode(username)+"</a></b>" %>"/>
+    <fmt:param value="<%= "<b><a href='user-properties.jsp?username="+URLEncoder.encode(username, "UTF-8")+"'>"+StringUtils.escapeHTMLTags(JID.unescapeNode(username))+"</a></b>" %>"/>
 </fmt:message>
 <% if (flag.getStartTime() != null) { %><fmt:message key="user.lockout.locked2"><fmt:param value="<%= flag.getStartTime().toString() %>"/></fmt:message> <% } %>
 <% if (flag.getStartTime() != null && flag.getEndTime() != null) { %> <fmt:message key="user.lockout.lockedand" /> <% } %> 
 <% if (flag.getEndTime() != null) { %><fmt:message key="user.lockout.locked3"><fmt:param value="<%= flag.getEndTime().toString() %>"/></fmt:message> <% } %>
 </p>
 
 <form action="user-lockout.jsp">
-    <input type="hidden" name="username" value="<%= username %>">
+    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
     <input type="submit" name="unlock" value="<fmt:message key="user.lockout.unlock" />">
     <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 </form>
 
 <%
@@ -152,11 +153,11 @@
         // User is not locked out
 %>
 
 <p>
 <fmt:message key="user.lockout.info" />
-<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>"><%= JID.unescapeNode(username) %></a></b>
+<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(username)) %></a></b>
 <fmt:message key="user.lockout.info1" />
 </p>
 
 <c:if test="${webManager.user.username == param.username}">
     <p class="jive-warning-text">
@@ -181,11 +182,11 @@
     <input type="radio" name="duration" value="1440" /> <fmt:message key="user.lockout.time.for" /> <fmt:message key="user.lockout.time.1day" /><br />
     <input type="radio" name="duration" value="10080" /> <fmt:message key="user.lockout.time.for" /> <fmt:message key="user.lockout.time.1week" /><br />
     <input type="radio" name="duration" value="-2" /> <fmt:message key="user.lockout.time.for" /> <input type="text" size="5" maxlength="10" name="duration_custom" /> <fmt:message key="user.lockout.time.minutes"/><br />
     <br />
     <% } %>
-    <input type="hidden" name="username" value="<%= username %>">
+    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
     <input type="submit" name="lock" value="<fmt:message key="user.lockout.lock" />">
     <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 </form>
 
 <%
diff --git a/src/web/user-message.jsp b/src/web/user-message.jsp
index de087fde0..ee7c71f90 100644
--- a/src/web/user-message.jsp
+++ b/src/web/user-message.jsp
@@ -17,10 +17,11 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  org.jivesoftware.openfire.SessionManager,
                  org.jivesoftware.openfire.session.ClientSession,
                  org.jivesoftware.openfire.user.User,
                  org.xmpp.packet.JID,
                  java.net.URLEncoder,
@@ -167,11 +168,11 @@ function updateSelect(el) {
 }
 </script>
 
 <form action="user-message.jsp" method="post" name="f">
 <% if(username != null){ %>
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
 <% } %>
 <input type="hidden" name="tabs" value="<%= tabs %>">
 <input type="hidden" name="send" value="true">
 <%  if (sess != null) { %>
 
@@ -274,6 +275,6 @@ function updateSelect(el) {
 document.f.message.focus();
 </script>
 
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-password.jsp b/src/web/user-password.jsp
index c341c8f68..a5d954ac0 100644
--- a/src/web/user-password.jsp
+++ b/src/web/user-password.jsp
@@ -130,11 +130,11 @@
 <p>
 <fmt:message key="user.password.info" />
 </p>
 
 <form action="user-password.jsp" name="passform" method="post">
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="username" value="<%=StringUtils.escapeForXML(username) %>">
 
 <fieldset>
     <legend><fmt:message key="user.password.change" /></legend>
     <div>
     <table cellpadding="3" cellspacing="0" border="0" width="100%">
@@ -142,11 +142,11 @@
         <tr>
             <td class="c1">
                 <fmt:message key="user.create.username" />:
             </td>
             <td class="c2">
-                <%= JID.unescapeNode(user.getUsername()) %>
+                <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.password.new_pwd" />:
diff --git a/src/web/user-properties.jsp b/src/web/user-properties.jsp
index 8b2ab9f7d..dcc56e864 100644
--- a/src/web/user-properties.jsp
+++ b/src/web/user-properties.jsp
@@ -26,10 +26,11 @@
     errorPage="error.jsp"
 %>
 <%@ page import="org.jivesoftware.util.JiveGlobals"%>
 <%@ page import="org.jivesoftware.util.LocaleUtils"%>
 <%@ page import="org.jivesoftware.util.ParamUtils"%>
+<%@ page import="org.jivesoftware.util.StringUtils"%>
 <%@ page import="org.xmpp.packet.JID"%><%@ page import="org.xmpp.packet.Presence"%>
 <%@ page import="java.net.URLEncoder" %>
 <%@ page import="java.util.Collection" %>
 <%@ page import="org.jivesoftware.util.StringUtils" %>
 
@@ -183,11 +184,11 @@
     <tr>
         <td class="c1">
             <fmt:message key="user.create.username" />:
         </td>
         <td>
-            <%= JID.unescapeNode(user.getUsername()) %>
+            <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
             <% if (lockedOut) { %><img src="/images/forbidden-16x16.gif" align="top" height="16" width="16" alt="<fmt:message key='user.properties.locked'/>" title="<fmt:message key='user.properties.locked'/>"/><% } %>
             <% if (pendingLockOut) { %><img src="/images/warning-16x16.gif" align="top" height="16" width="16" alt="<fmt:message key='user.properties.locked_set'/>" title="<fmt:message key='user.properties.locked_set'/>"/><% } %>
         </td>
     </tr>
     <tr>
@@ -239,11 +240,11 @@
                 <span style="color:#999">
                 <i><fmt:message key="user.properties.not_set" /></i>
                 </span>
 
             <%  } else { %>
-                <%= user.getName() %>
+                <%= StringUtils.escapeHTMLTags(user.getName()) %>
 
             <%  } %>
         </td>
     </tr>
     <tr>
@@ -255,11 +256,11 @@
                 <span style="color:#999">
                 <i><fmt:message key="user.properties.not_set" /></i>
                 </span>
 
             <%  } else { %>
-                <a href="mailto:<%= user.getEmail() %>"><%= user.getEmail() %></a>
+                <a href="mailto:<%= StringUtils.escapeForXML(user.getEmail()) %>"><%= StringUtils.escapeHTMLTags(user.getEmail()) %></a>
 
             <%  } %>
             &nbsp;
         </td>
     </tr>
@@ -304,13 +305,13 @@
 <br><br>
 
 <% if (user != null && !UserManager.getUserProvider().isReadOnly()) { %>
 
 <form action="user-edit-form.jsp">
-<input type="hidden" name="username" value="<%= user.getUsername() %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(user.getUsername()) %>">
 <input type="submit" value="<fmt:message key="global.edit_properties" />">
 </form>
 
 <% } %>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-roster-add.jsp b/src/web/user-roster-add.jsp
index 3ed322b89..4b5f77895 100644
--- a/src/web/user-roster-add.jsp
+++ b/src/web/user-roster-add.jsp
@@ -105,11 +105,11 @@
     </head>
     <body>
 
 <p>
     <fmt:message key="user.roster.add.info">
-        <fmt:param value="<%= username %>"/>
+        <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
     </fmt:message>
 </p>
 
 <%--<c:set var="submit" value="${param.create}"/>--%>
 <%--<c:set var="errors" value="${errors}"/>--%>
@@ -154,39 +154,39 @@
 
 <%  } %>
 
 <form name="f" action="user-roster-add.jsp" method="get">
 
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
 
     <div class="jive-contentBoxHeader">
 		<fmt:message key="user.roster.add.new_item" />
 	</div>
 	<div class="jive-contentBox">
 		<table cellpadding="3" cellspacing="0" border="0">
 		<tbody>
 		<tr>
 			<td width="1%" nowrap><label for="jidtf"><fmt:message key="user.roster.jid" />:</label> *</td>
 			<td width="99%">
-				<input type="text" name="jid" size="30" maxlength="255" value="<%= ((jid!=null) ? jid : "") %>"
+				<input type="text" name="jid" size="30" maxlength="255" value="<%= ((jid!=null) ? StringUtils.escapeForXML(jid) : "") %>"
 				 id="jidtf">
 			</td>
 		</tr>
 		<tr>
 			<td width="1%" nowrap>
 				<label for="nicknametf"><fmt:message key="user.roster.nickname" />:</label>
 			</td>
 			<td width="99%">
-				<input type="text" name="nickname" size="30" maxlength="255" value="<%= ((nickname!=null) ? nickname : "") %>"
+				<input type="text" name="nickname" size="30" maxlength="255" value="<%= ((nickname!=null) ? StringUtils.escapeForXML(nickname) : "") %>"
 				 id="nicknametf">
 			</td>
 		</tr>
 		<tr>
 			<td width="1%" nowrap>
 				<label for="groupstf"><fmt:message key="user.roster.groups" />:</label></td>
 			<td width="99%">
-				<input type="text" name="groups" size="30" maxlength="255" value="<%= ((groups!=null) ? groups : "") %>"
+				<input type="text" name="groups" size="30" maxlength="255" value="<%= ((groups!=null) ? StringUtils.escapeForXML(groups) : "") %>"
 				 id="groupstf">
 			</td>
 		</tr>
 		<tr>
 
@@ -209,6 +209,6 @@
     <script language="JavaScript" type="text/javascript">
     document.f.jid.focus();
     </script>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-roster-delete.jsp b/src/web/user-roster-delete.jsp
index 015571997..adec36e8a 100644
--- a/src/web/user-roster-delete.jsp
+++ b/src/web/user-roster-delete.jsp
@@ -65,18 +65,18 @@
     </head>
     <body>
 
     <p>
     <fmt:message key="user.roster.delete.info">
-        <fmt:param value="<%= "<b>"+jid+"</b>" %>" />
-        <fmt:param value="<%= "<b>"+username+"</b>" %>" />
+        <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(jid)+"</b>" %>" />
+        <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(username)+"</b>" %>" />
     </fmt:message>
     </p>
 
     <form action="user-roster-delete.jsp">
-    <input type="hidden" name="username" value="<%= username %>">
-    <input type="hidden" name="jid" value="<%= jid %>">
+    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
+    <input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
     <input type="submit" name="delete" value="<fmt:message key="user.roster.delete.delete" />">
     <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
     </form>
 
     </body>
diff --git a/src/web/user-roster-edit.jsp b/src/web/user-roster-edit.jsp
index 81fd2f850..3ed274bfc 100644
--- a/src/web/user-roster-edit.jsp
+++ b/src/web/user-roster-edit.jsp
@@ -16,10 +16,11 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  java.net.URLEncoder"
     errorPage="error.jsp"
 %><%@ page import="org.xmpp.packet.JID"%>
 <%@ page import="org.jivesoftware.openfire.roster.Roster" %>
 <%@ page import="org.jivesoftware.openfire.roster.RosterItem" %>
@@ -83,18 +84,18 @@
     </head>
     <body>
 
 <p>
 <fmt:message key="user.roster.edit.info">
-    <fmt:param value="<%= username %>"/>
+    <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
 </fmt:message>
 </p>
 
 <form action="user-roster-edit.jsp">
 
-<input type="hidden" name="username" value="<%= username %>">
-<input type="hidden" name="jid" value="<%= jid %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
+<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
 <input type="hidden" name="save" value="true">
 
 <fieldset>
     <legend><fmt:message key="user.roster.item.settings" /></legend>
     <div>
@@ -103,20 +104,20 @@
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.jid" />:
             </td>
             <td>
-                <%= jid %>
+                <%= StringUtils.escapeHTMLTags(jid) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.nickname" />:
             </td>
             <td>
                 <input type="text" size="30" maxlength="150" name="nickname"
-                 value="<%= item.getNickname() %>">
+                 value="<%= StringUtils.escapeForXML(item.getNickname()) %>">
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.groups" />:
@@ -129,11 +130,11 @@
                     int count = 0;
                     for (String group : groupList) {
                         if (count != 0) {
                             out.print(",");
                         }
-                        out.print(group);
+                        out.print(StringUtils.escapeForXML(group));
                         count++;
                     }
                 }
                   %>">
             </td>
@@ -150,11 +151,11 @@
                     for (Group group : sharedGroups) {
                         if (count != 0) {
                             out.print(",");
                         }
                         out.print("<a href='group-edit.jsp?group="+URLEncoder.encode(group.getName(), "UTF-8")+"'>");
-                        out.print(group.getName());
+                        out.print(StringUtils.escapeForXML(group.getName()));
                         out.print("</a>");
                         count++;
                     }
                 }
                 else {
@@ -188,6 +189,6 @@
 <input type="submit" name="cancel" value="<fmt:message key="global.cancel" />">
 
 </form>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-roster-view.jsp b/src/web/user-roster-view.jsp
index 5155623c5..cb0254a19 100644
--- a/src/web/user-roster-view.jsp
+++ b/src/web/user-roster-view.jsp
@@ -16,10 +16,11 @@
   - See the License for the specific language governing permissions and
   - limitations under the License.
 --%>
 
 <%@ page import="org.jivesoftware.util.ParamUtils,
+                 org.jivesoftware.util.StringUtils,
                  java.net.URLEncoder"
     errorPage="error.jsp"
 %><%@ page import="org.xmpp.packet.JID"%>
 <%@ page import="org.jivesoftware.openfire.roster.Roster" %>
 <%@ page import="org.jivesoftware.openfire.roster.RosterItem" %>
@@ -82,11 +83,11 @@
     </head>
     <body>
 
 <p>
 <fmt:message key="user.roster.edit.info">
-    <fmt:param value="<%= username %>"/>
+    <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
 </fmt:message>
 </p>
 
 <fieldset>
     <legend><fmt:message key="user.roster.item.settings" /></legend>
@@ -96,19 +97,19 @@
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.jid" />:
             </td>
             <td>
-                <%= jid %>
+                <%= StringUtils.escapeHTMLTags(jid) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.nickname" />:
             </td>
             <td>
-                <%= item.getNickname() %>
+                <%= StringUtils.escapeHTMLTags(item.getNickname()) %>
             </td>
         </tr>
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.groups" />:
@@ -120,11 +121,11 @@
                         int count = 0;
                         for (String group : groupList) {
                             if (count != 0) {
                                 out.print(",");
                             }
-                            out.print(group);
+                            out.print(StringUtils.escapeForXML(group));
                             count++;
                         }
                     }
                     else {
                         out.print("<i>None</i>");
@@ -144,11 +145,11 @@
                         for (Group group : sharedGroups) {
                             if (count != 0) {
                                 out.print(",");
                             }
                             out.print("<a href='group-edit.jsp?group="+URLEncoder.encode(group.getName(), "UTF-8")+"'>");
-                            out.print(group.getName());
+                            out.print(StringUtils.escapeForXML(group.getName()));
                             out.print("</a>");
                             count++;
                         }
                     }
                     else {
@@ -160,31 +161,31 @@
         <tr>
             <td class="c1">
                 <fmt:message key="user.roster.subscription" />:
             </td>
             <td>
-                <%= item.getSubStatus().getName() %>
+                <%= StringUtils.escapeHTMLTags(item.getSubStatus().getName()) %>
             </td>
         </tr>
     </tbody>
     </table>
     </div>
 </fieldset>
 
 <br><br>
 
 <form style="display: inline" action="user-roster-edit.jsp">
-<input type="hidden" name="jid" value="<%= jid %>">
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
 <input type="submit" value="<fmt:message key="user.roster.edit" />">
 </form>
 
 <% if (sharedGroups.isEmpty()) { %>
 <form style="display: inline" action="user-roster-delete.jsp">
-<input type="hidden" name="jid" value="<%= jid %>">
-<input type="hidden" name="username" value="<%= username %>">
+<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
+<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
 <input type="submit" value="<fmt:message key="global.delete" />">
 </form>
 <% } %>
 
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-roster.jsp b/src/web/user-roster.jsp
index 3fc4608d9..7ce359670 100644
--- a/src/web/user-roster.jsp
+++ b/src/web/user-roster.jsp
@@ -147,11 +147,11 @@
 
     <%  } %>
 
 <p>
 <fmt:message key="user.roster.info">
-    <fmt:param value="<%= "<b>"+JID.unescapeNode(username)+"</b>" %>" />
+    <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(JID.unescapeNode(username))+"</b>" %>" />
 </fmt:message>
 </p>
 
 <p style="margin-bottom: 2px">
 <fmt:message key="user.roster.total_items" />:
@@ -296,11 +296,11 @@
             <a href="user-roster-view.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>&jid=<%= URLEncoder.encode(rosterItem.getJid().toString(), "UTF-8") %>"
              title="<fmt:message key="user.roster.click_view" />"
              ><%= rosterItem.getJid() %></a>
         </td>
         <td>
-            <%= (rosterItem.getNickname() != null ? rosterItem.getNickname() : "<i>None</i>") %>
+            <%= (rosterItem.getNickname() != null ? StringUtils.escapeHTMLTags(rosterItem.getNickname()) : "<i>None</i>") %>
         </td>
         <td>
             <%
                 List<String> groups = rosterItem.getGroups();
                 int count = 0;
@@ -361,6 +361,6 @@
 </div>
 
 <br><br>
     
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/web/user-search.jsp b/src/web/user-search.jsp
index 252f5f1a5..093b27ee3 100644
--- a/src/web/user-search.jsp
+++ b/src/web/user-search.jsp
@@ -63,11 +63,11 @@
     <legend><fmt:message key="user.search.search_user" /></legend>
     <table cellpadding="3" cellspacing="1" border="0" width="600">
       <tr class="c1">
         <td width="1%" nowrap><fmt:message key="user.create.username" />:</td>
         <td class="c2">
-          <input type="text" name="username" value="<%= ((username!=null) ? username : "") %>" size="30" maxlength="75"/>
+          <input type="text" name="username" value="<%= ((username!=null) ? StringUtils.escapeForXML(username) : "") %>" size="30" maxlength="75"/>
         </td>
       </tr>
      <tr><td colspan="2" nowrap><input type="submit" name="search" value="<fmt:message key="user.search.search" />"/><input type="submit" name="cancel" value="<fmt:message key="global.cancel" />"/></td>
      </tr>
     </table>
diff --git a/src/web/user-summary.jsp b/src/web/user-summary.jsp
index b39019112..b241f2978 100644
--- a/src/web/user-summary.jsp
+++ b/src/web/user-summary.jsp
@@ -228,17 +228,17 @@
                 <img src="images/user-clear-16x16.gif" width="16" height="16" border="0" alt="<fmt:message key="user.properties.offline" />">
 
             <%  } %>
         </td>
         <td width="23%">
-            <a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= JID.unescapeNode(user.getUsername()) %></a>
+            <a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a>
             <% if (isAdmin) { %><img src="/images/star-16x16.gif" height="16" width="16" align="top" alt="<fmt:message key='user.properties.isadmin'/>" title="<fmt:message key='user.properties.isadmin'/>"/><% } %>
             <% if (lockedOut) { %><img src="/images/forbidden-16x16.gif" height="16" width="16" align="top" alt="<fmt:message key='user.properties.locked'/>" title="<fmt:message key='user.properties.locked'/>"/><% } %>
             <% if (pendingLockOut) { %><img src="/images/warning-16x16.gif" height="16" width="16" align="top" alt="<fmt:message key='user.properties.locked_set'/>" title="<fmt:message key='user.properties.locked_set'/>"/><% } %>
         </td>
         <td width="33%">
-            <%= user.getName() %> &nbsp;
+            <%= StringUtils.escapeHTMLTags(user.getName()) %> &nbsp;
         </td>
         <td width="15%">
             <%= JiveGlobals.formatDate(user.getCreationDate()) %>
         </td>
         <td width="25%">

Vulnerable code:                    org.jivesoftware.openfire.XMPPServer,
                   org.jivesoftware.openfire.audit.AuditManager,
							 value="<%= ((logDir != null) ? logDir : "") %>">
							<textarea name="ignore" cols="40" rows="3" wrap="virtual"><%= ((ignore != null) ? ignore : "") %></textarea>
</html>
                                       org.jivesoftware.openfire.container.Plugin"
        <img src="<%= plugin.getIcon() %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? pluginName : "") %> &nbsp;
        <a href="<%= plugin.getReadme() %>"
        <a href="<%= plugin.getChangelog() %>"
        <%= pluginDescription != null ? pluginDescription : "" %>
        <%= pluginVersion != null ? pluginVersion : "" %>
        <%= pluginAuthor != null ? pluginAuthor : "" %>  &nbsp;
        <%= fileSize %>
        <a href="javascript:downloadPlugin('<%=updateURL%>', '<%= plugin.hashCode()%>')"><span id="<%= plugin.hashCode() %>-image"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= plugin.getIcon()%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= plugin.getName()%> <fmt:message key="plugin.available.installation.success" /></td>
        <img src="<%= plugin.getIcon() %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? pluginName : "") %> &nbsp;
        <a href="<%= plugin.getReadme() %>"
        <a href="<%= plugin.getChangelog() %>"
        <%= pluginDescription != null ? pluginDescription : "" %>
        <%= pluginVersion != null ? pluginVersion : "" %>
        <%= pluginAuthor != null ? pluginAuthor : "" %>  &nbsp;
        <%= fileSize  %>
        <span id="<%= plugin.hashCode() %>-image"><a href="javascript:downloadPlugin('<%=updateURL%>', '<%= plugin.hashCode()%>')"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= plugin.getIcon()%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= plugin.getName()%> <fmt:message key="plugin.available.installation.success" /></td>
                <%= pluginDescription %>
                <%= pluginVersion%>
                <%= pluginAuthor%>
</html>
            <%= cs.getHostAddress() %>
            <%= cs.getHostName() %>
            <%= cs.getHostAddress() %>
            <%= cs.getHostName() %>
</html>
            <%= componentSession.getExternalComponent().getName() %>
            <%= componentSession.getExternalComponent().getCategory() %>
            <%= componentSession.getExternalComponent().getType() %>
            <%= componentSession.getHostAddress() %>
            <%= componentSession.getHostName() %>
</html>
            <%= componentSession.getExternalComponent().getName() %>
            <%= componentSession.getExternalComponent().getCategory() %>
            <td><%= componentSession.getExternalComponent().getType() %></td>
</html>
<%= sout.toString() %>
<%  } %>
                 java.util.Collection"
                <fmt:message key="component.settings.modification.denied" /> <%= operationFailedDetail != null ? operationFailedDetail : ""%>
							 value="<%= ((defaultSecret != null) ? defaultSecret : "") %>">
					<%= configuration.getSubdomain() %>
					<a href="#" onclick="if (confirm('<fmt:message key="component.settings.confirm_delete" />')) { location.replace('external-components-settings.jsp?deleteConf=<%= configuration.getSubdomain() %>'); } "
    <input type="hidden" name="group" value="<%= groupName %>" id="existingName">
             value="<%= ((name != null) ? name : "") %>" id="gname">
             ><%= ((description != null) ? description : "") %></textarea>
</html>%>
<input type="hidden" name="group" value="<%= groupName %>">
</html>
        <%= errorBuf %>
<input type="hidden" name="group" value="<%= groupName %>"/>
	               <input type="text" name="groupDisplayName" size="30" maxlength="100" value="<%= (groupDisplayName != null ? groupDisplayName : "") %>"><br>
        <input type="hidden" name="group" value="<%= groupName %>">
        <input type="hidden" name="group" value="<%= groupName %>">
                    <td><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(user.getUsername()) %></a><% if (!isLocal) { showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font><%}%></td>
%>
            <a href="group-edit.jsp?group=<%= groupName %>"><%= StringUtils.escapeHTMLTags(group.getName()) %></a>
            <a href="group-edit.jsp?group=<%= groupName %>"
            <a href="group-delete.jsp?group=<%= groupName %>"
</html>
                                <input id="CORSDomains" type="text" size="80" name="CORSDomains" value="<%= serverManager.getCORSAllowOrigin() %>">
                                <input id="XFFHeader" type="text" size="40" name="XFFHeader"  value="<%= xffHeader == null ? "" : xffHeader %>">
                                <input id="XFFServerHeader" type="text" size="40" name="XFFServerHeader" value="<%= xffServerHeader == null ? "" : xffServerHeader %>">
                                <input id="XFFHostHeader" type="text" size="40" name="XFFHostHeader" value="<%= xffHostHeader == null ? "" : xffHostHeader %>">
                                <input id="XFFHostName" type="text" size="40" name="XFFHostName" value="<%= xffHostName == null ? "" : xffHostName %>">
</html>
              <fmt:message key="ssl.certificates.error_messenge" />: <%= e.getMessage() %>
    <title><%= log %></title>
</html>
    <input type="hidden" name="url" value="<%= url %>">
<input type="hidden" name="log" value="<%= log %>">
                <td nowrap><b><%= logFile.getName() %></b> (<%= byteFormatter.format(logFile.length()) %>)</td>
<iframe src="log.jsp?log=<%= log %>&mode=<%= mode %>&lines=<%= ("All".equals(numLinesParam) ? "All" : String.valueOf(numLines)) %>"
</html>
								 value="<%= ((proxyHost != null) ? proxyHost : "") %>">
                    <%=proxySession.getCreator()%>
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
    <input type="hidden" name="mucname" value="<%= mucname %>" />
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
</html>
                    <%= userDisplay %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=owner"
                    <%= userDisplay %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=admin"
                    <%= userDisplay %><%=  nickname %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=member"
                    <%= userDisplay %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=outcast"
<b><a href="muc-room-edit-form.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>"><%= room.getJID().toBareJID() %></a></b>
<input type="hidden" name="roomJID" value="<%= roomJID.toBareJID() %>">
                <%= room.getJID().toBareJID() %>
</html>
            <td><%= room.getName() %></td>
    <input type="hidden" name="roomJID" value="<%= roomJID.toBareJID() %>">
                    <td><input type="text" name="roomName" value="<%= roomName %>">
                        <option value="<%= service.getServiceDomain() %>"<%= service.getServiceDomain().equals(mucName) ? " selected='selected'" : "" %>><%= service.getServiceDomain() %></option>
                                out.print("<input type='hidden' name='mucName' value='"+service.getServiceDomain()+"'/>"+service.getServiceDomain());
                   <td><%= roomJID.getDomain() %></td>
                    <td><input type="text" name="roomconfig_roomname" value="<%= (naturalName == null ? "" : naturalName) %>">
                    <td><input name="roomconfig_roomdesc" value="<%= (description == null ? "" : description) %>" type="text" size="40">
                    <td><input name="room_topic" value="<%= (roomSubject == null ? "" : roomSubject) %>" type="text" size="40">
                 java.text.DateFormat,
                 java.util.List"
        List<MUCRole> roles = room.getOccupantsByNickname(nickName);
        if (roles != null && roles.size() > 0) {
            	for (MUCRole role : roles) {
                    room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), "");
            	}
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+
                	"&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletesuccess=true");
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+
                	"&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletefailed=true");
                <fmt:param value="<%= nickName %>"/>
                <fmt:param value="<%= nickName %>"/>
            <td><%= room.getName() %></td>
            <td><%= role.getUserAddress() %></td>
            <td><%= role.getNickname() %></td>
            <td><%= role.getRole() %></td>
            <td><%= role.getAffiliation() %></td>
<a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucService.getServiceName(), "UTF-8")%>"><%= mucService.getServiceDomain() %></a>
    <option value="<%= service.getServiceName() %>"<%= mucService.getServiceName().equals(service.getServiceName()) ? " selected='selected'" : "" %>><%= service.getServiceDomain() %></option>
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : mucname %>&start=<%= (i*range) %>"
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : mucname %>&start=<%= (i*range) %>"
</html>
<b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
<input type="hidden" name="mucname" value="<%= mucname %>">
                <%= mucname %>
</html>
<%@ page import="org.jivesoftware.util.ParamUtils,
<input type="hidden" name="mucname" value="<%= mucname %>">
                    <input type="text" size="30" maxlength="150" name="mucname" value="<%= (mucname != null ? mucname : "") %>">
                    <%= mucname %>
                    <input type="text" size="30" maxlength="150" name="mucdesc" value="<%= (mucdesc != null ? mucdesc : "") %>">
</html>
                 org.jivesoftware.util.ParamUtils"
            <a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(service.getServiceName(), "UTF-8") %>"><%= JID.unescapeNode(service.getServiceName()) %></a>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
		<input type="text" name="userJID" size="30" maxlength="100" value="<%= (userJID != null ? userJID : "") %>"
							<%= userDisplay %>
							<a href="muc-sysadmins.jsp?userJID=<%= user.toString() %>&delete=true&mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
    <input type="hidden" name="mucname" value="<%= mucname %>" />
</html>
    <input type="text" size="30" maxlength="150" name="username" value="<%= username != null ? username : "" %>"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(event.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(event.getUsername()) %></a>
                <span title="<%= StringUtils.escapeHTMLTags(n) %>">
                <input type="hidden" name="propName" value="<%= StringUtils.escapeHTMLTags(propName) %>">
                <input type="text" name="propName" size="40" maxlength="100" value="<%= (propName != null ? StringUtils.escapeHTMLTags(propName) : "") %>">
</html>
            <td width="1%" ><img src="getFavicon?host=<%=host%>" width="16" height="16" alt=""></td>
            <td><a href="server-session-details.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"><%= host %></a></td>
</tr>
            <%= StringUtils.escapeForXML(address.toString()) %>
                <i> <fmt:message key="session.details.anonymous" /> </i> - <%= address.getResource()==null?"":StringUtils.escapeForXML(address.getResource()) %>
                <a href="user-properties.jsp?username=<%= URLEncoder.encode(n, "UTF-8") %>"><%= JID.unescapeNode(n) %></a>
                    statusTxt = " -- " + StringUtils.escapeForXML(statusTxt);
</html>
        <%= StringUtils.escapeForXML(sess.getAddress().getResource()) %>
                <%= _stat %>
                <%= sess.getPresence().getStatus() %>
                <%= sess.getPresence().getStatus() %>
</tr>
</html>
              <%= identities.toString() %> (<%= a %>)
              <a href="ssl-certificates.jsp?alias=<%= a %>&type=server&delete=true"
      <input name="alias" type="hidden" value="<%= a%>">
                               value="<%= ((name!=null) ? name : "") %>" id="namef">
                        <input type="text" name="ou" size="50" maxlength="75" value="<%= ((organizationalUnit!=null) ? organizationalUnit : "") %>" id="ouf">
                        <input type="text" name="o" size="50" maxlength="75" value="<%= ((organization!=null) ? organization : "") %>" id="of">
                        <input type="text" name="city" size="50" maxlength="75" value="<%= ((city!=null) ? city : "") %>" id="cityf">
                        <input type="text" name="state" size="30" maxlength="75" value="<%= ((state!=null) ? state : "") %>" id="statef">
                        <input type="text" name="country" size="2" maxlength="2" value="<%= ((countryCode!=null) ? countryCode : "") %>" id="countryf">
</html>
                <td><%= cache.getName() %></td>
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= nodeID %>"
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= nodeID %>">
				<input type="text" name="host" value="<%= (host != null)?host:"" %>" size="40" maxlength="150">
				<input type="text" name="server_username" value="<%= (username != null) ? username : "" %>" size="40" maxlength="150">
</html>
                        (Message: <%= mex.getMessage() %>)
                <%= host %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25)  %>
            <input type="hidden" name="from" value="<%= from %>">
            (<a href="user-edit-form.jsp?username=<%=user.getUsername()%>">Update Address</a>)
            <input type="text" name="to" value="<%= ((to != null) ? to : "") %>"
            <input type="text" name="subject" value="<%= ((subject != null) ? subject : "") %>"
            <textarea name="body" cols="45" rows="5" wrap="virtual"><%= body %></textarea>
</html>
				<input type="text" name="username" size="30" maxlength="75" value="<%= ((username!=null) ? username : "") %>"
				<input type="text" name="name" size="30" maxlength="75" value="<%= ((name!=null) ? name : "") %>"
				<input type="text" name="email" size="30" maxlength="75" value="<%= ((email!=null) ? email : "") %>"
</html>
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(user.getUsername()) %></a></b>
<input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="username" value="<%= username %>">
                <%= JID.unescapeNode(user.getUsername()) %>
                 value="<%= user.getName() %>">
                 value="<%= ((user.getEmail()!=null) ? user.getEmail() : "") %>">
    <fmt:param value="<%= "<b><a href='user-properties.jsp?username="+URLEncoder.encode(username, "UTF-8")+"'>"+JID.unescapeNode(username)+"</a></b>" %>"/>
    <input type="hidden" name="username" value="<%= username %>">
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>"><%= JID.unescapeNode(username) %></a></b>
    <input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="username" value="<%= username %>">
</html>
<input type="hidden" name="username" value="<%= username %>">
                <%= JID.unescapeNode(user.getUsername()) %>
            <%= JID.unescapeNode(user.getUsername()) %>
                <%= user.getName() %>
                <a href="mailto:<%= user.getEmail() %>"><%= user.getEmail() %></a>
<input type="hidden" name="username" value="<%= user.getUsername() %>">
</html>
        <fmt:param value="<%= username %>"/>
<input type="hidden" name="username" value="<%= username %>">
				<input type="text" name="jid" size="30" maxlength="255" value="<%= ((jid!=null) ? jid : "") %>"
				<input type="text" name="nickname" size="30" maxlength="255" value="<%= ((nickname!=null) ? nickname : "") %>"
				<input type="text" name="groups" size="30" maxlength="255" value="<%= ((groups!=null) ? groups : "") %>"
</html>
        <fmt:param value="<%= "<b>"+jid+"</b>" %>" />
        <fmt:param value="<%= "<b>"+username+"</b>" %>" />
    <input type="hidden" name="username" value="<%= username %>">
    <input type="hidden" name="jid" value="<%= jid %>">
    <fmt:param value="<%= username %>"/>
<input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="jid" value="<%= jid %>">
                <%= jid %>
                 value="<%= item.getNickname() %>">
                        out.print(group);
                        out.print(group.getName());
</html>
    <fmt:param value="<%= username %>"/>
                <%= jid %>
                <%= item.getNickname() %>
                            out.print(group);
                            out.print(group.getName());
                <%= item.getSubStatus().getName() %>
<input type="hidden" name="jid" value="<%= jid %>">
<input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="jid" value="<%= jid %>">
<input type="hidden" name="username" value="<%= username %>">
</html>
    <fmt:param value="<%= "<b>"+JID.unescapeNode(username)+"</b>" %>" />
            <%= (rosterItem.getNickname() != null ? rosterItem.getNickname() : "<i>None</i>") %>
</html>
          <input type="text" name="username" value="<%= ((username!=null) ? username : "") %>" size="30" maxlength="75"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= JID.unescapeNode(user.getUsername()) %></a>
            <%= user.getName() %> &nbsp;
Fixed code:                  org.jivesoftware.openfire.XMPPServer,
                 org.jivesoftware.openfire.audit.AuditManager,
                 org.jivesoftware.util.StringUtils,
							 value="<%= ((logDir != null) ? StringUtils.escapeForXML(logDir) : "") %>">
							<textarea name="ignore" cols="40" rows="3" wrap="virtual"><%= ((ignore != null) ? StringUtils.escapeHTMLTags(ignore) : "") %></textarea>
</html>
                                       org.jivesoftware.openfire.container.Plugin,
                                       org.jivesoftware.util.StringUtils"
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon()) %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %> &nbsp;
        <a href="<%= StringUtils.escapeForXML(plugin.getReadme()) %>"
        <a href="<%= StringUtils.escapeForXML(plugin.getChangelog()) %>"
        <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %>
        <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %>
        <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>  &nbsp;
        <%= StringUtils.escapeHTMLTags(fileSize) %>
        <a href="javascript:downloadPlugin('<%=StringUtils.escapeForXML(updateURL)%>', '<%= plugin.hashCode()%>')"><span id="<%= plugin.hashCode() %>-image"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon())%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= StringUtils.escapeHTMLTags(plugin.getName())%> <fmt:message key="plugin.available.installation.success" /></td>
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon()) %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %> &nbsp;
        <a href="<%= StringUtils.escapeForXML(plugin.getReadme()) %>"
        <a href="<%= StringUtils.escapeForXML(plugin.getChangelog()) %>"
        <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %>
        <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %>
        <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>  &nbsp;
        <%= StringUtils.escapeHTMLTags(fileSize)  %>
        <span id="<%= plugin.hashCode() %>-image"><a href="javascript:downloadPlugin('<%=StringUtils.escapeForXML(updateURL) %>', '<%= plugin.hashCode() %>')"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon())%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= StringUtils.escapeHTMLTags(plugin.getName())%> <fmt:message key="plugin.available.installation.success" /></td>
                <%= StringUtils.escapeHTMLTags(pluginDescription) %>
                <%= StringUtils.escapeHTMLTags(pluginVersion) %>
                <%= StringUtils.escapeHTMLTags(pluginAuthor) %>
</html>
<%@ page import="org.jivesoftware.util.StringUtils" %>
            <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %>
            <%= StringUtils.escapeHTMLTags(cs.getHostName()) %>
            <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %>
            <%= StringUtils.escapeHTMLTags(cs.getHostName()) %>
</html>
                 org.jivesoftware.util.StringUtils,
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getHostAddress()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getHostName()) %>
</html>
                 org.jivesoftware.util.StringUtils,
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %>
            <td><%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %></td>
</html>
                 org.jivesoftware.util.StringUtils,
<%= StringUtils.escapeHTMLTags(sout.toString()) %>
<%  } %>
                 org.jivesoftware.util.StringUtils,
                 java.util.Collection,
                 java.net.URLEncoder"
                <fmt:message key="component.settings.modification.denied" /> <%= operationFailedDetail != null ? StringUtils.escapeHTMLTags(operationFailedDetail) : ""%>
							 value="<%= ((defaultSecret != null) ? StringUtils.escapeForXML(defaultSecret) : "") %>">
					<%= StringUtils.escapeHTMLTags(configuration.getSubdomain()) %>
					<a href="#" onclick="if (confirm('<fmt:message key="component.settings.confirm_delete" />')) { location.replace('external-components-settings.jsp?deleteConf=<%= URLEncoder.encode(configuration.getSubdomain(),"UTF-8") %>'); } "
                 org.jivesoftware.util.StringUtils,
    <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>" id="existingName">
             value="<%= ((name != null) ? StringUtils.escapeForXML(name) : "") %>" id="gname">
             ><%= ((description != null) ? StringUtils.escapeHTMLTags(description) : "") %></textarea>
</html>%>
<input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
</html>
        <%= StringUtils.escapeHTMLTags(errorBuf.toString()) %>
<input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>"/>
	               <input type="text" name="groupDisplayName" size="30" maxlength="100" value="<%= (groupDisplayName != null ? StringUtils.escapeForXML(groupDisplayName) : "") %>"><br>
        <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
        <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
                    <td><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a><% if (!isLocal) { showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font><%}%></td>
%>
            <a href="group-edit.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"><%= StringUtils.escapeHTMLTags(group.getName()) %></a>
            <a href="group-edit.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"
            <a href="group-delete.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"
</html>
<%@ page import="org.jivesoftware.util.StringUtils" %>
                                <input id="CORSDomains" type="text" size="80" name="CORSDomains" value="<%= StringUtils.escapeForXML(serverManager.getCORSAllowOrigin()) %>">
                                <input id="XFFHeader" type="text" size="40" name="XFFHeader"  value="<%= xffHeader == null ? "" : StringUtils.escapeForXML(xffHeader) %>">
                                <input id="XFFServerHeader" type="text" size="40" name="XFFServerHeader" value="<%= xffServerHeader == null ? "" : StringUtils.escapeForXML(xffServerHeader) %>">
                                <input id="XFFHostHeader" type="text" size="40" name="XFFHostHeader" value="<%= xffHostHeader == null ? "" : StringUtils.escapeForXML(xffHostHeader) %>">
                                <input id="XFFHostName" type="text" size="40" name="XFFHostName" value="<%= xffHostName == null ? "" : StringUtils.escapeForXML(xffHostName) %>">
</html>
                org.jivesoftware.util.StringUtils,
              <fmt:message key="ssl.certificates.error_messenge" />: <%= StringUtils.escapeHTMLTags(e.getMessage()) %>
    <title><%= StringUtils.escapeHTMLTags(log) %></title>
</html>
    <input type="hidden" name="url" value="<%= StringUtils.escapeForXML(url) %>">
                 java.net.URLEncoder,
<input type="hidden" name="log" value="<%= StringUtils.escapeForXML(log) %>">
                <td nowrap><b><%= StringUtils.escapeHTMLTags(logFile.getName()) %></b> (<%= byteFormatter.format(logFile.length()) %>)</td>
<iframe src="log.jsp?log=<%= URLEncoder.encode(log) %>&mode=<%= URLEncoder.encode(mode) %>&lines=<%= ("All".equals(numLinesParam) ? "All" : String.valueOf(numLines)) %>"
</html>
                 org.jivesoftware.util.StringUtils,
								 value="<%= ((proxyHost != null) ? StringUtils.escapeForXML(proxyHost) : "") %>">
<%@ page import="org.jivesoftware.util.StringUtils" %>
                    <%= StringUtils.escapeHTMLTags(proxySession.getCreator())%>
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
</html>
                 org.jivesoftware.util.StringUtils,
                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=owner"
                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=admin"
                    <%= StringUtils.escapeHTMLTags(userDisplay) %><%=  StringUtils.escapeHTMLTags(nickname) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=member"
                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=outcast"
<b><a href="muc-room-edit-form.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %></a></b>
<input type="hidden" name="roomJID" value="<%= StringUtils.escapeForXML(roomJID.toBareJID()) %>">
                <%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %>
</html>
                 org.jivesoftware.util.StringUtils,
            <td><%= StringUtils.escapeHTMLTags(room.getName()) %></td>
    <input type="hidden" name="roomJID" value="<%= StringUtils.escapeForXML(roomJID.toBareJID()) %>">
                    <td><input type="text" name="roomName" value="<%= StringUtils.escapeForXML(roomName) %>">
                        <option value="<%= StringUtils.escapeForXML(service.getServiceDomain()) %>"<%= service.getServiceDomain().equals(mucName) ? " selected='selected'" : "" %>><%= StringUtils.escapeHTMLTags(service.getServiceDomain()) %></option>
                                out.print("<input type='hidden' name='mucName' value='"+StringUtils.escapeForXML(service.getServiceDomain())+"'/>"+StringUtils.escapeHTMLTags(service.getServiceDomain()));
                   <td><%= StringUtils.escapeHTMLTags(roomJID.getDomain()) %></td>
                    <td><input type="text" name="roomconfig_roomname" value="<%= (naturalName == null ? "" : StringUtils.escapeForXML(naturalName)) %>">
                    <td><input name="roomconfig_roomdesc" value="<%= (description == null ? "" : StringUtils.escapeForXML(description)) %>" type="text" size="40">
                    <td><input name="room_topic" value="<%= (roomSubject == null ? "" : StringUtils.escapeForXML(roomSubject)) %>" type="text" size="40">
                 org.jivesoftware.util.StringUtils,
                 java.text.DateFormat"
        MUCRole role = room.getOccupant(nickName);
        if (role != null) {
                room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), "");
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletesuccess=true");
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletefailed=true");
                <fmt:param value="<%= StringUtils.escapeForXML(nickName) %>"/>
                <fmt:param value="<%= StringUtils.escapeForXML(nickName) %>"/>
            <td><%= StringUtils.escapeHTMLTags(room.getName()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getUserAddress().toString()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getNickname().toString()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getRole().toString()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getAffiliation().toString()) %></td>
<a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucService.getServiceName(), "UTF-8")%>"><%= StringUtils.escapeHTMLTags(mucService.getServiceDomain()) %></a>
    <option value="<%= StringUtils.escapeForXML(service.getServiceName()) %>"<%= mucService.getServiceName().equals(service.getServiceName()) ? " selected='selected'" : "" %>><%= StringUtils.escapeHTMLTags(service.getServiceDomain()) %></option>
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : URLEncoder.encode(mucname) %>&start=<%= (i*range) %>"
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : URLEncoder.encode(mucname) %>&start=<%= (i*range) %>"
</html>
<b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
<input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>">
                <%= StringUtils.escapeHTMLTags(mucname) %>
</html>
<%@ page import="org.jivesoftware.util.StringUtils,
                 org.jivesoftware.util.ParamUtils,
<input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>">
                    <input type="text" size="30" maxlength="150" name="mucname" value="<%= (mucname != null ? StringUtils.escapeForXML(mucname) : "") %>">
                    <%= StringUtils.escapeHTMLTags(mucname) %>
                    <input type="text" size="30" maxlength="150" name="mucdesc" value="<%= (mucdesc != null ? StringUtils.escapeForXML(mucdesc) : "") %>">
</html>
                 org.jivesoftware.util.ParamUtils,
                 org.jivesoftware.util.StringUtils"
            <a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(service.getServiceName(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(service.getServiceName())) %></a>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
		<input type="text" name="userJID" size="30" maxlength="100" value="<%= (userJID != null ? StringUtils.escapeForXML(userJID) : "") %>"
							<%= StringUtils.escapeHTMLTags(userDisplay) %>
							<a href="muc-sysadmins.jsp?userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
</html>
    <input type="text" size="30" maxlength="150" name="username" value="<%= username != null ? StringUtils.escapeForXML(username) : "" %>"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(event.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(event.getUsername())) %></a>
                <span title="<%= StringUtils.escapeForXML(n) %>">
                <input type="hidden" name="propName" value="<%= StringUtils.escapeForXML(propName) %>">
                <input type="text" name="propName" size="40" maxlength="100" value="<%= (propName != null ? StringUtils.escapeForXML(propName) : "") %>">
</html>
                 org.jivesoftware.util.StringUtils,
            <td width="1%" ><img src="getFavicon?host=<%=URLEncoder.encode(host, "UTF-8")%>" width="16" height="16" alt=""></td>
            <td><a href="server-session-details.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"><%= StringUtils.escapeHTMLTags(host) %></a></td>
</tr>
                 org.jivesoftware.util.StringUtils,
            <%= StringUtils.escapeHTMLTags(address.toString()) %>
                <i> <fmt:message key="session.details.anonymous" /> </i> - <%= address.getResource()==null?"":StringUtils.escapeHTMLTags(address.getResource()) %>
                <a href="user-properties.jsp?username=<%= URLEncoder.encode(n, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(n)) %></a>
                    statusTxt = " -- " + StringUtils.escapeHTMLTags(statusTxt);
</html>
        <%= StringUtils.escapeHTMLTags(sess.getAddress().getResource()) %>
                <%= StringUtils.escapeHTMLTags(_stat) %>
                <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %>
                <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %>
</tr>
</html>
<%@ page import="java.net.URLEncoder" %>
              <%= StringUtils.escapeHTMLTags(identities.toString()) %> (<%= StringUtils.escapeHTMLTags(a) %>)
              <a href="ssl-certificates.jsp?alias=<%= URLEncoder.encode(a) %>&type=server&delete=true"
      <input name="alias" type="hidden" value="<%= StringUtils.escapeForXML(a)%>">
<%@ page import="org.jivesoftware.util.StringUtils" %>
                               value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>" id="namef">
                        <input type="text" name="ou" size="50" maxlength="75" value="<%= ((organizationalUnit!=null) ? StringUtils.escapeForXML(organizationalUnit) : "") %>" id="ouf">
                        <input type="text" name="o" size="50" maxlength="75" value="<%= ((organization!=null) ? StringUtils.escapeForXML(organization) : "") %>" id="of">
                        <input type="text" name="city" size="50" maxlength="75" value="<%= ((city!=null) ? StringUtils.escapeForXML(city) : "") %>" id="cityf">
                        <input type="text" name="state" size="30" maxlength="75" value="<%= ((state!=null) ? StringUtils.escapeForXML(state) : "") %>" id="statef">
                        <input type="text" name="country" size="2" maxlength="2" value="<%= ((countryCode!=null) ? StringUtils.escapeForXML(countryCode) : "") %>" id="countryf">
</html>
<%@ page import="org.jivesoftware.util.StringUtils"%>
                <td><%= StringUtils.escapeHTMLTags(cache.getName()) %></td>
<%@ page import="java.net.URLEncoder" %>
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= URLEncoder.encode(nodeID) %>"
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= URLEncoder.encode(nodeID) %>">
				<input type="text" name="host" value="<%= (host != null)? StringUtils.escapeForXML(host):"" %>" size="40" maxlength="150">
				<input type="text" name="server_username" value="<%= (username != null) ? StringUtils.escapeForXML(username) : "" %>" size="40" maxlength="150">
</html>
                 java.net.URLEncoder,
                        (Message: <%= StringUtils.escapeHTMLTags(mex.getMessage()) %>)
                <%= StringUtils.escapeHTMLTags(host) %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25)  %>
            <input type="hidden" name="from" value="<%= StringUtils.escapeForXML(from) %>">
            (<a href="user-edit-form.jsp?username=<%= URLEncoder.encode(user.getUsername())%>">Update Address</a>)
            <input type="text" name="to" value="<%= ((to != null) ? StringUtils.escapeForXML(to) : "") %>"
            <input type="text" name="subject" value="<%= ((subject != null) ? StringUtils.escapeForXML(subject) : "") %>"
            <textarea name="body" cols="45" rows="5" wrap="virtual"><%= StringUtils.escapeHTMLTags(body) %></textarea>
</html>
				<input type="text" name="username" size="30" maxlength="75" value="<%= ((username!=null) ? StringUtils.escapeForXML(username) : "") %>"
				<input type="text" name="name" size="30" maxlength="75" value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>"
				<input type="text" name="email" size="30" maxlength="75" value="<%= ((email!=null) ? StringUtils.escapeForXML(email) : "") %>"
</html>
<%@ page import="org.jivesoftware.util.StringUtils" %>
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a></b>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
                 org.jivesoftware.util.StringUtils,
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
                <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
                 value="<%= StringUtils.escapeForXML(user.getName()) %>">
                 value="<%= ((user.getEmail()!=null) ? StringUtils.escapeForXML(user.getEmail()) : "") %>">
<%@ page import="org.jivesoftware.util.StringUtils" %>
    <fmt:param value="<%= "<b><a href='user-properties.jsp?username="+URLEncoder.encode(username, "UTF-8")+"'>"+StringUtils.escapeHTMLTags(JID.unescapeNode(username))+"</a></b>" %>"/>
    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(username)) %></a></b>
    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
                 org.jivesoftware.util.StringUtils,
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
</html>
<input type="hidden" name="username" value="<%=StringUtils.escapeForXML(username) %>">
                <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
<%@ page import="org.jivesoftware.util.StringUtils"%>
            <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
                <%= StringUtils.escapeHTMLTags(user.getName()) %>
                <a href="mailto:<%= StringUtils.escapeForXML(user.getEmail()) %>"><%= StringUtils.escapeHTMLTags(user.getEmail()) %></a>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(user.getUsername()) %>">
</html>
        <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
				<input type="text" name="jid" size="30" maxlength="255" value="<%= ((jid!=null) ? StringUtils.escapeForXML(jid) : "") %>"
				<input type="text" name="nickname" size="30" maxlength="255" value="<%= ((nickname!=null) ? StringUtils.escapeForXML(nickname) : "") %>"
				<input type="text" name="groups" size="30" maxlength="255" value="<%= ((groups!=null) ? StringUtils.escapeForXML(groups) : "") %>"
</html>
        <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(jid)+"</b>" %>" />
        <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(username)+"</b>" %>" />
    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
    <input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
                 org.jivesoftware.util.StringUtils,
    <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
                <%= StringUtils.escapeHTMLTags(jid) %>
                 value="<%= StringUtils.escapeForXML(item.getNickname()) %>">
                        out.print(StringUtils.escapeForXML(group));
                        out.print(StringUtils.escapeForXML(group.getName()));
</html>
                 org.jivesoftware.util.StringUtils,
    <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
                <%= StringUtils.escapeHTMLTags(jid) %>
                <%= StringUtils.escapeHTMLTags(item.getNickname()) %>
                            out.print(StringUtils.escapeForXML(group));
                            out.print(StringUtils.escapeForXML(group.getName()));
                <%= StringUtils.escapeHTMLTags(item.getSubStatus().getName()) %>
<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
</html>
    <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(JID.unescapeNode(username))+"</b>" %>" />
            <%= (rosterItem.getNickname() != null ? StringUtils.escapeHTMLTags(rosterItem.getNickname()) : "<i>None</i>") %>
</html>
          <input type="text" name="username" value="<%= ((username!=null) ? StringUtils.escapeForXML(username) : "") %>" size="30" maxlength="75"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a>
            <%= StringUtils.escapeHTMLTags(user.getName()) %> &nbsp;