- GUI made immune to SQL injection attacks (Alexei)

git-svn-id: svn://svn.zabbix.com/trunk@2600 97f52cf1-0a1b-0410-bd0e-c28be96e8082

18 files changed, 110 insertions, 111 deletions

diff --git a/ChangeLog b/ChangeLog
index 66a74960..787db321 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
 Changes for 1.1beta6:
 
+ - GUI made immune to SQL injection attacks (Alexei)
  - added Check All functionality (Eugene)
  - added support of icon label locations (Alexei)
  - added new column sysmaps.label_location (Alexei)
diff --git a/frontends/php/bulkloader.php b/frontends/php/bulkloader.php
index bc0334bb..c5f35408 100644
--- a/frontends/php/bulkloader.php
+++ b/frontends/php/bulkloader.php
@@ -84,7 +84,7 @@
 				}
 
 				//  Determine which template, if any this host is linked to
-				$sql="select distinct(hostid) from hosts where status<>". HOST_STATUS_DELETED ." and host='$tmpHostTemplate'";
+				$sql="select distinct(hostid) from hosts where status<>". HOST_STATUS_DELETED ." and host='".zbx_ads($tmpHostTemplate)."'";
 				$sqlResult=DBselect($sql);
 				if(DBnum_rows($sqlResult)==1)
 				{
diff --git a/frontends/php/include/actions.inc.php b/frontends/php/include/actions.inc.php
index 9e443b6f..c88c7a65 100644
--- a/frontends/php/include/actions.inc.php
+++ b/frontends/php/include/actions.inc.php
@@ -44,7 +44,7 @@
 //                      return 0;
 //		}
 
-		$sql="insert into actions (userid,delay,nextcheck,subject,message,recipient,maxrepeats,repeatdelay) values ($id,$delay,0,'$subject','$message',$recipient,$maxrepeats,$repeatdelay)";
+		$sql="insert into actions (userid,delay,nextcheck,subject,message,recipient,maxrepeats,repeatdelay) values ($id,$delay,0,'".zbx_ads($subject)."','".zbx_ads($message)."',$recipient,$maxrepeats,$repeatdelay)";
 		$result=DBexecute($sql);
 		return DBinsert_id($result,"actions","actionid");
 	}
@@ -59,7 +59,7 @@
 //                      return 0;
 //		}
 
-		$sql="update actions set userid=$id,delay=$delay,nextcheck=0,subject='$subject',message='$message',recipient=$recipient,maxrepeats=$maxrepeats, repeatdelay=$repeatdelay where actionid=$actionid";
+		$sql="update actions set userid=$id,delay=$delay,nextcheck=0,subject='".zbx_ads($subject)."',message='".zbx_ads($message)."',recipient=$recipient,maxrepeats=$maxrepeats, repeatdelay=$repeatdelay where actionid=$actionid";
 		$result=DBexecute($sql);
 		return $result;
 	}
diff --git a/frontends/php/include/bulkloader.inc.php b/frontends/php/include/bulkloader.inc.php
index c03be61b..7ef22239 100644
--- a/frontends/php/include/bulkloader.inc.php
+++ b/frontends/php/include/bulkloader.inc.php
@@ -28,14 +28,14 @@ include_once    "include/config.inc.php";
 	//  Returns: 0 if unable to create, otherwise it returns the groupID
 	function        create_Host_Group($group)
 	{
-		$result=DBselect("select distinct(groupid) from groups where name='$group'");
+		$result=DBselect("select distinct(groupid) from groups where name='".zbx_ads($group)."'");
 		if(DBnum_rows($result)>0)
 		{
 			$row=DBfetch($result);
 			return $row["groupid"];
 		}
 
-		$result=DBexecute("insert into groups (name) values ('$group')");
+		$result=DBexecute("insert into groups (name) values ('".zbx_ads($group)."')");
 		if($result)
 		{
 			return DBinsert_id($result,"groups","name");
diff --git a/frontends/php/include/config.inc.php b/frontends/php/include/config.inc.php
index db004fbf..f1be42c9 100644
--- a/frontends/php/include/config.inc.php
+++ b/frontends/php/include/config.inc.php
@@ -332,7 +332,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		}
 # default_permission
 
-		$sql="select permission from rights where name='$right' and id!=0 and userid=".$USER_DETAILS["userid"];
+		$sql="select permission from rights where name='".zbx_ads($right)."' and id!=0 and userid=".$USER_DETAILS["userid"];
 		$result=DBselect($sql);
 
 		$all_permissions="";
@@ -422,7 +422,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		}
 # default_permission
 
-		$sql="select permission from rights where name='$right' and id=0 and userid=".$USER_DETAILS["userid"];
+		$sql="select permission from rights where name='".zbx_ads($right)."' and id=0 and userid=".$USER_DETAILS["userid"];
 		$result=DBselect($sql);
 
 		$group_permission="";
@@ -438,7 +438,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		$id_permission="";
 		if($id!=0)
 		{
-			$sql="select permission from rights where name='$right' and id=$id and userid=".$USER_DETAILS["userid"];
+			$sql="select permission from rights where name='".zbx_ads($right)."' and id=$id and userid=".$USER_DETAILS["userid"];
 			$result=DBselect($sql);
 			if(DBnum_rows($result)>0)
 			{
@@ -655,7 +655,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 
 	function	get_image_by_name($imagetype,$name)
 	{
-		$sql="select * from images where imagetype=$imagetype and name='$name'"; 
+		$sql="select * from images where imagetype=$imagetype and name='".zbx_ads($name)."'"; 
 		$result=DBselect($sql);
 		if(DBnum_rows($result) == 1)
 		{
@@ -797,7 +797,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 //			echo $function,"<br>";
 //			echo $parameter,"<br>";
 
-			$sql="select count(*) as cnt from hosts h,items i where h.host='$host' and i.key_='$key' and h.hostid=i.hostid";
+			$sql="select count(*) as cnt from hosts h,items i where h.host='".zbx_ads($host)."' and i.key_='".zbx_ads($key)."' and h.hostid=i.hostid";
 			$result=DBselect($sql);
 			$row=DBfetch($result);
 			if($row["cnt"]!=1)
@@ -973,13 +973,13 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 
 		if(isset($sessionid))
 		{
-			$sql="select u.userid,u.alias,u.name,u.surname,u.lang,u.refresh from sessions s,users u where s.sessionid='$sessionid' and s.userid=u.userid and ((s.lastaccess+u.autologout>".time().") or (u.autologout=0))";
+			$sql="select u.userid,u.alias,u.name,u.surname,u.lang,u.refresh from sessions s,users u where s.sessionid='".zbx_ads($sessionid)."' and s.userid=u.userid and ((s.lastaccess+u.autologout>".time().") or (u.autologout=0))";
 			$result=DBselect($sql);
 			if(DBnum_rows($result)==1)
 			{
 //				setcookie("sessionid",$sessionid,time()+3600);
 				setcookie("sessionid",$sessionid);
-				$sql="update sessions set lastaccess=".time()." where sessionid='$sessionid'";
+				$sql="update sessions set lastaccess=".time()." where sessionid='".zbx_ads($sessionid)."'";
 				DBexecute($sql);
 				$USER_DETAILS=DBfetch($result);
 				return;
@@ -1384,7 +1384,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 //				echo "PARAMETER:$parameter<BR>";
 				$state='';
 		
-				$sql="select i.itemid from items i,hosts h where i.key_='$key' and h.host='$host' and h.hostid=i.hostid";
+				$sql="select i.itemid from items i,hosts h where i.key_='".zbx_ads($key)."' and h.host='".zbx_ads($host)."' and h.hostid=i.hostid";
 #				echo $sql,"<Br>";
 				$res=DBselect($sql);
 				$row=DBfetch($res);
@@ -1392,7 +1392,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 				$itemid=$row["itemid"];
 #				echo "ITEMID:$itemid<BR>";
 	
-				$sql="insert into functions (itemid,triggerid,function,parameter) values ($itemid,$triggerid,'$function','$parameter')";
+				$sql="insert into functions (itemid,triggerid,function,parameter) values ($itemid,$triggerid,'".zbx_ads($function)."','".zbx_ads($parameter)."')";
 #				echo $sql,"<Br>";
 				$res=DBexecute($sql);
 				if(!$res)
@@ -1475,8 +1475,8 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			if($files["image"]["error"]==0)
 			if($files["image"]["size"]<1024*1024)
 			{
-				$image=zbx_ads(fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"])));
-				$sql="insert into images (name,imagetype,image) values ('$name',$imagetype,'$image')";
+				$image=fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"]));
+				$sql="insert into images (name,imagetype,image) values ('".zbx_ads($name)."',$imagetype,'".zbx_ads($image)."')";
 				return	DBexecute($sql);
 			}
 			else
@@ -1499,8 +1499,8 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			if($files["image"]["error"]==0)
 			if($files["image"]["size"]<1024*1024)
 			{
-				$image=zbx_ads(fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"])));
-				$sql="update images set name='$name',imagetype='$imagetype',image='$image' where imageid='$imageid'";
+				$image=fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"]));
+				$sql="update images set name='".zbx_ads($name)."',imagetype='".zbx_ads($imagetype)."',image='".zbx_ads($image)."' where imageid=$imageid";
 				return	DBexecute($sql);
 			}
 			else
@@ -1616,7 +1616,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 
 	function	add_group_to_host($hostid,$newgroup)
 	{
-		$sql="insert into groups (groupid,name) values (NULL,'$newgroup')";
+		$sql="insert into groups (groupid,name) values (NULL,'".zbx_ads($newgroup)."')";
 		$result=DBexecute($sql);
 		if(!$result)
 		{
@@ -1667,7 +1667,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 //			return 0;
 //		}
 
-		$sql="select * from groups where name='$name'";
+		$sql="select * from groups where name='".zbx_ads($name)."'";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -1675,7 +1675,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			return 0;
 		}
 
-		$sql="insert into groups (name) values ('$name')";
+		$sql="insert into groups (name) values ('".zbx_ads($name)."')";
 		$result=DBexecute($sql);
 		if(!$result)
 		{
@@ -1697,7 +1697,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 //			return 0;
 //		}
 
-		$sql="select * from groups where name='$name' and groupid<>$groupid";
+		$sql="select * from groups where name='".zbx_ads($name)."' and groupid<>$groupid";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -1705,7 +1705,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			return 0;
 		}
 
-		$sql="update groups set name='$name' where groupid=$groupid";
+		$sql="update groups set name='".zbx_ads($name)."' where groupid=$groupid";
 		$result=DBexecute($sql);
 		if(!$result)
 		{
@@ -1814,7 +1814,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 	{
 		$ret = 0;
 
-		$sql="select * from media_type where description='".zbx_ads($description)."' and mediatypeid!=".zbx_ads($mediatypeid);
+		$sql="select * from media_type where description='".zbx_ads($description)."' and mediatypeid!=$mediatypeid";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -1822,7 +1822,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		}
 		else
 		{
-			$sql="update media_type set type=".zbx_ads($type).",description='".zbx_ads($description)."',smtp_server='".zbx_ads($smtp_server)."',smtp_helo='".zbx_ads($smtp_helo)."',smtp_email='".zbx_ads($smtp_email)."',exec_path='".zbx_ads($exec_path)."' where mediatypeid=".zbx_ads($mediatypeid);
+			$sql="update media_type set type=$type,description='".zbx_ads($description)."',smtp_server='".zbx_ads($smtp_server)."',smtp_helo='".zbx_ads($smtp_helo)."',smtp_email='".zbx_ads($smtp_email)."',exec_path='".zbx_ads($exec_path)."' where mediatypeid=$mediatypeid";
 			$ret =	DBexecute($sql);
 		}
 		return $ret;
@@ -1839,8 +1839,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			return 0;
 		}
 
-		$description=zbx_ads($description);
-		$sql="select * from media_type where description='$description'";
+		$sql="select * from media_type where description='".zbx_ads($description)."'";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -1848,7 +1847,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		}
 		else
 		{
-			$sql="insert into media_type (type,description,smtp_server,smtp_helo,smtp_email,exec_path) values ($type,'$description','$smtp_server','$smtp_helo','$smtp_email','$exec_path')";
+			$sql="insert into media_type (type,description,smtp_server,smtp_helo,smtp_email,exec_path) values ($type,'".zbx_ads($description)."','".zbx_ads($smtp_server)."','".zbx_ads($smtp_helo)."','".zbx_ads($smtp_email)."','".zbx_ads($exec_path)."')";
 			$ret = DBexecute($sql);
 		}
 		return $ret;
@@ -1864,7 +1863,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		{
 			$s=$s|pow(2,(int)$severity[$i]);
 		}
-		$sql="insert into media (userid,mediatypeid,sendto,active,severity,period) values ($userid,'$mediatypeid','$sendto',$active,$s,'$period')";
+		$sql="insert into media (userid,mediatypeid,sendto,active,severity,period) values ($userid,'".zbx_ads($mediatypeid)."','".zbx_ads($sendto)."',$active,$s,'".zbx_ads($period)."')";
 		return	DBexecute($sql);
 	}
 
@@ -1878,7 +1877,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 		{
 			$s=$s|pow(2,(int)$severity[$i]);
 		}
-		$sql="update media set userid=$userid, mediatypeid=$mediatypeid, sendto='$sendto', active=$active,severity=$s,period='$period' where mediaid=$mediaid";
+		$sql="update media set userid=$userid, mediatypeid=$mediatypeid, sendto='".zbx_ads($sendto)."', active=$active,severity=$s,period='".zbx_ads($period)."' where mediaid=$mediaid";
 		return	DBexecute($sql);
 	}
 
@@ -2787,7 +2786,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			return $default_value;
 		}
 
-		$sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='$idx'";
+		$sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='".zbx_ads($idx)."'";
 		$result=DBselect($sql);
 
 		if(DBnum_rows($result)==0)
@@ -2810,18 +2809,18 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!!
 			return;
 		}
 
-		$sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='$idx'";
+		$sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='".zbx_ads($idx)."'";
 		$result=DBselect($sql);
 
 		if(DBnum_rows($result)==0)
 		{
-			$sql="insert into profiles (userid,idx,value) values (".$USER_DETAILS["userid"].",'$idx','$value')";
+			$sql="insert into profiles (userid,idx,value) values (".$USER_DETAILS["userid"].",'".zbx_ads($idx)."','".zbx_ads($value)."')";
 			DBexecute($sql);
 		}
 		else
 		{
 			$row=DBfetch($result);
-			$sql="update profiles set value='$value' where userid=".$USER_DETAILS["userid"]." and idx='$idx'";
+			$sql="update profiles set value='".zbx_ads($value)."' where userid=".$USER_DETAILS["userid"]." and idx='".zbx_ads($idx)."'";
 			DBexecute($sql);
 		}
 	}
diff --git a/frontends/php/include/graphs.inc.php b/frontends/php/include/graphs.inc.php
index a06d80c0..f60a8838 100644
--- a/frontends/php/include/graphs.inc.php
+++ b/frontends/php/include/graphs.inc.php
@@ -74,7 +74,7 @@
 			return 0;
 		}
 
-		$sql="insert into graphs (name,width,height,yaxistype,yaxismin,yaxismax) values ('$name',$width,$height,$yaxistype,$yaxismin,$yaxismax)";
+		$sql="insert into graphs (name,width,height,yaxistype,yaxismin,yaxismax) values ('".zbx_ads($name)."',$width,$height,$yaxistype,$yaxismin,$yaxismax)";
 		$result=DBexecute($sql);
 		return DBinsert_id($result,"graphs","graphid");
 	}
@@ -88,7 +88,7 @@
 			error("Insufficient permissions");
 			return 0;
 		}
-		$sql="update graphs set name='$name',width=$width,height=$height,yaxistype=$yaxistype,yaxismin=$yaxismin,yaxismax=$yaxismax where graphid=$graphid";
+		$sql="update graphs set name='".zbx_ads($name)."',width=$width,height=$height,yaxistype=$yaxistype,yaxismin=$yaxismin,yaxismax=$yaxismax where graphid=$graphid";
 		return	DBexecute($sql);
 	}
 	
@@ -162,14 +162,14 @@
 	
 	function	add_item_to_graph($graphid,$itemid,$color,$drawtype,$sortorder,$yaxisside)
 	{
-		$sql="insert into graphs_items (graphid,itemid,color,drawtype,sortorder,yaxisside) values ($graphid,$itemid,'$color',$drawtype,$sortorder,$yaxisside)";
+		$sql="insert into graphs_items (graphid,itemid,color,drawtype,sortorder,yaxisside) values ($graphid,$itemid,'".zbx_ads($color)."',$drawtype,$sortorder,$yaxisside)";
 		$result=DBexecute($sql);
 		return DBinsert_id($result,"graphs_items","gitemid");
 	}
 	
 	function	update_graph_item($gitemid,$itemid,$color,$drawtype,$sortorder,$yaxisside)
 	{
-		$sql="update graphs_items set itemid=$itemid,color='$color',drawtype=$drawtype,sortorder=$sortorder,yaxisside=$yaxisside where gitemid=$gitemid";
+		$sql="update graphs_items set itemid=$itemid,color='".zbx_ads($color)."',drawtype=$drawtype,sortorder=$sortorder,yaxisside=$yaxisside where gitemid=$gitemid";
 		return	DBexecute($sql);
 	}
 
@@ -254,7 +254,7 @@
 		{
 			if($host["graphs"]&2 == 0)	continue;
 
-			$sql="select i.itemid from items i where i.key_='".$template_item["key_"]."' and i.hostid=".$host["hostid"];
+			$sql="select i.itemid from items i where i.key_='".zbx_ads($template_item["key_"])."' and i.hostid=".$host["hostid"];
 			$items=DBselect($sql);
 			if(DBnum_rows($items)==0)	continue;
 			$item=DBfetch($items);
@@ -306,12 +306,12 @@
 		{
 			if($row["graphs"]&2 == 0)	continue;
 
-			$sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"];
+			$sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"];
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)==0)	continue;
 			$row2=DBfetch($result2);
 
-			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"];
+			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"];
 			$result3=DBselect($sql);
 			if(DBnum_rows($result3)==0)	continue; 
 			$row3=DBfetch($result3);
@@ -339,12 +339,12 @@
 		{
 			if($row["graphs"]&2 == 0)	continue;
 
-			$sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"];
+			$sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"];
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)==0)	continue;
 			$row2=DBfetch($result2);
 
-			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"];
+			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"];
 			$result3=DBselect($sql);
 			if(DBnum_rows($result3)==0)	continue; 
 			$row3=DBfetch($result3);
@@ -373,12 +373,12 @@
 		{
 			if($row["graphs"]&2 == 0)	continue;
 
-			$sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"];
+			$sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"];
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)==0)	continue;
 			$row2=DBfetch($result2);
 
-			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"];
+			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"];
 			$result3=DBselect($sql);
 			if(DBnum_rows($result3)==0)	continue; 
 			$row3=DBfetch($result3);
@@ -409,13 +409,13 @@
 		{
 			if($row["graphs"]&2 == 0)	continue;
 
-			$sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"];
+			$sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"];
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)==0)	continue;
 			$row2=DBfetch($result2);
 			$itemid=$row2["itemid"];
 
-			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"];
+			$sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"];
 			$result3=DBselect($sql);
 			if(DBnum_rows($result3)==0)	continue; 
 			$row3=DBfetch($result3);
diff --git a/frontends/php/include/hosts.inc.php b/frontends/php/include/hosts.inc.php
index e24a4c1e..c1223984 100644
--- a/frontends/php/include/hosts.inc.php
+++ b/frontends/php/include/hosts.inc.php
@@ -35,7 +35,7 @@
 			return 0;
 		}
 
-		$sql="select * from hosts where host='$host'";
+		$sql="select * from hosts where host='".zbx_ads($host)."'";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -52,7 +52,7 @@
 			$useip=0;
 		}
 
-		$sql="insert into hosts (host,port,status,useip,ip,disable_until,available) values ('$host',$port,$status,$useip,'$ip',0,".HOST_AVAILABLE_UNKNOWN.")";
+		$sql="insert into hosts (host,port,status,useip,ip,disable_until,available) values ('".zbx_ads($host)."',$port,$status,$useip,'".zbx_ads($ip)."',0,".HOST_AVAILABLE_UNKNOWN.")";
 		$result=DBexecute($sql);
 		if(!$result)
 		{
@@ -94,7 +94,7 @@
 			return 0;
 		}
 
-		$sql="select * from hosts where host='$host' and hostid<>$hostid";
+		$sql="select * from hosts where host='".zbx_ads($host)."' and hostid<>$hostid";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -112,7 +112,7 @@
 			$useip=0;
 		}
 
-		$sql="update hosts set host='$host',port=$port,useip=$useip,ip='$ip' where hostid=$hostid";
+		$sql="update hosts set host='".zbx_ads($host)."',port=$port,useip=$useip,ip='".zbx_ads($ip)."' where hostid=$hostid";
 		$result=DBexecute($sql);
 
 
diff --git a/frontends/php/include/items.inc.php b/frontends/php/include/items.inc.php
index 56e1c5e3..e8910e3b 100644
--- a/frontends/php/include/items.inc.php
+++ b/frontends/php/include/items.inc.php
@@ -23,7 +23,7 @@
 
 	function	update_item_in_group($groupid,$itemid,$description,$key,$hostid,$delay,$history,$status,$type,$snmp_community,$snmp_oid,$value_type,$trapper_hosts,$snmp_port,$units,$multiplier,$delta,$snmpv3_securityname,$snmpv3_securitylevel,$snmpv3_authpassphrase,$snmpv3_privpassphrase,$formula,$trends,$logtimefmt)
 	{
-		$sql="select i.itemid,i.hostid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_=\"$key\" and hg.hostid=i.hostid";
+		$sql="select i.itemid,i.hostid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_='".zbx_ads($key)."' and hg.hostid=i.hostid";
 		$result=DBexecute($sql);
 		while($row=DBfetch($result))
 		{
@@ -47,7 +47,7 @@
 			return 0;
 		}
 
-		$sql="select i.itemid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_=\"".$item["key_"]."\" and hg.hostid=i.hostid";
+		$sql="select i.itemid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_='".zbx_ads($item["key_"])."' and hg.hostid=i.hostid";
 		$result=DBexecute($sql);
 		while($row=DBfetch($result))
 		{
@@ -81,7 +81,7 @@
 
 		$host=get_host_by_hostid($hostid);
 
-		$sql="select count(*) as cnt from items where hostid=$hostid and key_='$key'";
+		$sql="select count(*) as cnt from items where hostid=$hostid and key_='".zbx_ads($key)."'";
 		$result=DBexecute($sql);
 		$row = DBfetch($result);
 		if($row["cnt"]>0)
@@ -107,7 +107,7 @@
 			$delta=0;
 		}
 
-		$sql="insert into items (description,key_,hostid,delay,history,nextcheck,status,type,snmp_community,snmp_oid,value_type,trapper_hosts,snmp_port,units,multiplier,delta,snmpv3_securityname,snmpv3_securitylevel,snmpv3_authpassphrase,snmpv3_privpassphrase,formula,trends,logtimefmt) values ('".zbx_ads($description)."','".zbx_ads($key)."',".zbx_ads($hostid).",".zbx_ads($delay).",".zbx_ads($history).",0,".zbx_ads($status).",".zbx_ads($type).",'".zbx_ads($snmp_community)."','".zbx_ads($snmp_oid)."',".zbx_ads($value_type).",'".zbx_ads($trapper_hosts)."',".zbx_ads($snmp_port).",'".zbx_ads($units)."',".zbx_ads($multiplier).",".zbx_ads($delta).",'".zbx_ads($snmpv3_securityname)."',".zbx_ads($snmpv3_securitylevel).",'".zbx_ads($snmpv3_authpassphrase)."','".zbx_ads($snmpv3_privpassphrase)."','".zbx_ads($formula)."',".zbx_ads($trends).",'".zbx_ads($logtimefmt)."')";
+		$sql="insert into items (description,key_,hostid,delay,history,nextcheck,status,type,snmp_community,snmp_oid,value_type,trapper_hosts,snmp_port,units,multiplier,delta,snmpv3_securityname,snmpv3_securitylevel,snmpv3_authpassphrase,snmpv3_privpassphrase,formula,trends,logtimefmt) values ('".zbx_ads($description)."','".zbx_ads($key)."',$hostid,$delay,$history,0,$status,$type,'".zbx_ads($snmp_community)."','".zbx_ads($snmp_oid)."',$value_type,'".zbx_ads($trapper_hosts)."',".zbx_ads($snmp_port).",'".zbx_ads($units)."',$multiplier,$delta,'".zbx_ads($snmpv3_securityname)."',".zbx_ads($snmpv3_securitylevel).",'".zbx_ads($snmpv3_authpassphrase)."','".zbx_ads($snmpv3_privpassphrase)."','".zbx_ads($formula)."',$trends,'".zbx_ads($logtimefmt)."')";
 		$result=DBexecute($sql);
 		if($result)
 		{
@@ -127,7 +127,7 @@
                         return 0;
 		}
 		if($status==ITEM_STATUS_ACTIVE)
-			$sql="update items set status=$status,error=\"\" where itemid=$itemid";
+			$sql="update items set status=$status,error='' where itemid=$itemid";
 		else
 			$sql="update items set status=$status where itemid=$itemid";
 
@@ -160,10 +160,10 @@
 			$delta=0;
 		}
 
-		$sql="update items set lastlogsize=0 where itemid=".zbx_ads($itemid)." and key_<>'".zbx_ads($key)."'";
+		$sql="update items set lastlogsize=0 where itemid=$itemid and key_<>'".zbx_ads($key)."'";
 		DBexecute($sql);
 
-		$sql="update items set description='".zbx_ads($description)."',key_='".zbx_ads($key)."',hostid=".zbx_ads($hostid).",delay=".zbx_ads($delay).",history=".zbx_ads($history).",nextcheck=0,status=".zbx_ads($status).",type=".zbx_ads($type).",snmp_community='".zbx_ads($snmp_community)."',snmp_oid='".zbx_ads($snmp_oid)."',value_type=".zbx_ads($value_type).",trapper_hosts='".zbx_ads($trapper_hosts)."',snmp_port=".zbx_ads($snmp_port).",units='".zbx_ads($units)."',multiplier=".zbx_ads($multiplier).",delta=".zbx_ads($delta).",snmpv3_securityname='".zbx_ads($snmpv3_securityname)."',snmpv3_securitylevel=".zbx_ads($snmpv3_securitylevel).",snmpv3_authpassphrase='".zbx_ads($snmpv3_authpassphrase)."',snmpv3_privpassphrase='".zbx_ads($snmpv3_privpassphrase)."',formula='".zbx_ads($formula)."',trends=".zbx_ads($trends).",logtimefmt='".zbx_ads($logtimefmt)."' where itemid=".zbx_ads($itemid);
+		$sql="update items set description='".zbx_ads($description)."',key_='".zbx_ads($key)."',hostid=$hostid,delay=$delay,history=$history,nextcheck=0,status=$status,type=$type,snmp_community='".zbx_ads($snmp_community)."',snmp_oid='".zbx_ads($snmp_oid)."',value_type=$value_type,trapper_hosts='".zbx_ads($trapper_hosts)."',snmp_port=$snmp_port,units='".zbx_ads($units)."',multiplier=$multiplier,delta=$delta,snmpv3_securityname='".zbx_ads($snmpv3_securityname)."',snmpv3_securitylevel=".zbx_ads($snmpv3_securitylevel).",snmpv3_authpassphrase='".zbx_ads($snmpv3_authpassphrase)."',snmpv3_privpassphrase='".zbx_ads($snmpv3_privpassphrase)."',formula='".zbx_ads($formula)."',trends=$trends,logtimefmt='".zbx_ads($logtimefmt)."' where itemid=$itemid";
 		$result=DBexecute($sql);
 		if($result)
 		{
@@ -181,7 +181,7 @@
 		{
 			$item=get_item_by_itemid($row["itemid"]);
 
-			$sql="select itemid from items where key_=\"".$item["key_"]."\" and hostid=$hostid";
+			$sql="select itemid from items where key_=\"".zbx_ads($item["key_"])."\" and hostid=$hostid";
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)==0)
 			{
@@ -241,7 +241,7 @@
 		while($row=DBfetch($result))
 		{
 			if($row["items"]&4 == 0)	continue;
-			$sql="select itemid from items where key_=\"".$item["key_"]."\" and hostid=".$row["hostid"];
+			$sql="select itemid from items where key_='".zbx_ads($item["key_"])."' and hostid=".$row["hostid"];
 			$result2=DBselect($sql);
 			while($row2=DBfetch($result2))
 			{
@@ -268,7 +268,7 @@
 		while($row=DBfetch($result))
 		{
 			if($row["items"]&2 == 0)	continue;
-			$sql="select itemid from items where key_=\"".$item["key_"]."\" and hostid=".$row["hostid"];
+			$sql="select itemid from items where key_=\"".zbx_ads($item["key_"])."\" and hostid=".$row["hostid"];
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)==1)
 			{
diff --git a/frontends/php/include/maps.inc.php b/frontends/php/include/maps.inc.php
index 7169e26e..bf263685 100644
--- a/frontends/php/include/maps.inc.php
+++ b/frontends/php/include/maps.inc.php
@@ -79,7 +79,7 @@
 			return 0;
 		}
 
-		$sql="update sysmaps set name='$name',width=$width,height=$height,background='$background',label_type=$label_type,label_location=$label_location where sysmapid=$sysmapid";
+		$sql="update sysmaps set name='".zbx_ads($name)."',width=$width,height=$height,background='".zbx_ads($background)."',label_type=$label_type,label_location=$label_location where sysmapid=$sysmapid";
 		return	DBexecute($sql);
 	}
 
@@ -93,7 +93,7 @@
 			return 0;
 		}
 
-		$sql="insert into sysmaps (name,width,height,background,label_type,label_location) values ('$name',$width,$height,'$background',$label_type,$label_location)";
+		$sql="insert into sysmaps (name,width,height,background,label_type,label_location) values ('".zbx_ads($name)."',$width,$height,'".zbx_ads($background)."',$label_type,$label_location)";
 		return	DBexecute($sql);
 	}
 
@@ -101,11 +101,11 @@
 	{
 		if($triggerid == 0)
 		{
-			$sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,NULL,$drawtype_off,'$color_off',$drawtype_on,'$color_on')";
+			$sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,NULL,$drawtype_off,'".zbx_ads($color_off)."',$drawtype_on,'".zbx_ads($color_on)."')";
 		}
 		else
 		{
-			$sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,$triggerid,$drawtype_off,'$color_off',$drawtype_on,'$color_on')";
+			$sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,$triggerid,$drawtype_off,'".zbx_ads($color_off)."',$drawtype_on,'".zbx_ads($color_on)."')";
 		}
 		return	DBexecute($sql);
 	}
@@ -120,13 +120,13 @@
 
 	function add_host_to_sysmap($sysmapid,$hostid,$label,$x,$y,$icon,$url,$icon_on)
 	{
-		$sql="insert into sysmaps_hosts (sysmapid,hostid,label,x,y,icon,url,icon_on) values ($sysmapid,$hostid,'$label',$x,$y,'$icon','$url','$icon_on')";
+		$sql="insert into sysmaps_hosts (sysmapid,hostid,label,x,y,icon,url,icon_on) values ($sysmapid,$hostid,'".zbx_ads($label)."',$x,$y,'".zbx_ads($icon)."','".zbx_ads($url)."','".zbx_ads($icon_on)."')";
 		return	DBexecute($sql);
 	}
 
 	function	update_sysmap_host($shostid,$sysmapid,$hostid,$label,$x,$y,$icon,$url,$icon_on)
 	{
-		$sql="update sysmaps_hosts set hostid=$hostid,label='$label',x=$x,y=$y,icon='$icon',url='$url',icon_on='$icon_on' where shostid=$shostid";
+		$sql="update sysmaps_hosts set hostid=$hostid,label='".zbx_ads($label)."',x=$x,y=$y,icon='".zbx_ads($icon)."',url='".zbx_ads($url)."',icon_on='".zbx_ads($icon_on)."' where shostid=$shostid";
 		return	DBexecute($sql);
 	}
 
@@ -176,7 +176,7 @@
 
 			if($status==HOST_STATUS_MONITORED)
 			{
-				$sql="select image from images where imagetype=1 and name='$icon'";
+				$sql="select image from images where imagetype=1 and name='".zbx_ads($icon)."'";
 				$result2=DBselect($sql);
 				if(DBnum_rows($result2)==1)
 				{
diff --git a/frontends/php/include/profiles.inc.php b/frontends/php/include/profiles.inc.php
index e94ff270..d88d59e8 100644
--- a/frontends/php/include/profiles.inc.php
+++ b/frontends/php/include/profiles.inc.php
@@ -38,7 +38,7 @@
 			return 0;
 		}
 
-		$sql="insert into hosts_profiles (hostid,devicetype,name,os,serialno,tag,macaddress,hardware,software,contact,location,notes) values (".zbx_ads($hostid).",'".zbx_ads($devicetype)."','".zbx_ads($name)."','".zbx_ads($os)."','".zbx_ads($serialno)."','".zbx_ads($tag)."','".zbx_ads($macaddress)."','".zbx_ads($hardware)."','".zbx_ads($software)."','".zbx_ads($contact)."','".zbx_ads($location)."','".zbx_ads($notes)."')";
+		$sql="insert into hosts_profiles (hostid,devicetype,name,os,serialno,tag,macaddress,hardware,software,contact,location,notes) values ($hostid,'".zbx_ads($devicetype)."','".zbx_ads($name)."','".zbx_ads($os)."','".zbx_ads($serialno)."','".zbx_ads($tag)."','".zbx_ads($macaddress)."','".zbx_ads($hardware)."','".zbx_ads($software)."','".zbx_ads($contact)."','".zbx_ads($location)."','".zbx_ads($notes)."')";
 		$result=DBexecute($sql);
 		
 		return	$result;
@@ -63,7 +63,7 @@
 			return 0;
 		}
 
-		$sql="update hosts_profiles set devicetype='".zbx_ads($devicetype)."',name='".zbx_ads($name)."',os='".zbx_ads($os)."',serialno='".zbx_ads($serialno)."',tag='".zbx_ads($tag)."',macaddress='".zbx_ads($macaddress)."',hardware='".zbx_ads($hardware)."',software='".zbx_ads($software)."',contact='".zbx_ads($contact)."',location='".zbx_ads($location)."',notes='".zbx_ads($notes)."' where hostid=".zbx_ads($hostid);
+		$sql="update hosts_profiles set devicetype='".zbx_ads($devicetype)."',name='".zbx_ads($name)."',os='".zbx_ads($os)."',serialno='".zbx_ads($serialno)."',tag='".zbx_ads($tag)."',macaddress='".zbx_ads($macaddress)."',hardware='".zbx_ads($hardware)."',software='".zbx_ads($software)."',contact='".zbx_ads($contact)."',location='".zbx_ads($location)."',notes='".zbx_ads($notes)."' where hostid=$hostid";
 		$result=DBexecute($sql);
 		
 		return	$result;
diff --git a/frontends/php/include/screens.inc.php b/frontends/php/include/screens.inc.php
index 1e21e396..f2b44365 100644
--- a/frontends/php/include/screens.inc.php
+++ b/frontends/php/include/screens.inc.php
@@ -27,7 +27,7 @@
                         return 0;
                 }
 
-                $sql="insert into screens (name,cols,rows) values ('$name',$cols,$rows)";
+                $sql="insert into screens (name,cols,rows) values ('".zbx_ads($name)."',$cols,$rows)";
                 return  DBexecute($sql);
         }
 
@@ -39,7 +39,7 @@
                         return 0;
                 }
 
-                $sql="update screens set name='$name',cols=$cols,rows=$rows where screenid=$screenid";
+                $sql="update screens set name='".zbx_ads($name)."',cols=$cols,rows=$rows where screenid=$screenid";
                 return  DBexecute($sql);
         }
 
diff --git a/frontends/php/include/services.inc.php b/frontends/php/include/services.inc.php
index 7a63d508..dd14ecbc 100644
--- a/frontends/php/include/services.inc.php
+++ b/frontends/php/include/services.inc.php
@@ -43,11 +43,11 @@
 				$description=expand_trigger_description($triggerid);
 //			}
 			$description=zbx_ads($description);
-			$sql="insert into services (name,triggerid,status,algorithm,showsla,goodsla,sortorder) values ('$description',$triggerid,0,$algorithm,$showsla,$goodsla,$sortorder)";
+			$sql="insert into services (name,triggerid,status,algorithm,showsla,goodsla,sortorder) values ('".zbx_ads($description)."',$triggerid,0,$algorithm,$showsla,$goodsla,$sortorder)";
 		}
 		else
 		{
-			$sql="insert into services (name,status,algorithm,showsla,goodsla,sortorder) values ('$name',0,$algorithm,$showsla,$goodsla,$sortorder)";
+			$sql="insert into services (name,status,algorithm,showsla,goodsla,sortorder) values ('".zbx_ads($name)."',0,$algorithm,$showsla,$goodsla,$sortorder)";
 		}
 		$result=DBexecute($sql);
 		if(!$result)
@@ -180,7 +180,7 @@
 		{
 			$showsla=0;
 		}
-		$sql="update services set name='$name',triggerid=$triggerid,status=0,algorithm=$algorithm,showsla=$showsla,goodsla=$goodsla,sortorder=$sortorder where serviceid=$serviceid";
+		$sql="update services set name='".zbx_ads($name)."',triggerid=$triggerid,status=0,algorithm=$algorithm,showsla=$showsla,goodsla=$goodsla,sortorder=$sortorder where serviceid=$serviceid";
 		return	DBexecute($sql);
 	}
 
diff --git a/frontends/php/include/triggers.inc.php b/frontends/php/include/triggers.inc.php
index 7e3d3fd3..97c6cd0a 100644
--- a/frontends/php/include/triggers.inc.php
+++ b/frontends/php/include/triggers.inc.php
@@ -27,7 +27,7 @@
 			return	0;
 		}
 
-		$sql="update triggers set comments='".zbx_ads($comments)."' where triggerid=".zbx_ads($triggerid);
+		$sql="update triggers set comments='".zbx_ads($comments)."' where triggerid=$triggerid";
 		return	DBexecute($sql);
 	}
 
@@ -109,7 +109,7 @@
 //			return	0;
 //		}
 
-		$sql="insert into triggers  (description,priority,status,comments,url,value,error) values ('".zbx_ads($description)."',".zbx_ads($priority).",".zbx_ads($status).",'".zbx_ads($comments)."','".zbx_ads($url)."',2,'Trigger just added. No status update so far.')";
+		$sql="insert into triggers  (description,priority,status,comments,url,value,error) values ('".zbx_ads($description)."',$priority,$status,'".zbx_ads($comments)."','".zbx_ads($url)."',2,'Trigger just added. No status update so far.')";
 #		echo $sql,"<br>";
 		$result=DBexecute($sql);
 		if(!$result)
@@ -122,7 +122,7 @@
 		add_alarm($triggerid,2);
  
 		$expression=implode_exp($expression,$triggerid);
-		$sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=".zbx_ads($triggerid);
+		$sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=$triggerid";
 #		echo $sql,"<br>";
 		DBexecute($sql);
 		reset_items_nextcheck($triggerid);
@@ -185,14 +185,13 @@
 		add_alarm($triggerid,2);
 //		$sql="update triggers set expression='$expression',description='$description',priority=$priority,status=$status,comments='$comments',url='$url' where triggerid=$triggerid";
 		reset_items_nextcheck($triggerid);
-		$sql="update triggers set expression='$expression',description='$description',priority=$priority,status=$status,comments='$comments',url='$url',value=2 where triggerid=$triggerid";
+		$sql="update triggers set expression='".zbx_ads($expression)."',description='".zbx_ads($description)."',priority=$priority,status=$status,comments='".zbx_ads($comments)."',url='".zbx_ads($url)."',value=2 where triggerid=$triggerid";
 		return	DBexecute($sql);
 	}
 
 	function	check_right_on_trigger($permission,$triggerid)
 	{
-                $sql="select distinct h.hostid from functions f,items i,hosts h
-where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
+                $sql="select distinct h.hostid from functions f,items i,hosts h where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
                 $result=DBselect($sql);
                 $ok=0;
 		while($row=DBfetch($result))
@@ -352,7 +351,7 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
 				while($row3=DBfetch($result2))
 				{
 
-					$sql="select itemid from items where key_=\"".$row3["key_"]."\" and hostid=".$row["hostid"];
+					$sql="select itemid from items where key_='".zbx_ads($row3["key_"])."' and hostid=".$row["hostid"];
 					$result3=DBselect($sql);
 					if(DBnum_rows($result3)!=1)
 					{
@@ -366,15 +365,15 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
 	
 					$item=get_item_by_itemid($row4["itemid"]);
 	
-					$sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",".$row2["triggerid"].",'".$row3["function"]."','".$row3["parameter"]."')";
+					$sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",".$row2["triggerid"].",'".zbx_ads($row3["function"])."','".zbx_ads($row3["parameter"])."')";
 					$result5=DBexecute($sql);
 					$functionid=DBinsert_id($result5,"functions","functionid");
 	
-					$sql="update triggers set expression='$expression_old' where triggerid=".$row2["triggerid"];
+					$sql="update triggers set expression='".zbx_ads($expression_old)."' where triggerid=".$row2["triggerid"];
 					DBexecute($sql);
 					$expression=str_replace("{".$row3["functionid"]."}","{".$functionid."}",$expression_old);
 					$expression_old=$expression;
-					$sql="update triggers set expression='$expression' where triggerid=".$row2["triggerid"];
+					$sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=".$row2["triggerid"];
 					DBexecute($sql);
 				}
 
@@ -422,7 +421,7 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
 
 			if($row["triggers"]&1 == 0)	continue;
 
-			$sql="insert into triggers  (description,priority,status,comments,url,value,expression) values ('".zbx_ads($trigger["description"])."',".$trigger["priority"].",".$trigger["status"].",'".zbx_ads($trigger["comments"])."','".zbx_ads($trigger["url"])."',2,'$expression_old')";
+			$sql="insert into triggers  (description,priority,status,comments,url,value,expression) values ('".zbx_ads($trigger["description"])."',".$trigger["priority"].",".$trigger["status"].",'".zbx_ads($trigger["comments"])."','".zbx_ads($trigger["url"])."',2,'".zbx_ads($expression_old)."')";
 			$result4=DBexecute($sql);
 			$triggerid_new=DBinsert_id($result4,"triggers","triggerid");
 
@@ -432,7 +431,7 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
 			// Loop: functions
 			while($row2=DBfetch($result2))
 			{
-				$sql="select itemid from items where key_=\"".$row2["key_"]."\" and hostid=".$row["hostid"];
+				$sql="select itemid from items where key_='".zbx_ads($row2["key_"])."' and hostid=".$row["hostid"];
 				$result3=DBselect($sql);
 				if(DBnum_rows($result3)!=1)
 				{
@@ -446,15 +445,15 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid";
 
 				$item=get_item_by_itemid($row3["itemid"]);
 
-				$sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",$triggerid_new,'".$row2["function"]."','".$row2["parameter"]."')";
+				$sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",$triggerid_new,'".zbx_ads($row2["function"])."','".zbx_ads($row2["parameter"])."')";
 				$result5=DBexecute($sql);
 				$functionid=DBinsert_id($result5,"functions","functionid");
 
-				$sql="update triggers set expression='$expression_old' where triggerid=$triggerid_new";
+				$sql="update triggers set expression='".zbx_ads($expression_old)."' where triggerid=$triggerid_new";
 				DBexecute($sql);
 				$expression=str_replace("{".$row2["functionid"]."}","{".$functionid."}",$expression_old);
 				$expression_old=$expression;
-				$sql="update triggers set expression='$expression' where triggerid=$triggerid_new";
+				$sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=$triggerid_new";
 				DBexecute($sql);
 
 				$host=get_host_by_hostid($row["hostid"]);
diff --git a/frontends/php/include/users.inc.php b/frontends/php/include/users.inc.php
index ac9dfca6..3ac82961 100644
--- a/frontends/php/include/users.inc.php
+++ b/frontends/php/include/users.inc.php
@@ -34,7 +34,7 @@
 			return 0;
 		}
 
-		$sql="select * from users where alias='$alias'";
+		$sql="select * from users where alias='".zbx_ads($alias)."'";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -43,7 +43,7 @@
 		}
 		
 		$passwd=md5($passwd);
-		$sql="insert into users (name,surname,alias,passwd,url,autologout,lang,refresh) values ('$name','$surname','$alias','$passwd','$url',$autologout,'$lang',$refresh)";
+		$sql="insert into users (name,surname,alias,passwd,url,autologout,lang,refresh) values ('".zbx_ads($name)."','".zbx_ads($surname)."','".zbx_ads($alias)."','".zbx_ads($passwd)."','".zbx_ads($url)."',$autologout,'".zbx_ads($lang)."',$refresh)";
 		return DBexecute($sql);
 	}
 
@@ -62,7 +62,7 @@
 			return 0;
 		}
 
-		$sql="select * from users where alias='$alias' and userid<>$userid";
+		$sql="select * from users where alias='".zbx_ads($alias)."' and userid<>$userid";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -72,12 +72,12 @@
 		
 		if($passwd=="")
 		{
-			$sql="update users set name='$name',surname='$surname',alias='$alias',url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid";
+			$sql="update users set name='".zbx_ads($name)."',surname='".zbx_ads($surname)."',alias='".zbx_ads($alias)."',url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid";
 		}
 		else
 		{
 			$passwd=md5($passwd);
-			$sql="update users set name='$name',surname='$surname',alias='$alias',passwd='$passwd',url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid";
+			$sql="update users set name='".zbx_ads($name)."',surname='".zbx_ads($surname)."',alias='".zbx_ads($alias)."',passwd='".zbx_ads($passwd)."',url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid";
 		}
 		return DBexecute($sql);
 	}
@@ -96,12 +96,12 @@
 
 		if($passwd=="")
 		{
-			$sql="update users set url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid";
+			$sql="update users set url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid";
 		}
 		else
 		{
 			$passwd=md5($passwd);
-			$sql="update users set passwd='$passwd',url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid";
+			$sql="update users set passwd='".zbx_ads($passwd)."',url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid";
 		}
 		return DBexecute($sql);
 	}
@@ -110,7 +110,7 @@
 
 	function	add_permission($userid,$right,$permission,$id)
 	{
-		$sql="insert into rights (userid,name,permission,id) values ($userid,'$right','$permission',$id)";
+		$sql="insert into rights (userid,name,permission,id) values ($userid,'".zbx_ads($right)."','".zbx_ads($permission)."',$id)";
 		return DBexecute($sql);
 	}
 
@@ -142,7 +142,7 @@
 			return 0;
 		}
 
-		$sql="select * from usrgrp where name='$name'";
+		$sql="select * from usrgrp where name='".zbx_ads($name)."'";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -150,7 +150,7 @@
 			return 0;
 		}
 
-		$sql="insert into usrgrp (name) values ('$name')";
+		$sql="insert into usrgrp (name) values ('".zbx_ads($name)."')";
 		$result=DBexecute($sql);
 		if(!$result)
 		{
@@ -177,7 +177,7 @@
 			return 0;
 		}
 
-		$sql="select * from usrgrp where name='$name' and usrgrpid<>$usrgrpid";
+		$sql="select * from usrgrp where name='".zbx_ads($name)."' and usrgrpid<>$usrgrpid";
 		$result=DBexecute($sql);
 		if(DBnum_rows($result)>0)
 		{
@@ -185,7 +185,7 @@
 			return 0;
 		}
 
-		$sql="update usrgrp set name='$name' where usrgrpid=$usrgrpid";
+		$sql="update usrgrp set name='".zbx_ads($name)."' where usrgrpid=$usrgrpid";
 		$result=DBexecute($sql);
 		if(!$result)
 		{
diff --git a/frontends/php/index.php b/frontends/php/index.php
index 88e2071c..18199872 100644
--- a/frontends/php/index.php
+++ b/frontends/php/index.php
@@ -83,7 +83,7 @@
 
 	if(isset($reconnect) && isset($sessionid))
 	{
-		$sql="delete from sessions where sessionid='$sessionid'";
+		$sql="delete from sessions where sessionid='".zbx_ads($sessionid)."'";
 		DBexecute($sql);
 		setcookie("sessionid",$sessionid,time()-3600);
 		unset($sessionid);
@@ -92,7 +92,7 @@
 	if(isset($enter)&&($enter=="Enter"))
 	{
 		$password=md5($password);
-		$sql="select u.userid,u.alias,u.name,u.surname,u.url,u.refresh from users u where u.alias='$name' and u.passwd='$password'";
+		$sql="select u.userid,u.alias,u.name,u.surname,u.url,u.refresh from users u where u.alias='".zbx_ads($name)."' and u.passwd='".zbx_ads($password)."'";
 		$result=DBselect($sql);
 		if(DBnum_rows($result)==1)
 		{
@@ -107,7 +107,7 @@
 			setcookie("sessionid",$sessionid,time()+3600);
 // Required !
 			$_COOKIE["sessionid"]=$sessionid;
-			$sql="insert into sessions (sessionid,userid,lastaccess) values ('$sessionid',".$USER_DETAILS["userid"].",".time().")";
+			$sql="insert into sessions (sessionid,userid,lastaccess) values ('".zbx_ads($sessionid)."',".$USER_DETAILS["userid"].",".time().")";
 			DBexecute($sql);
 
 			if($USER_DETAILS["url"] != '')
diff --git a/frontends/php/latest.php b/frontends/php/latest.php
index ce63f9d6..7876376e 100644
--- a/frontends/php/latest.php
+++ b/frontends/php/latest.php
@@ -186,7 +186,7 @@
 
 		$col=0;
 		if(isset($_REQUEST["select"]))
-			$sql="select h.host,i.itemid,i.description,i.lastvalue,i.prevvalue,i.lastclock,i.status,h.hostid,i.value_type,i.units,i.multiplier,i.key_ from items i,hosts h where h.hostid=i.hostid and h.status=".HOST_STATUS_MONITORED." and i.status=0 and i.description like '%".$_REQUEST["select"]."%' order by i.description";
+			$sql="select h.host,i.itemid,i.description,i.lastvalue,i.prevvalue,i.lastclock,i.status,h.hostid,i.value_type,i.units,i.multiplier,i.key_ from items i,hosts h where h.hostid=i.hostid and h.status=".HOST_STATUS_MONITORED." and i.status=0 and i.description like '%".zbx_ads($_REQUEST["select"])."%' order by i.description";
 		else
 			$sql="select h.host,i.itemid,i.description,i.lastvalue,i.prevvalue,i.lastclock,i.status,h.hostid,i.value_type,i.units,i.multiplier,i.key_ from items i,hosts h where h.hostid=i.hostid and h.status=".HOST_STATUS_MONITORED." and i.status=0 and h.hostid=".$_REQUEST["hostid"]." order by i.description";
 		$result=DBselect($sql);
diff --git a/frontends/php/map.php b/frontends/php/map.php
index c3049e1b..8b10e07e 100644
--- a/frontends/php/map.php
+++ b/frontends/php/map.php
@@ -86,7 +86,7 @@
 #	ImageFilledRectangle($im,0,0,$width,$height,$black);
 	if($background!="")
 	{
-		$sql="select image from images where imagetype=2 and name='$background'";
+		$sql="select image from images where imagetype=2 and name='".zbx_ads($background)."'";
 		$result2=DBselect($sql);
 		if(DBnum_rows($result2)==1)
 		{
@@ -286,7 +286,7 @@
 				$icons[$icon]=ImageCreateFromPNG("images/sysmaps/old/$icon.png");
 			}
 */
-			$sql="select image from images where imagetype=1 and name='$icon'";
+			$sql="select image from images where imagetype=1 and name='".zbx_ads($icon)."'";
 			$result2=DBselect($sql);
 			if(DBnum_rows($result2)!=1)
 			{
diff --git a/frontends/php/overview.php b/frontends/php/overview.php
index 25b5411d..f2af4e9c 100644
--- a/frontends/php/overview.php
+++ b/frontends/php/overview.php
@@ -153,7 +153,7 @@
 			$rows=array(nbsp($row["description"]));
 			foreach($hosts as $hostid)
 			{
-				$sql="select itemid,value_type,lastvalue,units from items where hostid=$hostid and description='".$row["description"]."'";
+				$sql="select itemid,value_type,lastvalue,units from items where hostid=$hostid and description='".zbx_ads($row["description"])."'";
 				$result2=DBselect($sql);
 				if(DBnum_rows($result2)==1)
 				{
@@ -224,14 +224,14 @@
 			$_REQUEST["sort"]="order by i.description";
 		}
 //		$sql="select distinct description from items order by 1;";
-		$sql="select distinct t.description from hosts h,items i,hosts_groups hg,triggers t,functions f where h.status=".HOST_STATUS_MONITORED." and t.status=".TRIGGER_STATUS_ENABLED." and h.hostid=i.hostid and hg.groupid=".zbx_ads($_REQUEST["groupid"])." and hg.hostid=h.hostid and t.triggerid=f.triggerid and f.itemid=i.itemid order by 1";
+		$sql="select distinct t.description from hosts h,items i,hosts_groups hg,triggers t,functions f where h.status=".HOST_STATUS_MONITORED." and t.status=".TRIGGER_STATUS_ENABLED." and h.hostid=i.hostid and hg.groupid=".$_REQUEST["groupid"]." and hg.hostid=h.hostid and t.triggerid=f.triggerid and f.itemid=i.itemid order by 1";
 		$result=DBselect($sql);
 		while($row=DBfetch($result))
 		{
 			$rows=array(nbsp($row["description"]));
 			foreach($hosts as $hostid)
 			{
-				$sql="select t.status,t.value,t.lastchange from triggers t,functions f,items i where f.triggerid=t.triggerid and i.itemid=f.itemid and t.status=".TRIGGER_STATUS_ENABLED." and i.hostid=".zbx_ads($hostid)." and t.description='".zbx_ads($row["description"])."'";
+				$sql="select t.status,t.value,t.lastchange from triggers t,functions f,items i where f.triggerid=t.triggerid and i.itemid=f.itemid and t.status=".TRIGGER_STATUS_ENABLED." and i.hostid=$hostid and t.description='".zbx_ads($row["description"])."'";
 				$result2=DBselect($sql);
 				if(DBnum_rows($result2)==1)
 				{