diff --git a/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php b/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php
index cfd27b43..e6f96784 100644
--- a/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php
+++ b/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php
@@ -42,6 +42,8 @@ if (isset($_GET["pass"]))						{$pass=$_GET["pass"];}
 	elseif (isset($_POST["pass"]))				{$pass=$_POST["pass"];}
 if (!$user) {echo "Page should only be viewed through the agent interface."; die;}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $VUselected_language = '';
diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php
index e66ef771..9cd58bda 100644
--- a/agc_2-X/trunk/www/agc/api.php
+++ b/agc_2-X/trunk/www/agc/api.php
@@ -258,6 +258,8 @@ if (isset($_GET["cid_choice"]))				{$cid_choice=$_GET["cid_choice"];}
 if (isset($_GET["outbound_cid"]))			{$outbound_cid=$_GET["outbound_cid"];}
 	elseif (isset($_POST["outbound_cid"]))	{$outbound_cid=$_POST["outbound_cid"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))
diff --git a/agc_2-X/trunk/www/agc/chat_db_query.php b/agc_2-X/trunk/www/agc/chat_db_query.php
index d2307027..961afb03 100644
--- a/agc_2-X/trunk/www/agc/chat_db_query.php
+++ b/agc_2-X/trunk/www/agc/chat_db_query.php
@@ -102,6 +102,8 @@ if (isset($_GET["chat_xfer_type"]))					{$chat_xfer_type=$_GET["chat_xfer_type"]
 if (isset($_GET["chat_xfer_value"]))					{$chat_xfer_value=$_GET["chat_xfer_value"];}
 	elseif (isset($_POST["chat_xfer_value"]))			{$chat_xfer_value=$_POST["chat_xfer_value"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if (!$user) {echo "No user, no using."; exit;}
 
 if (file_exists('options.php'))
diff --git a/agc_2-X/trunk/www/agc/conf_exten_check.php b/agc_2-X/trunk/www/agc/conf_exten_check.php
index e9d702fd..0c7e04e3 100644
--- a/agc_2-X/trunk/www/agc/conf_exten_check.php
+++ b/agc_2-X/trunk/www/agc/conf_exten_check.php
@@ -154,6 +154,8 @@ if (isset($_GET["phone_number"]))			{$phone_number=$_GET["phone_number"];}
 if (isset($_GET["visibility"]))				{$visibility=$_GET["visibility"];}
 	elseif (isset($_POST["visibility"]))	{$visibility=$_POST["visibility"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 
diff --git a/agc_2-X/trunk/www/agc/deactivate_lead.php b/agc_2-X/trunk/www/agc/deactivate_lead.php
index b476ffca..70ee60d9 100644
--- a/agc_2-X/trunk/www/agc/deactivate_lead.php
+++ b/agc_2-X/trunk/www/agc/deactivate_lead.php
@@ -70,6 +70,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/dispo_add_FPG.php b/agc_2-X/trunk/www/agc/dispo_add_FPG.php
index 5587d177..75651555 100644
--- a/agc_2-X/trunk/www/agc/dispo_add_FPG.php
+++ b/agc_2-X/trunk/www/agc/dispo_add_FPG.php
@@ -57,6 +57,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/dispo_change_status.php b/agc_2-X/trunk/www/agc/dispo_change_status.php
index b2b92e43..ef47774d 100644
--- a/agc_2-X/trunk/www/agc/dispo_change_status.php
+++ b/agc_2-X/trunk/www/agc/dispo_change_status.php
@@ -67,6 +67,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/dispo_list_quota.php b/agc_2-X/trunk/www/agc/dispo_list_quota.php
index eb4d83c1..9b015891 100644
--- a/agc_2-X/trunk/www/agc/dispo_list_quota.php
+++ b/agc_2-X/trunk/www/agc/dispo_list_quota.php
@@ -63,6 +63,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/dispo_move_list.php b/agc_2-X/trunk/www/agc/dispo_move_list.php
index 369ba56d..8604dfb0 100644
--- a/agc_2-X/trunk/www/agc/dispo_move_list.php
+++ b/agc_2-X/trunk/www/agc/dispo_move_list.php
@@ -125,6 +125,7 @@ if (isset($_GET["list_id_trigger"]))			{$list_id_trigger=$_GET["list_id_trigger"
 if (isset($_GET["multi_trigger"]))			{$multi_trigger=$_GET["multi_trigger"];}
 	elseif (isset($_POST["multi_trigger"]))	{$multi_trigger=$_POST["multi_trigger"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/dispo_send_email.php b/agc_2-X/trunk/www/agc/dispo_send_email.php
index 2229906c..4b060273 100644
--- a/agc_2-X/trunk/www/agc/dispo_send_email.php
+++ b/agc_2-X/trunk/www/agc/dispo_send_email.php
@@ -136,6 +136,7 @@ if (isset($_GET["email_attachment_19"]))			{$email_attachment_19=$_GET["email_at
 if (isset($_GET["email_attachment_20"]))			{$email_attachment_20=$_GET["email_attachment_20"];}
 	elseif (isset($_POST["email_attachment_20"]))	{$email_attachment_20=$_POST["email_attachment_20"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/update_cf_ivr.php b/agc_2-X/trunk/www/agc/update_cf_ivr.php
index 78be7609..ed39c8f2 100644
--- a/agc_2-X/trunk/www/agc/update_cf_ivr.php
+++ b/agc_2-X/trunk/www/agc/update_cf_ivr.php
@@ -47,6 +47,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';
diff --git a/agc_2-X/trunk/www/agc/vdc_db_query.php b/agc_2-X/trunk/www/agc/vdc_db_query.php
index 3843c8e4..538d5f4d 100644
--- a/agc_2-X/trunk/www/agc/vdc_db_query.php
+++ b/agc_2-X/trunk/www/agc/vdc_db_query.php
@@ -843,6 +843,8 @@ if (isset($_GET["calls_waiting_vl_twoLABEL"]))			{$calls_waiting_vl_twoLABEL=$_G
 if (isset($_GET["pause_max_url_trigger"]))			{$pause_max_url_trigger=$_GET["pause_max_url_trigger"];}
 	elseif (isset($_POST["pause_max_url_trigger"]))	{$pause_max_url_trigger=$_POST["pause_max_url_trigger"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))
diff --git a/agc_2-X/trunk/www/agc/vdc_email_display.php b/agc_2-X/trunk/www/agc/vdc_email_display.php
index f8a4536e..53fe076d 100644
--- a/agc_2-X/trunk/www/agc/vdc_email_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_email_display.php
@@ -64,6 +64,8 @@ if (isset($_GET["REPLY"]))	{$REPLY=$_GET["REPLY"];}
 if (isset($_GET["agent_email"]))	{$agent_email=$_GET["agent_email"];}
 	elseif (isset($_POST["agent_email"]))	{$agent_email=$_POST["agent_email"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 
diff --git a/agc_2-X/trunk/www/agc/vdc_form_display.php b/agc_2-X/trunk/www/agc/vdc_form_display.php
index 1576e791..9252edd5 100644
--- a/agc_2-X/trunk/www/agc/vdc_form_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_form_display.php
@@ -223,6 +223,8 @@ if (isset($_GET["orig_URL"]))			{$orig_URL=$_GET["orig_URL"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 
diff --git a/agc_2-X/trunk/www/agc/vdc_script_display.php b/agc_2-X/trunk/www/agc/vdc_script_display.php
index ee61d913..cb1c21e3 100644
--- a/agc_2-X/trunk/www/agc/vdc_script_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_script_display.php
@@ -267,6 +267,8 @@ if (isset($_GET["LOGINvarFIVE"]))			{$LOGINvarFIVE=$_GET["LOGINvarFIVE"];}
 if (isset($_GET["script_span"]))			{$script_span=$_GET["script_span"];}
 	elseif (isset($_POST["script_span"]))	{$script_span=$_POST["script_span"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))
diff --git a/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php b/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php
index 7a8f68fa..9417d3b4 100644
--- a/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php
+++ b/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php
@@ -236,6 +236,9 @@ if (strlen($appointment_time) < 1)
 $appointment_timeARRAY = explode(":",$appointment_time);
 $appointment_hour = $appointment_timeARRAY[0];
 $appointment_min = $appointment_timeARRAY[1];
+
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 ##### END Put custom fields here #####
 
 # if options file exists, use the override values for the above variables
diff --git a/agc_2-X/trunk/www/agc/vdc_script_notes.php b/agc_2-X/trunk/www/agc/vdc_script_notes.php
index a3435acb..80358c65 100644
--- a/agc_2-X/trunk/www/agc/vdc_script_notes.php
+++ b/agc_2-X/trunk/www/agc/vdc_script_notes.php
@@ -207,6 +207,8 @@ $appointment_timeARRAY = explode(":",$appointment_time);
 $appointment_hour = $appointment_timeARRAY[0];
 $appointment_min = $appointment_timeARRAY[1];
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))
diff --git a/agc_2-X/trunk/www/agc/vdc_soundboard_display.php b/agc_2-X/trunk/www/agc/vdc_soundboard_display.php
index a66fb367..8571914f 100644
--- a/agc_2-X/trunk/www/agc/vdc_soundboard_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_soundboard_display.php
@@ -52,6 +52,7 @@ if (isset($_GET["bgcolor"]))			{$bgcolor=$_GET["bgcolor"];}
 if (isset($_GET["bcrypt"]))				{$bcrypt=$_GET["bcrypt"];}
 	elseif (isset($_POST["bcrypt"]))	{$bcrypt=$_POST["bcrypt"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
diff --git a/agc_2-X/trunk/www/chat_customer/customer_chat_functions.php b/agc_2-X/trunk/www/chat_customer/customer_chat_functions.php
index 3e11a1e0..1d90c395 100644
--- a/agc_2-X/trunk/www/chat_customer/customer_chat_functions.php
+++ b/agc_2-X/trunk/www/chat_customer/customer_chat_functions.php
@@ -51,6 +51,7 @@ if (isset($_GET["available_agents"]))				{$available_agents=$_GET["available_age
 if (isset($_GET["show_email"]))						{$show_email=$_GET["show_email"];}
 	elseif (isset($_POST["show_email"]))			{$show_email=$_POST["show_email"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 $chat_member_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/',"",$chat_member_name);
 if (!$user) {echo "No user, no using."; exit;}
 
diff --git a/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php b/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php
index 52b1d879..b7c21610 100644
--- a/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php
@@ -47,6 +47,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 $START_TIME=date("U");
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_API_log_report.php b/agc_2-X/trunk/www/vicidial/AST_API_log_report.php
index b66e9e14..f40dd31a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_API_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_API_log_report.php
@@ -58,6 +58,8 @@ if (isset($_GET["show_urls"]))			{$show_urls=$_GET["show_urls"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name="API Log Report";
 $NOW_DATE = date("Y-m-d");
 if (!isset($users)) {$users=array();}
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php b/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
index fe4cb2f7..7e0ebff3 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
@@ -75,6 +75,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Service Level Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
index 114f9f7f..02c9094d 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
@@ -116,6 +116,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
index 8473dba8..0a03ddee 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
@@ -127,6 +127,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
index 2e30a1e8..acdd4969 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
@@ -80,6 +80,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($exclude_rollover)<2) {$exclude_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Summary Hourly Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_CMstats.php b/agc_2-X/trunk/www/vicidial/AST_CMstats.php
index 74fbb198..6eb6efb4 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CMstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CMstats.php
@@ -45,6 +45,8 @@ if (isset($_GET["report_type"]))			{$report_type=$_GET["report_type"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Callmenu Survey Report';
 $db_source = 'M';
 
diff --git a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php
index 0a163622..68876862 100644
--- a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php
@@ -74,6 +74,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='--';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound DID Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php b/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php
index e5937f46..c7c5ad31 100644
--- a/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php
+++ b/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php
@@ -45,6 +45,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='--';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound DID Summary Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
index ba5e8dff..a2045b16 100644
--- a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
@@ -42,6 +42,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
index 1b3df70b..773af3a1 100644
--- a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
+++ b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
@@ -61,6 +61,8 @@ if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if ($hourly_breakdown) 
 	{
 	$date_int=3600;
diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php
index aa4a3dc0..af86c8ba 100644
--- a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php
@@ -77,6 +77,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($type)<2) {$type='inbound';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($type == 'inbound')
 	{$report_name = 'Inbound IVR Report';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
index eefd6b1e..ebab22cb 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
@@ -53,6 +53,7 @@ $NOW_DATE = date("Y-m-d");
 if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
index 72050892..035ed4e8 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
@@ -60,6 +60,8 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Lists Campaign Statuses Report';
 $db_source = 'M';
 
diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
index ff62f0d4..ef589ccb 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
@@ -57,6 +57,7 @@ if (isset($_GET["use_lists"]))			{$use_lists=$_GET["use_lists"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Lists Pass Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php
index c16bffa1..d8faa721 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php
@@ -48,6 +48,8 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 if (isset($_GET["campaigns_or_lists_rpt"]))				{$campaigns_or_lists_rpt=$_GET["campaigns_or_lists_rpt"];}
 	elseif (isset($_POST["campaigns_or_lists_rpt"]))	{$campaigns_or_lists_rpt=$_POST["campaigns_or_lists_rpt"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Lists Statuses Report';
 $db_source = 'M';
 $JS_text="<script language='Javascript'>\n";
diff --git a/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php b/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
index 6aba2720..bc2ca2ae 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
@@ -41,6 +41,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'List Update Stats';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php b/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
index f0b895a1..de6dc88e 100644
--- a/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
+++ b/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
@@ -79,6 +79,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Outbound Summary Interval Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_VDADstats.php b/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
index 12fd2893..df077318 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
@@ -111,6 +111,7 @@ if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
 if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Outbound Calling Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
index 7421782e..0bba0646 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
@@ -51,6 +51,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_languages,language_method,source_id_display FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
index 5c2ad6f3..8c2c69f2 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
@@ -38,6 +38,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
index f2134de6..7306d3d2 100644
--- a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
+++ b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
@@ -62,6 +62,7 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
 $vicidial_listloader_fields = '|vendor_lead_code|source_id|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|rank|owner|';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php b/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
index 4fbecc6c..32d88f33 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
@@ -46,6 +46,7 @@ if (strlen($shift)<2) {$shift='ALL';}
 $report_name = 'Agent DID Report';
 $db_source = 'M';
 if ($file_download>0) {$DB="";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
index 48b5fad1..96aa9d76 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
@@ -71,6 +71,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Single Agent Daily';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php b/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php
index 50bf584d..35add0f0 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php
@@ -48,6 +48,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Single Agent Daily Time';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php
index 035e65bb..dc3f873a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php
@@ -45,6 +45,8 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_inbound_status.php b/agc_2-X/trunk/www/vicidial/AST_agent_inbound_status.php
index 4de2f36b..be99b9fe 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_inbound_status.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_inbound_status.php
@@ -47,6 +47,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 
 if (strlen($shift)<2) {$shift='ALL';}
 if ($search_archived_data=="checked") {$closer_log_table="vicidial_closer_log_archive";} else {$closer_log_table="vicidial_closer_log";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Agent Inbound Status Summary';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
index da52a489..515d6060 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
@@ -120,6 +120,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 
 if (strlen($shift)<2) {$shift='--';}
 if ($search_archived_data=="checked") {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $TIME_HF_agentperfdetail = 'HF';
 $TIME_H_agentperfdetail = 'H';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php
index 01092658..093f9b60 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php
@@ -77,8 +77,8 @@ if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
-
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Agent Performance Detail';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_mobile.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_mobile.php
index 3a07f062..efe95b03 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_mobile.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_mobile.php
@@ -60,6 +60,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 
 if (strlen($shift)<2) {$shift='--';}
 if ($search_archived_data=="checked") {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $TIME_HF_agentperfdetail = 'HF';
 $TIME_H_agentperfdetail = 'H';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
index e4e437b5..99ec1cc6 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
@@ -77,6 +77,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 	elseif (isset($_POST["show_defunct_users"]))	{$show_defunct_users=$_POST["show_defunct_users"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 if ($search_archived_data=="checked") {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
 
 $report_name = 'Agent Status Detail';
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
index afb73ebe..64fb736b 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
@@ -106,6 +106,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($stage)<2) {$stage='NAME';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($search_archived_data=="checked") 
 	{
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
index 6a3f2896..818b2a12 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
@@ -64,6 +64,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($stage)<2) {$stage='ID';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 require("screen_colors.php");
 
diff --git a/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php b/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
index 38c1ea85..0de22da2 100644
--- a/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
@@ -70,6 +70,7 @@ if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
 if (!isset($end_date_D)) {$end_date_D=$NOW_DATE;}
 if (!isset($query_date_T)) {$query_date_T="00:00:00";}
 if (!isset($end_date_T)) {$end_date_T="23:59:59";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php b/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
index ef401c4d..5cdbcf7f 100644
--- a/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
@@ -52,6 +52,8 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php b/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php
index 1b1871dc..8f945d44 100644
--- a/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php
@@ -64,8 +64,8 @@ if (isset($_GET["download_user"]))				{$download_user=$_GET["download_user"];}
 if (isset($_GET["download_manager"]))				{$download_manager=$_GET["download_manager"];}
 	elseif (isset($_POST["download_manager"]))	{$download_manager=$_POST["download_manager"];}
 
-
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Agent-Manager Chat Log';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php b/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php
index ecfa6cf5..fff23ea6 100644
--- a/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php
@@ -156,6 +156,7 @@ if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($server_ip)) {$server_ip = array();}
 if (!isset($sip_hangup_cause)) {$sip_hangup_cause = array();}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php b/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
index 38016283..84d208fc 100644
--- a/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
@@ -70,6 +70,7 @@ $STARTtime = date("U");
 if (!isset($group)) {$group = array();}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 $report_name = 'Dialer Inventory Report';
diff --git a/agc_2-X/trunk/www/vicidial/AST_email_log_display.php b/agc_2-X/trunk/www/vicidial/AST_email_log_display.php
index 35b82bee..db9f80b5 100644
--- a/agc_2-X/trunk/www/vicidial/AST_email_log_display.php
+++ b/agc_2-X/trunk/www/vicidial/AST_email_log_display.php
@@ -29,6 +29,8 @@ if (isset($_GET["email_row_id"]))	{$email_row_id=$_GET["email_row_id"];}
 if (isset($_GET["email_log_id"]))	{$email_log_id=$_GET["email_log_id"];}
 	elseif (isset($_POST["email_log_id"]))	{$email_log_id=$_POST["email_log_id"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0
diff --git a/agc_2-X/trunk/www/vicidial/AST_email_log_report.php b/agc_2-X/trunk/www/vicidial/AST_email_log_report.php
index 6abb5a29..fbe6904a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_email_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_email_log_report.php
@@ -70,6 +70,7 @@ if (isset($_GET["end_date"]))				{$end_date=$_GET["end_date"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Email Log Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php b/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
index c82a868a..499e8ca9 100644
--- a/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
@@ -62,6 +62,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 $START_TIME=date("U");
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php b/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
index d1f89343..1498a25a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
@@ -82,6 +82,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Daily Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
index 750f0d8f..6d582010 100644
--- a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
+++ b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
@@ -98,6 +98,7 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Forecasting Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php b/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php
index 1f886f7b..c2d39ec0 100644
--- a/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php
@@ -61,6 +61,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Performance Comparison Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_quality_control_report.php b/agc_2-X/trunk/www/vicidial/AST_quality_control_report.php
index f61549e4..7b28e5a8 100644
--- a/agc_2-X/trunk/www/vicidial/AST_quality_control_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_quality_control_report.php
@@ -66,6 +66,8 @@ if (isset($_GET["search_archived_data"]))					{$search_archived_data=$_GET["sear
 if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Quality Control Report';
 $db_source = 'M';
 $report_display_type="HTML";
diff --git a/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php b/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php
index 3d0a058a..5670d20d 100644
--- a/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php
@@ -54,6 +54,8 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name="Recording Access Log Report";
 $NOW_DATE = date("Y-m-d");
 if (!isset($users)) {$users=array();}
diff --git a/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php b/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php
index 839a1462..7e7144fb 100644
--- a/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php
@@ -65,6 +65,7 @@ if (!isset($report_display_type)) {$report_display_type = "HTML";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
 if (!isset($order_by)) {$order_by="monitor_start_time-asc";} 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Monitoring Log Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_server_performance.php b/agc_2-X/trunk/www/vicidial/AST_server_performance.php
index 04170cc7..8503638d 100644
--- a/agc_2-X/trunk/www/vicidial/AST_server_performance.php
+++ b/agc_2-X/trunk/www/vicidial/AST_server_performance.php
@@ -53,6 +53,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Server Performance Report';
 $db_source = 'M';
 
diff --git a/agc_2-X/trunk/www/vicidial/AST_source_vlc_status_report.php b/agc_2-X/trunk/www/vicidial/AST_source_vlc_status_report.php
index 7c7c5ada..49dae984 100644
--- a/agc_2-X/trunk/www/vicidial/AST_source_vlc_status_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_source_vlc_status_report.php
@@ -58,6 +58,7 @@ if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
 if (!isset($end_date_D)) {$end_date_D=$NOW_DATE;}
 if (!isset($query_date_T)) {$query_date_T="00:00:00";}
 if (!isset($end_date_T)) {$end_date_T="23:59:59";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php b/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
index 2f2e3541..35590a6e 100644
--- a/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
@@ -73,6 +73,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 if (isset($_GET["show_all_users"]))			{$show_all_users=$_GET["show_all_users"];}
 	elseif (isset($_POST["show_all_users"]))	{$show_all_users=$_POST["show_all_users"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Team Performance Detail';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php
index e564e3f6..441ec2a5 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php
@@ -125,10 +125,11 @@
 # 210615-2241 - Fix for issue #1314
 # 210618-1011 - Added CORS support
 # 210625-1432 - Added options.php RS_BargeSwap variable
+# 220217-2045 - Added input variable filters
 #
 
-$version = '2.14-110';
-$build = '210625-1432';
+$version = '2.14-111';
+$build = '220217-2045';
 $php_script='AST_timeonVDADall.php';
 
 require("dbconnect_mysqli.php");
@@ -252,6 +253,8 @@ if (isset($_GET["parkSTATS"]))			{$parkSTATS=$_GET["parkSTATS"];}
 if (isset($_GET["SLAinSTATS"]))				{$SLAinSTATS=$_GET["SLAinSTATS"];}
 	elseif (isset($_POST["SLAinSTATS"]))	{$SLAinSTATS=$_POST["SLAinSTATS"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # defaults
 $RS_BargeSwap=0;
 
@@ -413,6 +416,46 @@ else
 	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
 	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
 	}
+$RR = preg_replace('/[^0-9]/', '', $RR);
+$inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
+$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+$groups[0] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[0]);
+$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup);
+$DB = preg_replace('/[^0-9]/', '', $DB);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK);
+$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK);
+$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay);
+$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname);
+$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby);
+$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay);
+$CALLSdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CALLSdisplay);
+$PHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHONEdisplay);
+$CUSTPHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTPHONEdisplay);
+$CUSTINFOdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTINFOdisplay);
+if ($CUSTINFOdisplay==1)	{$CUSTPHONEdisplay=0;}	# only one of these should be on at one time
+if ($CUSTPHONEdisplay==1)	{$CUSTINFOdisplay=0;}	# only one of these should be on at one time
+$NOLEADSalert = preg_replace('/[^-_0-9a-zA-Z]/', '', $NOLEADSalert);
+$DROPINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $DROPINGROUPstats);
+$ALLINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $ALLINGROUPstats);
+$with_inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $with_inbound);
+$monitor_active = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_active);
+$monitor_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_phone);
+$CARRIERstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $CARRIERstats);
+$PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats);
+$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS);
+$parkSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $parkSTATS);
+$SLAinSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $SLAinSTATS);
+$INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE);
+$droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$mobile_device = preg_replace('/[^-_0-9a-zA-Z]/', '', $mobile_device);
+$RTajax = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTajax);
+$RTpass = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTpass);
+$RTuser = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTuser);
+$server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
index 7fd4c9d9..8a5ba474 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
@@ -84,6 +84,7 @@ if (!isset($UGdisplay))		{$UGdisplay=0;}	# 0=no, 1=yes
 if (!isset($UidORname))		{$UidORname=0;}	# 0=id, 1=name
 if (!isset($orderby))		{$orderby='timeup';}
 if (!isset($SERVdisplay))	{$SERVdisplay=1;}	# 0=no, 1=yes
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 function get_server_load($windows = false) {
 $os = strtolower(PHP_OS);
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
index d05ab71a..a5ee1d91 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
@@ -57,6 +57,7 @@ if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 
 if (!isset($RR))			{$gRRroup=4;}
 if (!isset($types))			{$types='SHOW ALL CAMPAIGNS';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 $report_name = 'Real-Time Campaign Summary';
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php
index 8ef10e4b..da531ce0 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php
@@ -42,6 +42,7 @@ if (isset($_GET["browser_dimension"]))	{$browser_dimension=$_GET["browser_dimens
 if (!isset($browser_dimension))			{$browser_dimension=800;}
 if (!isset($types))			{$types='LIST ALL CAMPAIGNS';}
 $cell_dimension=floor($browser_dimension/10);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Campaign Summary';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php
index 861fd8ba..36bc94ff 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php
@@ -100,6 +100,7 @@ if (isset($_GET["RTdisplay_type"]))			{$RTdisplay_type=$_GET["RTdisplay_type"];}
 if (isset($_GET["mobile_device"]))				{$mobile_device=$_GET["mobile_device"];}
 	elseif (isset($_POST["mobile_device"]))	{$mobile_device=$_POST["mobile_device"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Main Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
index 53e741f3..9cd4db92 100644
--- a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
@@ -54,6 +54,7 @@ if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($url_type)) {$url_type = array();}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
index afc9af14..3aa609c7 100644
--- a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
@@ -56,6 +56,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'User Group Hourly Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php
index ddaa5e9f..d639c1ac 100644
--- a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php
+++ b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php
@@ -61,6 +61,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'User Group Detail Hourly Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
index 379377dc..c0a75145 100644
--- a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
@@ -50,6 +50,8 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'User Group Login Report';
 $db_source = 'M';
 
diff --git a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
index d65d0ba5..0947a41a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
@@ -49,6 +49,7 @@ if (isset($_GET["submit"]))					{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
index 25cb7d60..c1838f2c 100644
--- a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
@@ -52,6 +52,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 $NOW_DATE = date("Y-m-d");
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
diff --git a/agc_2-X/trunk/www/vicidial/DNCcom_inbound_filter.php b/agc_2-X/trunk/www/vicidial/DNCcom_inbound_filter.php
index 8437405f..ca8f1c7e 100644
--- a/agc_2-X/trunk/www/vicidial/DNCcom_inbound_filter.php
+++ b/agc_2-X/trunk/www/vicidial/DNCcom_inbound_filter.php
@@ -44,6 +44,8 @@ if (isset($_GET["in_filter_override"]))				{$in_filter_override=$_GET["in_filter
 if (isset($_GET["in_cache_override"]))			{$in_cache_override=$_GET["in_cache_override"];}
 	elseif (isset($_POST["in_cache_override"]))	{$in_cache_override=$_POST["in_cache_override"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/Erlang_report.php b/agc_2-X/trunk/www/vicidial/Erlang_report.php
index a21536bf..01c14b77 100644
--- a/agc_2-X/trunk/www/vicidial/Erlang_report.php
+++ b/agc_2-X/trunk/www/vicidial/Erlang_report.php
@@ -98,6 +98,7 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Advanced Forecasting Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/KHOMP_admin.php b/agc_2-X/trunk/www/vicidial/KHOMP_admin.php
index 3f2e4003..06c74f30 100644
--- a/agc_2-X/trunk/www/vicidial/KHOMP_admin.php
+++ b/agc_2-X/trunk/www/vicidial/KHOMP_admin.php
@@ -102,6 +102,8 @@ if (isset($_GET["update_status"]))				{$update_status=$_GET["update_status"];}
 if (isset($_GET["update_dialstatus"]))				{$update_dialstatus=$_GET["update_dialstatus"];}
 	elseif (isset($_POST["update_dialstatus"]))	{$update_dialstatus=$_POST["update_dialstatus"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $SQLdate = date("Y-m-d H:i:s");
 $date = date("r");
 $ip = getenv("REMOTE_ADDR");
diff --git a/agc_2-X/trunk/www/vicidial/QM_live_monitor.php b/agc_2-X/trunk/www/vicidial/QM_live_monitor.php
index 285530d9..e07381ff 100644
--- a/agc_2-X/trunk/www/vicidial/QM_live_monitor.php
+++ b/agc_2-X/trunk/www/vicidial/QM_live_monitor.php
@@ -48,6 +48,7 @@ if (isset($_GET["extension"]))			{$extension=$_GET["extension"];}
 if (isset($_GET["stage"]))				{$stage=$_GET["stage"];}
 	elseif (isset($_POST["stage"]))		{$stage=$_POST["stage"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 $call = preg_replace('/[^0-9a-zA-Z]/', '', $call);
 $user = preg_replace('/[^0-9a-zA-Z]/', '', $user);
 $extension = preg_replace("/'|\"|\\\\|;/", '', $extension);
diff --git a/agc_2-X/trunk/www/vicidial/TCPAlitigatorlist_inbound_filter.php b/agc_2-X/trunk/www/vicidial/TCPAlitigatorlist_inbound_filter.php
index 8c54c963..e1949639 100644
--- a/agc_2-X/trunk/www/vicidial/TCPAlitigatorlist_inbound_filter.php
+++ b/agc_2-X/trunk/www/vicidial/TCPAlitigatorlist_inbound_filter.php
@@ -37,6 +37,8 @@ if (isset($_GET["in_filter_override"]))				{$in_filter_override=$_GET["in_filter
 if (isset($_GET["in_cache_override"]))			{$in_cache_override=$_GET["in_cache_override"];}
 	elseif (isset($_POST["in_cache_override"]))	{$in_cache_override=$_POST["in_cache_override"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php
index 254b14bf..229aa13c 100644
--- a/agc_2-X/trunk/www/vicidial/admin.php
+++ b/agc_2-X/trunk/www/vicidial/admin.php
@@ -2704,6 +2704,7 @@ if (isset($_GET["pause_max_url"]))			{$pause_max_url=$_GET["pause_max_url"];}
 if (isset($_GET["agent_hide_hangup"]))			{$agent_hide_hangup=$_GET["agent_hide_hangup"];}
 	elseif (isset($_POST["agent_hide_hangup"]))	{$agent_hide_hangup=$_POST["agent_hide_hangup"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if (isset($script_id)) {$script_id= mb_strtoupper($script_id,'utf-8');}
 if (isset($lead_filter_id)) {$lead_filter_id = mb_strtoupper($lead_filter_id,'utf-8');}
@@ -5819,12 +5820,13 @@ if ($SSscript_remove_js > 0)
 # 220215-1011 - Fix for XSS multi-script security issue
 # 220215-1431 - Additional XSS script text variable filtering
 # 220217-1727 - Added agent_hide_hangup system and campaign settings
+# 220217-2022 - Added input variable filtering
 #
 
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
 
-$admin_version = '2.14-846a';
-$build = '220217-1727';
+$admin_version = '2.14-847a';
+$build = '220217-2022';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");
diff --git a/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php b/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php
index d0f9f353..e2aadf1f 100644
--- a/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php
+++ b/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php
@@ -57,6 +57,7 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
 $block_scheduling_while_running=0;
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_amm_multi.php b/agc_2-X/trunk/www/vicidial/admin_amm_multi.php
index 50c99797..c38b5f05 100644
--- a/agc_2-X/trunk/www/vicidial/admin_amm_multi.php
+++ b/agc_2-X/trunk/www/vicidial/admin_amm_multi.php
@@ -56,6 +56,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php b/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php
index 2b757067..5eeab797 100644
--- a/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php
+++ b/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php
@@ -87,6 +87,7 @@ if (isset($_POST["USERdelete_from"]))				{$USERdelete_from=$_POST["USERdelete_fr
 if (isset($_POST["USERdelete_from_CONFIRMED"]))		{$USERdelete_from_CONFIRMED=$_POST["USERdelete_from_CONFIRMED"];}
 if (isset($_POST["DIDto_delete_TB"]))				{$DIDto_delete_TB=$_POST["DIDto_delete_TB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($DB) {echo "$form_to_run|";}
 
diff --git a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
index 53707bf3..11f511f8 100644
--- a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
+++ b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
@@ -50,6 +50,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_email_accounts.php b/agc_2-X/trunk/www/vicidial/admin_email_accounts.php
index 70275955..d74e57dc 100644
--- a/agc_2-X/trunk/www/vicidial/admin_email_accounts.php
+++ b/agc_2-X/trunk/www/vicidial/admin_email_accounts.php
@@ -95,6 +95,8 @@ if (isset($_GET["call_handle_method"]))						{$call_handle_method=$_GET["call_ha
 if (isset($_GET["agent_search_method"]))					{$agent_search_method=$_GET["agent_search_method"];}
 	elseif (isset($_POST["agent_search_method"]))			{$agent_search_method=$_POST["agent_search_method"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,enable_languages,language_method,active_modules,enable_auto_reports FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/admin_languages.php b/agc_2-X/trunk/www/vicidial/admin_languages.php
index 51b30322..8daba5c2 100644
--- a/agc_2-X/trunk/www/vicidial/admin_languages.php
+++ b/agc_2-X/trunk/www/vicidial/admin_languages.php
@@ -82,6 +82,7 @@ else
 	}
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php b/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php
index e6738962..94c88827 100644
--- a/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php
+++ b/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php
@@ -31,6 +31,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 
 $block_scheduling_while_running=0;
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
index 3a81373d..67829279 100644
--- a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
+++ b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
@@ -204,6 +204,8 @@ if (isset($_GET["international_dnc_scrub"]))			{$international_dnc_scrub=$_GET["
 if (strlen($dedupe_statuses_override)>0) {
 	$dedupe_statuses=explode(",", $dedupe_statuses_override);
 }
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if the didnt select an over ride wipe out in_file
 if ( $list_id_override == "in_file" ) { $list_id_override = ""; }
 if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; }
diff --git a/agc_2-X/trunk/www/vicidial/admin_lists_custom.php b/agc_2-X/trunk/www/vicidial/admin_lists_custom.php
index 43535afd..5c2f8cc3 100644
--- a/agc_2-X/trunk/www/vicidial/admin_lists_custom.php
+++ b/agc_2-X/trunk/www/vicidial/admin_lists_custom.php
@@ -1,7 +1,7 @@
 <?php
 # admin_lists_custom.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen manages the custom lists fields in ViciDial
 #
@@ -56,10 +56,11 @@
 # 210211-0032 - Added SOURCESELECT field type
 # 210304-2039 - Added option to "re-rank" field ranks when adding/updating a field in the middle of the form
 # 210311-2338 - Added BUTTON field type and 2FA
+# 220217-2004 - Added input variable filtering
 #
 
-$admin_version = '2.14-47';
-$build = '210311-2338';
+$admin_version = '2.14-48';
+$build = '220217-2004';
 
 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -123,6 +124,8 @@ if (isset($_GET["SUBMIT"]))						{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["field_rerank"]))				{$field_rerank=$_GET["field_rerank"];}
 	elseif (isset($_POST["field_rerank"]))		{$field_rerank=$_POST["field_rerank"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/admin_mobile.php b/agc_2-X/trunk/www/vicidial/admin_mobile.php
index 6510ad94..457fba4a 100644
--- a/agc_2-X/trunk/www/vicidial/admin_mobile.php
+++ b/agc_2-X/trunk/www/vicidial/admin_mobile.php
@@ -154,6 +154,7 @@ if (!file_exists('old_clear'))
 
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 #############################################
diff --git a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php
index b0d8db89..6b9e4f25 100644
--- a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php
+++ b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php
@@ -246,6 +246,7 @@ if ($archive_search=="Yes") {$vl_table="vicidial_list_archive";}
 else {$vl_table="vicidial_list"; $archive_search="No";}
 $altCIDdisplay="Yes";
 if ($CIDdisplay=="Yes") {$altCIDdisplay="No";} 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
diff --git a/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php b/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php
index bd8c04d4..f016c8c2 100644
--- a/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php
+++ b/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php
@@ -73,6 +73,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_search_lead.php b/agc_2-X/trunk/www/vicidial/admin_search_lead.php
index 7bdb75cf..d80be39a 100644
--- a/agc_2-X/trunk/www/vicidial/admin_search_lead.php
+++ b/agc_2-X/trunk/www/vicidial/admin_search_lead.php
@@ -102,6 +102,8 @@ if (isset($_GET["archive_search"]))			{$archive_search=$_GET["archive_search"];}
 if (isset($_GET["called_count"]))			{$called_count=$_GET["called_count"];}
 	elseif (isset($_POST["called_count"]))	{$called_count=$_POST["called_count"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,qc_features_active FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/admin_soundboard.php b/agc_2-X/trunk/www/vicidial/admin_soundboard.php
index 6cc3bafb..be3976c6 100644
--- a/agc_2-X/trunk/www/vicidial/admin_soundboard.php
+++ b/agc_2-X/trunk/www/vicidial/admin_soundboard.php
@@ -85,6 +85,7 @@ if (isset($_GET["ConFiRm"]))					{$ConFiRm=$_GET["ConFiRm"];}
 if (isset($_GET["SUBMIT"]))						{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))			{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_url_multi.php b/agc_2-X/trunk/www/vicidial/admin_url_multi.php
index 0e89d6ef..e65d68b4 100644
--- a/agc_2-X/trunk/www/vicidial/admin_url_multi.php
+++ b/agc_2-X/trunk/www/vicidial/admin_url_multi.php
@@ -63,6 +63,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/admin_user_list_new.php b/agc_2-X/trunk/www/vicidial/admin_user_list_new.php
index 438b1d68..59fcd422 100644
--- a/agc_2-X/trunk/www/vicidial/admin_user_list_new.php
+++ b/agc_2-X/trunk/www/vicidial/admin_user_list_new.php
@@ -42,6 +42,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/asterisk_debug.php b/agc_2-X/trunk/www/vicidial/asterisk_debug.php
index a32d2a0c..ddfa0296 100644
--- a/agc_2-X/trunk/www/vicidial/asterisk_debug.php
+++ b/agc_2-X/trunk/www/vicidial/asterisk_debug.php
@@ -29,6 +29,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/audio_store.php b/agc_2-X/trunk/www/vicidial/audio_store.php
index 659b9594..a27c4db8 100644
--- a/agc_2-X/trunk/www/vicidial/audio_store.php
+++ b/agc_2-X/trunk/www/vicidial/audio_store.php
@@ -83,6 +83,7 @@ if (isset($_GET["lead_file"]))				{$lead_file=$_GET["lead_file"];}
 if (isset($_GET["force_allow"]))			{$force_allow=$_GET["force_allow"];}
 	elseif (isset($_POST["force_allow"]))	{$force_allow=$_POST["force_allow"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
diff --git a/agc_2-X/trunk/www/vicidial/bench_agent_assign.php b/agc_2-X/trunk/www/vicidial/bench_agent_assign.php
index db5a2997..5d11b53b 100644
--- a/agc_2-X/trunk/www/vicidial/bench_agent_assign.php
+++ b/agc_2-X/trunk/www/vicidial/bench_agent_assign.php
@@ -36,6 +36,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/call_report_export.php b/agc_2-X/trunk/www/vicidial/call_report_export.php
index 7086842e..9bdf57db 100644
--- a/agc_2-X/trunk/www/vicidial/call_report_export.php
+++ b/agc_2-X/trunk/www/vicidial/call_report_export.php
@@ -113,6 +113,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Export Calls Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php b/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
index e1edbf0a..659a2c33 100644
--- a/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
+++ b/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
@@ -70,6 +70,7 @@ if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Export Calls Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php b/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php
index 6e830c6f..99ed60b0 100644
--- a/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php
+++ b/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php
@@ -1,7 +1,7 @@
 <?php
 # callbacks_bulk_change.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 120819-0119 - First build
@@ -15,6 +15,7 @@
 # 170409-1547 - Added IP List validation code
 # 170822-2255 - Added screen color settings
 # 170829-0040 - Added screen color settings
+# 220217-2220 - Added input variable filtering
 #
 
 require("dbconnect_mysqli.php");
@@ -43,6 +44,8 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["convert_to_anyone"]))			{$convert_to_anyone=$_GET["convert_to_anyone"];}
 	elseif (isset($_POST["convert_to_anyone"]))	{$convert_to_anyone=$_POST["convert_to_anyone"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;";
@@ -65,11 +68,19 @@ if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$old_user = preg_replace('/[^-_0-9a-zA-Z]/', '', $old_user);
+	$new_user = preg_replace('/[^-_0-9a-zA-Z]/', '', $new_user);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage);
 	}
 else
 	{
 	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
 	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$old_user = preg_replace('/[^-_0-9a-zA-Z]/', '', $old_user);
+	$new_user = preg_replace('/[^-_0-9\p{L}]/u', '', $new_user);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$stage = preg_replace('/[^-_0-9\p{L}]/u', '', $stage);
 	}
 
 $StarTtimE = date("U");
diff --git a/agc_2-X/trunk/www/vicidial/callbacks_bulk_move.php b/agc_2-X/trunk/www/vicidial/callbacks_bulk_move.php
index c40c4e31..458a8cf8 100644
--- a/agc_2-X/trunk/www/vicidial/callbacks_bulk_move.php
+++ b/agc_2-X/trunk/www/vicidial/callbacks_bulk_move.php
@@ -61,6 +61,8 @@ if (isset($_GET["purge_uncalled_records"]))			{$purge_uncalled_records=$_GET["pu
 if (isset($_GET["revert_status"]))			{$revert_status=$_GET["revert_status"];}
 	elseif (isset($_POST["revert_status"]))	{$revert_status=$_POST["revert_status"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/callbacks_export.php b/agc_2-X/trunk/www/vicidial/callbacks_export.php
index 021bf7d3..4fdd0b23 100644
--- a/agc_2-X/trunk/www/vicidial/callbacks_export.php
+++ b/agc_2-X/trunk/www/vicidial/callbacks_export.php
@@ -54,6 +54,8 @@ if (isset($_GET["callback_time_start"]))			{$callback_time_start=$_GET["callback
 if (isset($_GET["callback_time_end"]))			{$callback_time_end=$_GET["callback_time_end"];}
 	elseif (isset($_POST["callback_time_end"]))	{$callback_time_end=$_POST["callback_time_end"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/callcard_admin.php b/agc_2-X/trunk/www/vicidial/callcard_admin.php
index a52cd3e5..fd052191 100644
--- a/agc_2-X/trunk/www/vicidial/callcard_admin.php
+++ b/agc_2-X/trunk/www/vicidial/callcard_admin.php
@@ -84,6 +84,8 @@ if (isset($_GET["user"]))					{$user=$_GET["user"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'CallCard Search';
 $SEARCHONLY=0;
 
diff --git a/agc_2-X/trunk/www/vicidial/callcard_report_export.php b/agc_2-X/trunk/www/vicidial/callcard_report_export.php
index 4de029d1..98e0b261 100644
--- a/agc_2-X/trunk/www/vicidial/callcard_report_export.php
+++ b/agc_2-X/trunk/www/vicidial/callcard_report_export.php
@@ -52,6 +52,7 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php b/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php
index efb0bb4d..e8ab9fe1 100644
--- a/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php
+++ b/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php
@@ -62,6 +62,7 @@ if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
 if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Called Counts List IDs Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/callerID_log_report.php b/agc_2-X/trunk/www/vicidial/callerID_log_report.php
index 63e42332..38b81f2e 100644
--- a/agc_2-X/trunk/www/vicidial/callerID_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/callerID_log_report.php
@@ -47,6 +47,7 @@ if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Caller ID Log Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/campaign_debug.php b/agc_2-X/trunk/www/vicidial/campaign_debug.php
index b9ccf734..18dbb8f4 100644
--- a/agc_2-X/trunk/www/vicidial/campaign_debug.php
+++ b/agc_2-X/trunk/www/vicidial/campaign_debug.php
@@ -39,6 +39,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php b/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php
index e8163f89..1bfb0fb7 100644
--- a/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php
+++ b/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php
@@ -38,6 +38,8 @@ if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 if (isset($_GET["browser_dimension"]))	{$browser_dimension=$_GET["browser_dimension"];}
 	elseif (isset($_POST["browser_dimension"]))	{$browser_dimension=$_POST["browser_dimension"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php b/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php
index e540a4cf..fba8375d 100644
--- a/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php
+++ b/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php
@@ -106,6 +106,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php b/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php
index a2b29fbc..09589b3e 100644
--- a/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php
+++ b/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php
@@ -106,6 +106,7 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/closer.php b/agc_2-X/trunk/www/vicidial/closer.php
index bf03d166..5d1f5307 100644
--- a/agc_2-X/trunk/www/vicidial/closer.php
+++ b/agc_2-X/trunk/www/vicidial/closer.php
@@ -58,6 +58,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/closer_dispo.php b/agc_2-X/trunk/www/vicidial/closer_dispo.php
index 3f5c136b..68ca7df2 100644
--- a/agc_2-X/trunk/www/vicidial/closer_dispo.php
+++ b/agc_2-X/trunk/www/vicidial/closer_dispo.php
@@ -93,6 +93,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/closer_popup.php b/agc_2-X/trunk/www/vicidial/closer_popup.php
index 4296ee66..c3bf2cd3 100644
--- a/agc_2-X/trunk/www/vicidial/closer_popup.php
+++ b/agc_2-X/trunk/www/vicidial/closer_popup.php
@@ -59,6 +59,7 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/display_help.php b/agc_2-X/trunk/www/vicidial/display_help.php
index 224caf22..0c003b65 100644
--- a/agc_2-X/trunk/www/vicidial/display_help.php
+++ b/agc_2-X/trunk/www/vicidial/display_help.php
@@ -26,6 +26,7 @@ if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
 $help_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$help_id);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/fcstats.php b/agc_2-X/trunk/www/vicidial/fcstats.php
index 4e836d37..83942899 100644
--- a/agc_2-X/trunk/www/vicidial/fcstats.php
+++ b/agc_2-X/trunk/www/vicidial/fcstats.php
@@ -72,6 +72,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 $report_name = 'Fronter - Closer Report';
diff --git a/agc_2-X/trunk/www/vicidial/fcstats_detail.php b/agc_2-X/trunk/www/vicidial/fcstats_detail.php
index f0dd9930..e7fa5fe7 100644
--- a/agc_2-X/trunk/www/vicidial/fcstats_detail.php
+++ b/agc_2-X/trunk/www/vicidial/fcstats_detail.php
@@ -84,6 +84,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
diff --git a/agc_2-X/trunk/www/vicidial/force_agent_logout.php b/agc_2-X/trunk/www/vicidial/force_agent_logout.php
index 3a49606d..282870c3 100644
--- a/agc_2-X/trunk/www/vicidial/force_agent_logout.php
+++ b/agc_2-X/trunk/www/vicidial/force_agent_logout.php
@@ -40,6 +40,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/lead_report_export.php b/agc_2-X/trunk/www/vicidial/lead_report_export.php
index 240ace78..7c4c5be4 100644
--- a/agc_2-X/trunk/www/vicidial/lead_report_export.php
+++ b/agc_2-X/trunk/www/vicidial/lead_report_export.php
@@ -102,6 +102,7 @@ if (isset($_GET["exclude_call_log_data"]))			{$exclude_call_log_data=$_GET["excl
 
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Export Leads Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/leadloader_template_display.php b/agc_2-X/trunk/www/vicidial/leadloader_template_display.php
index befd705c..f2451b81 100644
--- a/agc_2-X/trunk/www/vicidial/leadloader_template_display.php
+++ b/agc_2-X/trunk/www/vicidial/leadloader_template_display.php
@@ -48,6 +48,8 @@ if (isset($_GET["buffer"]))				{$buffer=$_GET["buffer"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/list_download.php b/agc_2-X/trunk/www/vicidial/list_download.php
index 699fc3f9..d36497bb 100644
--- a/agc_2-X/trunk/www/vicidial/list_download.php
+++ b/agc_2-X/trunk/www/vicidial/list_download.php
@@ -64,6 +64,7 @@ if (isset($_GET["download_type"]))			{$download_type=$_GET["download_type"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
 if ($group_id=='SYSTEM_INTERNAL') {$download_type='systemdnc';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Download List';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/manager_chat_actions.php b/agc_2-X/trunk/www/vicidial/manager_chat_actions.php
index db969667..7e330405 100644
--- a/agc_2-X/trunk/www/vicidial/manager_chat_actions.php
+++ b/agc_2-X/trunk/www/vicidial/manager_chat_actions.php
@@ -44,6 +44,8 @@ if (isset($_GET["reload_chat_span"]))			{$reload_chat_span=$_GET["reload_chat_sp
 if (isset($_GET["action"]))						{$action=$_GET["action"];}
 	elseif (isset($_POST["action"]))			{$action=$_POST["action"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/manager_chat_interface.php b/agc_2-X/trunk/www/vicidial/manager_chat_interface.php
index 8aa85558..db87b571 100644
--- a/agc_2-X/trunk/www/vicidial/manager_chat_interface.php
+++ b/agc_2-X/trunk/www/vicidial/manager_chat_interface.php
@@ -54,6 +54,7 @@ if (isset($_GET["submit_chat"]))						{$submit_chat=$_GET["submit_chat"];}
 	elseif (isset($_POST["submit_chat"]))				{$submit_chat=$_POST["submit_chat"];}
 if (!$allow_replies) {$allow_replies="N";}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php b/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php
index 6bbfdd76..b401a1d2 100644
--- a/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php
+++ b/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php
@@ -56,6 +56,7 @@ if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
 if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $today=date("Y-m-d");
 
diff --git a/agc_2-X/trunk/www/vicidial/non_agent_api.php b/agc_2-X/trunk/www/vicidial/non_agent_api.php
index d10a1a6b..584dba9f 100644
--- a/agc_2-X/trunk/www/vicidial/non_agent_api.php
+++ b/agc_2-X/trunk/www/vicidial/non_agent_api.php
@@ -724,6 +724,8 @@ if ($qm_conf_ct > 0)
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$DB=preg_replace('/[^0-9]/','',$DB);
+
 if ($non_latin < 1)
 	{
 	$users=preg_replace('/[^-_0-9a-zA-Z\,]/','',$users);
@@ -738,7 +740,6 @@ if ($non_latin < 1)
 	$status_breakdown = preg_replace('/[^1Y]/','',$status_breakdown);
 	$show_percentages = preg_replace('/[^1Y]/','',$show_percentages);
 
-	$DB=preg_replace('/[^0-9]/','',$DB);
 	$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user);
 	$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
 	$agent_user=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user);
diff --git a/agc_2-X/trunk/www/vicidial/process_report.php b/agc_2-X/trunk/www/vicidial/process_report.php
index 4750fde6..80053a0c 100644
--- a/agc_2-X/trunk/www/vicidial/process_report.php
+++ b/agc_2-X/trunk/www/vicidial/process_report.php
@@ -27,6 +27,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/qc_api.php b/agc_2-X/trunk/www/vicidial/qc_api.php
index e49f00ae..d075678b 100644
--- a/agc_2-X/trunk/www/vicidial/qc_api.php
+++ b/agc_2-X/trunk/www/vicidial/qc_api.php
@@ -134,6 +134,8 @@ if (isset($_GET["consultative"]))				{$consultative=$_GET["consultative"];}
 if (isset($_GET["DB"]))							{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))				{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0
diff --git a/agc_2-X/trunk/www/vicidial/qc_call_client_iframe.php b/agc_2-X/trunk/www/vicidial/qc_call_client_iframe.php
index ba02dce6..d45c0523 100644
--- a/agc_2-X/trunk/www/vicidial/qc_call_client_iframe.php
+++ b/agc_2-X/trunk/www/vicidial/qc_call_client_iframe.php
@@ -132,6 +132,8 @@ if (isset($_POST["appointment_date"]))			{$appointment_date=$_POST["appointment_
 if (isset($_POST["appointment_time"]))			{$appointment_time=$_POST["appointment_time"];}
 	elseif (isset($_GET["appointment_time"]))	{$appointment_time=$_GET["appointment_time"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
diff --git a/agc_2-X/trunk/www/vicidial/qc_module_actions.php b/agc_2-X/trunk/www/vicidial/qc_module_actions.php
index 3d2a22e7..186532f4 100644
--- a/agc_2-X/trunk/www/vicidial/qc_module_actions.php
+++ b/agc_2-X/trunk/www/vicidial/qc_module_actions.php
@@ -146,6 +146,8 @@ if (isset($_POST["upd_customer"]))			{$upd_customer=$_POST["upd_customer"];}
 if (isset($_POST["view_epoch"]))			{$view_epoch=$_POST["view_epoch"];}
 	elseif (isset($_GET["view_epoch"]))	{$view_epoch=$_GET["view_epoch"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $defaultappointment = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
diff --git a/agc_2-X/trunk/www/vicidial/realtime_report.php b/agc_2-X/trunk/www/vicidial/realtime_report.php
index 52adfb9b..7aec9991 100644
--- a/agc_2-X/trunk/www/vicidial/realtime_report.php
+++ b/agc_2-X/trunk/www/vicidial/realtime_report.php
@@ -1,7 +1,7 @@
 <?php 
 # realtime_report.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -54,12 +54,13 @@
 # 201107-2254 - Added optional display of parked calls stats, inbound SLA and LIMITED report type
 # 210314-2039 - Added DID Description for inbound calls
 # 211216-0846 - Added new User Group options
+# 220217-2046 - Added input variable filters
 #
 
 $startMS = microtime();
 
-$version = '2.14-41';
-$build = '211216-0846';
+$version = '2.14-42';
+$build = '220217-2046';
 
 header ("Content-type: text/html; charset=utf-8");
 
@@ -143,6 +144,7 @@ if (isset($_GET["parkSTATS"]))			{$parkSTATS=$_GET["parkSTATS"];}
 if (isset($_GET["SLAinSTATS"]))				{$SLAinSTATS=$_GET["SLAinSTATS"];}
 	elseif (isset($_POST["SLAinSTATS"]))	{$SLAinSTATS=$_POST["SLAinSTATS"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Main Report';
 $db_source = 'M';
@@ -373,6 +375,13 @@ $SLAinSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $SLAinSTATS);
 $INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE);
 $droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal);
 $report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$mobile_device = preg_replace('/[^-_0-9a-zA-Z]/', '', $mobile_device);
+$RTajax = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTajax);
+$RTpass = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTpass);
+$RTuser = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTuser);
+$server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
diff --git a/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php b/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php
index abec64e7..20a80031 100644
--- a/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php
+++ b/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php
@@ -94,6 +94,8 @@ if (isset($_GET["INGROUPcolorOVERRIDE"]))				{$INGROUPcolorOVERRIDE=$_GET["INGRO
 if (isset($_GET["droppedOFtotal"]))				{$droppedOFtotal=$_GET["droppedOFtotal"];}
 	elseif (isset($_POST["droppedOFtotal"]))	{$droppedOFtotal=$_POST["droppedOFtotal"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Real-Time Main Report';
 $db_source = 'M';
 
diff --git a/agc_2-X/trunk/www/vicidial/remote_dispo.php b/agc_2-X/trunk/www/vicidial/remote_dispo.php
index fb5fada8..98cb04d3 100644
--- a/agc_2-X/trunk/www/vicidial/remote_dispo.php
+++ b/agc_2-X/trunk/www/vicidial/remote_dispo.php
@@ -107,6 +107,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/reset_agent_pass.php b/agc_2-X/trunk/www/vicidial/reset_agent_pass.php
index 9ecb6f0d..7ccf5a9f 100644
--- a/agc_2-X/trunk/www/vicidial/reset_agent_pass.php
+++ b/agc_2-X/trunk/www/vicidial/reset_agent_pass.php
@@ -41,6 +41,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php b/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php
index ae73bab2..f3abc53e 100644
--- a/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php
+++ b/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php
@@ -27,6 +27,8 @@ $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,hosted_settings,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/send_CID_call.php b/agc_2-X/trunk/www/vicidial/send_CID_call.php
index a7c9aced..c60f9139 100644
--- a/agc_2-X/trunk/www/vicidial/send_CID_call.php
+++ b/agc_2-X/trunk/www/vicidial/send_CID_call.php
@@ -39,6 +39,8 @@ if (isset($_GET["server_ip"]))				{$server_ip=$_GET["server_ip"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/settings_compare.php b/agc_2-X/trunk/www/vicidial/settings_compare.php
index 93b522a1..9210d832 100644
--- a/agc_2-X/trunk/www/vicidial/settings_compare.php
+++ b/agc_2-X/trunk/www/vicidial/settings_compare.php
@@ -31,6 +31,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial,qc_features_active FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/shared_debug.php b/agc_2-X/trunk/www/vicidial/shared_debug.php
index 86fa64fc..e8d34f02 100644
--- a/agc_2-X/trunk/www/vicidial/shared_debug.php
+++ b/agc_2-X/trunk/www/vicidial/shared_debug.php
@@ -31,6 +31,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/sph_report.php b/agc_2-X/trunk/www/vicidial/sph_report.php
index cc10273f..1b12d563 100644
--- a/agc_2-X/trunk/www/vicidial/sph_report.php
+++ b/agc_2-X/trunk/www/vicidial/sph_report.php
@@ -58,6 +58,7 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($role)<2) {$role='ALL';}
 if (strlen($order)<2) {$order='sales_down';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/timeclock_edit.php b/agc_2-X/trunk/www/vicidial/timeclock_edit.php
index ba0cce37..6241285d 100644
--- a/agc_2-X/trunk/www/vicidial/timeclock_edit.php
+++ b/agc_2-X/trunk/www/vicidial/timeclock_edit.php
@@ -61,6 +61,8 @@ if (isset($_GET["submit"]))						{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))						{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))			{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/timeclock_report.php b/agc_2-X/trunk/www/vicidial/timeclock_report.php
index 28b4f5a7..3a7ae42e 100644
--- a/agc_2-X/trunk/www/vicidial/timeclock_report.php
+++ b/agc_2-X/trunk/www/vicidial/timeclock_report.php
@@ -69,6 +69,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($order)<2) {$order='hours_down';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'User Timeclock Report';
 $db_source = 'M';
diff --git a/agc_2-X/trunk/www/vicidial/timeclock_status.php b/agc_2-X/trunk/www/vicidial/timeclock_status.php
index a7fcb312..d3b7a46d 100644
--- a/agc_2-X/trunk/www/vicidial/timeclock_status.php
+++ b/agc_2-X/trunk/www/vicidial/timeclock_status.php
@@ -54,6 +54,8 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["file_download"]))					{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))		{$file_download=$_POST["file_download"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'User Group Timeclock Status Report';
 $db_source = 'M';
 
diff --git a/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php b/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php
index 6fc29769..4689ed27 100644
--- a/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php
+++ b/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php
@@ -44,6 +44,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/user_stats.php b/agc_2-X/trunk/www/vicidial/user_stats.php
index ede89836..ec9685e2 100644
--- a/agc_2-X/trunk/www/vicidial/user_stats.php
+++ b/agc_2-X/trunk/www/vicidial/user_stats.php
@@ -115,6 +115,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 if (isset($_GET["NVAuser"]))			{$NVAuser=$_GET["NVAuser"];}
 	elseif (isset($_POST["NVAuser"]))	{$NVAuser=$_POST["NVAuser"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/user_status.php b/agc_2-X/trunk/www/vicidial/user_status.php
index 9b0435d8..6cd29226 100644
--- a/agc_2-X/trunk/www/vicidial/user_status.php
+++ b/agc_2-X/trunk/www/vicidial/user_status.php
@@ -75,6 +75,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,level_8_disable_add,enable_languages,language_method,allow_chats,admin_screen_colors FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/user_territories.php b/agc_2-X/trunk/www/vicidial/user_territories.php
index 172f3b74..691fa0da 100644
--- a/agc_2-X/trunk/www/vicidial/user_territories.php
+++ b/agc_2-X/trunk/www/vicidial/user_territories.php
@@ -57,6 +57,8 @@ if (isset($_GET["vl_owner"]))				{$vl_owner=$_GET["vl_owner"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0
diff --git a/agc_2-X/trunk/www/vicidial/vdremote.php b/agc_2-X/trunk/www/vicidial/vdremote.php
index 61a0bd63..d343d99b 100644
--- a/agc_2-X/trunk/www/vicidial/vdremote.php
+++ b/agc_2-X/trunk/www/vicidial/vdremote.php
@@ -67,6 +67,7 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
 if (!isset($force_logout)) {$force_logout = 0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if (file_exists('options.php'))
 	{require('options.php');}
diff --git a/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php b/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php
index 31cebd3f..06333ef2 100644
--- a/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php
+++ b/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php
@@ -62,6 +62,8 @@ if (isset($_GET["upd_domain"]))				{$upd_domain=$_GET["upd_domain"];}
 if (isset($_GET["upd_custom_reports_user_groups"]))				{$upd_custom_reports_user_groups=$_GET["upd_custom_reports_user_groups"];}
 	elseif (isset($_POST["upd_custom_reports_user_groups"]))	{$upd_custom_reports_user_groups=$_POST["upd_custom_reports_user_groups"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php b/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php
index 76671169..f60ed679 100644
--- a/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php
+++ b/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php
@@ -39,6 +39,7 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
diff --git a/agc_2-X/trunk/www/vicidial/vtiger_phone_match.php b/agc_2-X/trunk/www/vicidial/vtiger_phone_match.php
index fcae1039..3db1921b 100644
--- a/agc_2-X/trunk/www/vicidial/vtiger_phone_match.php
+++ b/agc_2-X/trunk/www/vicidial/vtiger_phone_match.php
@@ -28,6 +28,8 @@ if (isset($_GET["phone"]))				{$phone=$_GET["phone"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 ###############################################################
 ##### START SYSTEM_SETTINGS VTIGER CONNECTION INFO LOOKUP #####
 $stmt = "SELECT enable_vtiger_integration,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,use_non_latin FROM system_settings;";
diff --git a/agc_2-X/trunk/www/vicidial/vtiger_search.php b/agc_2-X/trunk/www/vicidial/vtiger_search.php
index 1dfc41f7..440a89bb 100644
--- a/agc_2-X/trunk/www/vicidial/vtiger_search.php
+++ b/agc_2-X/trunk/www/vicidial/vtiger_search.php
@@ -116,6 +116,8 @@ if (isset($_GET["submit"]))					{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #$DB = '1';	# DEBUG override
 $US = '_';
 $STARTtime = date("U");
diff --git a/agc_2-X/trunk/www/vicidial/whiteboard_reports.php b/agc_2-X/trunk/www/vicidial/whiteboard_reports.php
index 48667de5..a1631faf 100644
--- a/agc_2-X/trunk/www/vicidial/whiteboard_reports.php
+++ b/agc_2-X/trunk/www/vicidial/whiteboard_reports.php
@@ -58,6 +58,8 @@ if (isset($_GET["target_per_team"]))			{$target_per_team=$_GET["target_per_team"
 if (isset($_GET["rpt_type"]))					{$rpt_type=$_GET["rpt_type"];}
 	elseif (isset($_POST["rpt_type"]))			{$rpt_type=$_POST["rpt_type"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name="Real-Time Whiteboard Report";
 
 #############################################