diff --git a/agc_2-X/trunk/www/vicidial/AST_VDADstats.php b/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
index df077318..4fa18dc3 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_VDADstats.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 60619-1718 - Added variable filtering to eliminate SQL injection attack threat
@@ -57,6 +57,7 @@
 # 180508-0115 - Added new help display
 # 190823-1620 - Fixed download archive bug
 # 191013-0852 - Fixes for PHP7
+# 220301-1641 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -107,11 +108,19 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($list_ids)) {$list_ids = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
 if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
-$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Outbound Calling Report';
 $db_source = 'M';
@@ -124,9 +133,9 @@ $JS_onload="onload = function() {\n";
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,ofcom_uk_drop_calc,report_default_format FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,ofcom_uk_drop_calc,report_default_format,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -139,10 +148,44 @@ if ($qm_conf_ct > 0)
 	$SSlanguage_method =			$row[5];
 	$SSofcom_uk_drop_calc =			$row[6];
 	$SSreport_default_format =		$row[7];
+	$SSallow_web_debug =			$row[8];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
-if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
+
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$print_calls = preg_replace('/[^-_0-9a-zA-Z]/', '', $print_calls);
+$outbound_rate = preg_replace('/[^-_0-9a-zA-Z]/', '', $outbound_rate);
+$costformat = preg_replace('/[^-_0-9a-zA-Z]/', '', $costformat);
+$include_rollover = preg_replace('/[^-_0-9a-zA-Z]/', '', $include_rollover);
+$carrier_stats = preg_replace('/[^-_0-9a-zA-Z]/', '', $carrier_stats);
+$bottom_graph = preg_replace('/[^-_0-9a-zA-Z]/', '', $bottom_graph);
+$agent_hours = preg_replace('/[^-_0-9a-zA-Z]/', '', $agent_hours);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+
+# Variables filtered further down in the code
+# $group
+# $list_ids
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift);
+	}
 
 $DROPANSWERpercent_adjustment=0;
 if (file_exists('options.php'))
@@ -189,18 +232,6 @@ if ($srv_conf_ct > 0)
 	$carrier_logging_active =		$row[0];
 	}
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-# $group = preg_replace("/'|\"|\\\\|;/","",$group);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -308,7 +339,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -344,19 +375,12 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL
     exit;
 	}
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($list_ids)) {$list_ids = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 $i=0;
 $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	$group_string .= "$group[$i]|";
 	$i++;
 	}
@@ -396,6 +420,7 @@ $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$group[$i]|";
@@ -461,6 +486,7 @@ $list_id_string='|';
 $list_id_ct = count($list_ids);
 while($i < $list_id_ct)
 	{
+	$list_ids[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $list_ids[$i]);
 	$list_id_string .= "$list_ids[$i]|";
 	$list_id_SQL .= "'$list_ids[$i]',";
 	$list_idQS .= "&list_ids[]=$list_ids[$i]";
diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
index 0bba0646..269e2154 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_VICIDIAL_hopperlist.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -29,6 +29,7 @@
 # 190716-2119 - Added rank
 # 201111-1435 - Added Campaign Drop-Run load
 # 210514-1615 - Added owner to DB=1 output
+# 220301-1627 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -53,11 +54,19 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = '';}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($server_ip)) {$server_ip = '10.10.10.15';}
+$isdst = date("I");
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_languages,language_method,source_id_display FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_languages,language_method,source_id_display,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -66,21 +75,27 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[1];
 	$SSlanguage_method =			$row[2];
 	$SSsource_id_display =			$row[3];
+	$SSallow_web_debug =			$row[4];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
 	}
-$group = preg_replace("/'|\"|\\\\|;/","",$group);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
@@ -216,14 +231,6 @@ $LOGuser_group =			$row[1];
 $LOGadmin_hide_lead_data =	$row[2];
 $LOGadmin_hide_phone_data =	$row[3];
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = '';}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($server_ip)) {$server_ip = '10.10.10.15';}
-$isdst = date("I");
-
 ### Grab Server GMT value from the database
 $SERVER_GMT=-5;
 $stmt="SELECT local_gmt FROM servers where active='Y' limit 1;";
diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
index 8c2c69f2..bc27dc98 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
@@ -3,7 +3,7 @@
 # 
 # shows the agents logged into vicidial and set to take calls from in-group
 #
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 100320-2102 - First Build
@@ -16,6 +16,7 @@
 # 141230-0045 - Added code for on-the-fly language translations display
 # 170409-1534 - Added IP List validation code
 # 190216-0806 - Fix for user-group, in-group and campaign allowed/permissions matching issues
+# 220301-1624 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -40,11 +41,18 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = '';}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($server_ip)) {$server_ip = '10.10.10.15';}
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -52,21 +60,27 @@ if ($qm_conf_ct > 0)
 	$non_latin =					$row[0];
 	$SSenable_languages =			$row[1];
 	$SSlanguage_method =			$row[2];
+	$SSallow_web_debug =			$row[3];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
 	}
-$group = preg_replace("/'|\"|\\\\|;/","",$group);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
@@ -181,13 +195,6 @@ $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
 ##### END log visit to the vicidial_report_log table #####
 
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = '';}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($server_ip)) {$server_ip = '10.10.10.15';}
-
 $stmt="select group_id,group_name from vicidial_inbound_groups order by group_id;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {echo "$stmt\n";}
diff --git a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
index 6d582010..fc1d124d 100644
--- a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
+++ b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
@@ -1,7 +1,7 @@
 <?php
 # AST_inbound_forecasting.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -13,6 +13,7 @@
 # 180712-1508 - Fix for rare allowed reports issue
 # 191013-0856 - Fixes for PHP7
 # 210823-0948 - Fix for security issue, added NONE option for campaigns
+# 220301-2219 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -97,9 +98,19 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$MT[0]='';
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($campaign)) {$campaign = array();}
+if (!isset($drop_percent)) {$drop_percent = '3';}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'Inbound Forecasting Report';
 $db_source = 'M';
 
@@ -136,9 +147,9 @@ $JS_onload="onload = function() {\n";
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -149,19 +160,42 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$actual_agents=preg_replace("/[^0-9.]/", "", $actual_agents);
+$hourly_pay=preg_replace("/[^0-9.]/", "", $hourly_pay);
+$revenue_per_sale=preg_replace("/[^0-9.]/", "", $revenue_per_sale);
+$sale_chance=preg_replace("/[^0-9.]/", "", $sale_chance);
+$retry_rate=preg_replace("/[^0-9.]/", "", $retry_rate);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$drop_percent = preg_replace('/[^-\.\_0-9a-zA-Z]/', '', $drop_percent);
+$erlang_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $erlang_type);
+$target_pqueue = preg_replace('/[^-_0-9a-zA-Z]/', '', $target_pqueue);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+# Variables filtered further down in the code
+# $campaign
+# $group
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -402,34 +436,6 @@ while ($i < $groups_to_print)
 $groups_selected_str=preg_replace('/, $/', '', $groups_selected_str);
 $group_name_str=preg_replace('/, $/', '', $group_name_str);
 
-$MT[0]='';
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group) || !is_array($group)) {$group = array();}
-if (!isset($drop_percent)) {$drop_percent = '3';}
-if (!isset($campaign) || !is_array($campaign)) {$campaign = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
-$group=preg_replace('/[^-_0-9\p{L}]/u','',$group);
-$campaign=preg_replace('/[^-_0-9\p{L}]/u','',$campaign);
-$query_date = preg_replace('/[^-0-9]/','',$query_date);
-$end_date = preg_replace('/[^-0-9]/','',$end_date);
-$shift=preg_replace('/[^\p{L}]/u', '', $shift);
-$erlang_type=preg_replace('/[^\p{L}]/u', '', $erlang_type);
-$actual_agents=preg_replace("/[^0-9.]/", "", $actual_agents);
-$hourly_pay=preg_replace("/[^0-9.]/", "", $hourly_pay);
-$revenue_per_sale=preg_replace("/[^0-9.]/", "", $revenue_per_sale);
-$sale_chance=preg_replace("/[^0-9.]/", "", $sale_chance);
-$retry_rate=preg_replace("/[^0-9.]/", "", $retry_rate);
-$target_pqueue=preg_replace("/[^0-9.]/", "", $target_pqueue);
-$DB = preg_replace('/[^0-9]/','',$DB);
-$submit=preg_replace('/[^-_0-9\p{L}]/u','',$submit);
-$SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT);
-$file_download = preg_replace('/[^0-9]/','',$file_download);
-$report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type);
-
 $drop_percent=preg_replace("/[^\.0-9]/", "", $drop_percent);
 if ($drop_percent>100) {$drop_percent=100;}
 $drop_rate=$drop_percent/100;
@@ -440,10 +446,11 @@ $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if (in_array("--ALL--", $group))
 		{
 		$group_string = "--ALL--";
-		$group_SQL .= "'$campaign[$i]',";
+		$group_SQL .= "'$group[$i]',";
 		$groupQS = "&group[]=--ALL--";
 		}
 	if ( (strlen($group[$i]) > 0) and (preg_match("/\|$group[$i]\|/",$groups_string)) )
@@ -469,6 +476,7 @@ $campaign_string='|';
 $campaign_ct = count($campaign);
 while($i < $campaign_ct)
 	{
+	$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 	if (in_array("--ALL--", $campaign))
 		{
 		$campaign_string = "--ALL--";
diff --git a/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php b/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
index 35590a6e..9908bfd3 100644
--- a/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
@@ -6,7 +6,7 @@
 # QC statuses of QCFAIL, QCCANC and sales are defined by the Sale=Y status
 # flags being set on those statuses.
 #
-# Copyright (C) 2021  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -35,6 +35,7 @@
 # 191013-0825 - Fixes for PHP7
 # 200917-1720 - Modified for sale counts to be campaign-specific
 # 210222-1508 - Added option to show all users
+# 220301-2155 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -70,11 +71,23 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
-if (isset($_GET["show_all_users"]))			{$show_all_users=$_GET["show_all_users"];}
+if (isset($_GET["show_all_users"]))				{$show_all_users=$_GET["show_all_users"];}
 	elseif (isset($_POST["show_all_users"]))	{$show_all_users=$_POST["show_all_users"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$MT[0]='';
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($user_group)) {$user_group = array();}
+if (!isset($call_statuses)) {$call_statuses = array();}
+if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
+if (!isset($end_date_D)) {$end_date_D=$NOW_DATE;}
+if (!isset($query_date_T)) {$query_date_T="00:00:00";}
+if (!isset($end_date_T)) {$end_date_T="23:59:59";}
+
 $report_name = 'Team Performance Detail';
 $db_source = 'M';
 $JS_text.="<script language='Javascript'>\n";
@@ -82,9 +95,9 @@ $JS_onload="onload = function() {\n";
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+#if ($DB) {$HTML_text.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -96,10 +109,38 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSreport_default_format =		$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
-if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
+
+$query_date_D = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_D);
+$query_date_T = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_T);
+$end_date_D = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date_D);
+$end_date_T = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date_T);
+$show_all_users = preg_replace('/[^-_0-9a-zA-Z]/', '', $show_all_users);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+
+# Variables filtered further down in the code
+# $group
+# $user_group
+# $call_status
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
 
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
@@ -123,17 +164,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -241,7 +271,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -312,24 +342,13 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 
 ######################################
 
-$MT[0]='';
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($user_group)) {$group = array();}
-if (!isset($call_statuses)) {$call_statuses = array();}
-if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
-if (!isset($end_date_D)) {$end_date_D=$NOW_DATE;}
-if (!isset($query_date_T)) {$query_date_T="00:00:00";}
-if (!isset($end_date_T)) {$end_date_T="23:59:59";}
-
 
 $i=0;
 $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	$group_string .= "$group[$i]|";
 	$i++;
 	}
@@ -355,6 +374,7 @@ $call_status_string='|';
 $call_status_ct = count($call_status);
 while($i < $call_status_ct)
 	{
+	$call_status[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $call_status[$i]);
 	$call_status_string .= "$call_status[$i]|";
 	$i++;
 	}
@@ -383,6 +403,7 @@ while ($i < $call_statuses_to_print)
 #######################################
 for ($i=0; $i<count($user_group); $i++) 
 	{
+	$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 	if (preg_match('/\-\-ALL\-\-/', $user_group[$i])) {$all_user_groups=1;}
 	}
 
@@ -405,6 +426,7 @@ $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$group[$i]|";
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
index 8a5ba474..85ca5beb 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_timeonVDADallREC.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -34,6 +34,7 @@
 # 141114-0717 - Finalized adding QXZ translation to all admin files
 # 141230-1416 - Added code for on-the-fly language translations display
 # 170409-1534 - Added IP List validation code
+# 220301-2050 - Added allow_web_debug system setting
 #
 
 header ("Content-type: text/html; charset=utf-8");
@@ -73,18 +74,25 @@ if (isset($_GET["orderby"]))			{$orderby=$_GET["orderby"];}
 	elseif (isset($_POST["orderby"]))	{$orderby=$_POST["orderby"];}
 if (isset($_GET["SERVdisplay"]))			{$SERVdisplay=$_GET["SERVdisplay"];}
 	elseif (isset($_POST["SERVdisplay"]))	{$SERVdisplay=$_POST["SERVdisplay"];}
-
 if (isset($_GET["RECmonitorLINK"]))				{$RECmonitorLINK=$_GET["RECmonitorLINK"];}
 	elseif (isset($_POST["RECmonitorLINK"]))	{$RECmonitorLINK=$_POST["RECmonitorLINK"];}
 
-if (!isset($RR))			{$gRRroup=4;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
+$NOW_TIME = date("Y-m-d H:i:s");
+$FILE_TIME = date("Ymd-His");
+$NOW_DAY = date("Y-m-d");
+$NOW_HOUR = date("H:i:s");
+$STARTtime = date("U");
+$epochSIXhoursAGO = ($STARTtime - 21600);
+$timeSIXhoursAGO = date("Y-m-d H:i:s",$epochSIXhoursAGO);
+if (!isset($RR))			{$RR=4;}
 if (!isset($group))			{$group='';}
 if (!isset($usergroup))		{$usergroup='';}
 if (!isset($UGdisplay))		{$UGdisplay=0;}	# 0=no, 1=yes
 if (!isset($UidORname))		{$UidORname=0;}	# 0=id, 1=name
 if (!isset($orderby))		{$orderby='timeup';}
 if (!isset($SERVdisplay))	{$SERVdisplay=1;}	# 0=no, 1=yes
-$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 function get_server_load($windows = false) {
 $os = strtolower(PHP_OS);
@@ -127,9 +135,9 @@ $load_ave = get_server_load(true);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -140,10 +148,28 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$RR = preg_replace('/[^0-9]/', '', $RR);
+$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup);
+$DB = preg_replace('/[^0-9]/', '', $DB);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK);
+$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK);
+$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay);
+$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname);
+$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby);
+$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay);
+$RECmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $RECmonitorLINK);
+$server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -151,8 +177,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -231,14 +257,6 @@ $authrec=$row[0];
 if ($authrec=='1') {$RECmonitorLINK = 1;} else {$RECmonitorLINK = 0;}
    
 
-$NOW_TIME = date("Y-m-d H:i:s");
-$FILE_TIME = date("Ymd-His");
-$NOW_DAY = date("Y-m-d");
-$NOW_HOUR = date("H:i:s");
-$STARTtime = date("U");
-$epochSIXhoursAGO = ($STARTtime - 21600);
-$timeSIXhoursAGO = date("Y-m-d H:i:s",$epochSIXhoursAGO);
-
 $stmt="select campaign_id from vicidial_campaigns where active='Y';";
 if ($non_latin > 0)
 {
@@ -273,8 +291,6 @@ while ($i < $usergroups_to_print)
 	$i++;
 	}
 
-if (!isset($RR))   {$RR=4;}
-
 $NFB = '<b><font size=6 face="courier">';
 $NFE = '</font></b>';
 $F=''; $FG=''; $B=''; $BG='';
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
index a5ee1d91..df81eff5 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_timeonVDADallSUMMARY.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # Summary for all campaigns live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -31,6 +31,7 @@
 # 141230-0038 - Added code for on-the-fly language translations display
 # 170409-1534 - Added IP List validation code
 # 190927-1300 - Fixed PHP7 array issue
+# 220301-2044 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -55,19 +56,21 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
-if (!isset($RR))			{$gRRroup=4;}
-if (!isset($types))			{$types='SHOW ALL CAMPAIGNS';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($RR))	{$RR=4;}
+if (!isset($types))	{$types='SHOW ALL CAMPAIGNS';}
 
 $report_name = 'Real-Time Campaign Summary';
 $db_source = 'M';
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -78,18 +81,18 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
-	{
-	mysqli_close($link);
-	$use_slave_server=1;
-	$db_source = 'S';
-	require("dbconnect_mysqli.php");
-	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
-	}
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$RR = preg_replace('/[^-_0-9a-zA-Z]/', '', $RR);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$types = preg_replace('/[^- \_0-9a-zA-Z]/', '', $types);
 
 if ($non_latin < 1)
 	{
@@ -98,8 +101,17 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
+if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
+	{
+	mysqli_close($link);
+	$use_slave_server=1;
+	$db_source = 'S';
+	require("dbconnect_mysqli.php");
+	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -190,9 +202,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL
     exit;
 	}
 
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-
 $LOGallowed_campaignsSQL='';
 $whereLOGallowed_campaignsSQL='';
 if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
@@ -222,8 +231,6 @@ while ($i < $groups_to_print)
 	$i++;
 	}
 
-if (!isset($RR))   {$RR=4;}
-
 require("screen_colors.php");
 
 $NWB = "<IMG SRC=\"help.png\" onClick=\"FillAndShowHelpDiv(event, '";
diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php
index da531ce0..ca70a5d7 100644
--- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php
+++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_timeonVDADallSUMMARY_mobile.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # Mobile version of summary report for all campaigns live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -11,6 +11,7 @@
 #
 # 190129-1258 - First release
 # 200414-2000 - Minor display modifications, auto-selecting refresh rate onload
+# 220301-2036 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -28,30 +29,33 @@ if (isset($_GET["adastats"]))			{$adastats=$_GET["adastats"];}
 	elseif (isset($_POST["adastats"]))	{$adastats=$_POST["adastats"];}
 if (isset($_GET["types"]))				{$types=$_GET["types"];}
 	elseif (isset($_POST["types"]))		{$types=$_POST["types"];}
-if (isset($_GET["current_displayed_report"]))				{$current_displayed_report=$_GET["current_displayed_report"];}
-	elseif (isset($_POST["current_displayed_report"]))		{$current_displayed_report=$_POST["current_displayed_report"];}
+if (isset($_GET["current_displayed_report"]))			{$current_displayed_report=$_GET["current_displayed_report"];}
+	elseif (isset($_POST["current_displayed_report"]))	{$current_displayed_report=$_POST["current_displayed_report"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
-if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
+if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 if (isset($_GET["browser_dimension"]))	{$browser_dimension=$_GET["browser_dimension"];}
 	elseif (isset($_POST["browser_dimension"]))	{$browser_dimension=$_POST["browser_dimension"];}
 
-if (!isset($browser_dimension))			{$browser_dimension=800;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($browser_dimension))	{$browser_dimension=800;}
 if (!isset($types))			{$types='LIST ALL CAMPAIGNS';}
 $cell_dimension=floor($browser_dimension/10);
-$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Campaign Summary';
 $db_source = 'M';
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -62,18 +66,22 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
-	{
-	mysqli_close($link);
-	$use_slave_server=1;
-	$db_source = 'S';
-	require("dbconnect_mysqli.php");
-	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
-	}
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$RR = preg_replace('/[^-_0-9a-zA-Z]/', '', $RR);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$current_displayed_report = preg_replace('/[^-_0-9a-zA-Z]/', '', $current_displayed_report);
+$browser_dimension = preg_replace('/[^-_0-9a-zA-Z]/', '', $browser_dimension);
+
+# Variables filtered further down in the code
+# $types
 
 if ($non_latin < 1)
 	{
@@ -82,8 +90,17 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
+if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
+	{
+	mysqli_close($link);
+	$use_slave_server=1;
+	$db_source = 'S';
+	require("dbconnect_mysqli.php");
+	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -174,9 +191,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL
     exit;
 	}
 
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-
 $LOGallowed_campaignsSQL='';
 $whereLOGallowed_campaignsSQL='';
 if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
@@ -187,21 +201,32 @@ if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
 	$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
 	}
 
+for ($q=0; $q<count($types); $q++) 
+	{
+	$types[$q] = preg_replace('/[^- \_0-9a-zA-Z]/', '', $types[$q]);
+	}
+
 $campaign_typeSQL='';
-if (count($types)<2) {
+if (count($types)<2) 
+	{
+	$types = preg_replace('/[^- \_0-9\p{L}]/u', '', $types);
 	if ($types == 'AUTO-DIAL ONLY')			{$campaign_typeSQL="and dial_method IN('RATIO','ADAPT_HARD_LIMIT','ADAPT_TAPERED','ADAPT_AVERAGE')";} 
 	if ($types == 'MANUAL ONLY')			{$campaign_typeSQL="and dial_method IN('MANUAL','INBOUND_MAN')";} 
 	if ($types == 'INBOUND ONLY')			{$campaign_typeSQL="and campaign_allow_inbound='Y'";} 
-} else {
-	if (!in_array('LIST ALL CAMPAIGNS', $types)) {
+	}
+else 
+	{
+	if (!in_array('LIST ALL CAMPAIGNS', $types)) 
+		{
+		$types = preg_replace('/[^- \_0-9\p{L}]/u', '', $types);
 		$campaign_typeSQL='and (';
 		if (in_array('AUTO-DIAL ONLY', $types)) {$campaign_typeSQL="dial_method IN('RATIO','ADAPT_HARD_LIMIT','ADAPT_TAPERED','ADAPT_AVERAGE') or ";} #  unset($types['AUTO-DIAL ONLY']);
 		if (in_array('MANUAL ONLY', $types)) {$campaign_typeSQL="dial_method IN('MANUAL','INBOUND_MAN') or ";} #  unset($types['MANUAL ONLY']);
 		if (in_array('INBOUND ONLY', $types)) {$campaign_typeSQL="campaign_allow_inbound='Y' or ";} #  unset($types['INBOUND ONLY']);
 		$campaign_typeSQL='campaign_id in ('.implode("', '", $types).')';
 		$campaign_typeSQL=')';
+		}
 	}
-}
 
 
 $stmt="select campaign_id from vicidial_campaigns where active='Y' $LOGallowed_campaignsSQL $campaign_typeSQL order by campaign_id;";
diff --git a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
index 9cd4db92..7d83f432 100644
--- a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_url_log_report.php
 # 
-# Copyright (C) 2017  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 130620-0806 - First build
@@ -12,6 +12,7 @@
 # 151211-0950 - Added missing url types
 # 170409-1536 - Added IP List validation code
 # 170710-1801 - Added webform url type
+# 220301-1951 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -50,17 +51,19 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
+$NOW_DATE = date("Y-m-d");
 if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($url_type)) {$url_type = array();}
-$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -71,10 +74,26 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$query_date_D = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_D);
+$query_date_T = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_T);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$response_sec = preg_replace('/[^-_0-9a-zA-Z]/', '', $response_sec);
+$lower_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $lower_limit);
+$upper_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $upper_limit);
+
+# Variables filtered further down in the code
+# $url_type
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -82,12 +101,10 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
-$NOW_DATE = date("Y-m-d");
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -218,6 +235,7 @@ $url_type_ct = count($url_type);
 $i=0;
 while($i < $url_type_ct)
 	{
+	$url_type[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $url_type[$i]);
 	$url_type_string .= "$url_type[$i]|";
 	$i++;
 	}
@@ -240,6 +258,7 @@ $url_types_string='|';
 $url_type_ct = count($url_type);
 while($i < $url_type_ct)
 	{
+	$url_type[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $url_type[$i]);
 	if ( (strlen($url_type[$i]) > 0) and (preg_match("/\|$url_type[$i]\|/",$url_type_string)) )
 		{
 		$url_types_string .= "$url_type[$i]|";
diff --git a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php
index d639c1ac..986c12b8 100644
--- a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php
+++ b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_user_group_hourly_detail.php
 #
-# Copyright (C) 2019  Liz Tejada <liz@softkyrios.com> 
+# Copyright (C) 2022  Liz Tejada <liz@softkyrios.com> 
 #                     Joseph Johnson <freewermadmin@gmail.com>
 #                     Matt Florell <vicidial@gmail.com>
 #  
@@ -18,6 +18,7 @@
 # 170829-0040 - Added screen color settings
 # 180507-2315 - Added new help display
 # 191013-0816 - Fixes for PHP7
+# 220301-1940 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -34,13 +35,13 @@ if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
 if (isset($_GET["start_hour"]))				{$start_hour=$_GET["start_hour"];}
 	elseif (isset($_POST["start_hour"]))	{$start_hour=$_POST["start_hour"];}
 if (isset($_GET["end_hour"]))				{$end_hour=$_GET["end_hour"];}
-	elseif (isset($_POST["end_hour"]))	{$end_hour=$_POST["end_hour"];}
+	elseif (isset($_POST["end_hour"]))		{$end_hour=$_POST["end_hour"];}
 if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
 	elseif (isset($_POST["query_date"]))	{$query_date=$_POST["query_date"];}
 if (isset($_GET["group"]))					{$group=$_GET["group"];}
 	elseif (isset($_POST["group"]))			{$group=$_POST["group"];}
-if (isset($_GET["user_group"]))					{$user_group=$_GET["user_group"];}
-	elseif (isset($_POST["user_group"]))			{$user_group=$_POST["user_group"];}
+if (isset($_GET["user_group"]))				{$user_group=$_GET["user_group"];}
+	elseif (isset($_POST["user_group"]))	{$user_group=$_POST["user_group"];}
 if (isset($_GET["user"]))					{$user=$_GET["user"];}
 	elseif (isset($_POST["user"]))			{$user=$_POST["user"];}
 if (isset($_GET["shift"]))					{$shift=$_GET["shift"];}
@@ -60,17 +61,27 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$MT[0]='';
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($user_group)) {$user_group = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($start_hour)) {$start_hour = date("H");}
+if (!isset($end_hour)) {$end_hour = date("H");}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'User Group Detail Hourly Report';
 $db_source = 'M';
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -82,11 +93,42 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSreport_default_format =		$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
-##### END SETTINGS LOOKUP #####
-
-###########################################
+if ($SSallow_web_debug < 1) {$DB=0;}
 if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$start_hour = preg_replace('/[^-_0-9a-zA-Z]/', '', $start_hour);
+$end_hour = preg_replace('/[^-_0-9a-zA-Z]/', '', $end_hour);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+
+# Variables filtered further down in the code
+# $group
+# $user_group
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift);
+	$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift);
+	$stage = preg_replace('/[^-_0-9\p{L}]/u', '', $stage);
+	}
 
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
@@ -108,17 +150,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -216,7 +247,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -287,16 +318,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 	$whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
 	}
 
-$MT[0]='';
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($user_group)) {$user_group = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($start_hour)) {$start_hour = date("H");}
-if (!isset($end_hour)) {$end_hour = date("H");}
-
 
 $stmt="select user_group from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -316,6 +337,7 @@ $user_group_string='|';
 $user_group_ct = count($user_group);
 while($i < $user_group_ct)
 	{
+	$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 	$user_group_string .= "$user_group[$i]|";
 	$user_group_SQL .= "'$user_group[$i]',";
 	$user_groupQS .= "&user_group[]=$user_group[$i]";
@@ -350,6 +372,7 @@ $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$group[$i]|";
diff --git a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
index c0a75145..c961dd9b 100644
--- a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
@@ -4,7 +4,7 @@
 # This User-Group based report runs some very intensive SQL queries, so it is
 # not recommended to run this on long time periods. 
 #
-# Copyright (C) 2019  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -24,6 +24,7 @@
 # 170829-0040 - Added screen color settings
 # 180507-2315 - Added new help display
 # 191013-0822 - Fixes for PHP7
+# 220301-1656 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -35,8 +36,6 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
-if (isset($_GET["group"]))					{$group=$_GET["group"];}
-	elseif (isset($_POST["group"]))			{$group=$_POST["group"];}
 if (isset($_GET["user_group"]))				{$user_group=$_GET["user_group"];}
 	elseif (isset($_POST["user_group"]))	{$user_group=$_POST["user_group"];}
 if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
@@ -52,14 +51,20 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$MT[0]='';
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($user_group)) {$user_group = array();}
+
 $report_name = 'User Group Login Report';
 $db_source = 'M';
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$HTML_text.="$stmt\n";}
+#if ($DB) {$HTML_text.="$stmt\n";}
 if ($archive_tbl) {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
@@ -72,10 +77,31 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSreport_default_format =		$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
-if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
+
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+
+# Variables filtered further down in the code
+# $user_group
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
 
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
@@ -97,18 +123,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-$group = preg_replace("/'|\"|\\\\|;/","",$group);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -218,7 +232,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -287,17 +301,12 @@ while ($i < $user_groups_to_print)
 	}
 
 
-$MT[0]='';
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($user_group)) {$user_group = array();}
-
 $i=0;
 $user_group_string='|';
 $user_group_ct = count($user_group);
 while($i < $user_group_ct)
 	{
+	$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 	$user_group_string .= "$user_group[$i]|";
 	$user_group_SQL .= "'$user_group[$i]',";
 	$user_groupQS .= "&user_group[]=$user_group[$i]";
@@ -391,7 +400,7 @@ if ($archives_available=="Y")
 $HTML_text.="</TD><TD VALIGN=MIDDLE ALIGN='CENTER'> &nbsp; &nbsp; &nbsp; &nbsp; ";
 
 $HTML_text.="<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\n";
-$HTML_text.="<a href=\"$PHP_SELF?DB=$DB&query_date=$query_date&end_date=$end_date&query_date_D=$query_date_D&query_date_T=$query_date_T&end_date_D=$end_date_D&end_date_T=$end_date_T$groupQS$user_groupQS$call_statusQS&file_download=1&SUBMIT=$SUBMIT&search_archived_data=$search_archived_data\">"._QXZ("DOWNLOAD")."</a> |";
+$HTML_text.="<a href=\"$PHP_SELF?DB=$DB&query_date=$query_date&end_date=$end_date&query_date_D=$query_date_D&query_date_T=$query_date_T&end_date_D=$end_date_D&end_date_T=$end_date_T$user_groupQS$call_statusQS&file_download=1&SUBMIT=$SUBMIT&search_archived_data=$search_archived_data\">"._QXZ("DOWNLOAD")."</a> |";
 $HTML_text.=" <a href=\"./admin.php?ADD=999999\">"._QXZ("REPORTS")."</a> </FONT>\n";
 $HTML_text.="</FONT>\n";
 $HTML_text.="<BR><BR><INPUT TYPE=SUBMIT NAME=SUBMIT VALUE='"._QXZ("SUBMIT")."'>\n";
diff --git a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
index 0947a41a..80ba2295 100644
--- a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
@@ -1,12 +1,13 @@
 <?php 
 # AST_vdad_debug_log_report.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 161124-0737 - First build
 # 161201-0815 - Added more statistics and options
 # 170409-1550 - Added IP List validation code
+# 220301-1650 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -50,12 +51,21 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+$DBX=preg_replace("/[^0-9a-zA-Z]/","",$DBX);
+
+$NOW_DATE = date("Y-m-d");
+if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
+if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (strlen($stage) < 2) {$stage = 'SUMMARY';}
+if (strlen($lrerr_statuses) < 1) {$lrerr_statuses = 0;}
+if (strlen($uncounted_statuses) < 1) {$uncounted_statuses = 0;}
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -66,11 +76,23 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;   $DBX=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-$NOW_DATE = date("Y-m-d");
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$query_date_D = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_D);
+$query_date_T = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_T);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$lower_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $lower_limit);
+$upper_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $upper_limit);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$archive = preg_replace('/[^-_0-9a-zA-Z]/', '', $archive);
+$lrerr_statuses = preg_replace('/[^-_0-9a-zA-Z]/', '', $lrerr_statuses);
+$uncounted_statuses = preg_replace('/[^-_0-9a-zA-Z]/', '', $uncounted_statuses);
 
 if ($non_latin < 1)
 	{
@@ -80,9 +102,9 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$stage = preg_replace("/'|\"|\\\\|;/","",$stage);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$stage = preg_replace('/[^-_0-9\p{L}]/u',"",$stage);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -208,13 +230,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
 	}
 
-
-if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
-if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (strlen($stage) < 2) {$stage = 'SUMMARY';}
-if (strlen($lrerr_statuses) < 1) {$lrerr_statuses = 0;}
-if (strlen($uncounted_statuses) < 1) {$uncounted_statuses = 0;}
 $vicidial_vdad_log = 'vicidial_vdad_log';
 if ($archive > 0) {$vicidial_vdad_log = 'vicidial_vdad_log_archive';}
 $vicidial_log = 'vicidial_log';
diff --git a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
index c1838f2c..5b23d0b1 100644
--- a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
@@ -1,7 +1,7 @@
 <?php 
 # AST_webserver_url_report.php
 # 
-# Copyright (C) 2019  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 140225-0229 - First build
@@ -11,6 +11,7 @@
 # 170818-2130 - Added HTML formatting
 # 170829-0040 - Added screen color settings
 # 191013-0907 - Fixes for PHP7
+# 220301-1616 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -51,9 +52,9 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
-$NOW_DATE = date("Y-m-d");
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_DATE = date("Y-m-d");
 if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($webserver)) {$webserver = array();}
@@ -63,9 +64,9 @@ if (!isset($end_date)) {$end_date = $NOW_DATE;}
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -76,10 +77,27 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$query_date_D = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_D);
+$query_date_T = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date_T);
+$end_date_D = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date_D);
+$end_date_T = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date_T);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+
+# Variables filtered further down in the code
+# $webserver
+# $url
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -87,12 +105,10 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
-$NOW_DATE = date("Y-m-d");
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -222,6 +238,7 @@ $webserver_ct = count($webserver);
 $i=0;
 while($i < $webserver_ct)
 	{
+	$webserver[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$webserver[$i]);
 	$webserver_string .= "$webserver[$i]|";
 	$i++;
 	}
@@ -281,6 +298,7 @@ $url_ct = count($url);
 $i=0;
 while($i < $url_ct)
 	{
+	$url[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$url[$i]);
 	$url_string .= "$url[$i]|";
 	$i++;
 	}
@@ -308,6 +326,7 @@ $i=0;
 $url_SQL="";
 while($i < $url_ct)
 	{
+	$url[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$url[$i]);
 	if ( (strlen($url[$i]) > 0) and (preg_match("/\|$url[$i]\|/",$url_string)) ) 
 		{
 		$urls_string .= "$url[$i]|";
diff --git a/agc_2-X/trunk/www/vicidial/Erlang_report.php b/agc_2-X/trunk/www/vicidial/Erlang_report.php
index 01c14b77..57dba1e3 100644
--- a/agc_2-X/trunk/www/vicidial/Erlang_report.php
+++ b/agc_2-X/trunk/www/vicidial/Erlang_report.php
@@ -1,7 +1,7 @@
 <?php
 # Erlang_report.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -13,6 +13,7 @@
 # 180508-2215 - Added new help display
 # 180712-1508 - Fix for rare allowed reports issue
 # 191013-0820 - Fixes for PHP7
+# 220301-0937 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -72,13 +73,13 @@ if (isset($_GET["drop_percent"]))				{$drop_percent=$_GET["drop_percent"];}
 	elseif (isset($_POST["drop_percent"]))		{$drop_percent=$_POST["drop_percent"];}
 if (isset($_GET["shift"]))				{$shift=$_GET["shift"];}
 	elseif (isset($_POST["shift"]))		{$shift=$_POST["shift"];}
-if (isset($_GET["erlang_type"]))				{$erlang_type=$_GET["erlang_type"];}
+if (isset($_GET["erlang_type"]))			{$erlang_type=$_GET["erlang_type"];}
 	elseif (isset($_POST["erlang_type"]))	{$erlang_type=$_POST["erlang_type"];}
-if (isset($_GET["actual_agents"]))				{$actual_agents=$_GET["actual_agents"];}
+if (isset($_GET["actual_agents"]))			{$actual_agents=$_GET["actual_agents"];}
 	elseif (isset($_POST["actual_agents"]))	{$actual_agents=$_POST["actual_agents"];}
 if (isset($_GET["hourly_pay"]))				{$hourly_pay=$_GET["hourly_pay"];}
 	elseif (isset($_POST["hourly_pay"]))	{$hourly_pay=$_POST["hourly_pay"];}
-if (isset($_GET["revenue_per_sale"]))				{$revenue_per_sale=$_GET["revenue_per_sale"];}
+if (isset($_GET["revenue_per_sale"]))			{$revenue_per_sale=$_GET["revenue_per_sale"];}
 	elseif (isset($_POST["revenue_per_sale"]))	{$revenue_per_sale=$_POST["revenue_per_sale"];}
 if (isset($_GET["sale_chance"]))				{$sale_chance=$_GET["sale_chance"];}
 	elseif (isset($_POST["sale_chance"]))	{$sale_chance=$_POST["sale_chance"];}
@@ -94,27 +95,83 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
-if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_display_type"];}
+if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$MT[0]='';
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+if (!isset($group)) {$group = array();}
+if (!isset($campaign)) {$campaign = array();}
+if (!isset($drop_percent)) {$drop_percent = '3';}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'Advanced Forecasting Report';
 $db_source = 'M';
 
-if ($ignore_afterhours=="checked") {$status_clause=" and status!='AFTHRS'";}
+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
+$rslt=mysql_to_mysqli($stmt, $link);
+#if ($DB) {$MAIN.="$stmt\n";}
+$qm_conf_ct = mysqli_num_rows($rslt);
+if ($qm_conf_ct > 0)
+	{
+	$row=mysqli_fetch_row($rslt);
+	$non_latin =					$row[0];
+	$outbound_autodial_active =		$row[1];
+	$slave_db_server =				$row[2];
+	$reports_use_slave_db =			$row[3];
+	$SSenable_languages =			$row[4];
+	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$actual_agents=preg_replace("/[^0-9.]/", "", $actual_agents);
+$hourly_pay=preg_replace("/[^0-9.]/", "", $hourly_pay);
+$revenue_per_sale=preg_replace("/[^0-9.]/", "", $revenue_per_sale);
+$sale_chance=preg_replace("/[^0-9.]/", "", $sale_chance);
+$retry_rate=preg_replace("/[^0-9.]/", "", $retry_rate);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$drop_percent = preg_replace('/[^-\.\_0-9a-zA-Z]/', '', $drop_percent);
+$erlang_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $erlang_type);
+$target_pqueue = preg_replace('/[^-_0-9a-zA-Z]/', '', $target_pqueue);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+
+# Variables filtered further down in the code
+# $campaign
+# $group
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift);
+	}
 
 $HTML_text="";
-$actual_agents=preg_replace("/[^0-9.]/", "", $actual_agents);
 $actual_agents+=0;
-$hourly_pay=preg_replace("/[^0-9.]/", "", $hourly_pay);
 $hourly_pay+=0;
-$revenue_per_sale=preg_replace("/[^0-9.]/", "", $revenue_per_sale);
 $revenue_per_sale+=0;
-$sale_chance=preg_replace("/[^0-9.]/", "", $sale_chance);
 $sale_chance+=0;
-$retry_rate=preg_replace("/[^0-9.]/", "", $retry_rate);
 $retry_rate+=0;
 
 switch ($erlang_type) {
@@ -132,36 +189,6 @@ switch ($erlang_type) {
 $JS_text="<script language='Javascript'>\n";
 $JS_onload="onload = function() {\n";
 
-#############################################
-##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
-$rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
-$qm_conf_ct = mysqli_num_rows($rslt);
-if ($qm_conf_ct > 0)
-	{
-	$row=mysqli_fetch_row($rslt);
-	$non_latin =					$row[0];
-	$outbound_autodial_active =		$row[1];
-	$slave_db_server =				$row[2];
-	$reports_use_slave_db =			$row[3];
-	$SSenable_languages =			$row[4];
-	$SSlanguage_method =			$row[5];
-	}
-##### END SETTINGS LOOKUP #####
-###########################################
-
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -317,7 +344,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -400,16 +427,6 @@ while ($i < $groups_to_print)
 $groups_selected_str=preg_replace('/, $/', '', $groups_selected_str);
 $group_name_str=preg_replace('/, $/', '', $group_name_str);
 
-$MT[0]='';
-$NOW_DATE = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($drop_percent)) {$drop_percent = '3';}
-if (!isset($campaign)) {$campaign = array();}
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
-if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 $drop_percent=preg_replace("/[^\.0-9]/", "", $drop_percent);
 if ($drop_percent>100) {$drop_percent=100;}
 $drop_rate=$drop_percent/100;
@@ -420,10 +437,11 @@ $group_string='|';
 $group_ct = count($group);
 while($i < $group_ct)
 	{
+	$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 	if (in_array("--ALL--", $group))
 		{
 		$group_string = "--ALL--";
-		$group_SQL .= "'$campaign[$i]',";
+		$group_SQL .= "'$group[$i]',";
 		$groupQS = "&group[]=--ALL--";
 		}
 	if ( (strlen($group[$i]) > 0) and (preg_match("/\|$group[$i]\|/",$groups_string)) )
@@ -449,6 +467,7 @@ $campaign_string='|';
 $campaign_ct = count($campaign);
 while($i < $campaign_ct)
 	{
+	$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 	if (in_array("--ALL--", $campaign))
 		{
 		$campaign_string = "--ALL--";
diff --git a/agc_2-X/trunk/www/vicidial/call_report_export.php b/agc_2-X/trunk/www/vicidial/call_report_export.php
index 9bdf57db..41935fd0 100644
--- a/agc_2-X/trunk/www/vicidial/call_report_export.php
+++ b/agc_2-X/trunk/www/vicidial/call_report_export.php
@@ -5,7 +5,7 @@
 # and/or vicidial_closer_log information by status, list_id and date range. 
 # downloads to a flat text file that is tab delimited
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -62,6 +62,7 @@
 # 200709-2106 - Added EXTENDED_4 export option with logged list_id from time of call
 # 210911-1907 - Fix for --ALL-- selection user-group permission issue
 # 211119-1500 - Fix for status names 
+# 220301-1603 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -112,9 +113,24 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$US='_';
+$MT[0]='';
+$ip = getenv("REMOTE_ADDR");
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$FILE_TIME = date("Ymd-His");
+$STARTtime = date("U");
+if (!isset($campaign)) {$campaign = array();}
+if (!isset($group)) {$group = array();}
+if (!isset($user_group)) {$user_group = array();}
+if (!isset($list_id)) {$list_id = array();}
+if (!isset($status)) {$status = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'Export Calls Report';
 $db_source = 'M';
 $file_exported=0;
@@ -122,9 +138,9 @@ $DBout='';
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$DBout .= "$stmt\n";}
+#if ($DB) {$DBout .= "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -137,10 +153,44 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
 	$active_modules =				$row[7];
+	$SSallow_web_debug =			$row[8];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$date_field = preg_replace('/[^-\.\_0-9a-zA-Z]/', '', $date_field);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$ivr_export = preg_replace('/[^-_0-9a-zA-Z]/', '', $ivr_export);
+$run_export = preg_replace('/[^-_0-9a-zA-Z]/', '', $run_export);
+$header_row = preg_replace('/[^-_0-9a-zA-Z]/', '', $header_row);
+$rec_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $rec_fields);
+$custom_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $custom_fields);
+$call_notes = preg_replace('/[^-_0-9a-zA-Z]/', '', $call_notes);
+$export_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $export_fields);
+$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
+
+# Variables filtered further down in the code
+# $campaign
+# $group
+# $user_group
+# $list_id
+# $status
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 ### ARCHIVED DATA CHECK CONFIGURATION
 $archives_available="N";
 $log_tables_array=array("vicidial_log", "vicidial_closer_log", "vicidial_agent_log", "vicidial_log_extended", "recording_log", "vicidial_carrier_log", "vicidial_cpd_log", "vicidial_did_log", "vicidial_outbound_ivr_log");
@@ -177,17 +227,6 @@ else
 	}
 #############
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {$DBout .= "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -311,7 +350,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$campaign[0], $query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {$DBout .= "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -377,20 +416,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 ##### START RUN THE EXPORT AND OUTPUT FLAT DATA FILE #####
 if ($run_export > 0)
 	{
-	$US='_';
-	$MT[0]='';
-	$ip = getenv("REMOTE_ADDR");
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$FILE_TIME = date("Ymd-His");
-	$STARTtime = date("U");
-	if (!isset($campaign)) {$campaign = array();}
-	if (!isset($group)) {$group = array();}
-	if (!isset($user_group)) {$user_group = array();}
-	if (!isset($list_id)) {$list_id = array();}
-	if (!isset($status)) {$status = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
 	if ($date_field=="entry_date") {
 		$date_field = "vi.entry_date";
 		# Since entry_date only appears when the EXTENDED export option is selected, EXTENDED will automatically be used when entry_date is selected as the date field.
@@ -443,6 +468,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $campaign_ct)
 		{
+		$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 		if ( (preg_match("/ $campaign[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 			{
 			$campaign_string .= "$campaign[$i]|";
@@ -495,6 +521,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $group_ct)
 		{
+		$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 		$group_string .= "$group[$i]|";
 		$group_SQL .= "'$group[$i]',";
 		$i++;
@@ -538,6 +565,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $user_group_ct)
 		{
+		$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 		$user_group_string .= "$user_group[$i]|";
 		$user_group_SQL .= "'$user_group[$i]',";
 		$i++;
@@ -572,6 +600,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $list_ct)
 		{
+		$list_id[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $list_id[$i]);
 		$list_string .= "$list_id[$i]|";
 		$list_SQL .= "'$list_id[$i]',";
 		$i++;
@@ -618,6 +647,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $status_ct)
 		{
+		$status[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $status[$i]);
 		$status_string .= "$status[$i]|";
 		$status_SQL .= "'$status[$i]',";
 		$i++;
@@ -1506,16 +1536,6 @@ if ($run_export > 0)
 else
 	{
 	echo "$DBout";
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$STARTtime = date("U");
-	if (!isset($campaign)) {$campaign = array();}
-	if (!isset($group)) {$group = array();}
-	if (!isset($user_group)) {$user_group = array();}
-	if (!isset($list_id)) {$list_id = array();}
-	if (!isset($status)) {$status = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
 	if ($date_field=="entry_date") {
 		$date_field = "vi.entry_date";
 		# Since entry_date only appears when the EXTENDED export option is selected, EXTENDED will automatically be used when entry_date is selected as the date field.
diff --git a/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php b/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
index 659a2c33..4bb02380 100644
--- a/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
+++ b/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
@@ -6,7 +6,7 @@
 # downloads to a flat text file that is tab delimited. This version also
 # attempts to link carrier and dial log entries to those calls.
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -21,6 +21,7 @@
 # 190610-2037 - Fixed admin hide phone issue
 # 190926-0927 - Fixes for PHP7
 # 210911-1908 - Fix for --ALL-- selection user-group permission issue
+# 220301-1551 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -69,18 +70,33 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
-if (strlen($shift)<2) {$shift='ALL';}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$US='_';
+$MT[0]='';
+$ip = getenv("REMOTE_ADDR");
+$NOW_DATE = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$FILE_TIME = date("Ymd-His");
+$STARTtime = date("U");
+if (!isset($campaign)) {$campaign = array();}
+if (!isset($group)) {$group = array();}
+if (!isset($user_group)) {$user_group = array();}
+if (!isset($list_id)) {$list_id = array();}
+if (!isset($status)) {$status = array();}
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
+if (!isset($end_date)) {$end_date = $NOW_DATE;}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $report_name = 'Export Calls Report';
 $db_source = 'M';
 $file_exported=0;
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -93,9 +109,32 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
 	$active_modules =				$row[7];
+	$SSallow_web_debug =			$row[8];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
+
+$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $query_date);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$run_export = preg_replace('/[^-_0-9a-zA-Z]/', '', $run_export);
+$header_row = preg_replace('/[^-_0-9a-zA-Z]/', '', $header_row);
+$rec_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $rec_fields);
+$custom_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $custom_fields);
+$call_notes = preg_replace('/[^-_0-9a-zA-Z]/', '', $call_notes);
+$export_fields = preg_replace('/[^-_0-9a-zA-Z]/', '', $export_fields);
+$ivr_export = preg_replace('/[^-_0-9a-zA-Z]/', '', $ivr_export);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+
+# Variables filtered further down in the code
+# $campaign
+# $group
+# $user_group
+# $list_id
+# $status
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -103,8 +142,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -230,7 +269,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name Carrier', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$campaign[0], $query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name Carrier', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -296,21 +335,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 ##### START RUN THE EXPORT AND OUTPUT FLAT DATA FILE #####
 if ($run_export > 0)
 	{
-	$US='_';
-	$MT[0]='';
-	$ip = getenv("REMOTE_ADDR");
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$FILE_TIME = date("Ymd-His");
-	$STARTtime = date("U");
-	if (!isset($campaign)) {$campaign = array();}
-	if (!isset($group)) {$group = array();}
-	if (!isset($user_group)) {$user_group = array();}
-	if (!isset($list_id)) {$list_id = array();}
-	if (!isset($status)) {$status = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 	$campaign_ct = count($campaign);
 	$group_ct = count($group);
 	$user_group_ct = count($user_group);
@@ -345,6 +369,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $campaign_ct)
 		{
+		$campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]);
 		if ( (preg_match("/ $campaign[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
 			{
 			$campaign_string .= "$campaign[$i]|";
@@ -394,6 +419,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $group_ct)
 		{
+		$group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]);
 		$group_string .= "$group[$i]|";
 		$group_SQL .= "'$group[$i]',";
 		$groupQS .= "&group[]=$group[$i]";
@@ -438,6 +464,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $user_group_ct)
 		{
+		$user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]);
 		$user_group_string .= "$user_group[$i]|";
 		$user_group_SQL .= "'$user_group[$i]',";
 		$user_groupQS .= "&user_group[]=$user_group[$i]";
@@ -473,6 +500,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $list_ct)
 		{
+		$list_id[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $list_id[$i]);
 		$list_string .= "$list_id[$i]|";
 		$list_SQL .= "'$list_id[$i]',";
 		$listQS .= "&list_id[]=$list_id[$i]";
@@ -520,6 +548,7 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $status_ct)
 		{
+		$status[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $status[$i]);
 		$status_string .= "$status[$i]|";
 		$status_SQL .= "'$status[$i]',";
 		$statusQS .= "&status[]=$status[$i]";
@@ -1345,17 +1374,6 @@ if ($run_export > 0)
 
 if ($file_exported < 1)
 	{
-	$NOW_DATE = date("Y-m-d");
-	$NOW_TIME = date("Y-m-d H:i:s");
-	$STARTtime = date("U");
-	if (!isset($campaign)) {$campaign = array();}
-	if (!isset($group)) {$group = array();}
-	if (!isset($user_group)) {$user_group = array();}
-	if (!isset($list_id)) {$list_id = array();}
-	if (!isset($status)) {$status = array();}
-	if (!isset($query_date)) {$query_date = $NOW_DATE;}
-	if (!isset($end_date)) {$end_date = $NOW_DATE;}
-
 	$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;";
 	$rslt=mysql_to_mysqli($stmt, $link);
 	if ($DB) {echo "$stmt\n";}
diff --git a/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php b/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php
index 1bfb0fb7..a231a64c 100644
--- a/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php
+++ b/agc_2-X/trunk/www/vicidial/campaign_summary_mobile_report.php
@@ -1,7 +1,7 @@
 <?php 
 # campaign_summary_mobile_report.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # Back-end PHP script that generates text output to be interpreted by AST_timeonVDADallSUMMARY_mobile.php
 #
@@ -10,6 +10,7 @@
 # changes:
 #
 # 181212-2329 - Initial build
+# 220301-1015 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -40,11 +41,14 @@ if (isset($_GET["browser_dimension"]))	{$browser_dimension=$_GET["browser_dimens
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
+$NOW_TIME = date("Y-m-d H:i:s");
+$STARTtime = date("U");
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -55,18 +59,22 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
-	{
-	mysqli_close($link);
-	$use_slave_server=1;
-	$db_source = 'S';
-	require("dbconnect_mysqli.php");
-	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
-	}
+$RR = preg_replace('/[^-_0-9a-zA-Z]/', '', $RR);
+$current_displayed_report = preg_replace('/[^-_0-9a-zA-Z]/', '', $current_displayed_report);
+$browser_dimension = preg_replace('/[^-_0-9a-zA-Z]/', '', $browser_dimension);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
+# Variables filtered further down in the code
+# $types
 
 if ($non_latin < 1)
 	{
@@ -75,8 +83,17 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
+if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
+	{
+	mysqli_close($link);
+	$use_slave_server=1;
+	$db_source = 'S';
+	require("dbconnect_mysqli.php");
+	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -167,9 +184,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL
     exit;
 	}
 
-$NOW_TIME = date("Y-m-d H:i:s");
-$STARTtime = date("U");
-
 $LOGallowed_campaignsSQL='';
 $whereLOGallowed_campaignsSQL='';
 if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
@@ -180,13 +194,30 @@ if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
 	$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
 	}
 
+$typesSQL='';
+if (is_array($types))
+	{
+	for ($q=0; $q<count($types); $q++) 
+		{
+		$types[$q] = preg_replace('/[^- \_0-9a-zA-Z]/', '', $types[$q]);
+		if ($q > 0) {$typesSQL .= ",";}
+		$typesSQL .= "'$types[$q]'";
+		}
+	}
+else
+	{
+	$types = preg_replace('/[^- \_0-9a-zA-Z]/', '', $types);
+	$typesSQL .= "'$types[$q]'";
+	}
+
 $campaign_typeSQL='';
 if (count($types)<2) {
+	$types = preg_replace('/[^- \_0-9\p{L}]/u', '', $types);
 	if (in_array('LIST ALL CAMPAIGNS', $types))			{$campaign_typeSQL="";} 
 	else if (in_array('AUTO-DIAL ONLY', $types))			{$campaign_typeSQL="and dial_method IN('RATIO','ADAPT_HARD_LIMIT','ADAPT_TAPERED','ADAPT_AVERAGE')";} 
 	else if (in_array('MANUAL ONLY', $types))			{$campaign_typeSQL="and dial_method IN('MANUAL','INBOUND_MAN')";} 
 	else if (in_array('INBOUND ONLY', $types))			{$campaign_typeSQL="and campaign_allow_inbound='Y'";} 
-	else {$campaign_typeSQL="and campaign_id='".implode("', '", $types)."'";}
+	else {$campaign_typeSQL="and campaign_id IN(".$typesSQL.")";}
 } else {
 	if (!in_array('LIST ALL CAMPAIGNS', $types)) {
 		$campaign_typeSQL='and (';