From d46b1b5d26b8f541ce295d24e4a8af6d0b8a4c66 Mon Sep 17 00:00:00 2001
From: mattf <mattf@3d104415-ff17-0410-8863-d5cf3c621b8a>
Date: Sat, 27 May 2017 07:14:38 +0000
Subject: [PATCH] Added additional variable filtering

git-svn-id: svn://192.168.202.10@2760 3d104415-ff17-0410-8863-d5cf3c621b8a
---
 agc_2-X/trunk/extras/SCRIPT_multirecording.php | 18 +++++++++++++++++-
 .../extras/SCRIPT_multirecording_AJAX.php      | 15 ++++++++++++++-
 agc_2-X/trunk/www/agc/call_log_display.php     | 13 ++++++++-----
 agc_2-X/trunk/www/agc/chat_db_query.php        | 14 +++++++++++++-
 agc_2-X/trunk/www/agc/conf_exten_check.php     | 10 +++++++---
 agc_2-X/trunk/www/agc/deactivate_lead.php      |  8 +++++++-
 agc_2-X/trunk/www/agc/dispo_add_FPG.php        |  7 ++++++-
 agc_2-X/trunk/www/agc/dispo_move_list.php      |  5 +++++
 agc_2-X/trunk/www/agc/dispo_send_email.php     |  5 +++++
 agc_2-X/trunk/www/agc/inbound_popup.php        | 12 ++++++++----
 agc_2-X/trunk/www/agc/live_exten_check.php     | 13 +++++++++----
 agc_2-X/trunk/www/agc/manager_send.php         | 14 ++++++++++++--
 agc_2-X/trunk/www/agc/park_calls_display.php   | 12 ++++++++----
 agc_2-X/trunk/www/agc/phone_only.php           |  1 +
 agc_2-X/trunk/www/agc/update_cf_ivr.php        |  9 ++++++++-
 agc_2-X/trunk/www/agc/vdc_db_query.php         | 13 +++++++++++--
 agc_2-X/trunk/www/agc/vdc_email_display.php    | 12 +++++++++---
 agc_2-X/trunk/www/agc/vdc_form_display.php     |  6 ++++++
 agc_2-X/trunk/www/agc/vdc_script_display.php   | 13 +++++++++++--
 .../trunk/www/agc/vdc_script_dispo_example.php | 14 +++++++++++---
 agc_2-X/trunk/www/agc/vdc_script_notes.php     | 15 +++++++++++----
 agc_2-X/trunk/www/agc/vicidial-grey.php        |  1 +
 agc_2-X/trunk/www/agc/vicidial.php             |  1 +
 agc_2-X/trunk/www/agc/voicemail_check.php      | 10 ++++++----
 .../trunk/www/vicidial/AST_API_log_report.php  |  3 +++
 .../www/vicidial/AST_CLOSER_service_level.php  |  3 +++
 agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php |  3 +++
 .../trunk/www/vicidial/AST_CLOSERstats_v2.php  |  3 +++
 .../www/vicidial/AST_CLOSERsummary_hourly.php  |  3 +++
 agc_2-X/trunk/www/vicidial/AST_DIDstats.php    |  3 +++
 .../www/vicidial/AST_GROUP_ALIASstats.php      |  3 +++
 agc_2-X/trunk/www/vicidial/AST_IVRfilter.php   |  3 +++
 agc_2-X/trunk/www/vicidial/AST_IVRstats.php    |  3 +++
 .../www/vicidial/AST_LAGGED_log_report.php     |  3 +++
 .../www/vicidial/AST_LISTS_campaign_stats.php  |  3 +++
 .../www/vicidial/AST_LISTS_pass_report.php     |  3 +++
 agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php |  3 +++
 .../www/vicidial/AST_LIST_UPDATEstats.php      |  3 +++
 .../vicidial/AST_OUTBOUNDsummary_interval.php  |  3 +++
 agc_2-X/trunk/www/vicidial/AST_VDADstats.php   |  3 +++
 .../www/vicidial/AST_VICIDIAL_hopperlist.php   |  3 +++
 .../www/vicidial/AST_VICIDIAL_ingrouplist.php  |  3 +++
 .../trunk/www/vicidial/AST_agentDIDstats.php   |  3 +++
 .../www/vicidial/AST_agent_days_detail.php     |  3 +++
 .../trunk/www/vicidial/AST_agent_days_time.php |  3 +++
 .../vicidial/AST_agent_debug_log_report.php    |  3 +++
 .../www/vicidial/AST_agent_performance.php     |  8 +++++---
 .../vicidial/AST_agent_performance_detail.php  |  3 +++
 .../AST_agent_performance_detail_SALES.php     |  3 +++
 .../www/vicidial/AST_agent_status_detail.php   |  3 +++
 .../www/vicidial/AST_agent_time_detail.php     |  3 +++
 .../www/vicidial/AST_agent_time_sheet.php      |  3 +++
 .../vicidial/AST_agent_time_sheet_archive.php  |  3 +++
 .../vicidial/AST_agent_timeclock_detail.php    |  3 +++
 .../AST_campaign_status_list_report.php        |  3 +++
 .../www/vicidial/AST_carrier_log_report.php    |  3 +++
 .../trunk/www/vicidial/AST_chat_log_report.php |  3 +++
 .../trunk/www/vicidial/AST_dial_log_report.php |  3 +++
 .../vicidial/AST_dialer_inventory_report.php   |  3 +++
 .../www/vicidial/AST_email_log_report.php      |  3 +++
 .../www/vicidial/AST_hangup_cause_report.php   |  3 +++
 .../www/vicidial/AST_inbound_daily_report.php  |  3 +++
 .../www/vicidial/AST_inbound_forecasting.php   |  3 +++
 agc_2-X/trunk/www/vicidial/AST_parkstats.php   |  3 +++
 .../AST_performance_comparison_report.php      |  3 +++
 .../www/vicidial/AST_recording_log_report.php  |  3 +++
 .../www/vicidial/AST_rt_monitor_log_report.php |  3 +++
 .../www/vicidial/AST_server_performance.php    |  3 +++
 .../vicidial/AST_team_performance_detail.php   |  3 +++
 .../trunk/www/vicidial/AST_url_log_report.php  |  3 +++
 .../vicidial/AST_user_group_hourly_detail.php  |  3 +++
 .../vicidial/AST_usergroup_login_report.php    |  3 +++
 .../www/vicidial/AST_vdad_debug_log_report.php |  3 +++
 .../www/vicidial/AST_webserver_url_report.php  |  3 +++
 agc_2-X/trunk/www/vicidial/Erlang_report.php   |  3 +++
 agc_2-X/trunk/www/vicidial/admin.php           |  8 ++++++--
 agc_2-X/trunk/www/vicidial/asterisk_debug.php  |  3 +++
 .../trunk/www/vicidial/call_report_export.php  |  3 +++
 .../vicidial/call_report_export_carrier.php    |  3 +++
 .../called_counts_multilist_report.php         |  3 +++
 agc_2-X/trunk/www/vicidial/campaign_debug.php  |  3 +++
 agc_2-X/trunk/www/vicidial/fcstats.php         |  3 +++
 agc_2-X/trunk/www/vicidial/fcstats_detail.php  |  3 +++
 .../trunk/www/vicidial/group_hourly_stats.php  |  3 +++
 .../trunk/www/vicidial/lead_report_export.php  |  3 +++
 agc_2-X/trunk/www/vicidial/list_download.php   |  3 +++
 .../www/vicidial/medialog_inventory_report.php |  3 +++
 agc_2-X/trunk/www/vicidial/realtime_report.php |  3 +++
 agc_2-X/trunk/www/vicidial/sph_report.php      |  3 +++
 .../trunk/www/vicidial/timeclock_report.php    |  3 +++
 .../trunk/www/vicidial/timeclock_status.php    |  3 +++
 agc_2-X/trunk/www/vicidial/user_stats.php      |  3 +++
 agc_2-X/trunk/www/vicidial/user_status.php     |  3 +++
 agc_2-X/trunk/www/vicidial/voice_lab.php       |  3 +++
 .../trunk/www/vicidial/web_form_forward.php    |  6 ++++--
 95 files changed, 414 insertions(+), 53 deletions(-)

diff --git a/agc_2-X/trunk/extras/SCRIPT_multirecording.php b/agc_2-X/trunk/extras/SCRIPT_multirecording.php
index 650486ae..0f57361d 100644
--- a/agc_2-X/trunk/extras/SCRIPT_multirecording.php
+++ b/agc_2-X/trunk/extras/SCRIPT_multirecording.php
@@ -1,7 +1,7 @@
 <?php
 # SCRIPT_multirecording.php - script page that stops/starts recordings being made over a forced-recording (ALLFORCE) call
 # 
-# Copyright (C) 2016  Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
 # - works in conjunction with SCRIPT_multirecording_AJAX.php to allow reps the ability to make their own recordings over the course of a call while the entire call is being recorded into its own file, as in ALLFORCE recording.
 #
 # Implementation is done by creating a script in the Scripts section that calls this page within an <iframe> tag which passes several essential dialer variables to the page 
@@ -15,6 +15,7 @@
 # CHANGELOG
 # 120227-1512 - First Build
 # 160401-0026 - HTML formatting fixes
+# 170526-2158 - Added variable filtering
 #
 
 require("dbconnect.php");
@@ -34,6 +35,21 @@ if (isset($_GET["uniqueid"]))	{$uniqueid=$_GET["uniqueid"];}
 	elseif (isset($_POST["uniqueid"]))	{$uniqueid=$_POST["uniqueid"];}
 if (isset($_GET["vendor_lead_code"]))	{$vendor_lead_code=$_GET["vendor_lead_code"];}
 	elseif (isset($_POST["vendor_lead_code"]))	{$vendor_lead_code=$_POST["vendor_lead_code"];}
+
+
+# filter variables
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
+$phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$vendor_lead_code = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$vendor_lead_code);
+$user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$user);
+$server_ip = preg_replace('/[^\.0-9]/','',$server_ip);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$rec_action = preg_replace('/[^0-9a-zA-Z]/','',$rec_action);
+$recording_channel = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$recording_channel);
+
+
 ?>
 <html>
 <head>
diff --git a/agc_2-X/trunk/extras/SCRIPT_multirecording_AJAX.php b/agc_2-X/trunk/extras/SCRIPT_multirecording_AJAX.php
index a0b7f86a..ad991007 100644
--- a/agc_2-X/trunk/extras/SCRIPT_multirecording_AJAX.php
+++ b/agc_2-X/trunk/extras/SCRIPT_multirecording_AJAX.php
@@ -1,7 +1,7 @@
 <?php
 # SCRIPT_multirecording_AJAX.php - script that stops/starts recordings being made over a forced-recording (ALLFORCE) call
 # 
-# Copyright (C) 2016  Joe Johnson, Matt Florell <mattf@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Joe Johnson, Matt Florell <mattf@vicidial.com>    LICENSE: AGPLv2
 #
 # Other scripts that this application depends on:
 # - SCRIPT_multirecording.php: Gives agents ability to stop and start recordings over a forced-recording (ALLFORCE) call
@@ -10,6 +10,7 @@
 # 120224-2240 - First Build
 # 130328-0009 - Converted ereg to preg functions
 # 160401-0026 - Fix for Asterisk 1.8
+# 170526-2157 - Added variable filtering
 #
 
 require("dbconnect.php");
@@ -42,6 +43,18 @@ $exten="8309";
 $ext_context="default";
 #if (eregi("^10.10.", $server_ip)) {$ext_context="demo";} else {$ext_content="default";}
 
+# filter variables
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
+$phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$vendor_lead_code = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$vendor_lead_code);
+$user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$user);
+$server_ip = preg_replace('/[^\.0-9]/','',$server_ip);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$rec_action = preg_replace('/[^0-9a-zA-Z]/','',$rec_action);
+$recording_channel = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$recording_channel);
+
 $stmt="select campaign_rec_filename from vicidial_campaigns where campaign_id='$campaign'";
 $rslt=mysql_query($stmt, $link);
 $row=mysql_fetch_array($rslt);
diff --git a/agc_2-X/trunk/www/agc/call_log_display.php b/agc_2-X/trunk/www/agc/call_log_display.php
index e0aae76b..58c9bf5b 100644
--- a/agc_2-X/trunk/www/agc/call_log_display.php
+++ b/agc_2-X/trunk/www/agc/call_log_display.php
@@ -1,7 +1,7 @@
 <?php
-# call_log_display.php    version 2.12
+# call_log_display.php    version 2.14
 # 
-# Copyright (C) 2015  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to send the inbound and outbound calls for a specific phone
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -38,10 +38,11 @@
 # 141128-0852 - Code cleanup for QXZ functions
 # 141216-2113 - Added language settings lookups and user/pass variable standardization
 # 150723-1714 - Added ajax logging
-# 
+# 170526-2215 - Added additional variable filtering
+#
 
-$version = '0.0.12';
-$build = '150723-1714';
+$version = '2.14-19';
+$build = '170526-2215';
 $php_script = 'call_log_display.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -69,6 +70,8 @@ $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
+$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}
diff --git a/agc_2-X/trunk/www/agc/chat_db_query.php b/agc_2-X/trunk/www/agc/chat_db_query.php
index e49ae52b..c1414141 100644
--- a/agc_2-X/trunk/www/agc/chat_db_query.php
+++ b/agc_2-X/trunk/www/agc/chat_db_query.php
@@ -1,7 +1,7 @@
 <?php
 # chat_db_query.php
 #
-# Copyright (C) 2016  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # Called by vdc_chat_display.php and vicidial_chat_agent.js.  This contains all actions taken by the
 # agent's interface when chatting with customers, other agents, and managers, through 
@@ -21,6 +21,7 @@
 # 160831-2225 - Agent-to-agent interface now color-coded using system settings, if desired
 # 161217-0824 - Added code for multi-user internal chat sessions
 # 161221-0800 - Added color-coding for users in internal chat sessions
+# 170526-2257 - Added additional variable filtering
 #
 
 require("dbconnect_mysqli.php");
@@ -102,6 +103,17 @@ if (!$user) {echo "No user, no using."; exit;}
 if (file_exists('options.php'))
 	{require('options.php');}
 
+# variable filtering
+$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
+$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
+$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$agent_manager = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$agent_manager);
+$agent_user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$agent_user);
+$manager_chat_id = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$manager_chat_id);
+$chat_creator = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$chat_creator);
+$group_id = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$group_id);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $VUselected_language = '';
diff --git a/agc_2-X/trunk/www/agc/conf_exten_check.php b/agc_2-X/trunk/www/agc/conf_exten_check.php
index af3e355e..93128485 100644
--- a/agc_2-X/trunk/www/agc/conf_exten_check.php
+++ b/agc_2-X/trunk/www/agc/conf_exten_check.php
@@ -76,10 +76,11 @@
 # 161029-2216 - Formatting and additional agent debug logging
 # 161217-0822 - Addded agent debug logging of dead call trigger
 # 170220-1307 - Added external_lead_id trigger for switch_lead API function
+# 170526-2228 - Added additional variable filtering
 #
 
-$version = '2.14-51';
-$build = '170220-1307';
+$version = '2.14-52';
+$build = '170526-2228';
 $php_script = 'conf_exten_check.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=44;
@@ -176,7 +177,10 @@ if ($non_latin < 1)
 
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
-$conf_exten=preg_replace("/[^-_0-9a-zA-Z]/","",$conf_exten);
+$conf_exten = preg_replace("/[^-_0-9a-zA-Z]/","",$conf_exten);
+$exten = preg_replace("/\'|\"|\\\\|;/","",$exten);
+$clicks = preg_replace("/\'|\"|\\\\|;/","",$clicks);
+$customer_chat_id = preg_replace("/[^0-9a-zA-Z]/","",$customer_chat_id);
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}
diff --git a/agc_2-X/trunk/www/agc/deactivate_lead.php b/agc_2-X/trunk/www/agc/deactivate_lead.php
index a664047f..a4b7d5e8 100644
--- a/agc_2-X/trunk/www/agc/deactivate_lead.php
+++ b/agc_2-X/trunk/www/agc/deactivate_lead.php
@@ -1,7 +1,7 @@
 <?php
 # deactivate_lead.php
 # 
-# Copyright (C) 2014  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to be used in the "Dispo URL" field of a campaign
 # or in-group. It should take in the campaign_id to check for the same source_id
@@ -30,6 +30,7 @@
 # 140811-0845 - Changed to use QXZ function for echoing text
 # 141118-1234 - Formatting changes for QXZ output
 # 141216-2130 - Added language settings lookups and user/pass variable standardization
+# 170526-2301 - Added additional variable filtering
 #
 
 $api_script = 'deactivate';
@@ -77,8 +78,13 @@ $NOW_TIME = date("Y-m-d H:i:s");
 $sale_status = "$TD$sale_status$TD";
 $search_value='';
 
+# filter variables
 $user = preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$search_field = preg_replace("/\'|\"|\\\\|;| /","",$search_field);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$campaign_check = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_check);
+$new_status = preg_replace('/[^-_0-9a-zA-Z]/','',$new_status);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/dispo_add_FPG.php b/agc_2-X/trunk/www/agc/dispo_add_FPG.php
index a089f66f..6b786afd 100644
--- a/agc_2-X/trunk/www/agc/dispo_add_FPG.php
+++ b/agc_2-X/trunk/www/agc/dispo_add_FPG.php
@@ -1,7 +1,7 @@
 <?php
 # dispo_add_FPG.php
 # 
-# Copyright (C) 2015  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to be used in the "Dispo URL" field of a campaign
 # or in-group. It adds the phone_number of the call to a designated inbound 
@@ -20,6 +20,7 @@
 #
 # CHANGES
 # 150724-1657 - First Build
+# 170526-2305 - Added additional variable filtering
 #
 
 $api_script = 'add_FPG';
@@ -67,8 +68,12 @@ $search_value='';
 $match_found=0;
 $k=0;
 
+# filter variables
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number);
+$FPG_id = preg_replace("/\'|\"|\\\\|;| /","",$FPG_id);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/dispo_move_list.php b/agc_2-X/trunk/www/agc/dispo_move_list.php
index ffcee1c3..4525b1b8 100644
--- a/agc_2-X/trunk/www/agc/dispo_move_list.php
+++ b/agc_2-X/trunk/www/agc/dispo_move_list.php
@@ -59,6 +59,7 @@
 # 160910-1354 - Added populate_... options
 # 161021-1016 - Added lead_age option
 # 170402-0906 - Added list_id_trigger option, cleaned up outputs
+# 170526-2310 - Added additional variable filtering
 #
 
 $api_script = 'movelist';
@@ -131,10 +132,13 @@ $primary_match_found=0;
 $age_trigger=0;
 $k=0;
 
+# filter variables
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $lead_age = preg_replace('/[^_0-9]/', '', $lead_age);
+$lead_id = preg_replace('/[^_0-9]/', '', $lead_id);
 $list_id = preg_replace('/[^_0-9]/', '', $list_id);
+$new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id);
 $list_id_trigger = preg_replace('/[^_0-9]/', '', $list_id_trigger);
 
 #############################################
@@ -283,6 +287,7 @@ else
 									elseif (isset($_POST["$newlistfield"]))	{$new_list_id=$_POST["$newlistfield"];}
 								if (isset($_GET["$resetfield"]))			{$reset_dialed=$_GET["$resetfield"];}
 									elseif (isset($_POST["$resetfield"]))	{$reset_dialed=$_POST["$resetfield"];}
+								$new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id);
 								if ($DB) {echo _QXZ("MULTI_MATCH:")." $k|$sale_status|$new_list_id|$reset_dialed|$exclude_status|$talk_time_trigger|$called_count_trigger|\n";}
 								}
 							}
diff --git a/agc_2-X/trunk/www/agc/dispo_send_email.php b/agc_2-X/trunk/www/agc/dispo_send_email.php
index 8ee8e632..0f812e67 100644
--- a/agc_2-X/trunk/www/agc/dispo_send_email.php
+++ b/agc_2-X/trunk/www/agc/dispo_send_email.php
@@ -21,6 +21,7 @@
 # CHANGES
 # 150806-1424 - First Build
 # 170329-2145 - Added DID variables and custom fields values
+# 170526-2315 - Added additional variable filtering
 #
 
 $api_script = 'send_email';
@@ -70,8 +71,12 @@ $k=0;
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=14;
 
+# filter variables
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$call_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $call_id);
+$lead_id = preg_replace('/[^_0-9]/', '', $lead_id);
+$container_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $container_id);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/inbound_popup.php b/agc_2-X/trunk/www/agc/inbound_popup.php
index 75219842..0f384b71 100644
--- a/agc_2-X/trunk/www/agc/inbound_popup.php
+++ b/agc_2-X/trunk/www/agc/inbound_popup.php
@@ -1,7 +1,7 @@
 <?php
-# inbound_popup.php    version 2.10
+# inbound_popup.php    version 2.14
 # 
-# Copyright (C) 2014  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to open up when a live_inbound call comes in giving the user
 #   options of what to do with the call or options to lookup the callerID on various web sites
@@ -36,10 +36,11 @@
 # 130802-1008 - Changed to PHP mysqli functions
 # 140811-0843 - Changed to use QXZ function for echoing text
 # 141216-2120 - Added language settings lookups and user/pass variable standardization
+# 170526-2231 - Added additional variable filtering
 #
 
-$version = '0.0.12';
-$build = '141216-2120';
+$version = '2.14-13';
+$build = '170526-2231';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -72,10 +73,13 @@ if (isset($_GET["local_web_callerID_URL_enc"]))			{$local_web_callerID_URL_enc=$
 if (isset($_GET["local_web_callerID_URL_enc"]))			{$local_web_callerID_URL = rawurldecode($local_web_callerID_URL_enc);}
 	else {$local_web_callerID_URL = '';}
 
+# variable filtering
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}
diff --git a/agc_2-X/trunk/www/agc/live_exten_check.php b/agc_2-X/trunk/www/agc/live_exten_check.php
index f4c7bc61..0ad4bc33 100644
--- a/agc_2-X/trunk/www/agc/live_exten_check.php
+++ b/agc_2-X/trunk/www/agc/live_exten_check.php
@@ -1,7 +1,7 @@
 <?php
-# live_exten_check.php    version 2.12
+# live_exten_check.php    version 2.14
 # 
-# Copyright (C) 2015  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to send whether the client channel is live and to what channel it is connected
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -39,10 +39,11 @@
 # 141128-0854 - Code cleanup for QXZ functions
 # 141216-2109 - Added language settings lookups and user/pass variable standardization
 # 150723-1713 - Added ajax logging
+# 170526-2234 - Added additional variable filtering
 #
 
-$version = '2.10-16';
-$build = '150723-1713';
+$version = '2.14-17';
+$build = '170526-2234';
 $php_script = 'live_exten_check.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -70,10 +71,14 @@ if (isset($_GET["favorites_count"]))				{$favorites_count=$_GET["favorites_count
 if (isset($_GET["favorites_list"]))				{$favorites_list=$_GET["favorites_list"];}
 	elseif (isset($_POST["favorites_list"]))		{$favorites_list=$_POST["favorites_list"];}
 
+# variable filtering
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
+$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
+$favorites_list = preg_replace("/\'|\"|\\\\|;| /","",$favorites_list);
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}
diff --git a/agc_2-X/trunk/www/agc/manager_send.php b/agc_2-X/trunk/www/agc/manager_send.php
index 4a70dace..7ee5c69e 100644
--- a/agc_2-X/trunk/www/agc/manager_send.php
+++ b/agc_2-X/trunk/www/agc/manager_send.php
@@ -136,10 +136,11 @@
 # 161217-0823 - Added parked_calls_recent table entries for better handling of parked calls
 # 170317-2214 - Added more debugging output
 # 170513-1616 - Added more debugging output
+# 170526-2241 - Added additional variable filtering
 #
 
-$version = '2.14-83';
-$build = '170513-1616';
+$version = '2.14-84';
+$build = '170526-2241';
 $php_script = 'manager_send.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=142;
@@ -249,10 +250,19 @@ header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0
 
+# filter variables
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
+$phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
+$extension = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$extension);
+$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
 
 # default optional vars if not set
 if (!isset($ACTION))   {$ACTION="Originate";}
diff --git a/agc_2-X/trunk/www/agc/park_calls_display.php b/agc_2-X/trunk/www/agc/park_calls_display.php
index 79b4f339..3412f117 100644
--- a/agc_2-X/trunk/www/agc/park_calls_display.php
+++ b/agc_2-X/trunk/www/agc/park_calls_display.php
@@ -1,7 +1,7 @@
 <?php
-# park_calls_display.php    version 2.12
+# park_calls_display.php    version 2.14
 # 
-# Copyright (C) 2015  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to send the details on the parked calls on the server
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -30,10 +30,11 @@
 # 141118-1237 - Formatting changes for QXZ output
 # 141216-2105 - Added language settings lookups and user/pass variable standardization
 # 150723-1712 - Added ajax logging
+# 170526-2244 - Added additional variable filtering
 # 
 
-$version = '0.0.12';
-$build = '150723-1712';
+$version = '2.14-13';
+$build = '170526-2244';
 $php_script = 'park_calls_display.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -57,10 +58,13 @@ if (isset($_GET["exten"]))					{$exten=$_GET["exten"];}
 if (isset($_GET["protocol"]))				{$protocol=$_GET["protocol"];}
 	elseif (isset($_POST["protocol"]))		{$protocol=$_POST["protocol"];}
 
+# variable filtering
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
+$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
 
 # default optional vars if not set
 if (!isset($format))		{$format="text";}
diff --git a/agc_2-X/trunk/www/agc/phone_only.php b/agc_2-X/trunk/www/agc/phone_only.php
index e9e624ae..aa9d7382 100644
--- a/agc_2-X/trunk/www/agc/phone_only.php
+++ b/agc_2-X/trunk/www/agc/phone_only.php
@@ -172,6 +172,7 @@ $DS='-';
 $date = date("r");
 $ip = getenv("REMOTE_ADDR");
 $browser = getenv("HTTP_USER_AGENT");
+$browser=preg_replace("/\'|\"|\\\\/","",$browser);
 $script_name = getenv("SCRIPT_NAME");
 $server_name = getenv("SERVER_NAME");
 $server_port = getenv("SERVER_PORT");
diff --git a/agc_2-X/trunk/www/agc/update_cf_ivr.php b/agc_2-X/trunk/www/agc/update_cf_ivr.php
index ad8d42ba..27210f9f 100644
--- a/agc_2-X/trunk/www/agc/update_cf_ivr.php
+++ b/agc_2-X/trunk/www/agc/update_cf_ivr.php
@@ -1,7 +1,7 @@
 <?php
 # update_cf_ivr.php
 # 
-# Copyright (C) 2015  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is part of the API group and any modifications of data are
 # logged to the vicidial_api_log table.
@@ -10,6 +10,7 @@
 #
 # CHANGES
 # 150814-1441 - First Build
+# 170526-2319 - Added additional variable filtering
 #
 
 $api_script = 'update_cf_ivr';
@@ -55,8 +56,14 @@ $search_value='';
 $match_found=0;
 $k=0;
 
+# filter variables
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$caller_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $caller_id);
+$lead_id = preg_replace('/[^_0-9]/', '', $lead_id);
+$list_id = preg_replace('/[^_0-9]/', '', $list_id);
+$field = preg_replace('/[^-_0-9a-zA-Z]/', '', $field);
+$value = preg_replace("/\'|\"|\\\\|;| /","",$value);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/vdc_db_query.php b/agc_2-X/trunk/www/agc/vdc_db_query.php
index 20ff2204..a8a5e6ac 100644
--- a/agc_2-X/trunk/www/agc/vdc_db_query.php
+++ b/agc_2-X/trunk/www/agc/vdc_db_query.php
@@ -429,10 +429,11 @@
 # 170401-1437 - Added translation of callbacks statuses, issue #1006
 # 170429-0835 - Added callback_display_days option
 # 170504-1056 - Added start_call_url to manual-dial calls
+# 170526-2327 - Added additional variable filtering
 #
 
-$version = '2.14-323';
-$build = '170504-1056';
+$version = '2.14-324';
+$build = '170526-2327';
 $php_script = 'vdc_db_query.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=684;
@@ -926,18 +927,26 @@ if ($non_latin < 1)
 	$length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec);
 	$phone_code = preg_replace("/[^0-9]/","",$phone_code);
 	$phone_number = preg_replace("/[^0-9a-zA-Z]/","",$phone_number);
+	$status = preg_replace("/[^-_0-9a-zA-Z]/","",$status);
 	}
 else
 	{
 	$user = preg_replace("/\'|\"|\\\\|;/","",$user);
 	$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 	$orig_pass = preg_replace("/\'|\"|\\\\|;/","",$orig_pass);
+	$status = preg_replace("/\'|\"|\\\\|;/","",$status);
 	}
 
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
 $alt_phone = preg_replace("/\s/","",$alt_phone);
 $phone_number = preg_replace("/\s/","",$phone_number);
+$campaign = preg_replace("/\'|\"|\\\\|;/","",$campaign);
+$closer_choice = preg_replace("/\'|\"|\\\\|;/","",$closer_choice);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$list_id = preg_replace('/[^0-9]/','',$list_id);
+$conf_exten = preg_replace('/[^-_\.0-9a-zA-Z]/','',$conf_exten);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}
diff --git a/agc_2-X/trunk/www/agc/vdc_email_display.php b/agc_2-X/trunk/www/agc/vdc_email_display.php
index fe3c1705..96352004 100644
--- a/agc_2-X/trunk/www/agc/vdc_email_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_email_display.php
@@ -1,7 +1,7 @@
 <?php
 # vdc_email_display.php - VICIDIAL agent email display script
 #
-# Copyright (C) 2015  Matt Florell, Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell, Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This page displays any incoming emails in the Vicidial user interface.  It 
 # also allows the user to download and view any attachments sent in the email,
@@ -21,10 +21,11 @@
 # 141128-0850 - Code cleanup for QXZ functions
 # 141216-2117 - Added language settings lookups and user/pass variable standardization
 # 150603-1541 - Fixed email attachments issue
+# 170526-2330 - Added additional variable filtering
 #
 
-$version = '2.12-11';
-$build = '150603-1541';
+$version = '2.14-12';
+$build = '170526-2330';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -104,6 +105,11 @@ $IFRAME=0;
 
 $user = preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$campaign = preg_replace("/\'|\"|\\\\|;/","",$campaign);
+$attachment_id = preg_replace("/[^0-9]/","",$attachment_id);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$email_row_id = preg_replace('/[^0-9]/','',$email_row_id);
+$reply_to_address = preg_replace("/\'|\"|\\\\|;/","",$reply_to_address);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/vdc_form_display.php b/agc_2-X/trunk/www/agc/vdc_form_display.php
index 76344cd0..2847365b 100644
--- a/agc_2-X/trunk/www/agc/vdc_form_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_form_display.php
@@ -226,6 +226,12 @@ $IFRAME=0;
 
 $user = preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$lead_id = preg_replace('/[^0-9]/', '', $lead_id);
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/vdc_script_display.php b/agc_2-X/trunk/www/agc/vdc_script_display.php
index a7efaf2b..b2812867 100644
--- a/agc_2-X/trunk/www/agc/vdc_script_display.php
+++ b/agc_2-X/trunk/www/agc/vdc_script_display.php
@@ -34,10 +34,11 @@
 # 150923-2028 - Added DID custom variables
 # 160818-1226 - Added MANUALDIALLINK option
 # 170317-2315 - Fixed in-group list script override issue, added debug
+# 170526-2343 - Added additional variable filtering
 #
 
-$version = '2.14-28';
-$build = '170317-2315';
+$version = '2.14-29';
+$build = '170526-2343';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -260,6 +261,14 @@ $IFRAMEencode=1;
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $orig_pass = preg_replace("/\'|\"|\\\\|;| /","",$orig_pass);
+$lead_id = preg_replace('/[^0-9]/', '', $lead_id);
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
+$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
+$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php b/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php
index 91d6a9c3..25fc85b9 100644
--- a/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php
+++ b/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php
@@ -1,7 +1,7 @@
 <?php
 # vdc_script_dispo_example.php
 # 
-# Copyright (C) 2013  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to be used in the SCRIPT tab in an IFRAME and will not submit unless a specific field is filled in
 #
@@ -19,10 +19,11 @@
 # 130802-1036 - Changed to PHP mysqli functions
 # 140811-0832 - Changed to use QXZ function for echoing text
 # 141216-2133 - Added language settings lookups and user/pass variable standardization
+# 170526-2345 - Added additional variable filtering
 #
 
-$version = '2.10-7';
-$build = '141216-2133';
+$version = '2.14-8';
+$build = '170526-2345';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -251,6 +252,13 @@ if (strlen($call_date) < 1)
 
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
+$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
+$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/vdc_script_notes.php b/agc_2-X/trunk/www/agc/vdc_script_notes.php
index 02d2e15f..18ea173d 100644
--- a/agc_2-X/trunk/www/agc/vdc_script_notes.php
+++ b/agc_2-X/trunk/www/agc/vdc_script_notes.php
@@ -1,7 +1,7 @@
 <?php
 # vdc_script_notes.php
 # 
-# Copyright (C) 2014  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed open in the SCRIPT tab in the agent interface through
 # an IFRAME. It will create a new record for every SUBMIT
@@ -17,10 +17,11 @@
 # 130802-1037 - Changed to PHP mysqli functions
 # 140810-2113 - Changed to use QXZ function for echoing text
 # 141216-2132 - Added language settings lookups and user/pass variable standardization
+# 170526-2345 - Added additional variable filtering
 #
 
-$version = '2.10-7';
-$build = '141216-2132';
+$version = '2.14-8';
+$build = '170526-2345';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -217,9 +218,15 @@ $agents='@agents';
 if (strlen($call_date) < 1)
 	{$call_date = $NOW_TIME;}
 
-
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
+$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
+$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
+$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
diff --git a/agc_2-X/trunk/www/agc/vicidial-grey.php b/agc_2-X/trunk/www/agc/vicidial-grey.php
index de9c075f..2b152398 100644
--- a/agc_2-X/trunk/www/agc/vicidial-grey.php
+++ b/agc_2-X/trunk/www/agc/vicidial-grey.php
@@ -754,6 +754,7 @@ $DS='-';
 $date = date("r");
 $ip = getenv("REMOTE_ADDR");
 $browser = getenv("HTTP_USER_AGENT");
+$browser=preg_replace("/\'|\"|\\\\/","",$browser);
 $script_name = getenv("SCRIPT_NAME");
 $server_name = getenv("SERVER_NAME");
 $server_port = getenv("SERVER_PORT");
diff --git a/agc_2-X/trunk/www/agc/vicidial.php b/agc_2-X/trunk/www/agc/vicidial.php
index 26fac26d..e08e80d1 100644
--- a/agc_2-X/trunk/www/agc/vicidial.php
+++ b/agc_2-X/trunk/www/agc/vicidial.php
@@ -847,6 +847,7 @@ $DS='-';
 $date = date("r");
 $ip = getenv("REMOTE_ADDR");
 $browser = getenv("HTTP_USER_AGENT");
+$browser=preg_replace("/\'|\"|\\\\/","",$browser);
 $script_name = getenv("SCRIPT_NAME");
 $server_name = getenv("SERVER_NAME");
 $server_port = getenv("SERVER_PORT");
diff --git a/agc_2-X/trunk/www/agc/voicemail_check.php b/agc_2-X/trunk/www/agc/voicemail_check.php
index 2e759804..c7222ef2 100644
--- a/agc_2-X/trunk/www/agc/voicemail_check.php
+++ b/agc_2-X/trunk/www/agc/voicemail_check.php
@@ -1,7 +1,7 @@
 <?php
-# voicemail_check.php    version 2.12
+# voicemail_check.php    version 2.14
 # 
-# Copyright (C) 2015  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to check whether the voicemail box on the server defined has new and old messages
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -30,10 +30,11 @@
 # 141118-1240 - Formatting changes for QXZ output
 # 141216-1902 - Added language settings lookups and user/pass variable standardization
 # 150723-1711 - Added ajax logging
+# 170526-2351 - Added additional variable filtering
 #
 
-$version = '0.0.13';
-$build = '150723-1711';
+$version = '2.14-14';
+$build = '170526-2351';
 $php_script = 'voicemail_check.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -59,6 +60,7 @@ $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
 $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
+$vmail_box = preg_replace("/\'|\"|\\\\|;/","",$vmail_box);
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}
diff --git a/agc_2-X/trunk/www/vicidial/AST_API_log_report.php b/agc_2-X/trunk/www/vicidial/AST_API_log_report.php
index a317ae0f..edbe4d33 100644
--- a/agc_2-X/trunk/www/vicidial/AST_API_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_API_log_report.php
@@ -203,6 +203,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php b/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
index 7d6588c6..2d1b6a03 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
@@ -198,6 +198,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
index db9819a5..317216ec 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
@@ -348,6 +348,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
index 898cfc70..506f809a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
@@ -357,6 +357,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
index 966cae72..9ace302b 100644
--- a/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
+++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
@@ -215,6 +215,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php
index 37271a55..2a9b4665 100644
--- a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php
@@ -291,6 +291,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
index 436555d1..eff553cd 100644
--- a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
@@ -145,6 +145,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
index 9c1c7ec6..30f3dfa7 100644
--- a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
+++ b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
@@ -176,6 +176,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php
index 39a0b4ed..02a4f5b6 100644
--- a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php
@@ -210,6 +210,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
index d7dad448..b13a402c 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
@@ -159,6 +159,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
index 222e88b1..90bfadd5 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
@@ -189,6 +189,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
index 9c19027e..07e4e3f8 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
@@ -182,6 +182,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php
index 79fbdae7..2263aaab 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php
@@ -160,6 +160,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php b/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
index d787e934..13a42d08 100644
--- a/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
@@ -149,6 +149,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php b/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
index 034915ba..2d36fc75 100644
--- a/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
+++ b/agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
@@ -242,6 +242,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_VDADstats.php b/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
index 673c4441..073561b7 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VDADstats.php
@@ -266,6 +266,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
index 39ce9142..16eeb6f0 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
@@ -162,6 +162,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
index 33f5b8c5..5cbe5b7a 100644
--- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
+++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
@@ -139,6 +139,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php b/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
index 41493544..7bb020f3 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
@@ -260,6 +260,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
index 07b195f6..20f3ee97 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
@@ -200,6 +200,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php b/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php
index a792cb45..4bc0b375 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_days_time.php
@@ -178,6 +178,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php
index e544eda8..2f265ed3 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php
@@ -149,6 +149,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance.php
index ada970af..7674d5fb 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_performance.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance.php
@@ -16,6 +16,7 @@
 # 141114-0909 - Finalized adding QXZ translation to all admin files
 # 141230-1524 - Added code for on-the-fly language translations display
 # 170409-1534 - Added IP List validation code
+# 170527-0102 - Added variable filtering
 #
 
 require("dbconnect_mysqli.php");
@@ -27,13 +28,13 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
 if (isset($_GET["group"]))				{$group=$_GET["group"];}
 	elseif (isset($_POST["group"]))		{$group=$_POST["group"];}
 if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
-	elseif (isset($_POST["query_date"]))		{$query_date=$_POST["query_date"];}
+	elseif (isset($_POST["query_date"]))	{$query_date=$_POST["query_date"];}
 if (isset($_GET["shift"]))				{$shift=$_GET["shift"];}
 	elseif (isset($_POST["shift"]))		{$shift=$_POST["shift"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
-	elseif (isset($_POST["submit"]))		{$submit=$_POST["submit"];}
+	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
-	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
+	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
@@ -62,6 +63,7 @@ else
 	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
 	}
 $group = preg_replace("/'|\"|\\\\|;/","",$group);
+$query_date = preg_replace("/'|\"|\\\\|;/","",$query_date);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
index 74e6803a..111d87d9 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
@@ -239,6 +239,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php
index 33b31086..dc5bd40e 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php
@@ -177,6 +177,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
index f98266b1..f5fca8c4 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
@@ -175,6 +175,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
index cd5eb141..e40b00fe 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
@@ -255,6 +255,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php
index be036c32..f897ac2c 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php
@@ -189,6 +189,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php
index 38cff202..270e5b33 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php
@@ -147,6 +147,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
index 39cf4ceb..3106ed9c 100644
--- a/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
@@ -171,6 +171,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php b/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
index 3106263a..b800b187 100644
--- a/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
@@ -196,6 +196,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php b/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
index 1af53b8c..acfe79ba 100644
--- a/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
@@ -154,6 +154,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php b/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php
index d5d51bbe..def5c2e6 100644
--- a/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_chat_log_report.php
@@ -175,6 +175,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php b/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php
index a2e5adaa..9c6e8591 100644
--- a/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php
@@ -273,6 +273,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php b/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
index 763bd817..dcd57565 100644
--- a/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
@@ -177,6 +177,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_email_log_report.php b/agc_2-X/trunk/www/vicidial/AST_email_log_report.php
index a0935ca6..17732c55 100644
--- a/agc_2-X/trunk/www/vicidial/AST_email_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_email_log_report.php
@@ -213,6 +213,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php b/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
index 489ad870..4a991fc9 100644
--- a/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
@@ -314,6 +314,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php b/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
index b3c581cf..dd8a612b 100644
--- a/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
@@ -202,6 +202,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
index fc9ad61f..fef26a0d 100644
--- a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
+++ b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
@@ -279,6 +279,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_parkstats.php b/agc_2-X/trunk/www/vicidial/AST_parkstats.php
index 17e1a6ed..4233dc5e 100644
--- a/agc_2-X/trunk/www/vicidial/AST_parkstats.php
+++ b/agc_2-X/trunk/www/vicidial/AST_parkstats.php
@@ -150,6 +150,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php b/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php
index 2bb07bcc..f714ff1b 100644
--- a/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php
@@ -189,6 +189,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php b/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php
index e30e9cba..a7106e59 100644
--- a/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_recording_log_report.php
@@ -208,6 +208,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php b/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php
index 8f8d25f2..f961be72 100644
--- a/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php
@@ -206,6 +206,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_server_performance.php b/agc_2-X/trunk/www/vicidial/AST_server_performance.php
index af1007f1..fc9705f2 100644
--- a/agc_2-X/trunk/www/vicidial/AST_server_performance.php
+++ b/agc_2-X/trunk/www/vicidial/AST_server_performance.php
@@ -162,6 +162,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) 
 	{$HTTPprotocol = 'https://';}
 else 
diff --git a/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php b/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
index eae8351b..f1234b50 100644
--- a/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
@@ -199,6 +199,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
index 72856380..bc803e49 100644
--- a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php
@@ -160,6 +160,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
index 6fc565d8..5510eaa3 100644
--- a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
+++ b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
@@ -181,6 +181,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
index 40cfc17c..3b3449f4 100644
--- a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
@@ -179,6 +179,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
index 62476574..ee139742 100644
--- a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php
@@ -158,6 +158,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
index 551321a1..22d0180c 100644
--- a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
+++ b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php
@@ -162,6 +162,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/Erlang_report.php b/agc_2-X/trunk/www/vicidial/Erlang_report.php
index 96091652..732621b4 100644
--- a/agc_2-X/trunk/www/vicidial/Erlang_report.php
+++ b/agc_2-X/trunk/www/vicidial/Erlang_report.php
@@ -277,6 +277,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php
index a8a26c5f..39c00bd4 100644
--- a/agc_2-X/trunk/www/vicidial/admin.php
+++ b/agc_2-X/trunk/www/vicidial/admin.php
@@ -4123,12 +4123,13 @@ else
 # 170429-0807 - Added campaign setting callback_display_days
 # 170430-1001 - Added three_way_record_stop and hangup_xfer_record_start campaign settings
 # 170516-0632 - Added Real-Time Monitoring Log Report
+# 170527-0041 - Added filtering of browser details before logging
 #
 
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
 
-$admin_version = '2.14-615a';
-$build = '170516-0632';
+$admin_version = '2.14-616a';
+$build = '170527-0041';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");
@@ -5059,6 +5060,9 @@ if ( ($ADD==999993) or ($ADD==999992) or ($ADD==730000000000000) or ($ADD==83000
 	$LOGserver_port = getenv("SERVER_PORT");
 	$LOGrequest_uri = getenv("REQUEST_URI");
 	$LOGhttp_referer = getenv("HTTP_REFERER");
+	$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+	$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+	$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 	if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
 	else {$HTTPprotocol = 'http://';}
 	if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/asterisk_debug.php b/agc_2-X/trunk/www/vicidial/asterisk_debug.php
index 5b1f1bc7..0554791d 100644
--- a/agc_2-X/trunk/www/vicidial/asterisk_debug.php
+++ b/agc_2-X/trunk/www/vicidial/asterisk_debug.php
@@ -146,6 +146,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/call_report_export.php b/agc_2-X/trunk/www/vicidial/call_report_export.php
index 062a0741..1aa2c45d 100644
--- a/agc_2-X/trunk/www/vicidial/call_report_export.php
+++ b/agc_2-X/trunk/www/vicidial/call_report_export.php
@@ -268,6 +268,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php b/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
index 5d344ce7..66a057ee 100644
--- a/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
+++ b/agc_2-X/trunk/www/vicidial/call_report_export_carrier.php
@@ -193,6 +193,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php b/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php
index e8157060..80152667 100644
--- a/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php
+++ b/agc_2-X/trunk/www/vicidial/called_counts_multilist_report.php
@@ -211,6 +211,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/campaign_debug.php b/agc_2-X/trunk/www/vicidial/campaign_debug.php
index c663336b..208c0ce4 100644
--- a/agc_2-X/trunk/www/vicidial/campaign_debug.php
+++ b/agc_2-X/trunk/www/vicidial/campaign_debug.php
@@ -153,6 +153,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/fcstats.php b/agc_2-X/trunk/www/vicidial/fcstats.php
index 7518a702..6d6914f1 100644
--- a/agc_2-X/trunk/www/vicidial/fcstats.php
+++ b/agc_2-X/trunk/www/vicidial/fcstats.php
@@ -209,6 +209,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/fcstats_detail.php b/agc_2-X/trunk/www/vicidial/fcstats_detail.php
index 7777d8ae..28b68677 100644
--- a/agc_2-X/trunk/www/vicidial/fcstats_detail.php
+++ b/agc_2-X/trunk/www/vicidial/fcstats_detail.php
@@ -223,6 +223,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/group_hourly_stats.php b/agc_2-X/trunk/www/vicidial/group_hourly_stats.php
index 9e44ce6b..4fbfcd47 100644
--- a/agc_2-X/trunk/www/vicidial/group_hourly_stats.php
+++ b/agc_2-X/trunk/www/vicidial/group_hourly_stats.php
@@ -151,6 +151,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/lead_report_export.php b/agc_2-X/trunk/www/vicidial/lead_report_export.php
index a04a6af8..7eb737e8 100644
--- a/agc_2-X/trunk/www/vicidial/lead_report_export.php
+++ b/agc_2-X/trunk/www/vicidial/lead_report_export.php
@@ -244,6 +244,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/list_download.php b/agc_2-X/trunk/www/vicidial/list_download.php
index a11643f8..c6648eca 100644
--- a/agc_2-X/trunk/www/vicidial/list_download.php
+++ b/agc_2-X/trunk/www/vicidial/list_download.php
@@ -157,6 +157,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php b/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php
index ffb6e243..74671b1e 100644
--- a/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php
+++ b/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php
@@ -210,6 +210,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/realtime_report.php b/agc_2-X/trunk/www/vicidial/realtime_report.php
index aaa940f7..56ccce6a 100644
--- a/agc_2-X/trunk/www/vicidial/realtime_report.php
+++ b/agc_2-X/trunk/www/vicidial/realtime_report.php
@@ -388,6 +388,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/sph_report.php b/agc_2-X/trunk/www/vicidial/sph_report.php
index c5eeb904..b8a40bd6 100644
--- a/agc_2-X/trunk/www/vicidial/sph_report.php
+++ b/agc_2-X/trunk/www/vicidial/sph_report.php
@@ -169,6 +169,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/timeclock_report.php b/agc_2-X/trunk/www/vicidial/timeclock_report.php
index 41924d52..ea760094 100644
--- a/agc_2-X/trunk/www/vicidial/timeclock_report.php
+++ b/agc_2-X/trunk/www/vicidial/timeclock_report.php
@@ -193,6 +193,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/timeclock_status.php b/agc_2-X/trunk/www/vicidial/timeclock_status.php
index 3a654e38..48f1d755 100644
--- a/agc_2-X/trunk/www/vicidial/timeclock_status.php
+++ b/agc_2-X/trunk/www/vicidial/timeclock_status.php
@@ -185,6 +185,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/user_stats.php b/agc_2-X/trunk/www/vicidial/user_stats.php
index 260e5707..aaecb2ba 100644
--- a/agc_2-X/trunk/www/vicidial/user_stats.php
+++ b/agc_2-X/trunk/www/vicidial/user_stats.php
@@ -332,6 +332,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/user_status.php b/agc_2-X/trunk/www/vicidial/user_status.php
index 9951d49c..2286209c 100644
--- a/agc_2-X/trunk/www/vicidial/user_status.php
+++ b/agc_2-X/trunk/www/vicidial/user_status.php
@@ -246,6 +246,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/voice_lab.php b/agc_2-X/trunk/www/vicidial/voice_lab.php
index 08092c09..5e142f01 100644
--- a/agc_2-X/trunk/www/vicidial/voice_lab.php
+++ b/agc_2-X/trunk/www/vicidial/voice_lab.php
@@ -147,6 +147,9 @@ $LOGserver_name = getenv("SERVER_NAME");
 $LOGserver_port = getenv("SERVER_PORT");
 $LOGrequest_uri = getenv("REQUEST_URI");
 $LOGhttp_referer = getenv("HTTP_REFERER");
+$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser);
+$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri);
+$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer);
 if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
   else {$HTTPprotocol = 'http://';}
 if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
diff --git a/agc_2-X/trunk/www/vicidial/web_form_forward.php b/agc_2-X/trunk/www/vicidial/web_form_forward.php
index 793ddc19..d00b9c09 100644
--- a/agc_2-X/trunk/www/vicidial/web_form_forward.php
+++ b/agc_2-X/trunk/www/vicidial/web_form_forward.php
@@ -1,7 +1,7 @@
 <?php
 # web_form_forward.php - custom script forward agent to web page and alter vars
 # 
-# Copyright (C) 2013  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # You will need to customize this to your needs
 #
@@ -9,12 +9,15 @@
 # 80626-1121 - First Build
 # 90508-0644 - Changed to PHP long tags
 # 130902-0757 - Changed to mysqli PHP functions
+# 170527-0003 - Added variable filtering
 #
 
 if (isset($_GET["phone_number"]))	{$phone_number=$_GET["phone_number"];}
 if (isset($_GET["source_id"]))		{$source_id=$_GET["source_id"];}
 if (isset($_GET["user"]))			{$user=$_GET["user"];}
 
+$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
+
 require("dbconnect_mysqli.php");
 
 $stmt="SELECT full_name from vicidial_users where user='$user';";
@@ -35,5 +38,4 @@ echo"<BODY BGCOLOR=#FFFFFF marginheight=0 marginwidth=0 leftmargin=0 topmargin=0
 echo"<a href=\"$URL\">click here to continue. . .</a>\n";
 echo"</BODY></HTML>\n";
 
-
 ?>