diff --git a/extras/MySQL_AST_CREATE_tables.sql b/extras/MySQL_AST_CREATE_tables.sql
index f9739785..aeaffe8d 100644
--- a/extras/MySQL_AST_CREATE_tables.sql
+++ b/extras/MySQL_AST_CREATE_tables.sql
@@ -4584,6 +4584,7 @@ length_in_sec INT(10),
 visibility  ENUM('VISIBLE','HIDDEN','LOGIN','NONE') default 'NONE',
 agent_log_id INT(9) UNSIGNED,
 index (db_time),
+index (agent_log_id),
 unique index visibleuser (user, visibility, event_end_epoch)
 ) ENGINE=MyISAM;
 
@@ -5022,4 +5023,4 @@ INSERT INTO vicidial_settings_containers(container_id,container_notes,container_
 
 UPDATE system_settings set vdc_agent_api_active='1';
 
-UPDATE system_settings SET db_schema_version='1642',db_schema_update_date=NOW(),reload_timestamp=NOW();
+UPDATE system_settings SET db_schema_version='1643',db_schema_update_date=NOW(),reload_timestamp=NOW();
diff --git a/extras/upgrade_2.14.sql b/extras/upgrade_2.14.sql
index b2ff16ed..3333febb 100644
--- a/extras/upgrade_2.14.sql
+++ b/extras/upgrade_2.14.sql
@@ -1809,3 +1809,7 @@ ALTER TABLE vicidial_peer_event_log MODIFY channel_type ENUM('IAX2','SIP','PJSIP
 ALTER TABLE system_settings ADD allowed_sip_stacks ENUM('SIP','PJSIP','SIP_and_PJSIP') default 'SIP';
 
 UPDATE system_settings SET db_schema_version='1642',db_schema_update_date=NOW() where db_schema_version < 1642;
+
+CREATE INDEX vavl_agent_log_id on vicidial_agent_visibility_log (agent_log_id);
+
+UPDATE system_settings SET db_schema_version='1643',db_schema_update_date=NOW() where db_schema_version < 1643;
diff --git a/www/vicidial/AST_inbound_forecasting.php b/www/vicidial/AST_inbound_forecasting.php
index 5ffd0114..750f0d8f 100644
--- a/www/vicidial/AST_inbound_forecasting.php
+++ b/www/vicidial/AST_inbound_forecasting.php
@@ -12,6 +12,7 @@
 # 180507-2315 - Added new help display
 # 180712-1508 - Fix for rare allowed reports issue
 # 191013-0856 - Fixes for PHP7
+# 210823-0948 - Fix for security issue, added NONE option for campaigns
 #
 
 $startMS = microtime();
@@ -404,12 +405,30 @@ $MT[0]='';
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
-if (!isset($group)) {$group = array();}
+if (!isset($group) || !is_array($group)) {$group = array();}
 if (!isset($drop_percent)) {$drop_percent = '3';}
-if (!isset($campaign)) {$campaign = array();}
+if (!isset($campaign) || !is_array($campaign)) {$campaign = array();}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
 
+$group=preg_replace('/[^-_0-9\p{L}]/u','',$group);
+$campaign=preg_replace('/[^-_0-9\p{L}]/u','',$campaign);
+$query_date = preg_replace('/[^-0-9]/','',$query_date);
+$end_date = preg_replace('/[^-0-9]/','',$end_date);
+$shift=preg_replace('/[^\p{L}]/u', '', $shift);
+$erlang_type=preg_replace('/[^\p{L}]/u', '', $erlang_type);
+$actual_agents=preg_replace("/[^0-9.]/", "", $actual_agents);
+$hourly_pay=preg_replace("/[^0-9.]/", "", $hourly_pay);
+$revenue_per_sale=preg_replace("/[^0-9.]/", "", $revenue_per_sale);
+$sale_chance=preg_replace("/[^0-9.]/", "", $sale_chance);
+$retry_rate=preg_replace("/[^0-9.]/", "", $retry_rate);
+$target_pqueue=preg_replace("/[^0-9.]/", "", $target_pqueue);
+$DB = preg_replace('/[^0-9]/','',$DB);
+$submit=preg_replace('/[^-_0-9\p{L}]/u','',$submit);
+$SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT);
+$file_download = preg_replace('/[^0-9]/','',$file_download);
+$report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type);
+
 $drop_percent=preg_replace("/[^\.0-9]/", "", $drop_percent);
 if ($drop_percent>100) {$drop_percent=100;}
 $drop_rate=$drop_percent/100;
@@ -434,7 +453,7 @@ while($i < $group_ct)
 		}
 	$i++;
 	}
-if ( (preg_match('/\s\-\-NONE\-\-\s/',$group_string) ) or ($group_ct < 1) )
+if ( (preg_match('/\-\-NONE\-\-/',$group_string) ) or ($group_ct < 1) )
 	{
 	$group_SQL = "''";
 	}
@@ -463,7 +482,7 @@ while($i < $campaign_ct)
 		}
 	$i++;
 	}
-if ( (preg_match('/\s\-\-NONE\-\-\s/',$campaign_string) ) or ($campaign_ct < 1) )
+if ( (preg_match('/\-\-NONE\-\-/',$campaign_string) ) or ($campaign_ct < 1) )
 	{
 	$campaign_SQL = "''";
 	}
@@ -581,6 +600,7 @@ $MAIN.="<SELECT SIZE=5 NAME=campaign[] multiple>\n";
 #else
 #	{$MAIN.="<option value=\"--ALL--\">-- "._QXZ("ALL CAMPAIGNS")." --</option>\n";}
 $MAIN.="<option value=\"--ALL--\"".(in_array("--ALL--", $campaign) ? " selected" : "").">-- "._QXZ("ALL CAMPAIGNS")." --</option>\n";
+$MAIN.="<option value=\"--NONE--\"".(in_array("--NONE--", $campaign) ? " selected" : "").">-- "._QXZ("NONE")." --</option>\n";
 $o=0;
 $campaign_SQL="";
 while ($campaigns_to_print > $o)
@@ -601,6 +621,7 @@ $MAIN.="</TD>\n";
 
 $MAIN.="<TD VALIGN=TOP> <B>"._QXZ("In-groups").":</B><BR><SELECT SIZE=5 NAME=group[] multiple>\n";
 $MAIN.="<option value=\"--ALL--\"".(in_array("--ALL--", $group) ? " selected" : "").">--"._QXZ("ALL INGROUPS")."--</option>\n";
+$MAIN.="<option value=\"--NONE--\"".(in_array("--NONE--", $group) ? " selected" : "").">-- "._QXZ("NONE")." --</option>\n";
 
 $o=0;
 while ($groups_to_print > $o)
@@ -676,12 +697,12 @@ else
 
 	$campaign_string=preg_replace("/^\||\|$/", "", $campaign_string);
 	$group_string=preg_replace("/^\||\|$/", "", $group_string);
-	$ASCII_text =" Date range :  $query_date to $end_date\n";
+	$ASCII_text =" Date range :  $query_date to $end_date ($groups_selected==0 && $campaigns_selected==0)\n";
 	$ASCII_text.=" Campaigns  :  ".preg_replace("/\|/", ", ", $campaign_string)."\n";
 	$ASCII_text.=" In-groups  :  ".preg_replace("/\|/", ", ", $group_string)."\n\n";
 # 	$ASCII_text.=" Report type:  $erlang_type\n\n";
 
-	$HTML_text.=" Date range :  $query_date to $end_date\n";
+	$HTML_text.=" Date range :  $query_date to $end_date ($groups_selected==0 && $campaigns_selected==0)\n";
 	$HTML_text.=" Campaigns  :  ".preg_replace("/\|/", ", ", $campaign_string)."\n";
 	$HTML_text.=" In-groups  :  ".preg_replace("/\|/", ", ", $group_string)."";
 # 	$HTML_text.=" Report type:  $erlang_type\n\n";
diff --git a/www/vicidial/AST_quality_control_report.php b/www/vicidial/AST_quality_control_report.php
index 77472301..f61549e4 100644
--- a/www/vicidial/AST_quality_control_report.php
+++ b/www/vicidial/AST_quality_control_report.php
@@ -7,6 +7,7 @@
 #
 # changes:
 # 210306-1556 - First Build
+# 210827-1818 - Fix for security issue
 #
 
 $admin_version = '2.14-1';
@@ -60,6 +61,8 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 if (isset($_GET["show_percentages"]))					{$show_percentages=$_GET["show_percentages"];}
 	elseif (isset($_POST["show_percentages"]))			{$show_percentages=$_POST["show_percentages"];}
+if (isset($_GET["search_archived_data"]))					{$search_archived_data=$_GET["search_archived_data"];}
+	elseif (isset($_POST["search_archived_data"]))			{$search_archived_data=$_POST["search_archived_data"];}
 if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
@@ -298,13 +301,13 @@ $MT[0]='';
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
-if (!isset($group)) {$group = array();}
-if (!isset($statuses)) {$statuses = array();}
-if (!isset($users)) {$users = array();}
-if (!isset($user_groups)) {$user_groups = array();}
-if (!isset($QCusers)) {$QCusers = array();}
-if (!isset($QCstatuses)) {$QCstatuses = array();}
-if (!isset($QCuser_groups)) {$QCuser_groups = array();}
+if (!isset($group) || !is_array($group)) {$group = array();}
+if (!isset($statuses) || !is_array($statuses)) {$statuses = array();}
+if (!isset($users) || !is_array($users)) {$users = array();}
+if (!isset($user_groups) || !is_array($user_groups)) {$user_groups = array();}
+if (!isset($QCusers) || !is_array($QCusers)) {$QCusers = array();}
+if (!isset($QCstatuses) || !is_array($QCstatuses)) {$QCstatuses = array();}
+if (!isset($QCuser_groups) || !is_array($QCuser_groups)) {$QCuser_groups = array();}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
 if (!isset($query_time)) {$query_time = "00:00:00";}
@@ -316,6 +319,29 @@ if (!isset($end_time)) {$end_time = "23:59:59";}
 $all_QC_statuses=array("CLAIMED", "FINISHED");
 $QC_statuses_to_print=count($all_QC_statuses);
 
+$group=preg_replace('/[^-_0-9\p{L}]/u','',$group);
+$campaign=preg_replace('/[^-_0-9\p{L}]/u','',$campaign);
+$query_date = preg_replace('/[^-0-9]/','',$query_date);
+$end_date = preg_replace('/[^-0-9]/','',$end_date);
+$query_time=preg_replace("/[^0-9\:]/", "", $query_time);
+$end_time=preg_replace("/[^0-9\:]/", "", $end_time);
+$qc_finish_start_date = preg_replace('/[^-0-9]/','',$qc_finish_start_date);
+$qc_finish_end_date = preg_replace('/[^-0-9]/','',$qc_finish_end_date);
+$qc_finish_start_time=preg_replace("/[^0-9\:]/", "", $qc_finish_start_time);
+$qc_finish_end_time=preg_replace("/[^0-9\:]/", "", $qc_finish_end_time);
+
+$users=preg_replace('/[^-_0-9\p{L}]/u','',$users);
+$user_groups=preg_replace('/[^-_0-9\p{L}]/u','',$user_groups);
+$statuses=preg_replace('/[^-_0-9\p{L}]/u','',$statuses);
+$QCusers=preg_replace('/[^-_0-9\p{L}]/u','',$QCusers);
+$QCuser_groups=preg_replace('/[^-_0-9\p{L}]/u','',$QCuser_groups);
+$QCstatuses=preg_replace('/[^-_0-9\p{L}]/u','',$QCstatuses);
+$DB = preg_replace('/[^0-9]/','',$DB);
+$SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT);
+$show_percentages=preg_replace('/[^-_0-9\p{L}]/u','',$show_percentages);
+$file_download = preg_replace('/[^0-9]/','',$file_download);
+
+
 $i=0;
 $campaign_string='|';
 $campaigns_ct = count($group);
diff --git a/www/vicidial/AST_rt_whiteboard_rpt.php b/www/vicidial/AST_rt_whiteboard_rpt.php
index c7f13477..eac1968c 100644
--- a/www/vicidial/AST_rt_whiteboard_rpt.php
+++ b/www/vicidial/AST_rt_whiteboard_rpt.php
@@ -10,6 +10,7 @@
 # 180507-2315 - Added new help display
 # 180512-0000 - Fixed slave server capability
 # 190927-1758 - Fixed PHP7 array issue
+# 210827-1818 - Fix for security issue
 #
 
 $startMS = microtime();
@@ -55,6 +56,21 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
+$query_date = preg_replace('/[^-0-9]/','',$query_date);
+$end_date = preg_replace('/[^-0-9]/','',$end_date);
+$query_time=preg_replace("/[^0-9\:]/", "", $query_time);
+$end_time=preg_replace("/[^0-9\:]/", "", $end_time);
+$campaigns=preg_replace('/[^-_0-9\p{L}]/u','',$campaigns);
+$users=preg_replace('/[^-_0-9\p{L}]/u','',$users);
+$user_groups=preg_replace('/[^-_0-9\p{L}]/u','',$user_groups);
+$groups=preg_replace('/[^-_0-9\p{L}]/u','',$groups);
+$dids=preg_replace('/[^-_0-9\p{L}]/u','',$dids);
+$file_download = preg_replace('/[^0-9]/','',$file_download);
+$submit=preg_replace('/[^-_0-9\p{L}]/u','',$submit);
+$SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT);
+$DB = preg_replace('/[^0-9]/','',$DB);
+$report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type);
+
 if (!$query_date) {$query_date=date("Y-m-d");}
 if (!$end_date) {$end_date=date("Y-m-d");}
 if (!$query_time) {$query_time="08:00:00";}
diff --git a/www/vicidial/AST_rt_whiteboard_rpt_mobile.php b/www/vicidial/AST_rt_whiteboard_rpt_mobile.php
index 7fddf88f..a4dc6a08 100644
--- a/www/vicidial/AST_rt_whiteboard_rpt_mobile.php
+++ b/www/vicidial/AST_rt_whiteboard_rpt_mobile.php
@@ -7,6 +7,7 @@
 #
 # 190227-1259 - Initial build
 # 200309-1819 - Modifications for display formatting
+# 210827-1818 - Fix for security issue
 #
 
 $startMS = microtime();
@@ -52,6 +53,21 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
+$query_date = preg_replace('/[^-0-9]/','',$query_date);
+$end_date = preg_replace('/[^-0-9]/','',$end_date);
+$query_time=preg_replace("/[^0-9\:]/", "", $query_time);
+$end_time=preg_replace("/[^0-9\:]/", "", $end_time);
+$campaigns=preg_replace('/[^-_0-9\p{L}]/u','',$campaigns);
+$users=preg_replace('/[^-_0-9\p{L}]/u','',$users);
+$user_groups=preg_replace('/[^-_0-9\p{L}]/u','',$user_groups);
+$groups=preg_replace('/[^-_0-9\p{L}]/u','',$groups);
+$dids=preg_replace('/[^-_0-9\p{L}]/u','',$dids);
+$file_download = preg_replace('/[^0-9]/','',$file_download);
+$submit=preg_replace('/[^-_0-9\p{L}]/u','',$submit);
+$SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT);
+$DB = preg_replace('/[^0-9]/','',$DB);
+$report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type);
+
 if (!$query_date) {$query_date=date("Y-m-d");}
 if (!$end_date) {$end_date=date("Y-m-d");}
 if (!$query_time) {$query_time="08:00:00";}
@@ -218,7 +234,7 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
-if (!isset($groups)) {$groups = array();}
+if (!isset($groups) || !is_array($groups)) {$groups = array();}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
 
diff --git a/www/vicidial/agent_sales_report_mobile.php b/www/vicidial/agent_sales_report_mobile.php
index b72b0feb..21370aa6 100644
--- a/www/vicidial/agent_sales_report_mobile.php
+++ b/www/vicidial/agent_sales_report_mobile.php
@@ -32,8 +32,6 @@ if (isset($_GET["call_status"]))			{$call_status=$_GET["call_status"];}
 	elseif (isset($_POST["call_status"]))	{$call_status=$_POST["call_status"];}
 if (isset($_GET["user_group"]))				{$user_group=$_GET["user_group"];}
 	elseif (isset($_POST["user_group"]))	{$user_group=$_POST["user_group"];}
-if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
-	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
@@ -50,6 +48,19 @@ if (isset($_GET["refresh_rate"]))			{$refresh_rate=$_GET["refresh_rate"];}
 	elseif (isset($_POST["refresh_rate"]))	{$refresh_rate=$_POST["refresh_rate"];}
 
 
+$DB = preg_replace('/[^0-9]/','',$DB);
+$end_date_D = preg_replace('/[^-0-9]/','',$end_date_D);
+$end_date_T = preg_replace('/[^0-9\:]/','',$end_date_T);
+$query_date_D = preg_replace('/[^-0-9]/','',$query_date_D);
+$query_date_T = preg_replace('/[^0-9\:]/','',$query_date_T);
+$refresh_rate = preg_replace('/[^0-9]/','',$refresh_rate);
+$top_agents = preg_replace('/[^0-9]/','',$top_agents);
+$graph_type=preg_replace('/[^_0-9\p{L}]/u','',$graph_type);
+$report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type);
+$sort_by=preg_replace('/[^\p{L}]/u','',$sort_by);
+$SUBMIT=preg_replace('/[^\p{L}]/u','',$SUBMIT);
+
+
 $report_name = 'Agent Sales Report';
 $db_source = 'M';
 $JS_text.="<script language='Javascript'>\n";
@@ -202,7 +213,7 @@ else
 	$webserver_id = mysqli_insert_id($link);
 	}
 
-$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
+$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, 0, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 $report_log_id = mysqli_insert_id($link);
@@ -268,7 +279,7 @@ $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
 if (!isset($group)) {$group = array();}
-if (!isset($user_group)) {$group = array();}
+if (!isset($user_group)) {$user_group = array();}
 if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
 if (!isset($query_date_T)) {$query_date_T="00:00:00";}
 if (!isset($refresh_rate)) {$refresh_rate="1000000";}
diff --git a/www/vicidial/qc_call_client_iframe.php b/www/vicidial/qc_call_client_iframe.php
index 7b228301..ba02dce6 100644
--- a/www/vicidial/qc_call_client_iframe.php
+++ b/www/vicidial/qc_call_client_iframe.php
@@ -18,6 +18,8 @@
 # 141229-2013 - Added code for on-the-fly language translations display
 # 170409-1533 - Added IP List validation code
 # 210306-1052 - Changes for new QC module
+# 210825-0937 - Removed custom fields, unused here.
+# 210827-1818 - Fix for security issue
 #
 
 require("dbconnect_mysqli.php");
@@ -160,10 +162,6 @@ if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
-
-	$old_phone = preg_replace('/[^0-9]/','',$old_phone);
-	$phone_number = preg_replace('/[^0-9]/','',$phone_number);
-	$alt_phone = preg_replace('/[^0-9]/','',$alt_phone);
 	}	# end of non_latin
 else
 	{
@@ -171,6 +169,12 @@ else
 	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
 	}
 
+$old_phone = preg_replace('/[^0-9]/','',$old_phone);
+$phone_number = preg_replace('/[^0-9]/','',$phone_number);
+$alt_phone = preg_replace('/[^0-9]/','',$alt_phone);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$list_id = preg_replace('/[^0-9]/','',$list_id);
+
 if (strlen($phone_number)<6) {$phone_number=$old_phone;}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -232,50 +236,6 @@ if ( $qc_user_level < 1 )
 	exit;
 	}
 
-$label_title =				_QXZ("Title");
-$label_first_name =			_QXZ("First");
-$label_middle_initial =		_QXZ("MI");
-$label_last_name =			_QXZ("Last");
-$label_address1 =			_QXZ("Address1");
-$label_address2 =			_QXZ("Address2");
-$label_address3 =			_QXZ("Address3");
-$label_city =				_QXZ("City");
-$label_state =				_QXZ("State");
-$label_province =			_QXZ("Province");
-$label_postal_code =		_QXZ("Postal Code");
-$label_vendor_lead_code =	_QXZ("Vendor ID");
-$label_gender =				_QXZ("Gender");
-$label_phone_number =		_QXZ("Phone");
-$label_phone_code =			_QXZ("DialCode");
-$label_alt_phone =			_QXZ("Alt. Phone");
-$label_security_phrase =	_QXZ("Show");
-$label_email =				_QXZ("Email");
-$label_comments =			_QXZ("Comments");
-
-### find any custom field labels
-$stmt="SELECT label_title,label_first_name,label_middle_initial,label_last_name,label_address1,label_address2,label_address3,label_city,label_state,label_province,label_postal_code,label_vendor_lead_code,label_gender,label_phone_number,label_phone_code,label_alt_phone,label_security_phrase,label_email,label_comments from system_settings;";
-$rslt=mysql_to_mysqli($stmt, $link);
-$row=mysqli_fetch_row($rslt);
-if (strlen($row[0])>0)	{$label_title =				$row[0];}
-if (strlen($row[1])>0)	{$label_first_name =		$row[1];}
-if (strlen($row[2])>0)	{$label_middle_initial =	$row[2];}
-if (strlen($row[3])>0)	{$label_last_name =			$row[3];}
-if (strlen($row[4])>0)	{$label_address1 =			$row[4];}
-if (strlen($row[5])>0)	{$label_address2 =			$row[5];}
-if (strlen($row[6])>0)	{$label_address3 =			$row[6];}
-if (strlen($row[7])>0)	{$label_city =				$row[7];}
-if (strlen($row[8])>0)	{$label_state =				$row[8];}
-if (strlen($row[9])>0)	{$label_province =			$row[9];}
-if (strlen($row[10])>0) {$label_postal_code =		$row[10];}
-if (strlen($row[11])>0) {$label_vendor_lead_code =	$row[11];}
-if (strlen($row[12])>0) {$label_gender =			$row[12];}
-if (strlen($row[13])>0) {$label_phone_number =		$row[13];}
-if (strlen($row[14])>0) {$label_phone_code =		$row[14];}
-if (strlen($row[15])>0) {$label_alt_phone =			$row[15];}
-if (strlen($row[16])>0) {$label_security_phrase =	$row[16];}
-if (strlen($row[17])>0) {$label_email =				$row[17];}
-if (strlen($row[18])>0) {$label_comments =			$row[18];}
-
 //Is logged in admin user also logged in as an agent?
 function is_user_logged_in($user)
 	{
diff --git a/www/vicidial/qc_modify_lead.php b/www/vicidial/qc_modify_lead.php
index cb824789..69869406 100644
--- a/www/vicidial/qc_modify_lead.php
+++ b/www/vicidial/qc_modify_lead.php
@@ -30,6 +30,7 @@
 # 171001-1110 - Added in-browser audio control, if recording access control is disabled
 # 210304-1650 - Added modify_leads=5 read-only option
 # 210306-0854 - Redesign of QC module
+# 210827-1818 - Fix for security issue
 #
 
 require("dbconnect_mysqli.php");
diff --git a/www/vicidial/qc_scorecards.php b/www/vicidial/qc_scorecards.php
index ff275dc5..ce5a4911 100644
--- a/www/vicidial/qc_scorecards.php
+++ b/www/vicidial/qc_scorecards.php
@@ -7,6 +7,7 @@
 #
 # changes:
 # 210306-1532 - First Build
+# 210827-1818 - Fix for security issue
 #
 
 $admin_version = '2.14-1';
diff --git a/www/vicidial/realtime_report_mobile.php b/www/vicidial/realtime_report_mobile.php
index 9cbc0341..abec64e7 100644
--- a/www/vicidial/realtime_report_mobile.php
+++ b/www/vicidial/realtime_report_mobile.php
@@ -14,6 +14,7 @@
 # 190206-1616 - First Build
 # 190228-1535 - Minor pre-release changes
 # 200309-1819 - Modifications for display formatting
+# 210827-1818 - Fix for security issue
 #
 
 $startMS = microtime();