diff --git a/php/views/header.html.php b/php/views/header.html.php
index ac64eff..9ca2c4d 100644
--- a/php/views/header.html.php
+++ b/php/views/header.html.php
@@ -32,7 +32,7 @@
             $user = $container->login->getUser();
             echo '<p class="navbar-text pull-right">
                     Logged in as ';
-            echo $user->getUsername();
+            echo htmlspecialchars($user->getUsername());
             echo ' (<a class="navbar-link" href="' . $container->router->generate('logout') . '">logout</a>)';
             echo '</p>';
           }
diff --git a/php/views/home.html.php b/php/views/home.html.php
index c236902..ad6f234 100644
--- a/php/views/home.html.php
+++ b/php/views/home.html.php
@@ -24,8 +24,8 @@
             foreach($values['resultQuestions'] as $res) {
               echo '<tr>';
               echo '<td>' . $res['round_num'] . '</td>';
-              echo '<td>' . $res['channel'] . '</td>';
-              echo '<td class="breakable">' . $res['question'] . '</td>';
+              echo '<td>' . htmlspecialchars($res['channel']) . '</td>';
+              echo '<td class="breakable">' . htmlspecialchars($res['question']) . '</td>';
               echo '<td class="hidden-phone">' . $res['line_num'] . '</td>';
               echo '</tr>';
             }
@@ -54,7 +54,7 @@
             foreach($values['resultActivities'] as $res) {
               echo '<tr>';
               echo '<td>' . date('Y/m/d h:i:s A',$res['timestamp']) . '</td>';
-              echo '<td>' . $res['activity'] . '</td>';
+              echo '<td>' . htmlspecialchars($res['activity']) . '</td>';
               echo '</tr>';
             }
             ?>
diff --git a/php/views/profile.html.php b/php/views/profile.html.php
index 1919c80..3b02bfb 100644
--- a/php/views/profile.html.php
+++ b/php/views/profile.html.php
@@ -3,7 +3,7 @@ $userProfile = $values['userProfile'];
 ?>
     <div class="row profile-header">
       <div class="span12">
-        <h1><?php echo $userProfile['usrname']; ?></h1>
+        <h1><?php echo htmlspecialchars($userProfile['usrname']); ?></h1>
         <p>Profile and stats.</p>
       </div>
     </div>
diff --git a/php/views/reports.html.php b/php/views/reports.html.php
index cf5945a..9036df5 100644
--- a/php/views/reports.html.php
+++ b/php/views/reports.html.php
@@ -44,7 +44,7 @@ if($login->isLoggedIn()) {
             foreach($values['reportResult'] as $res) {
               echo '<tr>';
               echo '<td>' . $res['id'] . '</td>';
-              echo '<td class="hidden-phone">' . $res['username'] . '</td>';
+              echo '<td class="hidden-phone">' . htmlspecialchars($res['username']) . '</td>';
               echo '<td class="hidden-phone">' . $res['question_num'] . '</td>';
               echo '<td class="breakable">' . $res['original'] . '</td>';
               echo '<td class="breakable">' . $res['report_text'] . '</td>';
@@ -91,8 +91,8 @@ if($login->isLoggedIn()) {
             <?php
             foreach($values['editResult'] as $res) {
               $isItalic = false;
-              $splitNew = explode('*', $res['question']);
-              $splitOld = explode('*', $res['original']);
+              $splitNew = explode('*', htmlspecialchars($res['question']));
+              $splitOld = explode('*', htmlspecialchars($res['original']));
 
               $differenceString = '';
               for($y=0;$y<sizeof($splitNew);$y++){
@@ -133,9 +133,9 @@ if($login->isLoggedIn()) {
 
               echo '<tr>';
               echo '<td>' . $res['id'] . '</td>';
-              echo '<td class="hidden-phone">' . $res['username'] . '</td>';
+              echo '<td class="hidden-phone">' . htmlspecialchars($res['username']) . '</td>';
               echo '<td class="breakable">' . $differenceString . '</td>';
-              echo '<td class="breakable">' . $res['original'] . '</td>';
+              echo '<td class="breakable">' . htmlspecialchars($res['original']) . '</td>';
               echo '<td class="hidden-phone">' . $res['question_id'] . '</td>';
               if($isMod) {
                 echo '<td><a href="' . $container->router->generate('accept-edit', array("id"=>$res['id'])) . '" class="btn btn-mini"><i class="icon-ok"></i></a> <a href="' . $container->router->generate('remove-edit', array("id"=>$res['id'])) . '" class="btn btn-mini"><i class="icon-ban-circle"></i></a></td>';
@@ -178,8 +178,8 @@ if($login->isLoggedIn()) {
             foreach($values['newResult'] as $res) {
               echo '<tr>';
               echo '<td>' . $res['id'] . '</td>';
-              echo '<td>' . $res['username'] . '</td>';
-              echo '<td class="breakable">' . $res['question'] . '</td>';
+              echo '<td>' . htmlspecialchars($res['username']) . '</td>';
+              echo '<td class="breakable">' . htmlspecialchars($res['question']) . '</td>';
               if($isMod) {
                 echo '<td><a href="' . $container->router->generate('accept-new', array("id"=>$res['id'])) . '" class="btn btn-mini"><i class="icon-ok"></i></a> <a href="' . $container->router->generate('remove-new', array("id"=>$res['id'])) . '" class="btn btn-mini"><i class="icon-ban-circle"></i></a></td>';
               }
@@ -223,10 +223,10 @@ if($login->isLoggedIn()) {
             foreach($values['deleteResult'] as $res) {
               echo '<tr>';
               echo '<td>' . $res['id'] . '</td>';
-              echo '<td class="hidden-phone">' . $res['username'] . '</td>';
-              echo '<td class="breakable">' . $res['question'] . '</td>';
+              echo '<td class="hidden-phone">' . htmlspecialchars($res['username']) . '</td>';
+              echo '<td class="breakable">' . htmlspecialchars($res['question']) . '</td>';
               echo '<td class="hidden-phone">' . $res['line_num'] . '</td>';
-              echo '<td class="breakable">' . $res['reason'] . '</td>';
+              echo '<td class="breakable">' . htmlspecialchars($res['reason']) . '</td>';
               if($isMod) {
                 echo '<td><a href="' . $container->router->generate('accept-delete', array("id"=>$res['id'])) . '" class="btn btn-mini"><i class="icon-ok"></i></a> <a href="' . $container->router->generate('remove-delete', array("id"=>$res['id'])) . '" class="btn btn-mini"><i class="icon-ban-circle"></i></a></td>';
               }
diff --git a/php/views/stats.html.php b/php/views/stats.html.php
index 82eb807..6dbd6b2 100644
--- a/php/views/stats.html.php
+++ b/php/views/stats.html.php
@@ -24,7 +24,7 @@
             foreach($values['dayResult'] as $key=>$res) {
               echo '<tr>';
               echo '<td>' . ($key+1) . '</td>';
-              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . $res['username'] . '</a></td>';
+              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . htmlspecialchars($res['username']) . '</a></td>';
               echo '<td>' . number_format($res['points'],0) . '</td>';
               echo '</tr>';
             }
@@ -54,7 +54,7 @@
             foreach($values['weekResult'] as $key=>$res) {
               echo '<tr>';
               echo '<td>' . ($key+1) . '</td>';
-              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . $res['username'] . '</a></td>';
+              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . htmlspecialchars($res['username']) . '</a></td>';
               echo '<td>' . number_format($res['points'],0) . '</td>';
               echo '</tr>';
             }
@@ -85,7 +85,7 @@
             foreach($values['monthResult'] as $key=>$res) {
               echo '<tr>';
               echo '<td>' . ($key+1) . '</td>';
-              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . $res['username'] . '</a></td>';
+              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . htmlspecialchars($res['username']) . '</a></td>';
               echo '<td>' . number_format($res['points'],0) . '</td>';
               echo '</tr>';
             }
@@ -114,7 +114,7 @@
             foreach($values['yearResult'] as $key=>$res) {
               echo '<tr>';
               echo '<td>' . ($key+1) . '</td>';
-              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . $res['username'] . '</a></td>';
+              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . htmlspecialchars($res['username']) . '</a></td>';
               echo '<td>' . number_format($res['points'],0) . '</td>';
               echo '</tr>';
             }
diff --git a/php/views/top.html.php b/php/views/top.html.php
index d60768f..50ed1f1 100644
--- a/php/views/top.html.php
+++ b/php/views/top.html.php
@@ -34,7 +34,7 @@
             foreach($values['result'] as $res) {
               echo '<tr>';
               echo '<td>' . $currentRank . '</td>';
-              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . $res['username'] . '</a></td>';
+              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . htmlspecialchars($res['username']) . '</a></td>';
               echo '<td>' . number_format($res['points'],0) . '</td>';
               echo '</tr>';
               $currentRank++;
diff --git a/php/views/user.html.php b/php/views/user.html.php
index 18101cf..6e1ac7d 100644
--- a/php/views/user.html.php
+++ b/php/views/user.html.php
@@ -41,7 +41,7 @@
             <?php
             foreach($values['users'] as $res) {
               echo '<tr>';
-              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . $res['username'] . '</a></td>';
+              echo '<td><a href="' . $container->router->generate('profile', array("username"=>$res['username'])) . '">' . htmlspecialchars($res['username']) . '</a></td>';
               echo '<td>' . number_format($res['points'],0) . '</td>';
               echo '<td>' . number_format($res['total'],0) . '</td>';
               echo '</tr>';