From 003a5e915291956187ec9cc0140d3526adf93ff6 Mon Sep 17 00:00:00 2001
From: anonymoususer72041
 <247563575+anonymoususer72041@users.noreply.github.com>
Date: Wed, 18 Mar 2026 09:15:00 +0100
Subject: [PATCH 1/3] Normalize escaping for affected fields

---
 modules/calendar/Calendar.tpl |  4 ++--
 modules/candidates/Show.tpl   |  6 +++---
 modules/companies/Show.tpl    |  2 +-
 modules/contacts/Show.tpl     |  4 ++--
 modules/joborders/Show.tpl    | 16 ++++++++--------
 5 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/modules/calendar/Calendar.tpl b/modules/calendar/Calendar.tpl
index e180fa3dd..191a7d377 100755
--- a/modules/calendar/Calendar.tpl
+++ b/modules/calendar/Calendar.tpl
@@ -67,7 +67,7 @@
                                                     <select id="type" name="type" class="inputbox" style="width: 150px;">
                                                         <option value="">(Select a Type)</option>
                                                         <?php foreach ($this->calendarEventTypes as $type): ?>
-                                                            <option value="<?php echo($type['typeID']); ?>"><?php echo($type['description']); ?></option>
+                                                            <option value="<?php echo($type['typeID']); ?>"><?php $this->_($type['description']); ?></option>
                                                         <?php endforeach; ?>
                                                     </select>&nbsp;*
                                                 </td>
@@ -217,7 +217,7 @@
                                                     <select id="typeEdit" name="type" class="inputbox" style="width: 150px;">
                                                         <option value="">(Select a Type)</option>
                                                         <?php foreach ($this->calendarEventTypes as $type): ?>
-                                                            <option value="<?php echo($type['typeID']); ?>"><?php echo($type['description']); ?></option>
+                                                            <option value="<?php echo($type['typeID']); ?>"><?php $this->_($type['description']); ?></option>
                                                         <?php endforeach; ?>
                                                     </select>&nbsp;*
                                                 </td>
diff --git a/modules/candidates/Show.tpl b/modules/candidates/Show.tpl
index ab1a343a0..9ec74c9d5 100755
--- a/modules/candidates/Show.tpl
+++ b/modules/candidates/Show.tpl
@@ -4,9 +4,9 @@ use OpenCATS\UI\CandidateQuickActionMenu;
 use OpenCATS\UI\CandidateDuplicateQuickActionMenu;
 ?>
 <?php if ($this->isPopup): ?>
-    <?php TemplateUtility::printHeader('Candidate - '.$this->data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'modules/candidates/quickAction-candidates.js')); ?>
+    <?php TemplateUtility::printHeader('Candidate - ' . htmlspecialchars($this->data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'js/attachment.js', 'modules/candidates/quickAction-candidates.js')); ?>
 <?php else: ?>
-    <?php TemplateUtility::printHeader('Candidate - '.$this->data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'modules/candidates/quickAction-candidates.js', 'modules/candidates/quickAction-duplicates.js')); ?>
+    <?php TemplateUtility::printHeader('Candidate - ' . htmlspecialchars($this->data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'js/attachment.js', 'modules/candidates/quickAction-candidates.js', 'modules/candidates/quickAction-duplicates.js')); ?>
     
     <?php TemplateUtility::printHeaderBlock(); ?>
     <?php TemplateUtility::printTabs($this->active); ?>
@@ -614,7 +614,7 @@ use OpenCATS\UI\CandidateDuplicateQuickActionMenu;
                 <?php foreach($this->lists as $rowNumber => $list): ?>
                     <tr class="<?php TemplateUtility::printAlternatingRowClass($rowNumber); ?>">
                         <td>
-                            <a href="index.php?m=lists&a=showList&savedListID=<?php echo $list['listID']; ?>"><?php echo $list['name']; ?></a>
+                            <a href="index.php?m=lists&a=showList&savedListID=<?php echo $list['listID']; ?>"><?php $this->_($list['name']); ?></a>
                         </td>
                     </tr>
                 <?php endforeach; ?>
diff --git a/modules/companies/Show.tpl b/modules/companies/Show.tpl
index 86ec6a545..e016fba47 100755
--- a/modules/companies/Show.tpl
+++ b/modules/companies/Show.tpl
@@ -2,7 +2,7 @@
 include_once('./vendor/autoload.php');
 use OpenCATS\UI\QuickActionMenu;
 ?>
-<?php TemplateUtility::printHeader('Company - '.$this->data['name'], array( 'js/activity.js', 'js/sorttable.js')); ?>
+<?php TemplateUtility::printHeader('Company - ' . htmlspecialchars($this->data['name'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/attachment.js')); ?>
 <?php TemplateUtility::printHeaderBlock(); ?>
 <?php TemplateUtility::printTabs($this->active); ?>
     <div id="main">
diff --git a/modules/contacts/Show.tpl b/modules/contacts/Show.tpl
index 79b6927a0..79caa6d8a 100755
--- a/modules/contacts/Show.tpl
+++ b/modules/contacts/Show.tpl
@@ -3,7 +3,7 @@
 include_once('./vendor/autoload.php');
 use OpenCATS\UI\QuickActionMenu;
 ?>
-<?php TemplateUtility::printHeader('Contact - '.$this->data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js')); ?>
+<?php TemplateUtility::printHeader('Contact - ' . htmlspecialchars($this->data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/attachment.js')); ?>
 <?php TemplateUtility::printHeaderBlock(); ?>
 <?php TemplateUtility::printTabs($this->active); ?>
     <script type="text/javascript">
@@ -50,7 +50,7 @@ use OpenCATS\UI\QuickActionMenu;
                                 <td class="data">
                                     <a href="<?php echo(CATSUtility::getIndexName()); ?>?m=companies&amp;a=show&amp;companyID=<?php echo($this->data['companyID']); ?>">
                                         <span class="<?php echo($this->data['titleClassCompany']);?>">
-                                            <?php echo($this->data['companyName']); ?>
+                                            <?php $this->_($this->data['companyName']); ?>
                                         </span>
                                     </a>
                                     <?php if ($this->data['leftCompany']): ?>
diff --git a/modules/joborders/Show.tpl b/modules/joborders/Show.tpl
index 94906e998..754bc34a8 100755
--- a/modules/joborders/Show.tpl
+++ b/modules/joborders/Show.tpl
@@ -3,9 +3,9 @@ include_once('./vendor/autoload.php');
 use OpenCATS\UI\QuickActionMenu;
 ?>
 <?php if ($this->isPopup): ?>
-    <?php TemplateUtility::printHeader('Job Order - '.$this->data['title'], array('js/sorttable.js', 'js/match.js', 'js/pipeline.js')); ?>
+    <?php TemplateUtility::printHeader('Job Order - ' . htmlspecialchars($this->data['title'], ENT_QUOTES, HTML_ENCODING), array('js/sorttable.js', 'js/match.js', 'js/pipeline.js', 'js/attachment.js')); ?>
 <?php else: ?>
-    <?php TemplateUtility::printHeader('Job Order - '.$this->data['title'], array( 'js/sorttable.js', 'js/match.js', 'js/pipeline.js')); ?>
+    <?php TemplateUtility::printHeader('Job Order - ' . htmlspecialchars($this->data['title'], ENT_QUOTES, HTML_ENCODING), array( 'js/sorttable.js', 'js/match.js', 'js/pipeline.js', 'js/attachment.js')); ?>
     <?php TemplateUtility::printHeaderBlock(); ?>
     <?php TemplateUtility::printTabs($this->active); ?>
         <div id="main">
@@ -69,7 +69,7 @@ use OpenCATS\UI\QuickActionMenu;
                                 <td class="vertical">Company Name:</td>
                                 <td class="data">
                                     <a href="<?php echo(CATSUtility::getIndexName()); ?>?m=companies&amp;a=show&amp;companyID=<?php echo($this->data['companyID']); ?>">
-                                        <?php echo($this->data['companyName']); ?>
+                                        <?php $this->_($this->data['companyName']); ?>
                                     </a>
                                 </td>
                             </tr>
@@ -77,7 +77,7 @@ use OpenCATS\UI\QuickActionMenu;
                             <tr>
                                 <td class="vertical">Department:</td>
                                 <td class="data">
-                                    <?php echo($this->data['department']); ?>
+                                    <?php $this->_($this->data['department']); ?>
                                 </td>
                             </tr>
 
@@ -88,7 +88,7 @@ use OpenCATS\UI\QuickActionMenu;
 
                             <tr>
                                 <td class="vertical">Company Job ID:</td>
-                                <td class="data"><?php echo($this->data['companyJobID']); ?></td>
+                                <td class="data"><?php $this->_($this->data['companyJobID']); ?></td>
                             </tr>
 
                             <!-- CONTACT INFO -->
@@ -96,14 +96,14 @@ use OpenCATS\UI\QuickActionMenu;
                                 <td class="vertical">Contact Name:</td>
                                 <td class="data">
                                     <a href="<?php echo(CATSUtility::getIndexName()); ?>?m=contacts&amp;a=show&amp;contactID=<?php echo($this->data['contactID']); ?>">
-                                        <?php echo($this->data['contactFullName']); ?>
+                                        <?php $this->_($this->data['contactFullName']); ?>
                                     </a>
                                 </td>
                             </tr>
 
                             <tr>
                                 <td class="vertical">Contact Phone:</td>
-                                <td class="data"><?php echo($this->data['contactWorkPhone']); ?></td>
+                                <td class="data"><?php $this->_($this->data['contactWorkPhone']); ?></td>
                             </tr>
 
                             <tr>
@@ -227,7 +227,7 @@ use OpenCATS\UI\QuickActionMenu;
                 <?php endif; ?>
 
                 <?php if ($this->questionnaireID !== false): ?>
-                    <br />Applicants must complete the "<i><?php echo $this->questionnaireData['title']; ?></i>" (<a href="<?php echo CATSUtility::getIndexName(); ?>?m=settings&a=careerPortalQuestionnaire&questionnaireID=<?php echo $this->questionnaireID; ?>">edit</a>) questionnaire when applying.
+                    <br />Applicants must complete the "<i><?php $this->_($this->questionnaireData['title']); ?></i>" (<a href="<?php echo CATSUtility::getIndexName(); ?>?m=settings&a=careerPortalQuestionnaire&questionnaireID=<?php echo $this->questionnaireID; ?>">edit</a>) questionnaire when applying.
                 <?php else: ?>
                     <br />You have not attached any
                     <?php if ($this->getUserAccessLevel('setting.carrerPortalSettings') >= ACCESS_LEVEL_SA): ?>

From 8bf31dca515cdc5782a6984a4ec8c66ee0dbb5a3 Mon Sep 17 00:00:00 2001
From: anonymoususer72041
 <247563575+anonymoususer72041@users.noreply.github.com>
Date: Wed, 18 Mar 2026 09:15:00 +0100
Subject: [PATCH 2/3] Stop storing HTML entities in database writes

---
 modules/calendar/CalendarUI.php     | 14 ++---
 modules/candidates/CandidatesUI.php | 88 ++++++++++++++---------------
 modules/careers/CareersUI.php       |  3 +-
 modules/companies/CompaniesUI.php   | 60 ++++++++++----------
 modules/contacts/ContactsUI.php     | 80 +++++++++++++-------------
 modules/joborders/JobOrdersUI.php   | 28 ++++-----
 modules/settings/SettingsUI.php     | 16 +++---
 7 files changed, 144 insertions(+), 145 deletions(-)

diff --git a/modules/calendar/CalendarUI.php b/modules/calendar/CalendarUI.php
index 7436ef833..a9cf1d6e4 100755
--- a/modules/calendar/CalendarUI.php
+++ b/modules/calendar/CalendarUI.php
@@ -402,10 +402,10 @@ private function onAddEvent()
 
         $publicEntry     = $this->isChecked('publicEntry', $_POST);
         $reminderEnabled = $this->isChecked('reminderToggle', $_POST);
-        $description   = $this->getSanitisedInput('description', $_POST);
-        $title         = $this->getSanitisedInput('title', $_POST);
-        $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST);
-        $reminderTime  = $this->getSanitisedInput('reminderTime', $_POST);
+        $description   = $this->getTrimmedInput('description', $_POST);
+        $title         = $this->getTrimmedInput('title', $_POST);
+        $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST);
+        $reminderTime  = $this->getTrimmedInput('reminderTime', $_POST);
 
         // FIXME: Reminder time must be an integer!
 
@@ -595,9 +595,9 @@ private function onEditEvent()
         $publicEntry     = $this->isChecked('publicEntry', $_POST);
         $reminderEnabled = $this->isChecked('reminderToggle', $_POST);
 
-        $description   = $this->getSanitisedInput('description', $_POST);
-        $title         = $this->getSanitisedInput('title', $_POST);
-        $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST);
+        $description   = $this->getTrimmedInput('description', $_POST);
+        $title         = $this->getTrimmedInput('title', $_POST);
+        $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST);
         $reminderTime  = $this->getTrimmedInput('reminderTime', $_POST);
 
         // FIXME: Reminder time must be an integer!
diff --git a/modules/candidates/CandidatesUI.php b/modules/candidates/CandidatesUI.php
index 8aaa11582..d59a034da 100755
--- a/modules/candidates/CandidatesUI.php
+++ b/modules/candidates/CandidatesUI.php
@@ -986,28 +986,28 @@ public function checkParsingFunctions()
 
             // Retain all field data since this isn't done over AJAX (yet)
             $fields = array(
-                'firstName'       => $this->getSanitisedInput('firstName', $_POST),
-                'middleName'      => $this->getSanitisedInput('middleName', $_POST),
-                'lastName'        => $this->getSanitisedInput('lastName', $_POST),
-                'email1'          => $this->getSanitisedInput('email1', $_POST),
-                'email2'          => $this->getSanitisedInput('email2', $_POST),
-                'phoneHome'       => $this->getSanitisedInput('phoneHome', $_POST),
-                'phoneCell'       => $this->getSanitisedInput('phoneCell', $_POST),
-                'phoneWork'       => $this->getSanitisedInput('phoneWork', $_POST),
-                'address'         => $this->getSanitisedInput('address', $_POST),
-                'address2'        => $this->getSanitisedInput('address2', $_POST),
-                'city'            => $this->getSanitisedInput('city', $_POST),
-                'state'           => $this->getSanitisedInput('state', $_POST),
-                'zip'             => $this->getSanitisedInput('zip', $_POST),
+                'firstName'       => $this->getTrimmedInput('firstName', $_POST),
+                'middleName'      => $this->getTrimmedInput('middleName', $_POST),
+                'lastName'        => $this->getTrimmedInput('lastName', $_POST),
+                'email1'          => $this->getTrimmedInput('email1', $_POST),
+                'email2'          => $this->getTrimmedInput('email2', $_POST),
+                'phoneHome'       => $this->getTrimmedInput('phoneHome', $_POST),
+                'phoneCell'       => $this->getTrimmedInput('phoneCell', $_POST),
+                'phoneWork'       => $this->getTrimmedInput('phoneWork', $_POST),
+                'address'         => $this->getTrimmedInput('address', $_POST),
+                'address2'        => $this->getTrimmedInput('address2', $_POST),
+                'city'            => $this->getTrimmedInput('city', $_POST),
+                'state'           => $this->getTrimmedInput('state', $_POST),
+                'zip'             => $this->getTrimmedInput('zip', $_POST),
                 'source'          => $this->getTrimmedInput('source', $_POST),
-                'keySkills'       => $this->getSanitisedInput('keySkills', $_POST),
-                'currentEmployer' => $this->getSanitisedInput('currentEmployer', $_POST),
-                'currentPay'      => $this->getSanitisedInput('currentPay', $_POST),
-                'desiredPay'      => $this->getSanitisedInput('desiredPay', $_POST),
-                'notes'           => $this->getSanitisedInput('notes', $_POST),
-                'canRelocate'     => $this->getSanitisedInput('canRelocate', $_POST),
-                'webSite'         => $this->getSanitisedInput('webSite', $_POST),
-                'bestTimeToCall'  => $this->getSanitisedInput('bestTimeToCall', $_POST),
+                'keySkills'       => $this->getTrimmedInput('keySkills', $_POST),
+                'currentEmployer' => $this->getTrimmedInput('currentEmployer', $_POST),
+                'currentPay'      => $this->getTrimmedInput('currentPay', $_POST),
+                'desiredPay'      => $this->getTrimmedInput('desiredPay', $_POST),
+                'notes'           => $this->getTrimmedInput('notes', $_POST),
+                'canRelocate'     => $this->getTrimmedInput('canRelocate', $_POST),
+                'webSite'         => $this->getTrimmedInput('webSite', $_POST),
+                'bestTimeToCall'  => $this->getTrimmedInput('bestTimeToCall', $_POST),
                 'gender'          => $this->getTrimmedInput('gender', $_POST),
                 'race'            => $this->getTrimmedInput('race', $_POST),
                 'veteran'         => $this->getTrimmedInput('veteran', $_POST),
@@ -1287,7 +1287,7 @@ private function onEdit()
         }
 
         $formattedPhoneHome = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneHome', $_POST)
+            $this->getTrimmedInput('phoneHome', $_POST)
         );
         if (!empty($formattedPhoneHome))
         {
@@ -1295,11 +1295,11 @@ private function onEdit()
         }
         else
         {
-            $phoneHome = $this->getSanitisedInput('phoneHome', $_POST);
+            $phoneHome = $this->getTrimmedInput('phoneHome', $_POST);
         }
 
         $formattedPhoneCell = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneCell', $_POST)
+            $this->getTrimmedInput('phoneCell', $_POST)
         );
         if (!empty($formattedPhoneCell))
         {
@@ -1307,11 +1307,11 @@ private function onEdit()
         }
         else
         {
-            $phoneCell = $this->getSanitisedInput('phoneCell', $_POST);
+            $phoneCell = $this->getTrimmedInput('phoneCell', $_POST);
         }
 
         $formattedPhoneWork = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneWork', $_POST)
+            $this->getTrimmedInput('phoneWork', $_POST)
         );
         if (!empty($formattedPhoneWork))
         {
@@ -1319,7 +1319,7 @@ private function onEdit()
         }
         else
         {
-            $phoneWork = $this->getSanitisedInput('phoneWork', $_POST);
+            $phoneWork = $this->getTrimmedInput('phoneWork', $_POST);
         }
 
         $candidateID = $_POST['candidateID'];
@@ -1392,23 +1392,23 @@ private function onEdit()
         }
 
         $isActive        = $this->isChecked('isActive', $_POST);
-        $firstName       = $this->getSanitisedInput('firstName', $_POST);
-        $middleName      = $this->getSanitisedInput('middleName', $_POST);
-        $lastName        = $this->getSanitisedInput('lastName', $_POST);
-        $email1          = $this->getSanitisedInput('email1', $_POST);
-        $email2          = $this->getSanitisedInput('email2', $_POST);
-        $address         = $this->getSanitisedInput('address', $_POST);
-        $address2        = $this->getSanitisedInput('address2', $_POST);
-        $city            = $this->getSanitisedInput('city', $_POST);
-        $state           = $this->getSanitisedInput('state', $_POST);
-        $zip             = $this->getSanitisedInput('zip', $_POST);
-        $source          = $this->getSanitisedInput('source', $_POST);
-        $keySkills       = $this->getSanitisedInput('keySkills', $_POST);
-        $currentEmployer = $this->getSanitisedInput('currentEmployer', $_POST);
-        $currentPay      = $this->getSanitisedInput('currentPay', $_POST);
-        $desiredPay      = $this->getSanitisedInput('desiredPay', $_POST);
-        $notes           = $this->getSanitisedInput('notes', $_POST);
-        $webSite         = $this->getSanitisedInput('webSite', $_POST);
+        $firstName       = $this->getTrimmedInput('firstName', $_POST);
+        $middleName      = $this->getTrimmedInput('middleName', $_POST);
+        $lastName        = $this->getTrimmedInput('lastName', $_POST);
+        $email1          = $this->getTrimmedInput('email1', $_POST);
+        $email2          = $this->getTrimmedInput('email2', $_POST);
+        $address         = $this->getTrimmedInput('address', $_POST);
+        $address2        = $this->getTrimmedInput('address2', $_POST);
+        $city            = $this->getTrimmedInput('city', $_POST);
+        $state           = $this->getTrimmedInput('state', $_POST);
+        $zip             = $this->getTrimmedInput('zip', $_POST);
+        $source          = $this->getTrimmedInput('source', $_POST);
+        $keySkills       = $this->getTrimmedInput('keySkills', $_POST);
+        $currentEmployer = $this->getTrimmedInput('currentEmployer', $_POST);
+        $currentPay      = $this->getTrimmedInput('currentPay', $_POST);
+        $desiredPay      = $this->getTrimmedInput('desiredPay', $_POST);
+        $notes           = $this->getTrimmedInput('notes', $_POST);
+        $webSite         = $this->getTrimmedInput('webSite', $_POST);
         $bestTimeToCall  = $this->getTrimmedInput('bestTimeToCall', $_POST);
         $gender          = $this->getTrimmedInput('gender', $_POST);
         $race            = $this->getTrimmedInput('race', $_POST);
diff --git a/modules/careers/CareersUI.php b/modules/careers/CareersUI.php
index f592f785c..9097a93d7 100755
--- a/modules/careers/CareersUI.php
+++ b/modules/careers/CareersUI.php
@@ -1511,7 +1511,8 @@ private function onApplyToJobOrder($siteID, $candidateID = false)
             return;
         }
 	    
-    /* funciton getSanitisedInput used to fix XSS vuln in public portal */
+        // NOTE: Careers Portal renders these values into HTML without consistent output escaping.
+        // TODO (security/xss-hardening): Escape attributes/textarea/title consistently, then switch to getTrimmedInput().
         $lastName       = $this->getSanitisedInput('lastName', $_POST);
         $middleName     = $this->getSanitisedInput('middleName', $_POST);
         $firstName      = $this->getSanitisedInput('firstName', $_POST);
diff --git a/modules/companies/CompaniesUI.php b/modules/companies/CompaniesUI.php
index 49f23e287..b551aa243 100755
--- a/modules/companies/CompaniesUI.php
+++ b/modules/companies/CompaniesUI.php
@@ -544,7 +544,7 @@ private function add()
     private function onAdd()
     {
         $formattedPhone1 = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phone1', $_POST)
+            $this->getTrimmedInput('phone1', $_POST)
         );
         if (!empty($formattedPhone1))
         {
@@ -552,11 +552,11 @@ private function onAdd()
         }
         else
         {
-            $phone1 = $this->getSanitisedInput('phone1', $_POST);
+            $phone1 = $this->getTrimmedInput('phone1', $_POST);
         }
 
         $formattedPhone2 = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phone2', $_POST)
+            $this->getTrimmedInput('phone2', $_POST)
         );
         if (!empty($formattedPhone2))
         {
@@ -564,11 +564,11 @@ private function onAdd()
         }
         else
         {
-            $phone2 = $this->getSanitisedInput('phone2', $_POST);
+            $phone2 = $this->getTrimmedInput('phone2', $_POST);
         }
 
         $formattedFaxNumber = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('faxNumber', $_POST)
+            $this->getTrimmedInput('faxNumber', $_POST)
         );
         if (!empty($formattedFaxNumber))
         {
@@ -576,10 +576,10 @@ private function onAdd()
         }
         else
         {
-            $faxNumber = $this->getSanitisedInput('faxNumber', $_POST);
+            $faxNumber = $this->getTrimmedInput('faxNumber', $_POST);
         }
 
-        $url = $this->getSanitisedInput('url', $_POST);
+        $url = $this->getTrimmedInput('url', $_POST);
         if (!empty($url))
         {
             $formattedURL = StringUtility::extractURL($url);
@@ -593,14 +593,14 @@ private function onAdd()
         /* Hot company? */
         $isHot = $this->isChecked('isHot', $_POST);
 
-        $name            = $this->getSanitisedInput('name', $_POST);
-        $address         = $this->getSanitisedInput('address', $_POST);
-        $address2        = $this->getSanitisedInput('address2', $_POST);
-        $city            = $this->getSanitisedInput('city', $_POST);
-        $state           = $this->getSanitisedInput('state', $_POST);
-        $zip             = $this->getSanitisedInput('zip', $_POST);
-        $keyTechnologies = $this->getSanitisedInput('keyTechnologies', $_POST);
-        $notes           = $this->getSanitisedInput('notes', $_POST);
+        $name            = $this->getTrimmedInput('name', $_POST);
+        $address         = $this->getTrimmedInput('address', $_POST);
+        $address2        = $this->getTrimmedInput('address2', $_POST);
+        $city            = $this->getTrimmedInput('city', $_POST);
+        $state           = $this->getTrimmedInput('state', $_POST);
+        $zip             = $this->getTrimmedInput('zip', $_POST);
+        $keyTechnologies = $this->getTrimmedInput('keyTechnologies', $_POST);
+        $notes           = $this->getTrimmedInput('notes', $_POST);
 
         /* Departments list editor. */
         $departmentsCSV = $this->getTrimmedInput('departmentsCSV', $_POST);
@@ -753,7 +753,7 @@ private function onEdit()
         }
 
         $formattedPhone1 = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phone1', $_POST)
+            $this->getTrimmedInput('phone1', $_POST)
         );
         if (!empty($formattedPhone1))
         {
@@ -761,11 +761,11 @@ private function onEdit()
         }
         else
         {
-            $phone1 = $this->getSanitisedInput('phone1', $_POST);
+            $phone1 = $this->getTrimmedInput('phone1', $_POST);
         }
 
         $formattedPhone2 = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phone2', $_POST)
+            $this->getTrimmedInput('phone2', $_POST)
         );
         if (!empty($formattedPhone2))
         {
@@ -773,11 +773,11 @@ private function onEdit()
         }
         else
         {
-            $phone2 = $this->getSanitisedInput('phone2', $_POST);
+            $phone2 = $this->getTrimmedInput('phone2', $_POST);
         }
 
         $formattedFaxNumber = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('faxNumber', $_POST)
+            $this->getTrimmedInput('faxNumber', $_POST)
         );
         if (!empty($formattedFaxNumber))
         {
@@ -785,10 +785,10 @@ private function onEdit()
         }
         else
         {
-            $faxNumber = $this->getSanitisedInput('faxNumber', $_POST);
+            $faxNumber = $this->getTrimmedInput('faxNumber', $_POST);
         }
 
-        $url = $this->getSanitisedInput('url', $_POST);
+        $url = $this->getTrimmedInput('url', $_POST);
         if (!empty($url))
         {
             $formattedURL = StringUtility::extractURL($url);
@@ -865,14 +865,14 @@ private function onEdit()
             $emailAddress = '';
         }
 
-        $name            = $this->getSanitisedInput('name', $_POST);
-        $address         = $this->getSanitisedInput('address', $_POST);
-        $address2        = $this->getSanitisedInput('address2', $_POST);
-        $city            = $this->getSanitisedInput('city', $_POST);
-        $state           = $this->getSanitisedInput('state', $_POST);
-        $zip             = $this->getSanitisedInput('zip', $_POST);
-        $keyTechnologies = $this->getSanitisedInput('keyTechnologies', $_POST);
-        $notes           = $this->getSanitisedInput('notes', $_POST);
+        $name            = $this->getTrimmedInput('name', $_POST);
+        $address         = $this->getTrimmedInput('address', $_POST);
+        $address2        = $this->getTrimmedInput('address2', $_POST);
+        $city            = $this->getTrimmedInput('city', $_POST);
+        $state           = $this->getTrimmedInput('state', $_POST);
+        $zip             = $this->getTrimmedInput('zip', $_POST);
+        $keyTechnologies = $this->getTrimmedInput('keyTechnologies', $_POST);
+        $notes           = $this->getTrimmedInput('notes', $_POST);
 
         /* Departments list editor. */
         $departmentsCSV = $this->getTrimmedInput('departmentsCSV', $_POST);
diff --git a/modules/contacts/ContactsUI.php b/modules/contacts/ContactsUI.php
index 76f739e2a..9196c473c 100755
--- a/modules/contacts/ContactsUI.php
+++ b/modules/contacts/ContactsUI.php
@@ -488,7 +488,7 @@ private function onAdd()
         }
 
         $formattedPhoneWork = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneWork', $_POST)
+            $this->getTrimmedInput('phoneWork', $_POST)
         );
         if (!empty($formattedPhoneWork))
         {
@@ -496,11 +496,11 @@ private function onAdd()
         }
         else
         {
-            $phoneWork = $this->getSanitisedInput('phoneWork', $_POST);
+            $phoneWork = $this->getTrimmedInput('phoneWork', $_POST);
         }
 
         $formattedPhoneCell = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneCell', $_POST)
+            $this->getTrimmedInput('phoneCell', $_POST)
         );
         if (!empty($formattedPhoneCell))
         {
@@ -508,11 +508,11 @@ private function onAdd()
         }
         else
         {
-            $phoneCell = $this->getSanitisedInput('phoneCell', $_POST);
+            $phoneCell = $this->getTrimmedInput('phoneCell', $_POST);
         }
 
         $formattedPhoneOther = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneOther', $_POST)
+            $this->getTrimmedInput('phoneOther', $_POST)
         );
         if (!empty($formattedPhoneOther))
         {
@@ -520,24 +520,24 @@ private function onAdd()
         }
         else
         {
-            $phoneOther = $this->getSanitisedInput('phoneOther', $_POST);
+            $phoneOther = $this->getTrimmedInput('phoneOther', $_POST);
         }
 
         $companyID = $_POST['companyID'];
 
-        $firstName  = $this->getSanitisedInput('firstName', $_POST);
-        $lastName   = $this->getSanitisedInput('lastName', $_POST);
-        $title      = $this->getSanitisedInput('title', $_POST);
+        $firstName  = $this->getTrimmedInput('firstName', $_POST);
+        $lastName   = $this->getTrimmedInput('lastName', $_POST);
+        $title      = $this->getTrimmedInput('title', $_POST);
         $department = $this->getTrimmedInput('department', $_POST);
         $reportsTo  = $this->getTrimmedInput('reportsTo', $_POST);
-        $email1     = $this->getSanitisedInput('email1', $_POST);
-        $email2     = $this->getSanitisedInput('email2', $_POST);
-        $address    = $this->getSanitisedInput('address', $_POST);
-        $address2   = $this->getSanitisedInput('address2', $_POST);
-        $city       = $this->getSanitisedInput('city', $_POST);
-        $state      = $this->getSanitisedInput('state', $_POST);
-        $zip        = $this->getSanitisedInput('zip', $_POST);
-        $notes      = $this->getSanitisedInput('notes', $_POST);
+        $email1     = $this->getTrimmedInput('email1', $_POST);
+        $email2     = $this->getTrimmedInput('email2', $_POST);
+        $address    = $this->getTrimmedInput('address', $_POST);
+        $address2   = $this->getTrimmedInput('address2', $_POST);
+        $city       = $this->getTrimmedInput('city', $_POST);
+        $state      = $this->getTrimmedInput('state', $_POST);
+        $zip        = $this->getTrimmedInput('zip', $_POST);
+        $notes      = $this->getTrimmedInput('notes', $_POST);
 
          /* Hot contact? */
         $isHot = $this->isChecked('isHot', $_POST);
@@ -715,7 +715,7 @@ private function onEdit()
         $owner      = $_POST['owner'];
 
         $formattedPhoneWork = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneWork', $_POST)
+            $this->getTrimmedInput('phoneWork', $_POST)
         );
         if (!empty($formattedPhoneWork))
         {
@@ -723,11 +723,11 @@ private function onEdit()
         }
         else
         {
-            $phoneWork = $this->getSanitisedInput('phoneWork', $_POST);
+            $phoneWork = $this->getTrimmedInput('phoneWork', $_POST);
         }
 
         $formattedPhoneCell = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneCell', $_POST)
+            $this->getTrimmedInput('phoneCell', $_POST)
         );
         if (!empty($formattedPhoneCell))
         {
@@ -735,11 +735,11 @@ private function onEdit()
         }
         else
         {
-            $phoneCell = $this->getSanitisedInput('phoneCell', $_POST);
+            $phoneCell = $this->getTrimmedInput('phoneCell', $_POST);
         }
 
         $formattedPhoneOther = StringUtility::extractPhoneNumber(
-            $this->getSanitisedInput('phoneOther', $_POST)
+            $this->getTrimmedInput('phoneOther', $_POST)
         );
         if (!empty($formattedPhoneOther))
         {
@@ -747,7 +747,7 @@ private function onEdit()
         }
         else
         {
-            $phoneOther = $this->getSanitisedInput('phoneOther', $_POST);
+            $phoneOther = $this->getTrimmedInput('phoneOther', $_POST);
         }
 
         $contacts = new Contacts($this->_siteID);
@@ -814,19 +814,19 @@ private function onEdit()
             $emailAddress = '';
         }
 
-        $firstName  = $this->getSanitisedInput('firstName', $_POST);
-        $lastName   = $this->getSanitisedInput('lastName', $_POST);
-        $title      = $this->getSanitisedInput('title', $_POST);
+        $firstName  = $this->getTrimmedInput('firstName', $_POST);
+        $lastName   = $this->getTrimmedInput('lastName', $_POST);
+        $title      = $this->getTrimmedInput('title', $_POST);
         $department = $this->getTrimmedInput('department', $_POST);
         $reportsTo  = $this->getTrimmedInput('reportsTo', $_POST);
-        $email1     = $this->getSanitisedInput('email1', $_POST);
-        $email2     = $this->getSanitisedInput('email2', $_POST);
-        $address    = $this->getSanitisedInput('address', $_POST);
-        $address2   = $this->getSanitisedInput('address2', $_POST);
-        $city       = $this->getSanitisedInput('city', $_POST);
-        $state      = $this->getSanitisedInput('state', $_POST);
-        $zip        = $this->getSanitisedInput('zip', $_POST);
-        $notes      = $this->getSanitisedInput('notes', $_POST);
+        $email1     = $this->getTrimmedInput('email1', $_POST);
+        $email2     = $this->getTrimmedInput('email2', $_POST);
+        $address    = $this->getTrimmedInput('address', $_POST);
+        $address2   = $this->getTrimmedInput('address2', $_POST);
+        $city       = $this->getTrimmedInput('city', $_POST);
+        $state      = $this->getTrimmedInput('state', $_POST);
+        $zip        = $this->getTrimmedInput('zip', $_POST);
+        $notes      = $this->getTrimmedInput('notes', $_POST);
 
         $isHot = $this->isChecked('isHot', $_POST);
         $leftCompany = $this->isChecked('leftCompany', $_POST);
@@ -1361,9 +1361,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
                 CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid activity type ID.');
             }
 
-            $activityNote = $this->getSanitisedInput('activityNote', $_POST);
-
-            $activityNote = htmlspecialchars($activityNote);
+            $activityNote = $this->getTrimmedInput('activityNote', $_POST);
 
             /* Add the activity entry. */
             $activityID = $activityEntries->add(
@@ -1390,7 +1388,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
         if ($this->isChecked('scheduleEvent', $_POST))
         {
             /* Bail out if we received an invalid date. */
-            $trimmedDate = $this->getSanitisedInput('dateAdd', $_POST);
+            $trimmedDate = $this->getTrimmedInput('dateAdd', $_POST);
             $dateFormatFlag = $_SESSION['CATS']->isDateDMY()
                 ? DATE_FORMAT_DDMMYY
                 : DATE_FORMAT_MMDDYY;
@@ -1427,7 +1425,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
             $publicEntry = $this->isChecked('publicEntry', $_POST);
 
             $reminderEnabled = $this->isChecked('reminderToggle', $_POST);
-            $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST);
+            $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST);
             $reminderTime  = $this->getTrimmedInput('reminderTime', $_POST);
 
             $duration = -1;
@@ -1486,8 +1484,8 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
                 );
             }
 
-            $description = $this->getSanitisedInput('description', $_POST);
-            $title       = $this->getSanitisedInput('title', $_POST);
+            $description = $this->getTrimmedInput('description', $_POST);
+            $title       = $this->getTrimmedInput('title', $_POST);
 
             /* Bail out if any of the required fields are empty. */
             if (empty($title))
diff --git a/modules/joborders/JobOrdersUI.php b/modules/joborders/JobOrdersUI.php
index 699ff981f..e1e8f1993 100755
--- a/modules/joborders/JobOrdersUI.php
+++ b/modules/joborders/JobOrdersUI.php
@@ -795,17 +795,17 @@ private function onAdd()
         $owner       = $_POST['owner'];
         $openings    = $_POST['openings'];
 
-        $title       = $this->getSanitisedInput('title', $_POST);
+        $title       = $this->getTrimmedInput('title', $_POST);
         $companyJobID = $this->getTrimmedInput('companyJobID', $_POST);
         $type        = $this->getTrimmedInput('type', $_POST);
-        $city        = $this->getSanitisedInput('city', $_POST);
-        $state       = $this->getSanitisedInput('state', $_POST);
-        $duration    = $this->getSanitisedInput('duration', $_POST);
+        $city        = $this->getTrimmedInput('city', $_POST);
+        $state       = $this->getTrimmedInput('state', $_POST);
+        $duration    = $this->getTrimmedInput('duration', $_POST);
         $department  = $this->getTrimmedInput('department', $_POST);
-        $maxRate     = $this->getSanitisedInput('maxRate', $_POST);
-        $salary      = $this->getSanitisedInput('salary', $_POST);
+        $maxRate     = $this->getTrimmedInput('maxRate', $_POST);
+        $salary      = $this->getTrimmedInput('salary', $_POST);
         $description = $this->getTrimmedInput('description', $_POST);
-        $notes       = $this->getSanitisedInput('notes', $_POST);
+        $notes       = $this->getTrimmedInput('notes', $_POST);
 
         /* Bail out if any of the required fields are empty. */
         if (empty($title) || empty($type) || empty($city) || empty($state))
@@ -1132,18 +1132,18 @@ private function onEdit()
             $emailAddress = '';
         }
 
-        $title       = $this->getSanitisedInput('title', $_POST);
+        $title       = $this->getTrimmedInput('title', $_POST);
         $companyJobID = $this->getTrimmedInput('companyJobID', $_POST);
         $type        = $this->getTrimmedInput('type', $_POST);
-        $city        = $this->getSanitisedInput('city', $_POST);
-        $state       = $this->getSanitisedInput('state', $_POST);
+        $city        = $this->getTrimmedInput('city', $_POST);
+        $state       = $this->getTrimmedInput('state', $_POST);
         $status      = $this->getTrimmedInput('status', $_POST);
-        $duration    = $this->getSanitisedInput('duration', $_POST);
+        $duration    = $this->getTrimmedInput('duration', $_POST);
         $department  = $this->getTrimmedInput('department', $_POST);
-        $maxRate     = $this->getSanitisedInput('maxRate', $_POST);
-        $salary      = $this->getSanitisedInput('salary', $_POST);
+        $maxRate     = $this->getTrimmedInput('maxRate', $_POST);
+        $salary      = $this->getTrimmedInput('salary', $_POST);
         $description = $this->getTrimmedInput('description', $_POST);
-        $notes       = $this->getSanitisedInput('notes', $_POST);
+        $notes       = $this->getTrimmedInput('notes', $_POST);
 
         /* Bail out if any of the required fields are empty. */
         if (empty($title) || empty($type) || empty($city) || empty($state))
diff --git a/modules/settings/SettingsUI.php b/modules/settings/SettingsUI.php
index e3ef1b466..ab51dd4ee 100755
--- a/modules/settings/SettingsUI.php
+++ b/modules/settings/SettingsUI.php
@@ -1181,10 +1181,10 @@ private function onAddUser()
             return;
         }
 
-        $firstName      = $this->getSanitisedInput('firstName', $_POST);
-        $lastName       = $this->getSanitisedInput('lastName', $_POST);
-        $email          = $this->getSanitisedInput('email', $_POST);
-        $username       = $this->getSanitisedInput('username', $_POST);
+        $firstName      = $this->getTrimmedInput('firstName', $_POST);
+        $lastName       = $this->getTrimmedInput('lastName', $_POST);
+        $email          = $this->getTrimmedInput('email', $_POST);
+        $username       = $this->getTrimmedInput('username', $_POST);
         $accessLevel    = $this->getTrimmedInput('accessLevel', $_POST);
         $password       = $this->getTrimmedInput('password', $_POST);
         $retypePassword = $this->getTrimmedInput('retypePassword', $_POST);
@@ -1385,10 +1385,10 @@ private function onEditUser()
 
         $userID = $_POST['userID'];
 
-        $firstName   = $this->getSanitisedInput('firstName', $_POST);
-        $lastName    = $this->getSanitisedInput('lastName', $_POST);
-        $email       = $this->getSanitisedInput('email', $_POST);
-        $username    = $this->getSanitisedInput('username', $_POST);
+        $firstName   = $this->getTrimmedInput('firstName', $_POST);
+        $lastName    = $this->getTrimmedInput('lastName', $_POST);
+        $email       = $this->getTrimmedInput('email', $_POST);
+        $username    = $this->getTrimmedInput('username', $_POST);
         $password1   = $this->getTrimmedInput('password1', $_POST);
         $password2   = $this->getTrimmedInput('password2', $_POST);
         $passwordRst = $this->getTrimmedInput('passwordIsReset', $_POST);

From 865e5c97900a1c27dacaa7ed4d65dd75a6616b62 Mon Sep 17 00:00:00 2001
From: anonymoususer72041
 <247563575+anonymoususer72041@users.noreply.github.com>
Date: Wed, 18 Mar 2026 09:15:00 +0100
Subject: [PATCH 3/3] Decode legacy HTML entities via installer schema upgrade

---
 db/cats_schema.sql              |   2 +-
 modules/install/Schema.php      |   4 +
 modules/install/scripts/371.php | 168 ++++++++++++++++++++++++++++++++
 3 files changed, 173 insertions(+), 1 deletion(-)
 create mode 100644 modules/install/scripts/371.php

diff --git a/db/cats_schema.sql b/db/cats_schema.sql
index 5484f266f..268b9319c 100755
--- a/db/cats_schema.sql
+++ b/db/cats_schema.sql
@@ -850,7 +850,7 @@ insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (9,'ext
 insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (10,'graphs',0);
 insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (11,'home',0);
 insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (12,'import',0);
-insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',370);
+insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',371);
 insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (14,'joborders',0);
 insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (15,'lists',0);
 insert  into `module_schema`(`module_schema_id`,`name`,`version`) values (16,'login',0);
diff --git a/modules/install/Schema.php b/modules/install/Schema.php
index 79263f35c..1bedfec57 100755
--- a/modules/install/Schema.php
+++ b/modules/install/Schema.php
@@ -1396,6 +1396,10 @@ public static function get()
             '370' => '
                 DELETE FROM module_schema WHERE name = \'toolbar\';
             ',
+            '371' => 'PHP:
+                include_once(\'modules/install/scripts/371.php\');
+                update_371($db);
+            ',
 
         );
     }
diff --git a/modules/install/scripts/371.php b/modules/install/scripts/371.php
new file mode 100644
index 000000000..6302e3082
--- /dev/null
+++ b/modules/install/scripts/371.php
@@ -0,0 +1,168 @@
+<?php
+/*
+ * CATS
+ * Update 371 - decode HTML entities until stable for text fields
+ *
+ * Copyright (C) 2005 - 2007 Cognizo Technologies, Inc.
+ *
+ * The contents of this file are subject to the CATS Public License
+ * Version 1.1a (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ * http://www.catsone.com/.
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
+ * License for the specific language governing rights and limitations
+ * under the License.
+ *
+ * The Original Code is "CATS Standard Edition".
+ *
+ * The Initial Developer of the Original Code is Cognizo Technologies, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2005 - 2007
+ * (or from the year in which this file was created to the year 2007) by
+ * Cognizo Technologies, Inc. All Rights Reserved.
+ *
+ * $Id: 371.php $
+ */
+
+function update_371($db)
+{
+    $tables = array(
+        'joborder' => array(
+            'primaryKey' => 'joborder_id',
+            'columns' => array('title', 'description', 'notes', 'city', 'state', 'duration', 'rate_max', 'salary', 'client_job_id')
+        ),
+        'company' => array(
+            'primaryKey' => 'company_id',
+            'columns' => array('name', 'address', 'city', 'state', 'zip', 'url', 'key_technologies', 'notes')
+        ),
+        'contact' => array(
+            'primaryKey' => 'contact_id',
+            'columns' => array('first_name', 'last_name', 'title', 'email1', 'email2', 'address', 'city', 'state', 'zip', 'notes')
+        ),
+        'candidate' => array(
+            'primaryKey' => 'candidate_id',
+            'columns' => array('first_name', 'middle_name', 'last_name', 'email1', 'email2', 'address', 'city', 'state', 'notes', 'key_skills', 'current_employer', 'current_position', 'source', 'web_site', 'best_time_to_call', 'desired_pay', 'current_pay')
+        ),
+        'activity' => array(
+            'primaryKey' => 'activity_id',
+            'columns' => array('notes')
+        ),
+        'calendar_event' => array(
+            'primaryKey' => 'calendar_event_id',
+            'columns' => array('title', 'description', 'location', 'reminder_email')
+        ),
+        'history' => array(
+            'primaryKey' => 'history_id',
+            'columns' => array('previous_value', 'new_value', 'description')
+        ),
+        'email_history' => array(
+            'primaryKey' => 'email_history_id',
+            'columns' => array('text', 'recipients')
+        ),
+        'email_template' => array(
+            'primaryKey' => 'email_template_id',
+            'columns' => array('text', 'title', 'possible_variables')
+        ),
+        'extra_field' => array(
+            'primaryKey' => 'extra_field_id',
+            'columns' => array('value')
+        ),
+        'attachment' => array(
+            'primaryKey' => 'attachment_id',
+            'columns' => array('text')
+        ),
+        'feedback' => array(
+            'primaryKey' => 'feedback_id',
+            'columns' => array('feedback', 'subject')
+        )
+    );
+
+    foreach ($tables as $tableName => $tableData)
+    {
+        $tableExists = $db->getAllAssoc(
+            'SHOW TABLES LIKE ' . $db->makeQueryString($tableName)
+        );
+
+        if (empty($tableExists))
+        {
+            continue;
+        }
+
+        $columnsToUpdate = array();
+        foreach ($tableData['columns'] as $columnName)
+        {
+            $columnExists = $db->getAllAssoc(
+                'SHOW COLUMNS FROM `' . $tableName . '` LIKE ' . $db->makeQueryString($columnName)
+            );
+            if (!empty($columnExists))
+            {
+                $columnsToUpdate[] = $columnName;
+            }
+        }
+
+        if (empty($columnsToUpdate))
+        {
+            continue;
+        }
+
+        $selectColumns = array_merge(array($tableData['primaryKey']), $columnsToUpdate);
+        $selectParts = array();
+        foreach ($selectColumns as $columnName)
+        {
+            $selectParts[] = '`' . $columnName . '`';
+        }
+
+        $whereParts = array();
+        foreach ($columnsToUpdate as $columnName)
+        {
+            $whereParts[] = '`' . $columnName . "` LIKE '%&%'";
+        }
+
+        $rs = $db->getAllAssoc(
+            'SELECT ' . implode(', ', $selectParts) . ' FROM `' . $tableName . '` WHERE ' . implode(' OR ', $whereParts)
+        );
+
+        foreach ($rs as $rowIndex => $row)
+        {
+            $updates = array();
+            foreach ($columnsToUpdate as $columnName)
+            {
+                if (!isset($row[$columnName]))
+                {
+                    continue;
+                }
+
+                $originalValue = $row[$columnName];
+                $decodedValue = $originalValue;
+                $maxDecodePasses = 10;
+                for ($i = 0; $i < $maxDecodePasses; $i++)
+                {
+                    $nextValue = html_entity_decode($decodedValue, ENT_QUOTES, HTML_ENCODING);
+                    if ($nextValue === $decodedValue)
+                    {
+                        break;
+                    }
+                    $decodedValue = $nextValue;
+                }
+
+                if ($decodedValue !== $originalValue)
+                {
+                    $updates[] = '`' . $columnName . '` = ' . $db->makeQueryString($decodedValue);
+                }
+            }
+
+            if (!empty($updates))
+            {
+                $db->query(
+                    'UPDATE `' . $tableName . '` SET ' . implode(', ', $updates)
+                    . ' WHERE `' . $tableData['primaryKey'] . '` = '
+                    . $db->makeQueryInteger($row[$tableData['primaryKey']])
+                );
+            }
+        }
+    }
+}
+
+
+?>