KTS-2088

"The " in the name of a Document Type, Transition or State does not reflect in Edit mode" Fixed with lots of other similar issues. Committed By: Kevin Reviewed By: Conrad git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@6770 c91229c3-7414-0410-bfa2-8a42b809f60b

KTS-2088
"The " in the name of a Document Type, Transition or State does not reflect in Edit mode" Fixed with lots of other similar issues. Committed By: Kevin Reviewed By: Conrad git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@6770 c91229c3-7414-0410-bfa2-8a42b809f60b
kevin_fourie
1 parent 20a0e95f
Showing 34 changed files with 131 additions and 94 deletions
lib/actions/bulkaction.php
lib/actions/documentaction.inc.php
lib/actions/folderaction.inc.php
lib/authentication/authenticationprovider.inc.php
lib/authentication/authenticationsource.inc.php
lib/authentication/interceptor.inc.php
lib/authentication/interceptorinstances.inc.php
lib/browse/Criteria.inc
lib/browse/advancedcolumns.inc.php
lib/documentmanagement/DocumentField.inc
lib/documentmanagement/DocumentFieldLink.inc
lib/documentmanagement/DocumentTransactionType.inc.php
lib/documentmanagement/DocumentType.inc
lib/documentmanagement/LinkType.inc
lib/documentmanagement/MDTree.inc
lib/documentmanagement/MetaData.inc
lib/documentmanagement/documentmetadataversion.inc.php
lib/foldermanagement/Folder.inc
lib/groups/Group.inc
lib/help/helpreplacement.inc.php
@@ -41,6 +41,8 @@ require_once(KT_LIB_DIR . &#39;/documentmanagement/documentutil.inc.php&#39;);
 require_once(KT_LIB_DIR . '/widgets/forms.inc.php');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
+
 class KTBulkAction extends KTStandardDispatcher {
     var $sName;
     var $sDescription;
@@ -119,15 +121,15 @@ class KTBulkAction extends KTStandardDispatcher {
     }
     function getName() {
-        return $this->sName;
+        return sanitizeForSQLtoHTML($this->sName);
     }
     function getDisplayName() {
-        return $this->sDisplayName;
+        return sanitizeForSQLtoHTML($this->sDisplayName);
     }
     function getDescription() {
-        return $this->sDescription;
+        return sanitizeForSQLtoHTML($this->sDescription);
     }
     function customiseInfo($aInfo) {
@@ -33,6 +33,7 @@ require_once(KT_LIB_DIR . &#39;/actions/actionregistry.inc.php&#39;);
 require_once(KT_LIB_DIR . '/workflow/workflowutil.inc.php');
 require_once(KT_LIB_DIR . '/dispatcher.inc.php');
 require_once(KT_LIB_DIR . '/browse/browseutil.inc.php');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTDocumentAction extends KTStandardDispatcher {
     var $sName;
@@ -147,17 +148,17 @@ class KTDocumentAction extends KTStandardDispatcher {
     }
     function getName() {
-        return $this->sName;
+        return sanitizeForSQLtoHTML($this->sName);
     }
     function getDisplayName() {
         // Should be overridden by the i18nised display name
         // This is here solely for backwards compatibility
-        return $this->sDisplayName;
+        return sanitizeForSQLtoHTML($this->sDisplayName);
     }
     function getDescription() {
-        return $this->sDescription;
+        return sanitizeForSQLtoHTML($this->sDescription);
     }
     function customiseInfo($aInfo) {
@@ -32,6 +32,7 @@
 require_once(KT_LIB_DIR . '/dispatcher.inc.php');
 require_once(KT_LIB_DIR . '/actions/actionregistry.inc.php');
 require_once(KT_LIB_DIR . '/browse/browseutil.inc.php');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTFolderAction extends KTStandardDispatcher {
     var $sName;
@@ -111,17 +112,17 @@ class KTFolderAction extends KTStandardDispatcher {
     }
     function getName() {
-        return $this->sName;
+        return sanitizeForSQLtoHTML($this->sName);
     }
     function getDisplayName() {
         // This should be overridden by the i18nised display name
         // This implementation is only here for backwards compatibility
-        return $this->sDisplayName;
+        return sanitizeForSQLtoHTML($this->sDisplayName);
     }
     function getDescription() {
-        return $this->sDescription;
+        return sanitizeForSQLtoHTML($this->sDescription);
     }
     function customiseInfo($aInfo) {
@@ -30,6 +30,7 @@
  */
 require_once(KT_LIB_DIR . '/dispatcher.inc.php');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTAuthenticationProvider extends KTStandardDispatcher {
     var $sName;
@@ -77,7 +78,7 @@ class KTAuthenticationProvider extends KTStandardDispatcher {
     }
     function getName() {
-        return $this->sName;
+        return sanitizeForSQLtoHTML($this->sName);
     }
     function getNamespace() {
         return $this->sNamespace;
@@ -31,6 +31,7 @@
 require_once(KT_LIB_DIR . '/users/User.inc');
 require_once(KT_LIB_DIR . '/ktentity.inc');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTAuthenticationSource extends KTEntity {
     var $sName;
@@ -52,13 +53,13 @@ class KTAuthenticationSource extends KTEntity {
     var $_bUsePearError = true;
-    function getName() { return $this->sName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
     function getNamespace() { return $this->sNamespace; }
     function getAuthenticationProvider() { return $this->sAuthenticationProvider; }
     function getConfig() { return $this->sConfig; }
     function getIsUserSource() { return $this->bIsUserSource; }
     function getIsGroupSource() { return $this->bIsGroupSource; }
-    function setName($sName) { $this->sName = $sName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
     function setNamespace($sNamespace) { $this->sNamespace = $sNamespace; }
     function setAuthenticationProvider($sAuthenticationProvider) { $this->sAuthenticationProvider = $sAuthenticationProvider; }
     function setConfig($sConfig) { $this->sConfig = $sConfig; }
@@ -31,6 +31,7 @@
  */
 require_once(KT_LIB_DIR . '/dispatcher.inc.php');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTInterceptor extends KTStandardDispatcher {
     var $sName;
@@ -48,7 +49,7 @@ class KTInterceptor extends KTStandardDispatcher {
     }
     function getName() {
-        return $this->sName;
+        return sanitizeForSQLtoHTML($this->sName);
     }
     function getNamespace() {
@@ -32,6 +32,7 @@
 require_once(KT_LIB_DIR . '/users/User.inc');
 require_once(KT_LIB_DIR . '/ktentity.inc');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTInterceptorInstance extends KTEntity {
     var $sName;
@@ -48,10 +49,10 @@ class KTInterceptorInstance extends KTEntity {
     var $_bUsePearError = true;
-    function getName() { return $this->sName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
     function getInterceptorNamespace() { return $this->sInterceptorNamespace; }
     function getConfig() { return $this->sConfig; }
-    function setName($sName) { $this->sName = $sName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
     function setInterceptorNamespace($mValue) { $this->sInterceptorNamespace = $mValue; }
     function setConfig($sConfig) { $this->sConfig = $sConfig; }
@@ -43,6 +43,8 @@ require_once(KT_LIB_DIR . &#39;/workflow/workflow.inc.php&#39;);
 require_once(KT_LIB_DIR . '/browse/criteriaregistry.php');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
+
 class BrowseCriterion {
     var $sDisplay;
@@ -168,7 +170,7 @@ class BrowseCriterion {
     function getName() {
-        return $this->sDocumentField;
+        return sanitizeForSQLtoHTML($this->sDocumentField);
     }
     function getID() {
 <?php
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
+
 // more advanced, intelligent columns.
 class AdvancedColumn {
@@ -81,7 +83,7 @@ class AdvancedColumn {
     function addToDocumentQuery() { return array(null, null, null); }
     function getName() {
-        return $this->label;
+        return sanitizeForSQLtoHTML($this->label);
     }
     function getEntryId() {
@@ -33,6 +33,7 @@
 require_once(KT_LIB_DIR . '/documentmanagement/MetaData.inc');
 require_once(KT_LIB_DIR . '/metadata/metadatautil.inc.php');
 require_once(KT_LIB_DIR . '/documentmanagement/DocumentType.inc');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class DocumentField extends KTEntity {
@@ -72,10 +73,10 @@ class DocumentField extends KTEntity {
 	}
 	function getID() { return $this->iId; }
-	function getName() { return $this->sName; }
-	function setName($sNewValue) { $this->sName = $sNewValue; }
-	function setDescription($sNewValue) { $this->sDescription = $sNewValue; }
-	function getDescription() { return $this->sDescription; }	
+	function getName() { return sanitizeForSQLtoHTML($this->sName); }
+	function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
+	function setDescription($sNewValue) { $this->sDescription = sanitizeForSQL($sNewValue); }
+	function getDescription() { return sanitizeForSQLtoHTML($this->sDescription); }	
 	function getDataType() { return $this->sDataType; }
     function setDataType($sNewValue) { $this->sDataType = $sNewValue; }
 	function getIsGeneric() { return $this->bIsGeneric; }
@@ -121,7 +121,7 @@ class DocumentFieldLink extends KTEntity {
 	*
 	*/
 	function getValue() {
-		return sanitizeForHTML($this->sValue);
+		return sanitizeForSQLtoHTML($this->sValue);
 	}
 	/**
@@ -31,6 +31,7 @@
 require_once(KT_LIB_DIR . "/ktentity.inc");
 require_once(KT_LIB_DIR . "/util/ktutil.inc"); 
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTDocumentTransactionType extends KTEntity {
     /** primary key */
@@ -47,10 +48,10 @@ class KTDocumentTransactionType extends KTEntity {
     var $_bUsePearError = true;
     function getID() { return $this->iId; }
-    function getName() { return $this->sName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
     function getNamespace() { return $this->sNamespace; }
     function setID($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
     function setNamespace($sNamespace) { $this->sNamespace = $sNamespace; }
     function _table () {
@@ -30,6 +30,8 @@
  * Contributor( s): ______________________________________
  */
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
+
 class DocumentType extends KTEntity {
 	/** primary key value */
@@ -60,8 +62,8 @@ class DocumentType extends KTEntity {
 	}
 	function getID() { return $this->iId; }
-	function getName() { return $this->sName; }
-	function setName($sNewValue) { $this->sName = $sNewValue; }
+	function getName() { return sanitizeForSQLtoHTML($this->sName); }
+	function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
 	function getDisabled() { return $this->bDisabled; }
     function setDisabled($bNewValue) { $this->bDisabled = ($bNewValue) ? true : false; }
@@ -31,6 +31,7 @@
  */
 require_once(KT_DIR . '/lib/ktentity.inc');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class LinkType extends KTEntity {
     var $sName;
@@ -49,25 +50,25 @@ class LinkType extends KTEntity {
 	}
 	function getDescription() {
-		return $this->sDescription;
+		return sanitizeForSQLtoHTML($this->sDescription);
 	}
 	function setDescription($sNewValue) {
-		$this->sDescription = $sNewValue;
+		$this->sDescription = sanitizeForSQL($sNewValue);
 	}
 	function getName() {
-		return $this->sName;
+		return sanitizeForSQLtoHTML($this->sName);
 	}
 	function setName($sNewValue) {
-		$this->sName = $sNewValue;
+		$this->sName = sanitizeForSQL($sNewValue);
 	}
     function _fieldValues () {
         return array(
-            'name' => $this->sName,
-            'description' => $this->sDescription,
+            'name' => sanitizeForSQLtoHTML($this->sName),
+            'description' => sanitizeForSQLtoHTML($this->sDescription),
         );
     }
@@ -33,6 +33,7 @@ require_once(KT_LIB_DIR . &quot;/ktentity.inc&quot;);
 //require_once("../../../../../config/dmsDefaults.php"); // gak.
 require_once(KT_LIB_DIR . "/documentmanagement/DocumentField.inc");
 require_once(KT_LIB_DIR . "/documentmanagement/MetaData.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class MDTreeNode extends KTEntity {
     /** boilerplate DB code. */
@@ -55,8 +56,8 @@ class MDTreeNode extends KTEntity {
     function setID($iId) { $this->iId = $iId; }
     function getFieldId() { return $this->iFieldId; }
     function setFieldId($iFieldId) {  $this->iFieldId = $iFieldId; }
-    function getName() { return $this ->sName; }
-    function setName($sName) { $this->sName = $sName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
     function getParentNode() { return $this->iParentNode; }
     function setParentNode($iNode) { $this->iParentNode = $iParentNode; }
@@ -29,6 +29,9 @@
  * All Rights Reserved.
  * Contributor( s): ______________________________________
  */
+
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
+
 class MetaData extends KTEntity {
 	/** primary key value */
@@ -71,8 +74,8 @@ class MetaData extends KTEntity {
 	}
 	function getID() { return $this->iId; }
-	function getName() { return $this->sName; }
-	function setName($sNewValue) { $this->sName = $sNewValue; }
+	function getName() { return sanitizeForSQLtoHTML($this->sName); }
+	function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
 	function getDocFieldId() { return $this->iDocFieldId; }
 	function setDocFieldId($iNewValue) { $this->iDocFieldId = $iNewValue; }
     function getTreeParent() { return $this->iTreeParent; }
@@ -30,6 +30,7 @@
  */
 require_once(KT_LIB_DIR . '/ktentity.inc');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTDocumentMetadataVersion extends KTEntity {
     var $_bUsePearError = true;
@@ -32,6 +32,7 @@
 require_once(KT_LIB_DIR . "/foldermanagement/PhysicalFolderManagement.inc");
 require_once(KT_LIB_DIR . "/documentmanagement/Document.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class Folder extends KTEntity {
@@ -31,6 +31,7 @@
  */
 require_once(KT_LIB_DIR . '/unitmanagement/Unit.inc'); 
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class Group extends KTEntity {
@@ -89,8 +90,8 @@ class Group extends KTEntity {
     function setUnitAdmin($bNewValue) { $this->bIsUnitAdmin = $bNewValue; }
     function getSysAdmin() { return $this->bIsSysAdmin; }
     function setSysAdmin($bNewValue) { $this->bIsSysAdmin = $bNewValue; }
-    function getName() { return $this->sName; }
-    function setName($sNewValue) { $this->sName = $sNewValue; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
     function getUnitId() { return $this->iUnitId; }
     function setUnitId($iNewValue) { $this->iUnitId = $iNewValue; }
     function getAuthenticationDetails() { return $this->sAuthenticationDetails; }
@@ -30,6 +30,7 @@
  */
 require_once(KT_LIB_DIR . "/ktentity.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTHelpReplacement extends KTEntity {
     /** primary key */
@@ -50,13 +51,13 @@ class KTHelpReplacement extends KTEntity {
     var $_bUsePearError = true;
     function getID() { return $this->iId; }
-    function getName() { return $this->sName; }
-    function getDescription() { return $this->sDescription; }
-    function getTitle() { return $this->sTitle; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function getDescription() { return sanitizeForSQLtoHTML($this->sDescription); }
+    function getTitle() { return sanitizeForSQLtoHTML($this->sTitle); }
     function setID($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
-    function setDescription($sDescription) { $this->sDescription = $sDescription; }
-    function setTitle($sTitle) { $this->sTitle= $sTitle; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
+    function setDescription($sDescription) { $this->sDescription = sanitizeForSQL($sDescription); }
+    function setTitle($sTitle) { $this->sTitle= sanitizeForSQL($sTitle); }
     function _table () {
         global $default;
@@ -33,6 +33,7 @@
  */
 require_once(KT_LIB_DIR . "/ktentity.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTFieldBehaviour extends KTEntity {
     var $iId = -1;
@@ -50,12 +51,12 @@ class KTFieldBehaviour extends KTEntity {
     var $_bUsePearError = true;
     function getID() { return $this->iId; }
-    function getName() { return $this->sName; }
-    function getHumanName() { return $this->sHumanName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function getHumanName() { return sanitizeForSQLtoHTML($this->sHumanName); }
     function getFieldID() { return $this->iFieldID; }
     function setID($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
-    function setHumanName($sHumanName) { $this->sHumanName = $sHumanName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
+    function setHumanName($sHumanName) { $this->sHumanName = sanitizeForSQL($sHumanName); }
     function setFieldID($iFieldID) { $this->iFieldID = $iFieldID; }
     function _table () {
@@ -31,6 +31,7 @@
 require_once(KT_LIB_DIR . "/ktentity.inc");
 require_once(KT_LIB_DIR . "/documentmanagement/DocumentField.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 /**
  * class KTFieldset
@@ -67,10 +68,10 @@ class KTFieldset extends KTEntity {
     var $_bUsePearError = true;
 	function getId() { return $this->iId; }
-	function getName() { return $this->sName; }
-	function setDescription($sNewValue) { $this->sDescription = $sNewValue; }
-	function getDescription() { return $this->sDescription; }
-	function setName($sNewValue) { $this->sName = $sNewValue; }
+	function getName() { return sanitizeForSQLtoHTML($this->sName); }
+	function setDescription($sNewValue) { $this->sDescription = sanitizeForSQL($sNewValue); }
+	function getDescription() { return sanitizeForSQLtoHTML($this->sDescription); }
+	function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
 	function getNamespace() { return $this->sNamespace; }
     function setNamespace($sNewValue) {	$this->sNamespace = $sNewValue; }
 	function getMandatory() { return $this->bMandatory; }
@@ -30,6 +30,7 @@
  */
 require_once(KT_LIB_DIR . "/ktentity.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTPermission extends KTEntity {
     /** primary key */
@@ -51,12 +52,12 @@ class KTPermission extends KTEntity {
     var $_bUsePearError = true;
     function getID() { return $this->iId; }
-    function getName() { return $this->sName; }
-    function getHumanName() { return _kt($this->sHumanName); }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function getHumanName() { return sanitizeForSQLtoHTML($this->sHumanName); }
     function getBuiltIn() { return $this->bBuiltIn; }
     function setID($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
-    function setHumanName($sHumanName) { $this->sHumanName = $sHumanName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
+    function setHumanName($sHumanName) { $this->sHumanName = sanitizeForSQL($sHumanName); }
     function setBuiltIn($sBuiltIn) { $this->sBuiltIn = $sBuiltIn; }
     function _table () {
@@ -32,6 +32,7 @@
 require_once(KT_LIB_DIR . "/ktentity.inc"); 
 require_once(KT_LIB_DIR . "/util/ktutil.inc"); 
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class Role extends KTEntity {
@@ -59,8 +60,8 @@ class Role extends KTEntity {
     var $_bUsePearError = true;
 	function getId() { return $this->iId; }
-	function getName() { return $this->sName; }	
-	function setName($sNewValue) { $this->sName = $sNewValue; }
+	function getName() { return sanitizeForSQLtoHTML($this->sName); }	
+	function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
     function _fieldValues () { return array(
 		'name' => $this->sName,
@@ -30,6 +30,7 @@
  */
 require_once(KT_LIB_DIR . '/ktentity.inc');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 /**
  * Saved searches allow for common searches to be saved.
@@ -110,14 +111,14 @@ class KTSavedSearch extends KTEntity {
     // {{{ getters/setters
     function getId() { return $this->iId; }
-    function getName() { return $this->sName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
     function getNamespace() { return $this->sNamespace; }
     function getIsCondition() { return $this->bIsCondition; }
     function getIsComplete() { return $this->bIsComplete; }
     function getUserId() { return $this->iUserId; }
     function getSearch() { return $this->aSearch; }
     function setId($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
     function setNamespace($sNamespace) { $this->sNamespace = $sNamespace; }
     function setIsCondition($bIsCondition) { $this->bIsCondition = $bIsCondition; }
     function setIsComplete($bIsComplete) { $this->bIsComplete = $bIsComplete; }
@@ -28,6 +28,8 @@
  * Contributor( s): ______________________________________
  */
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
+
 class Unit extends KTEntity {
     var $_bUsePearError = true;
@@ -45,8 +47,8 @@ class Unit extends KTEntity {
         return KTUtil::getTableName('units');
     }
-    function getName() { return $this->sName; }
-    function setName($sNewValue) { $this->sName = $sNewValue; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
     function getFolderId() { return $this->iFolderId; }
     function setFolderId($iNewValue) { $this->iFolderId = $iNewValue; }
@@ -32,6 +32,7 @@
 require_once(KT_LIB_DIR . '/database/dbutil.inc'); 
 require_once(KT_LIB_DIR . '/ktentity.inc'); 
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 define('ADMIN_USER_ID', 1);
@@ -114,19 +115,19 @@ class User extends KTEntity {
     }
-    function getUserName() { return $this->sUserName; }
-    function setUserName($sNewValue) { $this->sUserName = $sNewValue; }
-    function getPassword() { return $this->sPassword; }
-    function setPassword($sNewValue) { $this->sPassword = $sNewValue; $this->bPasswordChanged = true; }
+    function getUserName() { return sanitizeForSQLtoHTML($this->sUserName); }
+    function setUserName($sNewValue) { $this->sUserName = sanitizeForSQL($sNewValue); }
+    function getPassword() { return sanitizeForSQLtoHTML($this->sPassword); }
+    function setPassword($sNewValue) { $this->sPassword = sanitizeForSQL($sNewValue); $this->bPasswordChanged = true; }
     function getQuotaMax() { return $this->iQuotaMax; }
     function setQuotaMax($iNewValue) { $this->iQuotaMax = $iNewValue; }
-    function setName($sNewValue) { $this->sName = $sNewValue; }
-    function getName() { return $this->sName; }
+    function setName($sNewValue) { $this->sName = sanitizeForSQL($sNewValue); }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
     function getQuotaCurrent() { return $this->iQuotaCurrent; }
-    function getEmail() { return $this->sEmail; }
-    function setEmail($sNewValue) { $this->sEmail = $sNewValue; }
-    function getMobile() { return $this->sMobile; }
-    function setMobile($sNewValue) { $this->sMobile = $sNewValue; }
+    function getEmail() { return sanitizeForSQLtoHTML($this->sEmail); }
+    function setEmail($sNewValue) { $this->sEmail = sanitizeForSQL($sNewValue); }
+    function getMobile() { return sanitizeForSQLtoHTML($this->sMobile); }
+    function setMobile($sNewValue) { $this->sMobile = sanitizeForSQL($sNewValue); }
     function getEmailNotification() { return $this->bEmailNotification; }
     function setEmailNotification($bNewValue) { $this->bEmailNotification = KTUtil::anyToBool($bNewValue); }
     function getSmsNotification() { return $this->bSmsNotification; }
@@ -33,6 +33,7 @@
  */
 require_once(KT_LIB_DIR . "/ktentity.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTWorkflow extends KTEntity {
     var $iId = -1;
@@ -52,13 +53,13 @@ class KTWorkflow extends KTEntity {
     var $_bUsePearError = true;
     function getID() { return $this->iId; }
-    function getName() { return $this->sName; }
-    function getHumanName() { return $this->sHumanName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function getHumanName() { return sanitizeForSQLtoHTML($this->sHumanName); }
     function getStartStateId() { return $this->iStartStateId; }
     function getIsEnabled() { return ($this->bEnabled == true); }
     function setID($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
-    function setHumanName($sHumanName) { $this->sHumanName = $sHumanName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
+    function setHumanName($sHumanName) { $this->sHumanName = sanitizeForSQL($sHumanName); }
     function setStartStateId($iStartStateId) { $this->iStartStateId = $iStartStateId; }
     function setIsEnabled($mValue) { $this->bEnabled = ($mValue == true); }
@@ -32,6 +32,7 @@
  */
 require_once(KT_LIB_DIR . "/ktentity.inc");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTWorkflowState extends KTEntity {
     var $iId = -1;
@@ -50,13 +51,13 @@ class KTWorkflowState extends KTEntity {
     var $_bUsePearError = true;
     function getId() { return $this->iId; }
-    function getName() { return $this->sName; }
-    function getHumanName() { return $this->sHumanName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function getHumanName() { return sanitizeForSQLtoHTML($this->sHumanName); }
     function getWorkflowId() { return $this->iWorkflowId; }
     function getInformDescriptorId() { return $this->iInformDescriptorId; }
     function setId($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
-    function setHumanName($sHumanName) { $this->sHumanName = $sHumanName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
+    function setHumanName($sHumanName) { $this->sHumanName = sanitizeForSQL($sHumanName); }
     function setWorkflowId($iWorkflowId) { $this->iWorkflowId = $iWorkflowId; }
     function setInformDescriptorId($iInformDescriptorId) { $this->iInformDescriptorId = $iInformDescriptorId; }
@@ -33,6 +33,7 @@
 require_once(KT_LIB_DIR . "/ktentity.inc");
 require_once(KT_LIB_DIR . "/workflow/workflowutil.inc.php");
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTWorkflowTransition extends KTEntity {
     var $iId = -1;
@@ -60,8 +61,8 @@ class KTWorkflowTransition extends KTEntity {
     var $_bUsePearError = true;
     function getId() { return $this->iId; }
-    function getName() { return $this->sName; }
-    function getHumanName() { return $this->sHumanName; }
+    function getName() { return sanitizeForSQLtoHTML($this->sName); }
+    function getHumanName() { return sanitizeForSQLtoHTML($this->sHumanName); }
     function getWorkflowId() { return $this->iWorkflowId; }
     function getTargetStateId() { return $this->iTargetStateId; }
     function getGuardPermissionId() { return $this->iGuardPermissionId; }
@@ -70,8 +71,8 @@ class KTWorkflowTransition extends KTEntity {
     function getGuardConditionId() { return $this->iGuardConditionId; }
     function setId($iId) { $this->iId = $iId; }
-    function setName($sName) { $this->sName = $sName; }
-    function setHumanName($sHumanName) { $this->sHumanName = $sHumanName; }
+    function setName($sName) { $this->sName = sanitizeForSQL($sName); }
+    function setHumanName($sHumanName) { $this->sHumanName = sanitizeForSQL($sHumanName); }
     function setWorkflowId($iWorkflowId) { $this->iWorkflowId = $iWorkflowId; }
     function setTargetStateId($iTargetStateId) { $this->iTargetStateId = $iTargetStateId; }
     function setGuardPermissionId($iGuardPermissionId) { $this->iGuardPermissionId = $iGuardPermissionId; }
@@ -36,6 +36,7 @@
  */
 //require_once(KT_LIB_DIR . '/workflow/workflowtriggerinstance');
+require_once(KT_LIB_DIR . "/util/sanitize.inc");
 class KTWorkflowTrigger {
     var $sNamespace = 'ktcore.workflowtriggers.abstractbase';
@@ -72,7 +73,7 @@ class KTWorkflowTrigger {
         );
     }
-    function getName() { return $this->sFriendlyName; }    
+    function getName() { return sanitizeForSQLtoHTML($this->sFriendlyName); }    
     function getNamespace() { return $this->sNamespace; }    
     function getConfigId() { return $this->oTriggerInstance->getId(); }    
@@ -882,7 +882,7 @@ class KTDocumentMoveAction extends KTDocumentAction {
             $oForm->addWidget(
                 array('ktcore.widgets.string', array(
                     'label' => _kt('Document Title'),
-                    'value' => $this->oDocument->getName(),
+                    'value' => sanitizeForHTML($this->oDocument->getName()),
                     'important_description' => _kt('Please indicate a new title to use to resolve any title conflicts.'),
                     'name' => 'name',
                     'required' => true,
@@ -898,7 +898,7 @@ class KTDocumentMoveAction extends KTDocumentAction {
             $oForm->addWidget(
                 array('ktcore.widgets.string', array(
                     'label' => _kt('Filename'),
-                    'value' => $this->oDocument->getFilename(),
+                    'value' => sanitizeForHTML($this->oDocument->getFilename()),
                     'important_description' => _kt('Please indicate a new filename to use to resolve any conflicts.'),
                     'name' => 'filename',
                     'required' => true,
@@ -1083,7 +1083,7 @@ class KTDocumentCopyAction extends KTDocumentAction {
             $oForm->addWidget(
                 array('ktcore.widgets.string', array(
                     'label' => _kt('Document Title'),
-                    'value' => $this->oDocument->getName(),
+                    'value' => sanitizeForHTML($this->oDocument->getName()),
                     'important_description' => _kt('Please indicate a new title to use to resolve any title conflicts.'),
                     'name' => 'name',
                     'required' => true,
@@ -1099,7 +1099,7 @@ class KTDocumentCopyAction extends KTDocumentAction {
             $oForm->addWidget(
                 array('ktcore.widgets.string', array(
                     'label' => _kt('Filename'),
-                    'value' => $this->oDocument->getFilename(),
+                    'value' => sanitizeForHTML($this->oDocument->getFilename()),
                     'important_description' => _kt('Please indicate a new filename to use to resolve any conflicts.'),
                     'name' => 'filename',
                     'required' => true,
@@ -422,7 +422,7 @@ class KTWorkflowAdminV2 extends KTAdminDispatcher {
                 'description' => _kt("Each workflow must have a unique name."),   
                 'name' => 'workflow_name',
                 'required' => true,     
-                'value' => $this->oWorkflow->getName(),        
+                'value' => sanitizeForHTML($this->oWorkflow->getName()),        
             )),
             array('ktcore.widgets.entityselection', array(
                 'label' => _kt("Starting State"),
@@ -911,7 +911,7 @@ class KTWorkflowAdminV2 extends KTAdminDispatcher {
                 'label' => _kt('State Name'),
                 'description' => _kt('As documents progress through their lifecycle, they pass through a number of <strong>states</strong>.  These states describe a step in the process the document must follow.  Examples of states include "reviewed","submitted" or "pending".  State names must be unique, and this includes states already in this workflow.'),
                 'required' => true,
-                'value' => $oState->getName(),
+                'value' => sanitizeForHTML($oState->getName()),
             )),
         ));
@@ -1002,7 +1002,7 @@ class KTWorkflowAdminV2 extends KTAdminDispatcher {
                 'label' => _kt('Transition Name'),
                 'description' => _kt('In order to move between states, users will cause "transitions" to occur.  These transitions represent processes followed, e.g. "review document", "distribute invoice" or "publish".  Transition names must be unique within the workflow (e.g. within this workflow, you can only have one transition called "publish")'),
                 'required' => true,
-                'value' => $oTransition->getName(),
+                'value' => sanitizeForHTML($oTransition->getName()),
             )),
         ));
@@ -70,14 +70,14 @@ class PreferencesDispatcher extends KTStandardDispatcher {
                 'description' => _kt('Your full name.  This is shown in reports and listings.  e.g. <strong>John Smith</strong>'),
                 'required' => true,
                 'name' => 'name',
-                'value' => $this->oUser->getName(),
+                'value' => sanitizeForHTML($this->oUser->getName()),
                 'autocomplete' => false)),
             array('ktcore.widgets.string', array(
                 'label' => _kt('Email Address'),
                 'description' => _kt('Your email address.  Notifications and alerts are mailed to this address if <strong>email notifications</strong> is set below. e.g. <strong>jsmith@acme.com</strong>'),
                 'required' => false,
                 'name' => 'email_address', 
-                'value' => $this->oUser->getEmail(),                
+                'value' => sanitizeForHTML($this->oUser->getEmail()),                
                 'autocomplete' => false)),           
             array('ktcore.widgets.boolean', array(
                 'label' => _kt('Email Notifications'),