diff --git a/controllers/admin/AdminSearchConfController.php b/controllers/admin/AdminSearchConfController.php
index 00d2daab7..5809d2d56 100644
--- a/controllers/admin/AdminSearchConfController.php
+++ b/controllers/admin/AdminSearchConfController.php
@@ -335,11 +335,11 @@ class AdminSearchConfControllerCore extends AdminController
             $this->errors[] = $this->l('Aliases and results are both required.');
         }
         if (!Validate::isValidSearch($search)) {
-            $this->errors[] = $search.' '.$this->l('Is not a valid result');
+            $this->errors[] = Tools::safeOutput($search).' '.$this->l('Is not a valid result');
         }
         foreach ($aliases as $alias) {
             if (!Validate::isValidSearch($alias)) {
-                $this->errors[] = $alias.' '.$this->l('Is not a valid alias');
+                $this->errors[] = Tools::safeOutput($alias).' '.$this->l('Is not a valid alias');
             }
         }
 
diff --git a/modules/blocknavigationmenu/views/templates/admin/custom_navigation_link_setting/helpers/form/form.tpl b/modules/blocknavigationmenu/views/templates/admin/custom_navigation_link_setting/helpers/form/form.tpl
index 264969825..f27638a3e 100644
--- a/modules/blocknavigationmenu/views/templates/admin/custom_navigation_link_setting/helpers/form/form.tpl
+++ b/modules/blocknavigationmenu/views/templates/admin/custom_navigation_link_setting/helpers/form/form.tpl
@@ -127,7 +127,7 @@
 							<div class="col-lg-10">
 								{foreach from=$languages item=language}
 									{assign var="navigation_link_name" value="navigation_link_name_`$language.id_lang`"}
-									<input type="text" id="{$navigation_link_name}" name="{$navigation_link_name}" value="{if isset($navigationLinkInfo.name[$language.id_lang]) && $navigationLinkInfo.name[$language.id_lang]}{$navigationLinkInfo.name[$language.id_lang]}{else if isset($smarty.post.$navigation_link_name)}{$smarty.post.$navigation_link_name}{/if}" data-lang-name="{$language.name}" placeholder="{l s='Enter exlore link name' mod='blocknavigationmenu'}" class="form-control navigation_link_name_all" {if $currentLang.id_lang != $language.id_lang}style="display:none;"{/if}/>
+									<input type="text" id="{$navigation_link_name}" name="{$navigation_link_name}" value="{if isset($navigationLinkInfo.name[$language.id_lang]) && $navigationLinkInfo.name[$language.id_lang]}{$navigationLinkInfo.name[$language.id_lang]|escape:'htmlall':'UTF-8'}{else if isset($smarty.post.$navigation_link_name)}{$smarty.post.$navigation_link_name|escape:'htmlall':'UTF-8'}{/if}" data-lang-name="{$language.name}" placeholder="{l s='Enter exlore link name' mod='blocknavigationmenu'}" class="form-control navigation_link_name_all" {if $currentLang.id_lang != $language.id_lang}style="display:none;"{/if}/>
 								{/foreach}
 							</div>
 							{if $languages|@count > 1}
@@ -176,7 +176,7 @@
 						</span>
 					</label>
 					<div class="col-lg-5">
-						<input type="text" name="link" {if isset($smarty.post.link)}value="{$smarty.post.link}"{elseif isset($navigationLinkInfo['link'])}value="{$navigationLinkInfo['link']}"{/if}>
+						<input type="text" name="link" {if isset($smarty.post.link)}value="{$smarty.post.link|escape:'htmlall':'UTF-8'}"{elseif isset($navigationLinkInfo['link'])}value="{$navigationLinkInfo['link']|escape:'htmlall':'UTF-8'}"{/if}>
 					</div>
 				</div>
 				<div class="form-group custom_redirect_page_div {if isset($smarty.post.is_custom_redirect_link)}{if $smarty.post.is_custom_redirect_link}hidden{/if}{elseif isset($navigationLinkInfo['is_custom_link']) && $navigationLinkInfo['is_custom_link']}hidden{/if}">
diff --git a/modules/hotelreservationsystem/views/templates/admin/add_hotel/helpers/form/form.tpl b/modules/hotelreservationsystem/views/templates/admin/add_hotel/helpers/form/form.tpl
index 4e4123d84..6b0cdc270 100644
--- a/modules/hotelreservationsystem/views/templates/admin/add_hotel/helpers/form/form.tpl
+++ b/modules/hotelreservationsystem/views/templates/admin/add_hotel/helpers/form/form.tpl
@@ -183,7 +183,7 @@
 									id="short_description_{$language.id_lang}"
 									{if isset($PS_SHORT_DESC_LIMIT) && $PS_SHORT_DESC_LIMIT} maxlength="{$PS_SHORT_DESC_LIMIT|intval}"{/if}
 									cols="2" rows="3"
-									class="form-control">{if isset($smarty.post.$short_desc_name)}{$smarty.post.$short_desc_name}{elseif isset($edit)}{$hotel_info.short_description[{$language.id_lang}]}{/if}</textarea>
+									class="form-control">{if isset($smarty.post.$short_desc_name)}{$smarty.post.$short_desc_name|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.short_description[{$language.id_lang}]|escape:'htmlall':'UTF-8'}{/if}</textarea>
 								</div>
 							{/foreach}
 						</div>
@@ -201,7 +201,7 @@
 									name="description_{$language.id_lang}"
 									id="description_{$language.id_lang}"
 									cols="2" rows="3"
-									class="wk_tinymce form-control">{if isset($smarty.post.$description)}{$smarty.post.$description}{elseif isset($edit)}{$hotel_info.description[{$language.id_lang}]}{/if}</textarea>
+									class="wk_tinymce form-control">{if isset($smarty.post.$description)}{$smarty.post.$description|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.description[{$language.id_lang}]|escape:'htmlall':'UTF-8'}{/if}</textarea>
 								</div>
 							{/foreach}
 						</div>
@@ -209,7 +209,7 @@
 					<div class="form-group">
 						<label class="col-sm-3 control-label required">{l s='Phone :' mod='hotelreservationsystem'}</label>
 						<div class="col-sm-6">
-							<input type="text" name="phone" id="phone" value="{if isset($smarty.post.phone)}{$smarty.post.phone}{elseif isset($edit)}{$address_info.phone|escape:'htmlall':'UTF-8'}{/if}"/>
+							<input type="text" name="phone" id="phone" value="{if isset($smarty.post.phone)}{$smarty.post.phone|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$address_info.phone|escape:'htmlall':'UTF-8'}{/if}"/>
 						</div>
 					</div>
 					<div class="form-group">
@@ -219,7 +219,7 @@
 								<span class="input-group-addon">
 									<i class="icon-envelope-o"></i>
 								</span>
-								<input class="reg_sel_input form-control-static" type="text" name="email" id="hotel_email" value="{if isset($smarty.post.email)}{$smarty.post.email}{elseif isset($edit)}{$hotel_info.email|escape:'htmlall':'UTF-8'}{/if}"/>
+								<input class="reg_sel_input form-control-static" type="text" name="email" id="hotel_email" value="{if isset($smarty.post.email)}{$smarty.post.email|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.email|escape:'htmlall':'UTF-8'}{/if}"/>
 							</div>
 						</div>
 					</div>
@@ -232,13 +232,13 @@
 					<div class="form-group">
 						<label class="col-sm-3 control-label required">{l s='Address :' mod='hotelreservationsystem'}</label>
 						<div class="col-sm-6">
-							<textarea name="address" rows="4" cols="35" >{if isset($smarty.post.address)}{$smarty.post.address}{elseif isset($edit)}{$address_info.address1|escape:'htmlall':'UTF-8'}{/if}</textarea>
+							<textarea name="address" rows="4" cols="35" >{if isset($smarty.post.address)}{$smarty.post.address|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$address_info.address1|escape:'htmlall':'UTF-8'}{/if}</textarea>
 						</div>
 					</div>
 					<div class="form-group check_in_div" style="position:relative">
 						<label class="col-sm-3 control-label" for="fax">{l s='Fax' mod='hotelreservationsystem'}</label>
 						<div class="col-sm-6">
-							<input autocomplete="off" type="text" class="form-control" id="fax" name="fax" value="{if isset($smarty.post.fax)}{$smarty.post.fax}{elseif isset($edit)}{$hotel_info.fax|escape:'htmlall':'UTF-8'}{/if}" />
+							<input autocomplete="off" type="text" class="form-control" id="fax" name="fax" value="{if isset($smarty.post.fax)}{$smarty.post.fax|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.fax|escape:'htmlall':'UTF-8'}{/if}" />
 						</div>
 					</div>
 					<div class="form-group">
@@ -261,7 +261,7 @@
 							{l s='Check-in:' mod='hotelreservationsystem'}
 						</label>
 						<div class="col-sm-2">
-							<input autocomplete="off" type="text" class="form-control" id="check_in_time" name="check_in" value="{if isset($smarty.post.check_in)}{$smarty.post.check_in}{elseif isset($edit)}{$hotel_info.check_in|escape:'htmlall':'UTF-8'}{/if}" />
+							<input autocomplete="off" type="text" class="form-control" id="check_in_time" name="check_in" value="{if isset($smarty.post.check_in)}{$smarty.post.check_in|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.check_in|escape:'htmlall':'UTF-8'}{/if}" />
 						</div>
 					</div>
 					<div class="form-group check_out_div" style="position:relative">
@@ -269,7 +269,7 @@
 							{l s='Check-out:' mod='hotelreservationsystem'}
 						</label>
 						<div class="col-sm-2">
-							<input autocomplete="off" type="text" class="form-control" id="check_out_time" name="check_out" value="{if isset($smarty.post.check_out)}{$smarty.post.check_out}{elseif isset($edit)}{$hotel_info.check_out|escape:'htmlall':'UTF-8'}{/if}" />
+							<input autocomplete="off" type="text" class="form-control" id="check_out_time" name="check_out" value="{if isset($smarty.post.check_out)}{$smarty.post.check_out|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.check_out|escape:'htmlall':'UTF-8'}{/if}" />
 						</div>
 					</div>
 					<div class="form-group">
@@ -305,13 +305,13 @@
 					<div class="form-group">
 						<label class="control-label col-sm-3 required" for="hotel_city">{l s='City :' mod='hotelreservationsystem'}</label>
 						<div class="col-sm-6">
-							<input class="form-control" type="" data-validate="" id="hotel_city" name="hotel_city" value="{if isset($smarty.post.hotel_city)}{$smarty.post.hotel_city}{elseif isset($edit)}{$address_info.city|escape:'htmlall':'UTF-8'}{/if}" />
+							<input class="form-control" type="" data-validate="" id="hotel_city" name="hotel_city" value="{if isset($smarty.post.hotel_city)}{$smarty.post.hotel_city|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$address_info.city|escape:'htmlall':'UTF-8'}{/if}" />
 						</div>
 					</div>
 					<div class="form-group">
 						<label class="control-label col-sm-3 required" for="hotel_postal_code">{l s='Zip Code :' mod='hotelreservationsystem'}</label>
 						<div class="col-sm-6">
-							<input class="form-control" type="" data-validate="" id="hotel_postal_code" name="hotel_postal_code" value="{if isset($smarty.post.hotel_postal_code)}{$smarty.post.hotel_postal_code}{elseif isset($edit)}{$address_info.postcode|escape:'htmlall':'UTF-8'}{/if}" />
+							<input class="form-control" type="" data-validate="" id="hotel_postal_code" name="hotel_postal_code" value="{if isset($smarty.post.hotel_postal_code)}{$smarty.post.hotel_postal_code|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$address_info.postcode|escape:'htmlall':'UTF-8'}{/if}" />
 						</div>
 					</div>
 					<div class="form-group">
@@ -339,7 +339,7 @@
 									name="policies_{$language.id_lang}"
 									id="policies_{$language.id_lang}"
 									cols="2" rows="3"
-									class="wk_tinymce form-control">{if isset($smarty.post.$policies)}{$smarty.post.$policies}{elseif isset($edit)}{$hotel_info.policies[{$language.id_lang}]}{/if}</textarea>
+									class="wk_tinymce form-control">{if isset($smarty.post.$policies)}{$smarty.post.$policies|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$hotel_info.policies[{$language.id_lang}]|escape:'htmlall':'UTF-8'}{/if}</textarea>
 								</div>
 							{/foreach}
 						</div>
@@ -519,7 +519,7 @@
 						<div class="form-group" {if isset($smarty.post.enable_use_global_max_checkout_offset)} {if !$smarty.post.enable_use_global_max_checkout_offset} style="display:block;" {else} style="display:none;" {/if} {elseif isset($order_restrict_date_info.use_global_max_checkout_offset) && !$order_restrict_date_info.use_global_max_checkout_offset} style="display:block;" {else} style="display:none;" {/if}>
 							<label class="control-label col-sm-3 required" for="max_checkout_offset">{l s='Maximum checkout offset :' mod='hotelreservationsystem'}</label>
 							<div class="col-sm-2">
-								<input type="text" class="form-control" id="max_checkout_offset" name="max_checkout_offset" value="{if isset($smarty.post.max_checkout_offset)}{$smarty.post.max_checkout_offset}{elseif isset($order_restrict_date_info.max_checkout_offset)}{$order_restrict_date_info.max_checkout_offset|escape:'htmlall':'UTF-8'}{/if}" />
+								<input type="text" class="form-control" id="max_checkout_offset" name="max_checkout_offset" value="{if isset($smarty.post.max_checkout_offset)}{$smarty.post.max_checkout_offset|escape:'htmlall':'UTF-8'}{elseif isset($order_restrict_date_info.max_checkout_offset)}{$order_restrict_date_info.max_checkout_offset|escape:'htmlall':'UTF-8'}{/if}" />
 							</div>
 						</div>
 						<div class="form-group">
diff --git a/modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl b/modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl
index 8456fdf26..7396a91ac 100644
--- a/modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl
+++ b/modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl
@@ -40,7 +40,7 @@
 			<div class="col-lg-3">
 				{foreach from=$languages item=language}
 					{assign var="feature_price_name" value="feature_price_name_`$language.id_lang`"}
-					<input type="text" id="{$feature_price_name}" name="{$feature_price_name}" value="{if isset($objFeaturePrice->feature_price_name[$language.id_lang]) && $objFeaturePrice->feature_price_name[$language.id_lang]}{$objFeaturePrice->feature_price_name[$language.id_lang]}{else if isset($smarty.post.$feature_price_name)}{$smarty.post.$feature_price_name}{/if}" data-lang-name="{$language.name}" placeholder="{l s='Enter advanced price rule name' mod='hotelreservationsystem'}" class="form-control feature_price_name_all" {if $currentLang.id_lang != $language.id_lang}style="display:none;"{/if}/>
+					<input type="text" id="{$feature_price_name}" name="{$feature_price_name}" value="{if isset($objFeaturePrice->feature_price_name[$language.id_lang]) && $objFeaturePrice->feature_price_name[$language.id_lang]}{$objFeaturePrice->feature_price_name[$language.id_lang]|escape:'htmlall':'UTF-8'}{else if isset($smarty.post.$feature_price_name)}{$smarty.post.$feature_price_name|escape:'htmlall':'UTF-8'}{/if}" data-lang-name="{$language.name}" placeholder="{l s='Enter advanced price rule name' mod='hotelreservationsystem'}" class="form-control feature_price_name_all" {if $currentLang.id_lang != $language.id_lang}style="display:none;"{/if}/>
 				{/foreach}
 			</div>
 			{if $languages|@count > 1}
@@ -182,7 +182,7 @@
 			<div class="col-lg-3">
 				<div class="input-group">
 					<span class="input-group-addon payment_type_icon">{if isset($edit)} {if $objFeaturePrice->impact_type == HotelRoomTypeFeaturePricing::IMPACT_TYPE_FIXED_PRICE}{$defaultcurrency_sign}{else}%{/if}{else}%{/if}</span>
-					<input type="text" id="impact_value" name="impact_value" value="{if isset($smarty.post.impact_value) && $smarty.post.impact_value}{$smarty.post.impact_value}{elseif isset($objFeaturePrice->impact_value)}{$objFeaturePrice->impact_value}{/if}"/>
+					<input type="text" id="impact_value" name="impact_value" value="{if isset($smarty.post.impact_value) && $smarty.post.impact_value}{$smarty.post.impact_value|escape:'htmlall':'UTF-8'}{elseif isset($objFeaturePrice->impact_value)}{$objFeaturePrice->impact_value|escape:'htmlall':'UTF-8'}{/if}"/>
 				</div>
 			</div>
 		</div>
diff --git a/modules/hotelreservationsystem/views/templates/admin/order_refund_rules/helpers/form/form.tpl b/modules/hotelreservationsystem/views/templates/admin/order_refund_rules/helpers/form/form.tpl
index b5764b51c..a687eb6c0 100644
--- a/modules/hotelreservationsystem/views/templates/admin/order_refund_rules/helpers/form/form.tpl
+++ b/modules/hotelreservationsystem/views/templates/admin/order_refund_rules/helpers/form/form.tpl
@@ -65,7 +65,7 @@
 						name="description_{$language.id_lang|escape:'htmlall':'UTF-8'}"
 						id="description_{$language.id_lang|escape:'htmlall':'UTF-8'}"
 						cols="2" rows="3"
-						class="form-control">{if isset($smarty.post.$description)}{$smarty.post.$description}{elseif isset($edit)}{$refund_rules_info.description[$language.id_lang]|escape:'htmlall':'UTF-8'}{/if}</textarea>
+						class="form-control">{if isset($smarty.post.$description)}{$smarty.post.$description|escape:'htmlall':'UTF-8'}{elseif isset($edit)}{$refund_rules_info.description[$language.id_lang]|escape:'htmlall':'UTF-8'}{/if}</textarea>
 					</div>
 				{/foreach}
 			</div>