From be14203534c5f09d0c70c2bf59b81b80f2a90b32 Mon Sep 17 00:00:00 2001
From: Steven Wittens <steven@10.no-reply.drupal.org>
Date: Thu, 31 Mar 2005 09:25:33 +0000
Subject: - #18817: Clean up plain-text checking (see drupal-devel!)

---
 modules/aggregator.module            | 48 ++++++++++++++---------------
 modules/aggregator/aggregator.module | 48 ++++++++++++++---------------
 modules/archive.module               |  2 +-
 modules/archive/archive.module       |  2 +-
 modules/block.module                 |  8 ++---
 modules/block/block.module           |  8 ++---
 modules/blogapi.module               |  4 +--
 modules/blogapi/blogapi.module       |  4 +--
 modules/book.module                  | 18 +++++------
 modules/book/book.module             | 18 +++++------
 modules/comment.module               | 31 ++++++++++---------
 modules/comment/comment.module       | 31 ++++++++++---------
 modules/contact.module               |  2 +-
 modules/contact/contact.module       |  2 +-
 modules/drupal.module                |  4 +--
 modules/drupal/drupal.module         |  4 +--
 modules/filter.module                | 18 +++++------
 modules/filter/filter.module         | 18 +++++------
 modules/forum.module                 | 12 ++++----
 modules/forum/forum.module           | 12 ++++----
 modules/locale.module                |  9 +++---
 modules/locale/locale.module         |  9 +++---
 modules/menu.module                  | 14 ++++-----
 modules/menu/menu.module             | 14 ++++-----
 modules/node.module                  | 29 +++++++++---------
 modules/node/node.module             | 29 +++++++++---------
 modules/path.module                  |  6 ++--
 modules/path/path.module             |  6 ++--
 modules/poll.module                  | 10 +++----
 modules/poll/poll.module             | 10 +++----
 modules/profile.module               | 36 +++++++++++-----------
 modules/profile/profile.module       | 36 +++++++++++-----------
 modules/queue.module                 | 10 +++----
 modules/search.module                | 10 +++----
 modules/search/search.module         | 10 +++----
 modules/statistics.module            |  2 +-
 modules/statistics/statistics.module |  2 +-
 modules/taxonomy.module              | 18 +++++------
 modules/taxonomy/taxonomy.module     | 18 +++++------
 modules/upload.module                |  8 ++---
 modules/upload/upload.module         |  8 ++---
 modules/user.module                  | 58 ++++++++++++++++++------------------
 modules/user/user.module             | 58 ++++++++++++++++++------------------
 43 files changed, 355 insertions(+), 349 deletions(-)

(limited to 'modules')

diff --git a/modules/aggregator.module b/modules/aggregator.module
index edd23ad1e..2374afd9c 100644
--- a/modules/aggregator.module
+++ b/modules/aggregator.module
@@ -198,11 +198,11 @@ function aggregator_block($op, $delta = 0, $edit = array()) {
     if ($op == 'list') {
       $result = db_query('SELECT cid, title FROM {aggregator_category} ORDER BY title');
       while ($category = db_fetch_object($result)) {
-        $block['category:'. $category->cid]['info'] = t('%title category latest items', array('%title' => $category->title));
+        $block['category:'. $category->cid]['info'] = t('%title category latest items', array('%title' => theme('placeholder', $category->title)));
       }
       $result = db_query('SELECT fid, title FROM {aggregator_feed} ORDER BY fid');
       while ($feed = db_fetch_object($result)) {
-        $block['feed:'. $feed->fid]['info'] = t('%title feed latest items', array('%title' => $feed->title));
+        $block['feed:'. $feed->fid]['info'] = t('%title feed latest items', array('%title' => theme('placeholder', $feed->title)));
       }
     }
     else if ($op == 'configure') {
@@ -231,7 +231,7 @@ function aggregator_block($op, $delta = 0, $edit = array()) {
       switch ($type) {
         case 'feed':
           if ($feed = db_fetch_object(db_query('SELECT fid, title, block FROM {aggregator_feed} WHERE fid = %d', $id))) {
-            $block['subject'] = $feed->title;
+            $block['subject'] = check_plain($feed->title);
             $result = db_query_range('SELECT * FROM {aggregator_item} WHERE fid = %d ORDER BY timestamp DESC, iid DESC', $feed->fid, 0, $feed->block);
             $block['content'] = '<div class="more-link">'. l(t('more'), 'aggregator/sources/'. $feed->fid, array('title' => t('View this feed\'s recent news.'))) .'</div>';
           }
@@ -239,7 +239,7 @@ function aggregator_block($op, $delta = 0, $edit = array()) {
 
         case 'category':
           if ($category = db_fetch_object(db_query('SELECT cid, title, block FROM {aggregator_category} WHERE cid = %d', $id))) {
-            $block['subject'] = $category->title;
+            $block['subject'] = check_plain($category->title);
             $result = db_query_range('SELECT i.* FROM {aggregator_category_item} ci LEFT JOIN {aggregator_item} i ON ci.iid = i.iid WHERE ci.cid = %d ORDER BY i.timestamp DESC, i.iid DESC', $category->cid, 0, $category->block);
             $block['content'] = '<div class="more-link">'. l(t('more'), 'aggregator/categories/'. $category->cid, array('title' => t('View this category\'s recent news.'))) .'</div>';
           }
@@ -265,7 +265,7 @@ function aggregator_remove($feed) {
   }
   db_query('DELETE FROM {aggregator_item} WHERE fid = %d', $feed['fid']);
   db_query("UPDATE {aggregator_feed} SET checked = 0, etag = '', modified = 0 WHERE fid = %d", $feed['fid']);
-  drupal_set_message(t('Removed news items from %site.', array('%site' => '<em>'. $feed['title'] .'</em>')));
+  drupal_set_message(t('Removed news items from %site.', array('%site' => theme('placeholder', $feed['title']))));
 }
 
 /**
@@ -345,11 +345,11 @@ function aggregator_refresh($feed) {
   switch ($result->code) {
     case 304:
       db_query('UPDATE {aggregator_feed} SET checked = %d WHERE fid = %d', time(), $feed['fid']);
-      drupal_set_message(t('No new syndicated content from %site.', array('%site' => '<em>'. $feed['title'] .'</em>')));
+      drupal_set_message(t('No new syndicated content from %site.', array('%site' => theme('placeholder', $feed['title']))));
       break;
     case 301:
       $feed['url'] = $result->redirect_url;
-      watchdog('aggregator', t('Updated URL for feed %title to %url.', array('%title' => '<em>'. $feed['title'] .'</em>', '%url' => '<em>'. $feed['url'] .'</em>')));
+      watchdog('aggregator', t('Updated URL for feed %title to %url.', array('%title' => theme('placeholder', $feed['title']), '%url' => theme('placeholder', $feed['url']))));
       break;
 
     case 200:
@@ -397,13 +397,13 @@ function aggregator_refresh($feed) {
 
         cache_clear_all();
 
-        $message = t('Syndicated content from %site.', array('%site' => '<em>'. $feed[title] .'</em>'));
+        $message = t('Syndicated content from %site.', array('%site' => theme('placeholder', $feed[title])));
         watchdog('aggregator', $message);
         drupal_set_message($message);
       }
       break;
     default:
-      $message = t('Failed to parse RSS feed %site: %error.', array('%site' => '<em>'. $feed['title'] .'</em>', '%error' => "<em>$result->code $result->error</em>"));
+      $message = t('Failed to parse RSS feed %site: %error.', array('%site' => theme('placeholder', $feed['title']), '%error' => theme('placeholder', $result->code .' '. $result->error)));
       watchdog('aggregator', $message, WATCHDOG_WARNING);
       drupal_set_message($message);
   }
@@ -461,7 +461,7 @@ function aggregator_parse_feed(&$data, $feed) {
   xml_set_character_data_handler($xml_parser, 'aggregator_element_data');
 
   if (!xml_parse($xml_parser, $data, 1)) {
-    $message = t('Failed to parse RSS feed %site: %error at line %line.', array('%site' => '<em>'. $feed['title'] .'</em>', '%error' => xml_error_string(xml_get_error_code($xml_parser)), '%line' => xml_get_current_line_number($xml_parser)));
+    $message = t('Failed to parse RSS feed %site: %error at line %line.', array('%site' => theme('placeholder', $feed['title']), '%error' => xml_error_string(xml_get_error_code($xml_parser)), '%line' => xml_get_current_line_number($xml_parser)));
     watchdog('aggregator', $message, WATCHDOG_WARNING);
     drupal_set_message($message, 'error');
     return 0;
@@ -554,7 +554,7 @@ function aggregator_parse_feed(&$data, $feed) {
     }
 
     if (!valid_input_data($item['DESCRIPTION'])) {
-      drupal_set_message(t('Failed to parse entry from %site feed: suspicious input data.', array('%site' => '<em>'. $feed['title'] .'</em>')), 'error');
+      drupal_set_message(t('Failed to parse entry from %site feed: suspicious input data.', array('%site' => theme('placeholder', $feed['title']))), 'error');
     }
     else {
       aggregator_save_item(array('iid' => $entry->iid, 'fid' => $feed['fid'], 'timestamp' => $timestamp, 'title' => $title, 'link' => $link, 'author' => $item['AUTHOR'], 'description' => $item['DESCRIPTION']));
@@ -643,7 +643,7 @@ function aggregator_form_feed($edit = array()) {
   $categories = db_query('SELECT c.cid, c.title, f.fid FROM {aggregator_category} c LEFT JOIN {aggregator_category_feed} f ON c.cid = f.cid AND f.fid = %d ORDER BY title', $edit['fid']);
   while ($category = db_fetch_object($categories)) {
     $options[$category->cid] = $category->title;
-    if ($category->fid) $values[] = $category->cid;
+    if ($category->fid) $values[] = check_plain($category->cid);
   }
   if ($options) {
     $form .= form_checkboxes(t('Categorize news items'), 'category', $values, $options, t('New items in this feed will be automatically filed in the the checked categories as they are received.'));
@@ -920,7 +920,7 @@ function _aggregator_page_list($sql, $op, $header = '') {
         $selected = array();
         while ($category = db_fetch_object($categories_result)) {
           if (!$done) {
-            $categories[$category->cid] = check_form($category->title);
+            $categories[$category->cid] = check_plain($category->title);
           }
           if ($category->iid) {
             $selected[] = $category->cid;
@@ -932,7 +932,7 @@ function _aggregator_page_list($sql, $op, $header = '') {
       else {
         $form = '';
         while ($category = db_fetch_object($categories_result)) {
-          $form .= form_checkbox(check_form($category->title), 'categories]['. $item->iid .'][', $category->cid, !is_null($category->iid));
+          $form .= form_checkbox(check_plain($category->title), 'categories]['. $item->iid .'][', $category->cid, !is_null($category->iid));
         }
       }
       $rows[] = array(theme('aggregator_page_item', $item), array('data' => $form, 'class' => 'categorize-item'));
@@ -960,7 +960,7 @@ function aggregator_page_sources() {
   $result = db_query('SELECT f.fid, f.title, f.description, f.image, MAX(i.timestamp) AS last FROM {aggregator_feed} f LEFT JOIN {aggregator_item} i ON f.fid = i.fid GROUP BY f.fid');
   $output = "<div id=\"aggregator\">\n";
   while ($feed = db_fetch_object($result)) {
-    $output .= "<h2>$feed->title</h2>\n";
+    $output .= '<h2>'. check_plain($feed->title) ."</h2>\n";
 
     // Most recent items:
     $list = array();
@@ -987,13 +987,13 @@ function aggregator_page_opml() {
   $output = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n";
   $output .= "<opml version=\"1.1\">\n";
   $output .= "<head>\n";
-  $output .= '<title>'. drupal_specialchars(variable_get('site_name', 'Drupal')) ."</title>\n";
+  $output .= '<title>'. check_plain(variable_get('site_name', 'Drupal')) ."</title>\n";
   $output .= '<dateModified>'. gmdate('r') ."</dateModified>\n";
   $output .= "</head>\n";
   $output .= "<body>\n";
 
   while ($feed = db_fetch_object($result)) {
-    $output .= '<outline text="'. drupal_specialchars($feed->title) .'" xmlUrl="'. drupal_specialchars($feed->url) ."\" />\n";
+    $output .= '<outline text="'. check_plain($feed->title) .'" xmlUrl="'. check_url($feed->url) ."\" />\n";
   }
 
   $output .= "</body>\n";
@@ -1011,7 +1011,7 @@ function aggregator_page_categories() {
   $output = "<div id=\"aggregator\">\n";
 
   while ($category = db_fetch_object($result)) {
-    $output .= "<h2>$category->title</h2>\n";
+    $output .= '<h2>'. check_plain($category->title) ."</h2>\n";
     if (variable_get('aggregator_summary_items', 3)) {
       $list = array();
       $items = db_query_range('SELECT i.title, i.timestamp, i.link, f.title as feed_title, f.link as feed_link FROM {aggregator_category_item} ci LEFT JOIN {aggregator_item} i ON i.iid = ci.iid LEFT JOIN {aggregator_feed} f ON i.fid = f.fid WHERE ci.cid = %d ORDER BY i.timestamp DESC', $category->cid, 0, variable_get('aggregator_summary_items', 3));
@@ -1042,7 +1042,7 @@ function theme_aggregator_feed($feed) {
   $output .= $feed->description;
   $output .= '<h3>'. t('URL') ."</h3>\n";
   $output .= theme('xml_icon', $feed->url);
-  $output .= "<a href=\"$feed->link\">$feed->link</a>\n";
+  $output .= '<a href="'. check_url($feed->link) .'">'. check_plain($feed->link) ."</a>\n";
   $output .= '<h3>'. t('Last update') ."</h3>\n";
   $updated = t('%time ago', array('%time' => format_interval(time() - $feed->checked)));
 
@@ -1066,12 +1066,12 @@ function theme_aggregator_block_item($item, $feed = 0) {
 
   if ($user->uid && module_exist('blog') && user_access('edit own blog')) {
     if ($image = theme('image', 'misc/blog.png', t('blog it'), t('blog it'))) {
-      $output .= '<div class="icon">'. l($image, 'node/add/blog', array('title' => t('Comment on this news item in your personal blog.'), 'class' => 'blog-it'), "iid=$item->iid") .'</div>';
+      $output .= '<div class="icon">'. l($image, 'node/add/blog', array('title' => t('Comment on this news item in your personal blog.'), 'class' => 'blog-it'), "iid=$item->iid", NULL, FALSE, TRUE) .'</div>';
     }
   }
 
   // Display the external link to the item.
-  $output .= "<a href=\"$item->link\">$item->title</a>\n";
+  $output .= '<a href="'. check_url($item->link) .'">'. check_plain($item->title) ."</a>\n";
 
   return $output;
 }
@@ -1086,7 +1086,7 @@ function theme_aggregator_block_item($item, $feed = 0) {
  * @ingroup themeable
  */
 function theme_aggregator_summary_item($item) {
-  $output = '<a href="'. check_url($item->link) .'">'. $item->title .'</a> <span class="age">'. t('%age old', array('%age' => format_interval(time() - $item->timestamp))) .'</span>';
+  $output = '<a href="'. check_url($item->link) .'">'. check_plain($item->title) .'</a> <span class="age">'. t('%age old', array('%age' => format_interval(time() - $item->timestamp))) .'</span>';
   if ($item->feed_link) {
     $output .= ', <span class="source"><a href="'. $item->feed_link .'">'. $item->feed_title .'</a></span>';
   }
@@ -1110,9 +1110,9 @@ function theme_aggregator_page_item($item) {
   $output .= "<div class=\"news-item\">\n";
   $output .= ' <div class="date">'. date('H:i', $item->timestamp) ."</div>\n";
   $output .= " <div class=\"body\">\n";
-  $output .= "  <div class=\"title\"><a href=\"$item->link\">$item->title</a></div>\n";
+  $output .= '  <div class="title"><a href="'. check_url($item->link) .'">'. check_plain($item->title) ."</a></div>\n";
   if ($item->description) {
-    $output .= "  <div class=\"description\">$item->description</div>\n";
+    $output .= '  <div class="description">'. check_plain($item->description) ."</div>\n";
   }
   if ($item->ftitle && $item->fid) {
     $output .= '  <div class="source">'. t('Source') .': '. l($item->ftitle, "aggregator/sources/$item->fid") ."</div>\n";
diff --git a/modules/aggregator/aggregator.module b/modules/aggregator/aggregator.module
index edd23ad1e..2374afd9c 100644
--- a/modules/aggregator/aggregator.module
+++ b/modules/aggregator/aggregator.module
@@ -198,11 +198,11 @@ function aggregator_block($op, $delta = 0, $edit = array()) {
     if ($op == 'list') {
       $result = db_query('SELECT cid, title FROM {aggregator_category} ORDER BY title');
       while ($category = db_fetch_object($result)) {
-        $block['category:'. $category->cid]['info'] = t('%title category latest items', array('%title' => $category->title));
+        $block['category:'. $category->cid]['info'] = t('%title category latest items', array('%title' => theme('placeholder', $category->title)));
       }
       $result = db_query('SELECT fid, title FROM {aggregator_feed} ORDER BY fid');
       while ($feed = db_fetch_object($result)) {
-        $block['feed:'. $feed->fid]['info'] = t('%title feed latest items', array('%title' => $feed->title));
+        $block['feed:'. $feed->fid]['info'] = t('%title feed latest items', array('%title' => theme('placeholder', $feed->title)));
       }
     }
     else if ($op == 'configure') {
@@ -231,7 +231,7 @@ function aggregator_block($op, $delta = 0, $edit = array()) {
       switch ($type) {
         case 'feed':
           if ($feed = db_fetch_object(db_query('SELECT fid, title, block FROM {aggregator_feed} WHERE fid = %d', $id))) {
-            $block['subject'] = $feed->title;
+            $block['subject'] = check_plain($feed->title);
             $result = db_query_range('SELECT * FROM {aggregator_item} WHERE fid = %d ORDER BY timestamp DESC, iid DESC', $feed->fid, 0, $feed->block);
             $block['content'] = '<div class="more-link">'. l(t('more'), 'aggregator/sources/'. $feed->fid, array('title' => t('View this feed\'s recent news.'))) .'</div>';
           }
@@ -239,7 +239,7 @@ function aggregator_block($op, $delta = 0, $edit = array()) {
 
         case 'category':
           if ($category = db_fetch_object(db_query('SELECT cid, title, block FROM {aggregator_category} WHERE cid = %d', $id))) {
-            $block['subject'] = $category->title;
+            $block['subject'] = check_plain($category->title);
             $result = db_query_range('SELECT i.* FROM {aggregator_category_item} ci LEFT JOIN {aggregator_item} i ON ci.iid = i.iid WHERE ci.cid = %d ORDER BY i.timestamp DESC, i.iid DESC', $category->cid, 0, $category->block);
             $block['content'] = '<div class="more-link">'. l(t('more'), 'aggregator/categories/'. $category->cid, array('title' => t('View this category\'s recent news.'))) .'</div>';
           }
@@ -265,7 +265,7 @@ function aggregator_remove($feed) {
   }
   db_query('DELETE FROM {aggregator_item} WHERE fid = %d', $feed['fid']);
   db_query("UPDATE {aggregator_feed} SET checked = 0, etag = '', modified = 0 WHERE fid = %d", $feed['fid']);
-  drupal_set_message(t('Removed news items from %site.', array('%site' => '<em>'. $feed['title'] .'</em>')));
+  drupal_set_message(t('Removed news items from %site.', array('%site' => theme('placeholder', $feed['title']))));
 }
 
 /**
@@ -345,11 +345,11 @@ function aggregator_refresh($feed) {
   switch ($result->code) {
     case 304:
       db_query('UPDATE {aggregator_feed} SET checked = %d WHERE fid = %d', time(), $feed['fid']);
-      drupal_set_message(t('No new syndicated content from %site.', array('%site' => '<em>'. $feed['title'] .'</em>')));
+      drupal_set_message(t('No new syndicated content from %site.', array('%site' => theme('placeholder', $feed['title']))));
       break;
     case 301:
       $feed['url'] = $result->redirect_url;
-      watchdog('aggregator', t('Updated URL for feed %title to %url.', array('%title' => '<em>'. $feed['title'] .'</em>', '%url' => '<em>'. $feed['url'] .'</em>')));
+      watchdog('aggregator', t('Updated URL for feed %title to %url.', array('%title' => theme('placeholder', $feed['title']), '%url' => theme('placeholder', $feed['url']))));
       break;
 
     case 200:
@@ -397,13 +397,13 @@ function aggregator_refresh($feed) {
 
         cache_clear_all();
 
-        $message = t('Syndicated content from %site.', array('%site' => '<em>'. $feed[title] .'</em>'));
+        $message = t('Syndicated content from %site.', array('%site' => theme('placeholder', $feed[title])));
         watchdog('aggregator', $message);
         drupal_set_message($message);
       }
       break;
     default:
-      $message = t('Failed to parse RSS feed %site: %error.', array('%site' => '<em>'. $feed['title'] .'</em>', '%error' => "<em>$result->code $result->error</em>"));
+      $message = t('Failed to parse RSS feed %site: %error.', array('%site' => theme('placeholder', $feed['title']), '%error' => theme('placeholder', $result->code .' '. $result->error)));
       watchdog('aggregator', $message, WATCHDOG_WARNING);
       drupal_set_message($message);
   }
@@ -461,7 +461,7 @@ function aggregator_parse_feed(&$data, $feed) {
   xml_set_character_data_handler($xml_parser, 'aggregator_element_data');
 
   if (!xml_parse($xml_parser, $data, 1)) {
-    $message = t('Failed to parse RSS feed %site: %error at line %line.', array('%site' => '<em>'. $feed['title'] .'</em>', '%error' => xml_error_string(xml_get_error_code($xml_parser)), '%line' => xml_get_current_line_number($xml_parser)));
+    $message = t('Failed to parse RSS feed %site: %error at line %line.', array('%site' => theme('placeholder', $feed['title']), '%error' => xml_error_string(xml_get_error_code($xml_parser)), '%line' => xml_get_current_line_number($xml_parser)));
     watchdog('aggregator', $message, WATCHDOG_WARNING);
     drupal_set_message($message, 'error');
     return 0;
@@ -554,7 +554,7 @@ function aggregator_parse_feed(&$data, $feed) {
     }
 
     if (!valid_input_data($item['DESCRIPTION'])) {
-      drupal_set_message(t('Failed to parse entry from %site feed: suspicious input data.', array('%site' => '<em>'. $feed['title'] .'</em>')), 'error');
+      drupal_set_message(t('Failed to parse entry from %site feed: suspicious input data.', array('%site' => theme('placeholder', $feed['title']))), 'error');
     }
     else {
       aggregator_save_item(array('iid' => $entry->iid, 'fid' => $feed['fid'], 'timestamp' => $timestamp, 'title' => $title, 'link' => $link, 'author' => $item['AUTHOR'], 'description' => $item['DESCRIPTION']));
@@ -643,7 +643,7 @@ function aggregator_form_feed($edit = array()) {
   $categories = db_query('SELECT c.cid, c.title, f.fid FROM {aggregator_category} c LEFT JOIN {aggregator_category_feed} f ON c.cid = f.cid AND f.fid = %d ORDER BY title', $edit['fid']);
   while ($category = db_fetch_object($categories)) {
     $options[$category->cid] = $category->title;
-    if ($category->fid) $values[] = $category->cid;
+    if ($category->fid) $values[] = check_plain($category->cid);
   }
   if ($options) {
     $form .= form_checkboxes(t('Categorize news items'), 'category', $values, $options, t('New items in this feed will be automatically filed in the the checked categories as they are received.'));
@@ -920,7 +920,7 @@ function _aggregator_page_list($sql, $op, $header = '') {
         $selected = array();
         while ($category = db_fetch_object($categories_result)) {
           if (!$done) {
-            $categories[$category->cid] = check_form($category->title);
+            $categories[$category->cid] = check_plain($category->title);
           }
           if ($category->iid) {
             $selected[] = $category->cid;
@@ -932,7 +932,7 @@ function _aggregator_page_list($sql, $op, $header = '') {
       else {
         $form = '';
         while ($category = db_fetch_object($categories_result)) {
-          $form .= form_checkbox(check_form($category->title), 'categories]['. $item->iid .'][', $category->cid, !is_null($category->iid));
+          $form .= form_checkbox(check_plain($category->title), 'categories]['. $item->iid .'][', $category->cid, !is_null($category->iid));
         }
       }
       $rows[] = array(theme('aggregator_page_item', $item), array('data' => $form, 'class' => 'categorize-item'));
@@ -960,7 +960,7 @@ function aggregator_page_sources() {
   $result = db_query('SELECT f.fid, f.title, f.description, f.image, MAX(i.timestamp) AS last FROM {aggregator_feed} f LEFT JOIN {aggregator_item} i ON f.fid = i.fid GROUP BY f.fid');
   $output = "<div id=\"aggregator\">\n";
   while ($feed = db_fetch_object($result)) {
-    $output .= "<h2>$feed->title</h2>\n";
+    $output .= '<h2>'. check_plain($feed->title) ."</h2>\n";
 
     // Most recent items:
     $list = array();
@@ -987,13 +987,13 @@ function aggregator_page_opml() {
   $output = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n";
   $output .= "<opml version=\"1.1\">\n";
   $output .= "<head>\n";
-  $output .= '<title>'. drupal_specialchars(variable_get('site_name', 'Drupal')) ."</title>\n";
+  $output .= '<title>'. check_plain(variable_get('site_name', 'Drupal')) ."</title>\n";
   $output .= '<dateModified>'. gmdate('r') ."</dateModified>\n";
   $output .= "</head>\n";
   $output .= "<body>\n";
 
   while ($feed = db_fetch_object($result)) {
-    $output .= '<outline text="'. drupal_specialchars($feed->title) .'" xmlUrl="'. drupal_specialchars($feed->url) ."\" />\n";
+    $output .= '<outline text="'. check_plain($feed->title) .'" xmlUrl="'. check_url($feed->url) ."\" />\n";
   }
 
   $output .= "</body>\n";
@@ -1011,7 +1011,7 @@ function aggregator_page_categories() {
   $output = "<div id=\"aggregator\">\n";
 
   while ($category = db_fetch_object($result)) {
-    $output .= "<h2>$category->title</h2>\n";
+    $output .= '<h2>'. check_plain($category->title) ."</h2>\n";
     if (variable_get('aggregator_summary_items', 3)) {
       $list = array();
       $items = db_query_range('SELECT i.title, i.timestamp, i.link, f.title as feed_title, f.link as feed_link FROM {aggregator_category_item} ci LEFT JOIN {aggregator_item} i ON i.iid = ci.iid LEFT JOIN {aggregator_feed} f ON i.fid = f.fid WHERE ci.cid = %d ORDER BY i.timestamp DESC', $category->cid, 0, variable_get('aggregator_summary_items', 3));
@@ -1042,7 +1042,7 @@ function theme_aggregator_feed($feed) {
   $output .= $feed->description;
   $output .= '<h3>'. t('URL') ."</h3>\n";
   $output .= theme('xml_icon', $feed->url);
-  $output .= "<a href=\"$feed->link\">$feed->link</a>\n";
+  $output .= '<a href="'. check_url($feed->link) .'">'. check_plain($feed->link) ."</a>\n";
   $output .= '<h3>'. t('Last update') ."</h3>\n";
   $updated = t('%time ago', array('%time' => format_interval(time() - $feed->checked)));
 
@@ -1066,12 +1066,12 @@ function theme_aggregator_block_item($item, $feed = 0) {
 
   if ($user->uid && module_exist('blog') && user_access('edit own blog')) {
     if ($image = theme('image', 'misc/blog.png', t('blog it'), t('blog it'))) {
-      $output .= '<div class="icon">'. l($image, 'node/add/blog', array('title' => t('Comment on this news item in your personal blog.'), 'class' => 'blog-it'), "iid=$item->iid") .'</div>';
+      $output .= '<div class="icon">'. l($image, 'node/add/blog', array('title' => t('Comment on this news item in your personal blog.'), 'class' => 'blog-it'), "iid=$item->iid", NULL, FALSE, TRUE) .'</div>';
     }
   }
 
   // Display the external link to the item.
-  $output .= "<a href=\"$item->link\">$item->title</a>\n";
+  $output .= '<a href="'. check_url($item->link) .'">'. check_plain($item->title) ."</a>\n";
 
   return $output;
 }
@@ -1086,7 +1086,7 @@ function theme_aggregator_block_item($item, $feed = 0) {
  * @ingroup themeable
  */
 function theme_aggregator_summary_item($item) {
-  $output = '<a href="'. check_url($item->link) .'">'. $item->title .'</a> <span class="age">'. t('%age old', array('%age' => format_interval(time() - $item->timestamp))) .'</span>';
+  $output = '<a href="'. check_url($item->link) .'">'. check_plain($item->title) .'</a> <span class="age">'. t('%age old', array('%age' => format_interval(time() - $item->timestamp))) .'</span>';
   if ($item->feed_link) {
     $output .= ', <span class="source"><a href="'. $item->feed_link .'">'. $item->feed_title .'</a></span>';
   }
@@ -1110,9 +1110,9 @@ function theme_aggregator_page_item($item) {
   $output .= "<div class=\"news-item\">\n";
   $output .= ' <div class="date">'. date('H:i', $item->timestamp) ."</div>\n";
   $output .= " <div class=\"body\">\n";
-  $output .= "  <div class=\"title\"><a href=\"$item->link\">$item->title</a></div>\n";
+  $output .= '  <div class="title"><a href="'. check_url($item->link) .'">'. check_plain($item->title) ."</a></div>\n";
   if ($item->description) {
-    $output .= "  <div class=\"description\">$item->description</div>\n";
+    $output .= '  <div class="description">'. check_plain($item->description) ."</div>\n";
   }
   if ($item->ftitle && $item->fid) {
     $output .= '  <div class="source">'. t('Source') .': '. l($item->ftitle, "aggregator/sources/$item->fid") ."</div>\n";
diff --git a/modules/archive.module b/modules/archive.module
index 446071c33..de6b87948 100644
--- a/modules/archive.module
+++ b/modules/archive.module
@@ -91,7 +91,7 @@ function archive_calendar($original = 0) {
   $output .= "\n<!-- calendar -->\n";
   $output .= '<div class="calendar">';
   $output .= '<table summary="'. t('A calendar to browse the archives') .".\">\n";
-  $output .= ' <caption>'. l('&laquo;', 'archive/'. date('Y/m/d', $prev), array('title' => t('Previous month'))) .' '. format_date($requested, 'custom', 'F') . date(' Y', $requested) .' '. ($nextmonth <= time() ? l('&raquo;', 'archive/'. date('Y/m/d', $next), array('title' => t('Next month'))) : '&nbsp;') ."</caption>\n";
+  $output .= ' <caption>'. l('«', 'archive/'. date('Y/m/d', $prev), array('title' => t('Previous month'))) .' '. format_date($requested, 'custom', 'F') . date(' Y', $requested) .' '. ($nextmonth <= time() ? l('»', 'archive/'. date('Y/m/d', $next), array('title' => t('Next month'))) : ' ') ."</caption>\n";
 
   // First day of week (0 => Sunday, 1 => Monday, ...)
   $weekstart = variable_get('date_first_day', 0);
diff --git a/modules/archive/archive.module b/modules/archive/archive.module
index 446071c33..de6b87948 100644
--- a/modules/archive/archive.module
+++ b/modules/archive/archive.module
@@ -91,7 +91,7 @@ function archive_calendar($original = 0) {
   $output .= "\n<!-- calendar -->\n";
   $output .= '<div class="calendar">';
   $output .= '<table summary="'. t('A calendar to browse the archives') .".\">\n";
-  $output .= ' <caption>'. l('&laquo;', 'archive/'. date('Y/m/d', $prev), array('title' => t('Previous month'))) .' '. format_date($requested, 'custom', 'F') . date(' Y', $requested) .' '. ($nextmonth <= time() ? l('&raquo;', 'archive/'. date('Y/m/d', $next), array('title' => t('Next month'))) : '&nbsp;') ."</caption>\n";
+  $output .= ' <caption>'. l('«', 'archive/'. date('Y/m/d', $prev), array('title' => t('Previous month'))) .' '. format_date($requested, 'custom', 'F') . date(' Y', $requested) .' '. ($nextmonth <= time() ? l('»', 'archive/'. date('Y/m/d', $next), array('title' => t('Next month'))) : ' ') ."</caption>\n";
 
   // First day of week (0 => Sunday, 1 => Monday, ...)
   $weekstart = variable_get('date_first_day', 0);
diff --git a/modules/block.module b/modules/block.module
index 78a848f5e..caeee3691 100644
--- a/modules/block.module
+++ b/modules/block.module
@@ -86,7 +86,7 @@ function block_block($op = 'list', $delta = 0, $edit = array()) {
     case 'list':
       $result = db_query('SELECT bid, title, info FROM {boxes} ORDER BY title');
       while ($block = db_fetch_object($result)) {
-        $blocks[$block->bid]['info'] = $block->info ? $block->info : $block->title;
+        $blocks[$block->bid]['info'] = $block->info ? check_plain($block->info) : check_plain($block->title);
       }
       return $blocks;
 
@@ -103,7 +103,7 @@ function block_block($op = 'list', $delta = 0, $edit = array()) {
 
     case 'view':
       $block = db_fetch_object(db_query('SELECT * FROM {boxes} WHERE bid = %d', $delta));
-      $data['subject'] = $block->title;
+      $data['subject'] = check_plain($block->title);
       $data['content'] = check_output($block->body, $block->format);
       return $data;
   }
@@ -335,13 +335,13 @@ function block_box_delete($bid = 0) {
 
   if ($_POST['edit']['confirm']) {
     db_query('DELETE FROM {boxes} WHERE bid = %d', $bid);
-    drupal_set_message(t('The block %name has been deleted.', array('%name' => '<em>'. $info .'</em>')));
+    drupal_set_message(t('The block %name has been deleted.', array('%name' => theme('placeholder', $info))));
     cache_clear_all();
     drupal_goto('admin/block');
   }
   else {
     $output = theme('confirm',
-                    t('Are you sure you want to delete the block %name?', array('%name' => '<em>'. $info .'</em>')),
+                    t('Are you sure you want to delete the block %name?', array('%name' => theme('placeholder', $info))),
                     'admin/block',
                     NULL,
                     t('Delete'));
diff --git a/modules/block/block.module b/modules/block/block.module
index 78a848f5e..caeee3691 100644
--- a/modules/block/block.module
+++ b/modules/block/block.module
@@ -86,7 +86,7 @@ function block_block($op = 'list', $delta = 0, $edit = array()) {
     case 'list':
       $result = db_query('SELECT bid, title, info FROM {boxes} ORDER BY title');
       while ($block = db_fetch_object($result)) {
-        $blocks[$block->bid]['info'] = $block->info ? $block->info : $block->title;
+        $blocks[$block->bid]['info'] = $block->info ? check_plain($block->info) : check_plain($block->title);
       }
       return $blocks;
 
@@ -103,7 +103,7 @@ function block_block($op = 'list', $delta = 0, $edit = array()) {
 
     case 'view':
       $block = db_fetch_object(db_query('SELECT * FROM {boxes} WHERE bid = %d', $delta));
-      $data['subject'] = $block->title;
+      $data['subject'] = check_plain($block->title);
       $data['content'] = check_output($block->body, $block->format);
       return $data;
   }
@@ -335,13 +335,13 @@ function block_box_delete($bid = 0) {
 
   if ($_POST['edit']['confirm']) {
     db_query('DELETE FROM {boxes} WHERE bid = %d', $bid);
-    drupal_set_message(t('The block %name has been deleted.', array('%name' => '<em>'. $info .'</em>')));
+    drupal_set_message(t('The block %name has been deleted.', array('%name' => theme('placeholder', $info))));
     cache_clear_all();
     drupal_goto('admin/block');
   }
   else {
     $output = theme('confirm',
-                    t('Are you sure you want to delete the block %name?', array('%name' => '<em>'. $info .'</em>')),
+                    t('Are you sure you want to delete the block %name?', array('%name' => theme('placeholder', $info))),
                     'admin/block',
                     NULL,
                     t('Delete'));
diff --git a/modules/blogapi.module b/modules/blogapi.module
index a3a5c75de..58807c87b 100644
--- a/modules/blogapi.module
+++ b/modules/blogapi.module
@@ -153,7 +153,7 @@ function blogapi_new_post($req_params) {
 
   $nid = node_save($node);
   if ($nid) {
-    watchdog('content', t('%type: added %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
+    watchdog('content', t('%type: added %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
     return new xmlrpcresp(new xmlrpcval($nid, 'string'));
   }
 
@@ -215,7 +215,7 @@ function blogapi_edit_post($req_params) {
   }
   $nid = node_save($node);
   if ($nid) {
-    watchdog('content', t('%type: updated %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
+    watchdog('content', t('%type: updated %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
     return new xmlrpcresp(new xmlrpcval(true, 'boolean'));
   }
 
diff --git a/modules/blogapi/blogapi.module b/modules/blogapi/blogapi.module
index a3a5c75de..58807c87b 100644
--- a/modules/blogapi/blogapi.module
+++ b/modules/blogapi/blogapi.module
@@ -153,7 +153,7 @@ function blogapi_new_post($req_params) {
 
   $nid = node_save($node);
   if ($nid) {
-    watchdog('content', t('%type: added %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
+    watchdog('content', t('%type: added %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
     return new xmlrpcresp(new xmlrpcval($nid, 'string'));
   }
 
@@ -215,7 +215,7 @@ function blogapi_edit_post($req_params) {
   }
   $nid = node_save($node);
   if ($nid) {
-    watchdog('content', t('%type: updated %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
+    watchdog('content', t('%type: updated %title using blog API.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$nid"));
     return new xmlrpcresp(new xmlrpcval(true, 'boolean'));
   }
 
diff --git a/modules/book.module b/modules/book.module
index 76bb98b60..576f8fd1a 100644
--- a/modules/book.module
+++ b/modules/book.module
@@ -148,7 +148,7 @@ function book_block($op = 'list', $delta = 0) {
           $expand[] = $node->nid;
         }
 
-        $block['subject'] = $path[0]->title;
+        $block['subject'] = check_plain($path[0]->title);
         $block['content'] = book_tree($expand[0], 5, $expand);
       }
     }
@@ -287,7 +287,7 @@ function book_outline() {
           $output .= form_submit(t('Add to book outline'));
         }
 
-        drupal_set_title($node->title);
+        drupal_set_title(check_plain($node->title));
         print theme('page', form($output));
     }
   }
@@ -477,7 +477,7 @@ function theme_book_navigation($node) {
       $links .= '<div class="prev">';
       $links .= l(t('previous'), 'node/'. $prev->nid, array('title' => t('View the previous page.')));
       $links .= '</div>';
-      $titles .= '<div class="prev">'. $prev->title .'</div>';
+      $titles .= '<div class="prev">'. check_plain($prev->title) .'</div>';
     }
     else {
       $links .= '<div class="prev">&nbsp;</div>'; // Make an empty div to fill the space.
@@ -486,7 +486,7 @@ function theme_book_navigation($node) {
       $links .= '<div class="next">';
       $links .= l(t('next'), 'node/'. $next->nid, array('title' => t('View the next page.')));
       $links .= '</div>';
-      $titles .= '<div class="next">'. $next->title .'</div>';
+      $titles .= '<div class="next">'. check_plain($next->title) .'</div>';
     }
     else {
       $links .= '<div class="next">&nbsp;</div>'; // Make an empty div to fill the space.
@@ -633,7 +633,7 @@ function book_print($nid = 0, $depth = 1) {
       // Allow modules to change $node->body before viewing.
       node_invoke_nodeapi($node, 'view', $node->body, false);
 
-      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. $node->title .'</h1>';
+      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. check_plain($node->title) .'</h1>';
 
       if ($node->body) {
         $output .= $node->body;
@@ -643,7 +643,7 @@ function book_print($nid = 0, $depth = 1) {
 
   $output .= book_print_recurse($nid, $depth);
 
-  $html = '<html><head><title>'. $node->title .'</title>';
+  $html = '<html><head><title>'. check_plain($node->title) .'</title>';
   $html .= '<base href="'. $base_url .'/" />';
   $html .= "<style type=\"text/css\">\n@import url(misc/print.css);\n</style>";
   $html .= '</head><body>'. $output .'</body></html>';
@@ -671,7 +671,7 @@ function book_print_recurse($parent = '', $depth = 1) {
       // Allow modules to change $node->body before viewing.
       node_invoke_nodeapi($node, 'view', $node->body, false);
 
-      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. $node->title .'</h1>';
+      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. check_plain($node->title) .'</h1>';
 
       if ($node->body) {
         $output .= '<ul>'. $node->body .'</ul>';
@@ -707,7 +707,7 @@ function book_admin_view($nid, $depth = 0) {
   if ($nid) {
     $node = node_load(array('nid' => $nid));
 
-    $output .= '<h3>'. $node->title .'</h3>';
+    $output .= '<h3>'. check_plain($node->title) .'</h3>';
 
     $header = array(t('Title'), t('Weight'), array('data' => t('Operations'), 'colspan' => '3'));
     $rows[] = book_admin_view_line($node);
@@ -738,7 +738,7 @@ function book_admin_save($nid, $edit = array()) {
       }
     }
 
-    $message = t('Updated book %title.', array('%title' => "<em>$book->title</em>"));
+    $message = t('Updated book %title.', array('%title' => theme('placeholder', $book->title)));
     watchdog('content', $message);
 
     return $message;
diff --git a/modules/book/book.module b/modules/book/book.module
index 76bb98b60..576f8fd1a 100644
--- a/modules/book/book.module
+++ b/modules/book/book.module
@@ -148,7 +148,7 @@ function book_block($op = 'list', $delta = 0) {
           $expand[] = $node->nid;
         }
 
-        $block['subject'] = $path[0]->title;
+        $block['subject'] = check_plain($path[0]->title);
         $block['content'] = book_tree($expand[0], 5, $expand);
       }
     }
@@ -287,7 +287,7 @@ function book_outline() {
           $output .= form_submit(t('Add to book outline'));
         }
 
-        drupal_set_title($node->title);
+        drupal_set_title(check_plain($node->title));
         print theme('page', form($output));
     }
   }
@@ -477,7 +477,7 @@ function theme_book_navigation($node) {
       $links .= '<div class="prev">';
       $links .= l(t('previous'), 'node/'. $prev->nid, array('title' => t('View the previous page.')));
       $links .= '</div>';
-      $titles .= '<div class="prev">'. $prev->title .'</div>';
+      $titles .= '<div class="prev">'. check_plain($prev->title) .'</div>';
     }
     else {
       $links .= '<div class="prev">&nbsp;</div>'; // Make an empty div to fill the space.
@@ -486,7 +486,7 @@ function theme_book_navigation($node) {
       $links .= '<div class="next">';
       $links .= l(t('next'), 'node/'. $next->nid, array('title' => t('View the next page.')));
       $links .= '</div>';
-      $titles .= '<div class="next">'. $next->title .'</div>';
+      $titles .= '<div class="next">'. check_plain($next->title) .'</div>';
     }
     else {
       $links .= '<div class="next">&nbsp;</div>'; // Make an empty div to fill the space.
@@ -633,7 +633,7 @@ function book_print($nid = 0, $depth = 1) {
       // Allow modules to change $node->body before viewing.
       node_invoke_nodeapi($node, 'view', $node->body, false);
 
-      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. $node->title .'</h1>';
+      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. check_plain($node->title) .'</h1>';
 
       if ($node->body) {
         $output .= $node->body;
@@ -643,7 +643,7 @@ function book_print($nid = 0, $depth = 1) {
 
   $output .= book_print_recurse($nid, $depth);
 
-  $html = '<html><head><title>'. $node->title .'</title>';
+  $html = '<html><head><title>'. check_plain($node->title) .'</title>';
   $html .= '<base href="'. $base_url .'/" />';
   $html .= "<style type=\"text/css\">\n@import url(misc/print.css);\n</style>";
   $html .= '</head><body>'. $output .'</body></html>';
@@ -671,7 +671,7 @@ function book_print_recurse($parent = '', $depth = 1) {
       // Allow modules to change $node->body before viewing.
       node_invoke_nodeapi($node, 'view', $node->body, false);
 
-      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. $node->title .'</h1>';
+      $output .= '<h1 id="'. $node->nid .'" name="'. $node->nid .'" class="book-h'. $depth .'">'. check_plain($node->title) .'</h1>';
 
       if ($node->body) {
         $output .= '<ul>'. $node->body .'</ul>';
@@ -707,7 +707,7 @@ function book_admin_view($nid, $depth = 0) {
   if ($nid) {
     $node = node_load(array('nid' => $nid));
 
-    $output .= '<h3>'. $node->title .'</h3>';
+    $output .= '<h3>'. check_plain($node->title) .'</h3>';
 
     $header = array(t('Title'), t('Weight'), array('data' => t('Operations'), 'colspan' => '3'));
     $rows[] = book_admin_view_line($node);
@@ -738,7 +738,7 @@ function book_admin_save($nid, $edit = array()) {
       }
     }
 
-    $message = t('Updated book %title.', array('%title' => "<em>$book->title</em>"));
+    $message = t('Updated book %title.', array('%title' => theme('placeholder', $book->title)));
     watchdog('content', $message);
 
     return $message;
diff --git a/modules/comment.module b/modules/comment.module
index a22da2242..876e89bff 100644
--- a/modules/comment.module
+++ b/modules/comment.module
@@ -274,7 +274,7 @@ function comment_nodeapi(&$node, $op, $arg = 0) {
       $text = '';
       $comments = db_query('SELECT subject, comment, format FROM {comments} WHERE nid = %d AND status = 0', $node->nid);
       while ($comment = db_fetch_object($comments)) {
-        $text .= '<h2>'. $comment->subject .'</h2>'. check_output($comment->comment, $comment->format);
+        $text .= '<h2>'. check_plain($comment->subject) .'</h2>'. check_output($comment->comment, $comment->format);
       }
       return $text;
 
@@ -431,9 +431,12 @@ function comment_validate_form($edit) {
 
   // Validate the comment's subject.  If not specified, extract
   // one from the comment's body.
-  $edit['subject'] = strip_tags($edit['subject']);
-  if ($edit['subject'] == '') {
-    $edit['subject'] = truncate_utf8(strip_tags($edit['comment']), 29, TRUE);
+  if (trim($edit['subject']) == '') {
+    // The body may be in any format, so we:
+    // 1) Filter it into HTML
+    // 2) Strip out all HTML tags
+    // 3) Convert entities back to plain-text.
+    $edit['subject'] = truncate_utf8(decode_entities(strip_tags(check_output($edit['comment'], $edit['format']))), 29, TRUE);
   }
 
   // Validate the comment's body.
@@ -450,7 +453,7 @@ function comment_validate_form($edit) {
   if (!$user->uid) {
     if (variable_get('comment_anonymous', 0) > 0) {
       if ($edit['name']) {
-        $taken = db_result(db_query("SELECT COUNT(uid) FROM {users} WHERE LOWER(name) = '%s'", strip_tags($edit['name'])), 0);
+        $taken = db_result(db_query("SELECT COUNT(uid) FROM {users} WHERE LOWER(name) = '%s'", $edit['name']), 0);
 
         if ($taken != 0) {
           form_set_error('name', t('The name you used belongs to a registered user.'));
@@ -494,7 +497,7 @@ function comment_preview($edit) {
   // Attach the user and time information.
   $comment->uid = $user->uid;
   $comment->timestamp = time();
-  $comment->name = $user->name ? $user->name : $comment->name;
+  $comment->name = check_plain($user->name ? $user->name : $comment->name);
 
   // Preview the comment.
   $output .= theme('comment_view', $comment, theme('links', module_invoke_all('link', 'comment', $comment, 1)));
@@ -523,7 +526,7 @@ function comment_post($edit) {
       // validated/filtered data to perform such check.
       $duplicate = db_result(db_query("SELECT COUNT(cid) FROM {comments} WHERE pid = %d AND nid = %d AND subject = '%s' AND comment = '%s'", $edit['pid'], $edit['nid'], $edit['subject'], $edit['comment']), 0);
       if ($duplicate != 0) {
-        watchdog('content', t('Comment: duplicate %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_WARNING);
+        watchdog('content', t('Comment: duplicate %subject.', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_WARNING);
       }
 
       if ($edit['cid']) {
@@ -538,7 +541,7 @@ function comment_post($edit) {
         module_invoke_all('comment', 'update', $edit);
 
         // Add an entry to the watchdog log.
-        watchdog('content', t('Comment: updated %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
+        watchdog('content', t('Comment: updated %subject.', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
       }
       else {
         // Add the comment to database.
@@ -641,7 +644,7 @@ function comment_post($edit) {
         module_invoke_all('comment', 'insert', $edit);
 
         // Add an entry to the watchdog log.
-        watchdog('content', t('Comment: added %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
+        watchdog('content', t('Comment: added %subject.', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
       }
 
       // Clear the cache so an anonymous user can see his comment being added.
@@ -662,7 +665,7 @@ function comment_post($edit) {
     }
   }
   else {
-    watchdog('content', t('Comment: unauthorized comment submitted or comment submitted to a closed node %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_WARNING);
+    watchdog('content', t('Comment: unauthorized comment submitted or comment submitted to a closed node (%subject).', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_WARNING);
   }
 }
 
@@ -974,7 +977,7 @@ function comment_delete($cid) {
   }
   else if ($comment->cid) {
     $output = theme('confirm',
-                    t('Are you sure you want to delete the comment %title?', array('%title' => '<em>'. $comment->subject .'</em>')),
+                    t('Are you sure you want to delete the comment %title?', array('%title' => theme('placeholder', $comment->subject))),
                     'node/'. $comment->nid,
                     t('Any replies to this comment will be lost. This action cannot be undone.'),
                     t('Delete'));
@@ -992,7 +995,7 @@ function comment_delete($cid) {
 
 function comment_save($id, $edit) {
   db_query("UPDATE {comments} SET subject = '%s', comment = '%s', status = %d, format = '%s', name = '%s', mail = '%s', homepage = '%s' WHERE cid = %d", $edit['subject'], $edit['comment'], $edit['status'], $edit['format'], $edit['name'], $edit['mail'], $edit['homepage'], $id);
-  watchdog('content', t('Comment: modified %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')));
+  watchdog('content', t('Comment: modified %subject.', array('%subject' => theme('placeholder', $edit['subject']))));
   drupal_set_message(t('The comment has been saved.'));
 
   _comment_update_node_statistics($edit['nid']);
@@ -1023,7 +1026,7 @@ function comment_admin_overview($type = 'new') {
   while ($comment = db_fetch_object($result)) {
     $comment->name = $comment->uid ? $comment->registered_name : $comment->name;
     $rows[] = array(
-        l($comment->subject, "node/$comment->nid", array('title' => htmlspecialchars(truncate_utf8($comment->comment, 128))), NULL, "comment-$comment->cid") ." ". theme('mark', node_mark($comment->nid, $comment->timestamp)),
+        l($comment->subject, "node/$comment->nid", array('title' => truncate_utf8($comment->comment, 128)), NULL, "comment-$comment->cid") ." ". theme('mark', node_mark($comment->nid, $comment->timestamp)),
         format_name($comment),
         ($comment->status == 0 ? t('Published') : t('Not published')),
         format_date($comment->timestamp, 'small'),
@@ -1624,7 +1627,7 @@ function theme_comment_post_forbidden() {
 function _comment_delete_thread($comment) {
   // Delete the comment:
   db_query('DELETE FROM {comments} WHERE cid = %d', $comment->cid);
-  watchdog('content', t('Comment: deleted %subject.', array('%subject' => "<em>$comment->subject</em>")));
+  watchdog('content', t('Comment: deleted %subject.', array('%subject' => theme('placeholder', $comment->subject))));
 
   module_invoke_all('comment', 'delete', $comment);
 
diff --git a/modules/comment/comment.module b/modules/comment/comment.module
index a22da2242..876e89bff 100644
--- a/modules/comment/comment.module
+++ b/modules/comment/comment.module
@@ -274,7 +274,7 @@ function comment_nodeapi(&$node, $op, $arg = 0) {
       $text = '';
       $comments = db_query('SELECT subject, comment, format FROM {comments} WHERE nid = %d AND status = 0', $node->nid);
       while ($comment = db_fetch_object($comments)) {
-        $text .= '<h2>'. $comment->subject .'</h2>'. check_output($comment->comment, $comment->format);
+        $text .= '<h2>'. check_plain($comment->subject) .'</h2>'. check_output($comment->comment, $comment->format);
       }
       return $text;
 
@@ -431,9 +431,12 @@ function comment_validate_form($edit) {
 
   // Validate the comment's subject.  If not specified, extract
   // one from the comment's body.
-  $edit['subject'] = strip_tags($edit['subject']);
-  if ($edit['subject'] == '') {
-    $edit['subject'] = truncate_utf8(strip_tags($edit['comment']), 29, TRUE);
+  if (trim($edit['subject']) == '') {
+    // The body may be in any format, so we:
+    // 1) Filter it into HTML
+    // 2) Strip out all HTML tags
+    // 3) Convert entities back to plain-text.
+    $edit['subject'] = truncate_utf8(decode_entities(strip_tags(check_output($edit['comment'], $edit['format']))), 29, TRUE);
   }
 
   // Validate the comment's body.
@@ -450,7 +453,7 @@ function comment_validate_form($edit) {
   if (!$user->uid) {
     if (variable_get('comment_anonymous', 0) > 0) {
       if ($edit['name']) {
-        $taken = db_result(db_query("SELECT COUNT(uid) FROM {users} WHERE LOWER(name) = '%s'", strip_tags($edit['name'])), 0);
+        $taken = db_result(db_query("SELECT COUNT(uid) FROM {users} WHERE LOWER(name) = '%s'", $edit['name']), 0);
 
         if ($taken != 0) {
           form_set_error('name', t('The name you used belongs to a registered user.'));
@@ -494,7 +497,7 @@ function comment_preview($edit) {
   // Attach the user and time information.
   $comment->uid = $user->uid;
   $comment->timestamp = time();
-  $comment->name = $user->name ? $user->name : $comment->name;
+  $comment->name = check_plain($user->name ? $user->name : $comment->name);
 
   // Preview the comment.
   $output .= theme('comment_view', $comment, theme('links', module_invoke_all('link', 'comment', $comment, 1)));
@@ -523,7 +526,7 @@ function comment_post($edit) {
       // validated/filtered data to perform such check.
       $duplicate = db_result(db_query("SELECT COUNT(cid) FROM {comments} WHERE pid = %d AND nid = %d AND subject = '%s' AND comment = '%s'", $edit['pid'], $edit['nid'], $edit['subject'], $edit['comment']), 0);
       if ($duplicate != 0) {
-        watchdog('content', t('Comment: duplicate %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_WARNING);
+        watchdog('content', t('Comment: duplicate %subject.', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_WARNING);
       }
 
       if ($edit['cid']) {
@@ -538,7 +541,7 @@ function comment_post($edit) {
         module_invoke_all('comment', 'update', $edit);
 
         // Add an entry to the watchdog log.
-        watchdog('content', t('Comment: updated %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
+        watchdog('content', t('Comment: updated %subject.', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
       }
       else {
         // Add the comment to database.
@@ -641,7 +644,7 @@ function comment_post($edit) {
         module_invoke_all('comment', 'insert', $edit);
 
         // Add an entry to the watchdog log.
-        watchdog('content', t('Comment: added %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
+        watchdog('content', t('Comment: added %subject.', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $edit['nid'], NULL, NULL, 'comment-'. $edit['cid']));
       }
 
       // Clear the cache so an anonymous user can see his comment being added.
@@ -662,7 +665,7 @@ function comment_post($edit) {
     }
   }
   else {
-    watchdog('content', t('Comment: unauthorized comment submitted or comment submitted to a closed node %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')), WATCHDOG_WARNING);
+    watchdog('content', t('Comment: unauthorized comment submitted or comment submitted to a closed node (%subject).', array('%subject' => theme('placeholder', $edit['subject']))), WATCHDOG_WARNING);
   }
 }
 
@@ -974,7 +977,7 @@ function comment_delete($cid) {
   }
   else if ($comment->cid) {
     $output = theme('confirm',
-                    t('Are you sure you want to delete the comment %title?', array('%title' => '<em>'. $comment->subject .'</em>')),
+                    t('Are you sure you want to delete the comment %title?', array('%title' => theme('placeholder', $comment->subject))),
                     'node/'. $comment->nid,
                     t('Any replies to this comment will be lost. This action cannot be undone.'),
                     t('Delete'));
@@ -992,7 +995,7 @@ function comment_delete($cid) {
 
 function comment_save($id, $edit) {
   db_query("UPDATE {comments} SET subject = '%s', comment = '%s', status = %d, format = '%s', name = '%s', mail = '%s', homepage = '%s' WHERE cid = %d", $edit['subject'], $edit['comment'], $edit['status'], $edit['format'], $edit['name'], $edit['mail'], $edit['homepage'], $id);
-  watchdog('content', t('Comment: modified %subject.', array('%subject' => '<em>'. $edit['subject'] .'</em>')));
+  watchdog('content', t('Comment: modified %subject.', array('%subject' => theme('placeholder', $edit['subject']))));
   drupal_set_message(t('The comment has been saved.'));
 
   _comment_update_node_statistics($edit['nid']);
@@ -1023,7 +1026,7 @@ function comment_admin_overview($type = 'new') {
   while ($comment = db_fetch_object($result)) {
     $comment->name = $comment->uid ? $comment->registered_name : $comment->name;
     $rows[] = array(
-        l($comment->subject, "node/$comment->nid", array('title' => htmlspecialchars(truncate_utf8($comment->comment, 128))), NULL, "comment-$comment->cid") ." ". theme('mark', node_mark($comment->nid, $comment->timestamp)),
+        l($comment->subject, "node/$comment->nid", array('title' => truncate_utf8($comment->comment, 128)), NULL, "comment-$comment->cid") ." ". theme('mark', node_mark($comment->nid, $comment->timestamp)),
         format_name($comment),
         ($comment->status == 0 ? t('Published') : t('Not published')),
         format_date($comment->timestamp, 'small'),
@@ -1624,7 +1627,7 @@ function theme_comment_post_forbidden() {
 function _comment_delete_thread($comment) {
   // Delete the comment:
   db_query('DELETE FROM {comments} WHERE cid = %d', $comment->cid);
-  watchdog('content', t('Comment: deleted %subject.', array('%subject' => "<em>$comment->subject</em>")));
+  watchdog('content', t('Comment: deleted %subject.', array('%subject' => theme('placeholder', $comment->subject))));
 
   module_invoke_all('comment', 'delete', $comment);
 
diff --git a/modules/contact.module b/modules/contact.module
index 627f6ca3a..b86989963 100644
--- a/modules/contact.module
+++ b/modules/contact.module
@@ -88,7 +88,7 @@ function contact_mail_user() {
 
           // Tidy up the body:
           foreach ($message as $key => $value) {
-            $message[$key] = wordwrap(strip_tags($value));
+            $message[$key] = wordwrap(check_plain($value));
           }
 
           // Prepare all fields:
diff --git a/modules/contact/contact.module b/modules/contact/contact.module
index 627f6ca3a..b86989963 100644
--- a/modules/contact/contact.module
+++ b/modules/contact/contact.module
@@ -88,7 +88,7 @@ function contact_mail_user() {
 
           // Tidy up the body:
           foreach ($message as $key => $value) {
-            $message[$key] = wordwrap(strip_tags($value));
+            $message[$key] = wordwrap(check_plain($value));
           }
 
           // Prepare all fields:
diff --git a/modules/drupal.module b/modules/drupal.module
index 9158221bf..08add863c 100644
--- a/modules/drupal.module
+++ b/modules/drupal.module
@@ -95,7 +95,7 @@ function drupal_directory_ping($arguments) {
     db_query("DELETE FROM {directory} WHERE link = '%s' OR mail = '%s'", $link, $mail);
     db_query("INSERT INTO {directory} (link, name, mail, slogan, mission, timestamp) VALUES ('%s', '%s', '%s', '%s', '%s', %d)", $link, $name, $mail, $slogan, $mission, time());
 
-    watchdog('directory ping', t('Ping from %name (%link).', array('%name' => "<em>$name</em>", '%link' => "<em>$link</em>")), WATCHDOG_NOTICE, "<a href=\"$link\">view</a>");
+    watchdog('directory ping', t('Ping from %name (%link).', array('%name' => theme('placeholder', $name), '%link' => theme('placeholder', $link))), WATCHDOG_NOTICE, '<a href="'. check_url($link) .'">view</a>');
 
     return new xmlrpcresp(new xmlrpcval(1, 'int'));
   }
@@ -143,7 +143,7 @@ function drupal_notify($server) {
   $result = $client->send($message, 5);
 
   if (!$result || $result->faultCode()) {
-    watchdog('directory ping', t('Failed to notify %url at %path: %error.', array('%url' => '<em>'. $url["host"] .'</em>', '%path' => '<em>'. $url["path"] .'</em>', '%error' => '<em>'. $result->faultString() .'</em>')), WATCHDOG_WARNING);
+    watchdog('directory ping', t('Failed to notify %url at %path: %error.', array('%url' => theme('placeholder', $url['host']), '%path' => theme('placeholder', $url['path']), '%error' => theme('placeholder', $result->faultString()))), WATCHDOG_WARNING);
   }
 
 }
diff --git a/modules/drupal/drupal.module b/modules/drupal/drupal.module
index 9158221bf..08add863c 100644
--- a/modules/drupal/drupal.module
+++ b/modules/drupal/drupal.module
@@ -95,7 +95,7 @@ function drupal_directory_ping($arguments) {
     db_query("DELETE FROM {directory} WHERE link = '%s' OR mail = '%s'", $link, $mail);
     db_query("INSERT INTO {directory} (link, name, mail, slogan, mission, timestamp) VALUES ('%s', '%s', '%s', '%s', '%s', %d)", $link, $name, $mail, $slogan, $mission, time());
 
-    watchdog('directory ping', t('Ping from %name (%link).', array('%name' => "<em>$name</em>", '%link' => "<em>$link</em>")), WATCHDOG_NOTICE, "<a href=\"$link\">view</a>");
+    watchdog('directory ping', t('Ping from %name (%link).', array('%name' => theme('placeholder', $name), '%link' => theme('placeholder', $link))), WATCHDOG_NOTICE, '<a href="'. check_url($link) .'">view</a>');
 
     return new xmlrpcresp(new xmlrpcval(1, 'int'));
   }
@@ -143,7 +143,7 @@ function drupal_notify($server) {
   $result = $client->send($message, 5);
 
   if (!$result || $result->faultCode()) {
-    watchdog('directory ping', t('Failed to notify %url at %path: %error.', array('%url' => '<em>'. $url["host"] .'</em>', '%path' => '<em>'. $url["path"] .'</em>', '%error' => '<em>'. $result->faultString() .'</em>')), WATCHDOG_WARNING);
+    watchdog('directory ping', t('Failed to notify %url at %path: %error.', array('%url' => theme('placeholder', $url['host']), '%path' => theme('placeholder', $url['path']), '%error' => theme('placeholder', $result->faultString()))), WATCHDOG_WARNING);
   }
 
 }
diff --git a/modules/filter.module b/modules/filter.module
index 74e95e079..2fa406d75 100644
--- a/modules/filter.module
+++ b/modules/filter.module
@@ -60,9 +60,9 @@ function filter_filter_tips($delta, $format, $long = false) {
           if ($allowed_html = variable_get("allowed_html_$format", '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>')) {
             switch ($long) {
               case 0:
-                return t('Allowed HTML tags') .': '. drupal_specialchars($allowed_html);
+                return t('Allowed HTML tags') .': '. check_plain($allowed_html);
               case 1:
-                $output = '<p>'. t('Allowed HTML tags') .': '. drupal_specialchars($allowed_html) .'</p>';
+                $output = '<p>'. t('Allowed HTML tags') .': '. check_plain($allowed_html) .'</p>';
                 if (!variable_get("filter_html_help_$format", 1)) {
                   return $output;
                 }
@@ -111,14 +111,14 @@ function filter_filter_tips($delta, $format, $long = false) {
                     if ($tips[$tag]) {
                       $rows[] = array(
                         array('data' => $tips[$tag][0], 'class' => 'description'),
-                        array('data' => '<code>'. drupal_specialchars($tips[$tag][1]) .'</code>', 'class' => 'type'),
+                        array('data' => '<code>'. check_plain($tips[$tag][1]) .'</code>', 'class' => 'type'),
                         array('data' => $tips[$tag][1], 'class' => 'get')
                       );
                     }
                   }
                   else {
                     $rows[] = array(
-                      array('data' => t('No help provided for tag %tag.', array('%tag' => drupal_specialchars($tag))), 'class' => 'description', 'colspan' => 3),
+                      array('data' => t('No help provided for tag %tag.', array('%tag' => check_plain($tag))), 'class' => 'description', 'colspan' => 3),
                     );
                   }
                 }
@@ -137,7 +137,7 @@ function filter_filter_tips($delta, $format, $long = false) {
                 foreach ($entities as $entity) {
                   $rows[] = array(
                     array('data' => $entity[0], 'class' => 'description'),
-                    array('data' => '<code>'. drupal_specialchars($entity[1]) .'</code>', 'class' => 'type'),
+                    array('data' => '<code>'. check_plain($entity[1]) .'</code>', 'class' => 'type'),
                     array('data' => $entity[1], 'class' => 'get')
                   );
                 }
@@ -365,7 +365,7 @@ function filter_admin_add() {
     db_query("INSERT INTO {filter_formats} (name) VALUES ('%s')", $name);
   }
 
-  drupal_set_message(t('Added input format %format.', array('%format' => '<em>'. $edit['name'] .'</em>')));
+  drupal_set_message(t('Added input format %format.', array('%format' => theme('placeholder', $edit['name']))));
   drupal_goto('admin/filters');
 }
 
@@ -386,7 +386,7 @@ function filter_admin_delete() {
 
       cache_clear_all('filter:'. $edit['format'], true);
 
-      drupal_set_message(t('Deleted input format %format.', array('%format' => '<em>'. $edit['name'] .'</em>')));
+      drupal_set_message(t('Deleted input format %format.', array('%format' => theme('placeholder', $edit['name']))));
     }
     drupal_goto('admin/filters');
   }
@@ -397,7 +397,7 @@ function filter_admin_delete() {
   $extra  = form_hidden('format', $format->format);
   $extra .= form_hidden('name', $format->name);
   $output = theme('confirm',
-                  t('Are you sure you want to delete the input format %format?', array('%format' => '<em>'. $format->name .'</em>')),
+                  t('Are you sure you want to delete the input format %format?', array('%format' => theme('placeholder', $format->name))),
                   'admin/filters',
                   t('If you have any content left in this input format, it will be switched to the default input format. This action cannot be undone.'),
                   t('Delete'),
@@ -927,7 +927,7 @@ function _filter_html($text, $format) {
 
   if (variable_get("filter_html_$format", FILTER_HTML_STRIP) == FILTER_HTML_ESCAPE) {
     // Escape HTML
-    $text = drupal_specialchars($text);
+    $text = check_plain($text);
   }
 
   if (variable_get("filter_html_nofollow_$format", FALSE)) {
diff --git a/modules/filter/filter.module b/modules/filter/filter.module
index 74e95e079..2fa406d75 100644
--- a/modules/filter/filter.module
+++ b/modules/filter/filter.module
@@ -60,9 +60,9 @@ function filter_filter_tips($delta, $format, $long = false) {
           if ($allowed_html = variable_get("allowed_html_$format", '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>')) {
             switch ($long) {
               case 0:
-                return t('Allowed HTML tags') .': '. drupal_specialchars($allowed_html);
+                return t('Allowed HTML tags') .': '. check_plain($allowed_html);
               case 1:
-                $output = '<p>'. t('Allowed HTML tags') .': '. drupal_specialchars($allowed_html) .'</p>';
+                $output = '<p>'. t('Allowed HTML tags') .': '. check_plain($allowed_html) .'</p>';
                 if (!variable_get("filter_html_help_$format", 1)) {
                   return $output;
                 }
@@ -111,14 +111,14 @@ function filter_filter_tips($delta, $format, $long = false) {
                     if ($tips[$tag]) {
                       $rows[] = array(
                         array('data' => $tips[$tag][0], 'class' => 'description'),
-                        array('data' => '<code>'. drupal_specialchars($tips[$tag][1]) .'</code>', 'class' => 'type'),
+                        array('data' => '<code>'. check_plain($tips[$tag][1]) .'</code>', 'class' => 'type'),
                         array('data' => $tips[$tag][1], 'class' => 'get')
                       );
                     }
                   }
                   else {
                     $rows[] = array(
-                      array('data' => t('No help provided for tag %tag.', array('%tag' => drupal_specialchars($tag))), 'class' => 'description', 'colspan' => 3),
+                      array('data' => t('No help provided for tag %tag.', array('%tag' => check_plain($tag))), 'class' => 'description', 'colspan' => 3),
                     );
                   }
                 }
@@ -137,7 +137,7 @@ function filter_filter_tips($delta, $format, $long = false) {
                 foreach ($entities as $entity) {
                   $rows[] = array(
                     array('data' => $entity[0], 'class' => 'description'),
-                    array('data' => '<code>'. drupal_specialchars($entity[1]) .'</code>', 'class' => 'type'),
+                    array('data' => '<code>'. check_plain($entity[1]) .'</code>', 'class' => 'type'),
                     array('data' => $entity[1], 'class' => 'get')
                   );
                 }
@@ -365,7 +365,7 @@ function filter_admin_add() {
     db_query("INSERT INTO {filter_formats} (name) VALUES ('%s')", $name);
   }
 
-  drupal_set_message(t('Added input format %format.', array('%format' => '<em>'. $edit['name'] .'</em>')));
+  drupal_set_message(t('Added input format %format.', array('%format' => theme('placeholder', $edit['name']))));
   drupal_goto('admin/filters');
 }
 
@@ -386,7 +386,7 @@ function filter_admin_delete() {
 
       cache_clear_all('filter:'. $edit['format'], true);
 
-      drupal_set_message(t('Deleted input format %format.', array('%format' => '<em>'. $edit['name'] .'</em>')));
+      drupal_set_message(t('Deleted input format %format.', array('%format' => theme('placeholder', $edit['name']))));
     }
     drupal_goto('admin/filters');
   }
@@ -397,7 +397,7 @@ function filter_admin_delete() {
   $extra  = form_hidden('format', $format->format);
   $extra .= form_hidden('name', $format->name);
   $output = theme('confirm',
-                  t('Are you sure you want to delete the input format %format?', array('%format' => '<em>'. $format->name .'</em>')),
+                  t('Are you sure you want to delete the input format %format?', array('%format' => theme('placeholder', $format->name))),
                   'admin/filters',
                   t('If you have any content left in this input format, it will be switched to the default input format. This action cannot be undone.'),
                   t('Delete'),
@@ -927,7 +927,7 @@ function _filter_html($text, $format) {
 
   if (variable_get("filter_html_$format", FILTER_HTML_STRIP) == FILTER_HTML_ESCAPE) {
     // Escape HTML
-    $text = drupal_specialchars($text);
+    $text = check_plain($text);
   }
 
   if (variable_get("filter_html_nofollow_$format", FALSE)) {
diff --git a/modules/forum.module b/modules/forum.module
index e086cf991..dae76244f 100644
--- a/modules/forum.module
+++ b/modules/forum.module
@@ -228,10 +228,10 @@ function forum_overview() {
   if ($tree) {
     foreach ($tree as $term) {
       if (in_array($term->tid, variable_get('forum_containers', array()))) {
-        $rows[] = array(_forum_depth($term->depth) .' '. $term->name, l(t('edit container'), "admin/forum/edit/container/$term->tid"));
+        $rows[] = array(_forum_depth($term->depth) .' '. check_plain($term->name), l(t('edit container'), "admin/forum/edit/container/$term->tid"));
       }
       else {
-        $rows[] = array(_forum_depth($term->depth) .' '. $term->name, l(t('edit forum'), "admin/forum/edit/forum/$term->tid"));
+        $rows[] = array(_forum_depth($term->depth) .' '. check_plain($term->name), l(t('edit forum'), "admin/forum/edit/forum/$term->tid"));
        }
 
     }
@@ -381,11 +381,11 @@ function forum_link($type, $node = 0, $main = 0) {
     }
 
     if ($prev) {
-      $links[] = l(t('previous forum topic'), "node/$prev->nid", array('title' => $prev->title));
+      $links[] = l(t('previous forum topic'), "node/$prev->nid", array('title' => check_plain($prev->title)));
     }
 
     if ($next) {
-      $links[] = l(t('next forum topic'), "node/$next->nid", array('title' => $next->title));
+      $links[] = l(t('next forum topic'), "node/$next->nid", array('title' => check_plain($next->title)));
     }
   }
 
@@ -478,7 +478,7 @@ function forum_validate(&$node) {
       if (db_result(db_query('SELECT COUNT(*) FROM {term_data} WHERE tid = %d AND vid = %d', $term, $vocabulary))) {
         if (in_array($term, $containers)) {
           $term = taxonomy_get_term($term);
-          form_set_error('taxonomy', t('The item %forum is only a container for forums. Please select one of the forums below it.', array('%forum' => "<em>$term->name</em>")));
+          form_set_error('taxonomy', t('The item %forum is only a container for forums. Please select one of the forums below it.', array('%forum' => theme('placeholder', $term->name))));
         }
         else {
           $node->tid = $term;
@@ -878,7 +878,7 @@ function theme_forum_topic_list($tid, $topics, $sortby, $forum_per_page) {
       if ($topic->tid != $tid) {
         $rows[] = array(
           array('data' => _forum_icon($topic->new, $topic->num_comments, $topic->comment_mode, $topic->sticky), 'class' => 'icon'),
-          array('data' => $topic->title, 'class' => 'title'),
+          array('data' => check_plain($topic->title), 'class' => 'title'),
           array('data' => l(t('This topic has been moved'), "forum/$topic->tid"), 'colspan' => '3')
         );
       }
diff --git a/modules/forum/forum.module b/modules/forum/forum.module
index e086cf991..dae76244f 100644
--- a/modules/forum/forum.module
+++ b/modules/forum/forum.module
@@ -228,10 +228,10 @@ function forum_overview() {
   if ($tree) {
     foreach ($tree as $term) {
       if (in_array($term->tid, variable_get('forum_containers', array()))) {
-        $rows[] = array(_forum_depth($term->depth) .' '. $term->name, l(t('edit container'), "admin/forum/edit/container/$term->tid"));
+        $rows[] = array(_forum_depth($term->depth) .' '. check_plain($term->name), l(t('edit container'), "admin/forum/edit/container/$term->tid"));
       }
       else {
-        $rows[] = array(_forum_depth($term->depth) .' '. $term->name, l(t('edit forum'), "admin/forum/edit/forum/$term->tid"));
+        $rows[] = array(_forum_depth($term->depth) .' '. check_plain($term->name), l(t('edit forum'), "admin/forum/edit/forum/$term->tid"));
        }
 
     }
@@ -381,11 +381,11 @@ function forum_link($type, $node = 0, $main = 0) {
     }
 
     if ($prev) {
-      $links[] = l(t('previous forum topic'), "node/$prev->nid", array('title' => $prev->title));
+      $links[] = l(t('previous forum topic'), "node/$prev->nid", array('title' => check_plain($prev->title)));
     }
 
     if ($next) {
-      $links[] = l(t('next forum topic'), "node/$next->nid", array('title' => $next->title));
+      $links[] = l(t('next forum topic'), "node/$next->nid", array('title' => check_plain($next->title)));
     }
   }
 
@@ -478,7 +478,7 @@ function forum_validate(&$node) {
       if (db_result(db_query('SELECT COUNT(*) FROM {term_data} WHERE tid = %d AND vid = %d', $term, $vocabulary))) {
         if (in_array($term, $containers)) {
           $term = taxonomy_get_term($term);
-          form_set_error('taxonomy', t('The item %forum is only a container for forums. Please select one of the forums below it.', array('%forum' => "<em>$term->name</em>")));
+          form_set_error('taxonomy', t('The item %forum is only a container for forums. Please select one of the forums below it.', array('%forum' => theme('placeholder', $term->name))));
         }
         else {
           $node->tid = $term;
@@ -878,7 +878,7 @@ function theme_forum_topic_list($tid, $topics, $sortby, $forum_per_page) {
       if ($topic->tid != $tid) {
         $rows[] = array(
           array('data' => _forum_icon($topic->new, $topic->num_comments, $topic->comment_mode, $topic->sticky), 'class' => 'icon'),
-          array('data' => $topic->title, 'class' => 'title'),
+          array('data' => check_plain($topic->title), 'class' => 'title'),
           array('data' => l(t('This topic has been moved'), "forum/$topic->tid"), 'colspan' => '3')
         );
       }
diff --git a/modules/locale.module b/modules/locale.module
index 3f31ff755..493d34a99 100644
--- a/modules/locale.module
+++ b/modules/locale.module
@@ -107,6 +107,7 @@ function locale_user($type, $edit, &$user, $category = NULL) {
     if ($user->language == '') {
       $user->language = key($languages['name']);
     }
+    $languages['name'] = array_map('check_plain', $languages['name']);
     return array(array('title' => t('Interface language settings'), 'data' => form_radios(t("Language"), 'language', $user->language, $languages['name'], t("Selecting a different locale will change the interface language of the site."))));
   }
 }
@@ -299,7 +300,7 @@ function locale_admin_manage_delete_screen() {
     if (isset($languages['name'][$edit['langcode']])) {
       db_query("DELETE FROM {locales_meta} WHERE locale = '%s'", $edit['langcode']);
       db_query("DELETE FROM {locales_target} WHERE locale = '%s'", $edit['langcode']);
-      $message = t('%locale language removed.', array('%locale' => '<em>'. t($languages['name'][$edit['langcode']]) .'</em>'));
+      $message = t('%locale language removed.', array('%locale' => theme('placeholder', t($languages['name'][$edit['langcode']]))));
       drupal_set_message($message);
       watchdog('locale', $message);
     }
@@ -320,7 +321,7 @@ function locale_admin_manage_delete_screen() {
 
   $extra = form_hidden('langcode', $langcode);
   $output = theme('confirm',
-                  t('Are you sure you want to delete the language %name?', array('%name' => '<em>'. t($languages['name'][$langcode]) .'</em>')),
+                  t('Are you sure you want to delete the language %name?', array('%name' => theme('placeholder', t($languages['name'][$langcode])))),
                   'admin/locale/language/overview',
                   t('Deleting a language will remove all data associated with it. This action cannot be undone.'),
                   t('Delete'),
@@ -359,7 +360,7 @@ function locale_admin_manage_add() {
         drupal_set_message(t('You need to specify both the language code and the English name of the new language.'), 'error');
       }
       else {
-        drupal_set_message(t('The language %language (%code) is already set up.', array('%language' => '<em>'. $edit['langname'] .'</em>', '%code' => '<em>'. $edit['langcode'] .'</em>')), 'error');
+        drupal_set_message(t('The language %language (%code) is already set up.', array('%language' => '<em>'. check_plain($edit['langname']) .'</em>', '%code' => theme('placeholder', $edit['langcode']))), 'error');
       }
       break;
   }
@@ -388,7 +389,7 @@ function locale_admin_import() {
       // Now import strings into the language
       $file = file_check_upload('file');
       if ($ret = _locale_import_po($file, $edit['langcode'], $edit['mode']) == FALSE) {
-        $message = t('Translation import of %filename failed.', array('%filename' => "<em>$file->filename</em>"));
+        $message = t('Translation import of %filename failed.', array('%filename' => theme('placeholder', $file->filename)));
         drupal_set_message($message, 'error');
         watchdog('locale', $message, WATCHDOG_ERROR);
       }
diff --git a/modules/locale/locale.module b/modules/locale/locale.module
index 3f31ff755..493d34a99 100644
--- a/modules/locale/locale.module
+++ b/modules/locale/locale.module
@@ -107,6 +107,7 @@ function locale_user($type, $edit, &$user, $category = NULL) {
     if ($user->language == '') {
       $user->language = key($languages['name']);
     }
+    $languages['name'] = array_map('check_plain', $languages['name']);
     return array(array('title' => t('Interface language settings'), 'data' => form_radios(t("Language"), 'language', $user->language, $languages['name'], t("Selecting a different locale will change the interface language of the site."))));
   }
 }
@@ -299,7 +300,7 @@ function locale_admin_manage_delete_screen() {
     if (isset($languages['name'][$edit['langcode']])) {
       db_query("DELETE FROM {locales_meta} WHERE locale = '%s'", $edit['langcode']);
       db_query("DELETE FROM {locales_target} WHERE locale = '%s'", $edit['langcode']);
-      $message = t('%locale language removed.', array('%locale' => '<em>'. t($languages['name'][$edit['langcode']]) .'</em>'));
+      $message = t('%locale language removed.', array('%locale' => theme('placeholder', t($languages['name'][$edit['langcode']]))));
       drupal_set_message($message);
       watchdog('locale', $message);
     }
@@ -320,7 +321,7 @@ function locale_admin_manage_delete_screen() {
 
   $extra = form_hidden('langcode', $langcode);
   $output = theme('confirm',
-                  t('Are you sure you want to delete the language %name?', array('%name' => '<em>'. t($languages['name'][$langcode]) .'</em>')),
+                  t('Are you sure you want to delete the language %name?', array('%name' => theme('placeholder', t($languages['name'][$langcode])))),
                   'admin/locale/language/overview',
                   t('Deleting a language will remove all data associated with it. This action cannot be undone.'),
                   t('Delete'),
@@ -359,7 +360,7 @@ function locale_admin_manage_add() {
         drupal_set_message(t('You need to specify both the language code and the English name of the new language.'), 'error');
       }
       else {
-        drupal_set_message(t('The language %language (%code) is already set up.', array('%language' => '<em>'. $edit['langname'] .'</em>', '%code' => '<em>'. $edit['langcode'] .'</em>')), 'error');
+        drupal_set_message(t('The language %language (%code) is already set up.', array('%language' => '<em>'. check_plain($edit['langname']) .'</em>', '%code' => theme('placeholder', $edit['langcode']))), 'error');
       }
       break;
   }
@@ -388,7 +389,7 @@ function locale_admin_import() {
       // Now import strings into the language
       $file = file_check_upload('file');
       if ($ret = _locale_import_po($file, $edit['langcode'], $edit['mode']) == FALSE) {
-        $message = t('Translation import of %filename failed.', array('%filename' => "<em>$file->filename</em>"));
+        $message = t('Translation import of %filename failed.', array('%filename' => theme('placeholder', $file->filename)));
         drupal_set_message($message, 'error');
         watchdog('locale', $message, WATCHDOG_ERROR);
       }
diff --git a/modules/menu.module b/modules/menu.module
index 0a972ec39..28e207f92 100644
--- a/modules/menu.module
+++ b/modules/menu.module
@@ -120,7 +120,7 @@ function menu_reset() {
       break;
     default:
       $output = theme('confirm',
-                      t('Are you sure you want to reset all menu items to their default settings?', array('%item' => '<em>'. $title .'</em>')),
+                      t('Are you sure you want to reset all menu items to their default settings?'),
                       'admin/menu',
                       t('Any custom additions or changes to the menu will be lost.'),
                       t('Reset all'));
@@ -167,7 +167,7 @@ function menu_reset_item($mid) {
     default:
       $title = db_result(db_query('SELECT title FROM {menu} WHERE mid = %d', $mid));
       $output = theme('confirm',
-                      t('Are you sure you want to reset the item %item to its default values?', array('%item' => '<em>'. $title .'</em>')),
+                      t('Are you sure you want to reset the item %item to its default values?', array('%item' => theme('placeholder', $title))),
                       'admin/menu',
                       t('Any customizations will be lost. This action cannot be undone.'),
                       t('Reset'));
@@ -198,10 +198,10 @@ function menu_delete_item($mid) {
       break;
     default:
       if ($menu->type & MENU_IS_ROOT) {
-        $message = t('Are you sure you want to delete the menu %item?', array('%item' => '<em>'. $menu->title .'</em>'));
+        $message = t('Are you sure you want to delete the menu %item?', array('%item' => theme('placeholder', $menu->title)));
       }
       else {
-        $message = t('Are you sure you want to delete the custom menu item %item?', array('%item' => '<em>'. $menu->title .'</em>'));
+        $message = t('Are you sure you want to delete the custom menu item %item?', array('%item' => theme('placeholder', $menu->title)));
       }     
       $output = theme('confirm', $message, 'admin/menu', t('This action cannot be undone.'), t('Delete'));
       print theme('page', $output);
@@ -348,16 +348,16 @@ function menu_edit_item_save($edit) {
 
   if ($edit['mid']) {
     db_query("UPDATE {menu} SET pid = %d, path = '%s', title = '%s', description = '%s', weight = %d, type = %d WHERE mid = %d", $edit['pid'], $edit['path'], $edit['title'], $edit['description'], $edit['weight'], $edit['type'] | MENU_MODIFIED_BY_ADMIN, $edit['mid']);
-    drupal_set_message(t('Updated menu item %title.', array('%title' => '<em>'. $edit['title'] .'</em>')));
+    drupal_set_message(t('Updated menu item %title.', array('%title' => theme('placeholder', $edit['title']))));
   }
   else {
     $mid = db_next_id('{menu}_mid');
     db_query("INSERT INTO {menu} (mid, pid, path, title, description, weight, type) VALUES (%d, %d, '%s', '%s', '%s', %d, %d)", $mid, $edit['pid'], $edit['path'], $edit['title'], $edit['description'], $edit['weight'], $edit['type'] | MENU_MODIFIED_BY_ADMIN);
-    drupal_set_message(t('Created new menu item %title.', array('%title' => '<em>'. $edit['title'] .'</em>')));
+    drupal_set_message(t('Created new menu item %title.', array('%title' => theme('placeholder', $edit['title']))));
     if (array_key_exists($edit['path'], $menu['path index'])) {
       $old_mid = $menu['path index'][$edit['path']];
       $old_item = $menu['items'][$old_mid];
-      drupal_set_message(t('Since a menu item %old already exists for %path, this new menu item was created as a shortcut to that location.', array('%old' => l('<em>'. $old_item['title'] .'</em>', 'admin/menu/item/edit/'. $old_mid), '%path' => '<em>'. $edit['path'] .'</em>')));
+      drupal_set_message(t('Since a menu item %old already exists for %path, this new menu item was created as a shortcut to that location.', array('%old' => l(theme('placeholder', $old_item['title']), 'admin/menu/item/edit/'. $old_mid, array(), NULL, NULL, FALSE, TRUE), '%path' => theme('placeholder', $edit['path']))));
     }
   }
 }
diff --git a/modules/menu/menu.module b/modules/menu/menu.module
index 0a972ec39..28e207f92 100644
--- a/modules/menu/menu.module
+++ b/modules/menu/menu.module
@@ -120,7 +120,7 @@ function menu_reset() {
       break;
     default:
       $output = theme('confirm',
-                      t('Are you sure you want to reset all menu items to their default settings?', array('%item' => '<em>'. $title .'</em>')),
+                      t('Are you sure you want to reset all menu items to their default settings?'),
                       'admin/menu',
                       t('Any custom additions or changes to the menu will be lost.'),
                       t('Reset all'));
@@ -167,7 +167,7 @@ function menu_reset_item($mid) {
     default:
       $title = db_result(db_query('SELECT title FROM {menu} WHERE mid = %d', $mid));
       $output = theme('confirm',
-                      t('Are you sure you want to reset the item %item to its default values?', array('%item' => '<em>'. $title .'</em>')),
+                      t('Are you sure you want to reset the item %item to its default values?', array('%item' => theme('placeholder', $title))),
                       'admin/menu',
                       t('Any customizations will be lost. This action cannot be undone.'),
                       t('Reset'));
@@ -198,10 +198,10 @@ function menu_delete_item($mid) {
       break;
     default:
       if ($menu->type & MENU_IS_ROOT) {
-        $message = t('Are you sure you want to delete the menu %item?', array('%item' => '<em>'. $menu->title .'</em>'));
+        $message = t('Are you sure you want to delete the menu %item?', array('%item' => theme('placeholder', $menu->title)));
       }
       else {
-        $message = t('Are you sure you want to delete the custom menu item %item?', array('%item' => '<em>'. $menu->title .'</em>'));
+        $message = t('Are you sure you want to delete the custom menu item %item?', array('%item' => theme('placeholder', $menu->title)));
       }     
       $output = theme('confirm', $message, 'admin/menu', t('This action cannot be undone.'), t('Delete'));
       print theme('page', $output);
@@ -348,16 +348,16 @@ function menu_edit_item_save($edit) {
 
   if ($edit['mid']) {
     db_query("UPDATE {menu} SET pid = %d, path = '%s', title = '%s', description = '%s', weight = %d, type = %d WHERE mid = %d", $edit['pid'], $edit['path'], $edit['title'], $edit['description'], $edit['weight'], $edit['type'] | MENU_MODIFIED_BY_ADMIN, $edit['mid']);
-    drupal_set_message(t('Updated menu item %title.', array('%title' => '<em>'. $edit['title'] .'</em>')));
+    drupal_set_message(t('Updated menu item %title.', array('%title' => theme('placeholder', $edit['title']))));
   }
   else {
     $mid = db_next_id('{menu}_mid');
     db_query("INSERT INTO {menu} (mid, pid, path, title, description, weight, type) VALUES (%d, %d, '%s', '%s', '%s', %d, %d)", $mid, $edit['pid'], $edit['path'], $edit['title'], $edit['description'], $edit['weight'], $edit['type'] | MENU_MODIFIED_BY_ADMIN);
-    drupal_set_message(t('Created new menu item %title.', array('%title' => '<em>'. $edit['title'] .'</em>')));
+    drupal_set_message(t('Created new menu item %title.', array('%title' => theme('placeholder', $edit['title']))));
     if (array_key_exists($edit['path'], $menu['path index'])) {
       $old_mid = $menu['path index'][$edit['path']];
       $old_item = $menu['items'][$old_mid];
-      drupal_set_message(t('Since a menu item %old already exists for %path, this new menu item was created as a shortcut to that location.', array('%old' => l('<em>'. $old_item['title'] .'</em>', 'admin/menu/item/edit/'. $old_mid), '%path' => '<em>'. $edit['path'] .'</em>')));
+      drupal_set_message(t('Since a menu item %old already exists for %path, this new menu item was created as a shortcut to that location.', array('%old' => l(theme('placeholder', $old_item['title']), 'admin/menu/item/edit/'. $old_mid, array(), NULL, NULL, FALSE, TRUE), '%path' => theme('placeholder', $edit['path']))));
     }
   }
 }
diff --git a/modules/node.module b/modules/node.module
index 29aae45cb..adf40d94c 100644
--- a/modules/node.module
+++ b/modules/node.module
@@ -990,7 +990,7 @@ function node_revision_overview($nid) {
   if (user_access('administer nodes')) {
     $node = node_load(array('nid' => $nid));
 
-    drupal_set_title($node->title);
+    drupal_set_title(check_plain($node->title));
 
     if ($node->revisions) {
       $header = array(t('Older revisions'), array('colspan' => '3', 'data' => t('Operations')));
@@ -1059,7 +1059,7 @@ function node_revision_rollback($nid, $revision) {
 
     node_save($rev, $filter);
 
-    drupal_set_message(t('Rolled back to revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => "<em>$node->title</em>")));
+    drupal_set_message(t('Rolled back to revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => theme('placeholder', $node->title))));
     drupal_goto('node/'. $nid .'/revisions');
   }
 }
@@ -1075,7 +1075,7 @@ function node_revision_delete($nid, $revision) {
 
     node_save($node, array('nid', 'revisions'));
 
-    drupal_set_message(t('Deleted revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => "<em>$node->title</em>")));
+    drupal_set_message(t('Deleted revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => theme('placeholder', $node->title))));
     drupal_goto('node/'. $nid . (count($node->revisions) ? '/revisions' : ''));
   }
 }
@@ -1199,9 +1199,8 @@ function node_validate($node) {
 
   // Validate the title field.
   if (isset($node->title)) {
-    $node->title = strip_tags($node->title);
-    if (!$node->title) {
-      form_set_error('title', t('You have to specify a valid title.'));
+    if (trim($node->title) == '') {
+      form_set_error('title', t('You have to specify a title.'));
     }
   }
 
@@ -1242,7 +1241,7 @@ function node_validate($node) {
       $node->uid = $account->uid;
     }
     else {
-      form_set_error('name', t('The name %name does not exist.', array ('%name' => "<em>$node->name</em>")));
+      form_set_error('name', t('The username %name does not exist.', array ('%name' => theme('placeholder', $node->name))));
     }
 
     // Validate the "authored on" field.
@@ -1309,7 +1308,7 @@ function node_form($edit) {
   $output .= '<div class="node-form">';
 
   // Add hidden 'op' variable, which specifies the default operation (Preview).
-  $output .= '<input type="hidden" name="op" value="'. check_form(t('Preview')) ."\" />\n";
+  $output .= '<input type="hidden" name="op" value="'. check_plain(t('Preview')) ."\" />\n";
 
   // Add the admin-specific parts.
   if (user_access('administer nodes')) {
@@ -1455,7 +1454,7 @@ function node_edit($id) {
 
   $node = node_load(array('nid' => $id));
 
-  drupal_set_title($node->title);
+  drupal_set_title(check_plain($node->title));
 
   $output = node_form($node);
 
@@ -1560,7 +1559,7 @@ function node_submit(&$node) {
     // perform this operation:
     if (node_access('update', $node)) {
       $node->nid = node_save($node);
-      watchdog('content', t('%type: updated %title.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
+      watchdog('content', t('%type: updated %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
       $msg = t('The %post was updated.', array ('%post' => node_invoke($node, 'node_name')));
     }
   }
@@ -1569,7 +1568,7 @@ function node_submit(&$node) {
     // perform this operation:
     if (node_access('create', $node)) {
       $node->nid = node_save($node);
-      watchdog('content', t('%type: added %title.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
+      watchdog('content', t('%type: added %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
       $msg = t('Your %post was created.', array ('%post' => node_invoke($node, 'node_name')));
     }
   }
@@ -1603,12 +1602,12 @@ function node_delete($edit) {
         search_wipe($node->nid, 'node');
       }
 
-      watchdog('content', t('%type: deleted %title.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")));
+      watchdog('content', t('%type: deleted %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))));
     }
     else {
       $extra = form_hidden('nid', $node->nid);
       $output = theme('confirm',
-                      t('Are you sure you want to delete %title?', array('%title' => '<em>'. $node->title .'</em>')),
+                      t('Are you sure you want to delete %title?', array('%title' => theme('placeholder', $node->title))),
                       $_GET['destination'] ? $_GET['destination'] : 'node/'. $node->nid,
                       t('This action cannot be undone.'),
                       t('Delete'),
@@ -1681,7 +1680,7 @@ function node_page() {
       if (is_numeric(arg(1))) {
         $node = node_load(array('nid' => arg(1)), $_GET['revision']);
         if ($node->nid) {
-          drupal_set_title($node->title);
+          drupal_set_title(check_plain($node->title));
           print theme('page', node_show($node, arg(2)));
         }
         else {
@@ -1758,7 +1757,7 @@ function node_update_index() {
     // Allow modules to change $node->body before viewing.
     node_invoke_nodeapi($node, 'view', false, false);
 
-    $text = '<h1>'. drupal_specialchars($node->title) .'</h1>'. $node->body;
+    $text = '<h1>'. check_plain($node->title) .'</h1>'. $node->body;
 
     // Fetch extra data normally not visible
     $extra = node_invoke_nodeapi($node, 'update index');
diff --git a/modules/node/node.module b/modules/node/node.module
index 29aae45cb..adf40d94c 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -990,7 +990,7 @@ function node_revision_overview($nid) {
   if (user_access('administer nodes')) {
     $node = node_load(array('nid' => $nid));
 
-    drupal_set_title($node->title);
+    drupal_set_title(check_plain($node->title));
 
     if ($node->revisions) {
       $header = array(t('Older revisions'), array('colspan' => '3', 'data' => t('Operations')));
@@ -1059,7 +1059,7 @@ function node_revision_rollback($nid, $revision) {
 
     node_save($rev, $filter);
 
-    drupal_set_message(t('Rolled back to revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => "<em>$node->title</em>")));
+    drupal_set_message(t('Rolled back to revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => theme('placeholder', $node->title))));
     drupal_goto('node/'. $nid .'/revisions');
   }
 }
@@ -1075,7 +1075,7 @@ function node_revision_delete($nid, $revision) {
 
     node_save($node, array('nid', 'revisions'));
 
-    drupal_set_message(t('Deleted revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => "<em>$node->title</em>")));
+    drupal_set_message(t('Deleted revision %revision of %title', array('%revision' => "<em>#$revision</em>", '%title' => theme('placeholder', $node->title))));
     drupal_goto('node/'. $nid . (count($node->revisions) ? '/revisions' : ''));
   }
 }
@@ -1199,9 +1199,8 @@ function node_validate($node) {
 
   // Validate the title field.
   if (isset($node->title)) {
-    $node->title = strip_tags($node->title);
-    if (!$node->title) {
-      form_set_error('title', t('You have to specify a valid title.'));
+    if (trim($node->title) == '') {
+      form_set_error('title', t('You have to specify a title.'));
     }
   }
 
@@ -1242,7 +1241,7 @@ function node_validate($node) {
       $node->uid = $account->uid;
     }
     else {
-      form_set_error('name', t('The name %name does not exist.', array ('%name' => "<em>$node->name</em>")));
+      form_set_error('name', t('The username %name does not exist.', array ('%name' => theme('placeholder', $node->name))));
     }
 
     // Validate the "authored on" field.
@@ -1309,7 +1308,7 @@ function node_form($edit) {
   $output .= '<div class="node-form">';
 
   // Add hidden 'op' variable, which specifies the default operation (Preview).
-  $output .= '<input type="hidden" name="op" value="'. check_form(t('Preview')) ."\" />\n";
+  $output .= '<input type="hidden" name="op" value="'. check_plain(t('Preview')) ."\" />\n";
 
   // Add the admin-specific parts.
   if (user_access('administer nodes')) {
@@ -1455,7 +1454,7 @@ function node_edit($id) {
 
   $node = node_load(array('nid' => $id));
 
-  drupal_set_title($node->title);
+  drupal_set_title(check_plain($node->title));
 
   $output = node_form($node);
 
@@ -1560,7 +1559,7 @@ function node_submit(&$node) {
     // perform this operation:
     if (node_access('update', $node)) {
       $node->nid = node_save($node);
-      watchdog('content', t('%type: updated %title.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
+      watchdog('content', t('%type: updated %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
       $msg = t('The %post was updated.', array ('%post' => node_invoke($node, 'node_name')));
     }
   }
@@ -1569,7 +1568,7 @@ function node_submit(&$node) {
     // perform this operation:
     if (node_access('create', $node)) {
       $node->nid = node_save($node);
-      watchdog('content', t('%type: added %title.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
+      watchdog('content', t('%type: added %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
       $msg = t('Your %post was created.', array ('%post' => node_invoke($node, 'node_name')));
     }
   }
@@ -1603,12 +1602,12 @@ function node_delete($edit) {
         search_wipe($node->nid, 'node');
       }
 
-      watchdog('content', t('%type: deleted %title.', array('%type' => '<em>'. t($node->type) .'</em>', '%title' => "<em>$node->title</em>")));
+      watchdog('content', t('%type: deleted %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))));
     }
     else {
       $extra = form_hidden('nid', $node->nid);
       $output = theme('confirm',
-                      t('Are you sure you want to delete %title?', array('%title' => '<em>'. $node->title .'</em>')),
+                      t('Are you sure you want to delete %title?', array('%title' => theme('placeholder', $node->title))),
                       $_GET['destination'] ? $_GET['destination'] : 'node/'. $node->nid,
                       t('This action cannot be undone.'),
                       t('Delete'),
@@ -1681,7 +1680,7 @@ function node_page() {
       if (is_numeric(arg(1))) {
         $node = node_load(array('nid' => arg(1)), $_GET['revision']);
         if ($node->nid) {
-          drupal_set_title($node->title);
+          drupal_set_title(check_plain($node->title));
           print theme('page', node_show($node, arg(2)));
         }
         else {
@@ -1758,7 +1757,7 @@ function node_update_index() {
     // Allow modules to change $node->body before viewing.
     node_invoke_nodeapi($node, 'view', false, false);
 
-    $text = '<h1>'. drupal_specialchars($node->title) .'</h1>'. $node->body;
+    $text = '<h1>'. check_plain($node->title) .'</h1>'. $node->body;
 
     // Fetch extra data normally not visible
     $extra = node_invoke_nodeapi($node, 'update index');
diff --git a/modules/path.module b/modules/path.module
index e48589c05..ba2251490 100644
--- a/modules/path.module
+++ b/modules/path.module
@@ -296,15 +296,15 @@ function path_save($edit) {
   $pid = $edit['pid'];
 
   if (!valid_url($src)) {
-    form_set_error('src', t('The system path %path is invalid.', array('%path' => "<em>$src</em>")));
+    form_set_error('src', t('The system path %path is invalid.', array('%path' => theme('placeholder', $src))));
   }
 
   if (!valid_url($dst)) {
-    form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => "<em>$dst</em>")));
+    form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => theme('placeholder', $dst))));
   }
 
   if (db_result(db_query("SELECT COUNT(dst) FROM {url_alias} WHERE pid != %d AND dst = '%s'", $pid, $dst))) {
-    form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => "<em>$dst</em>")));
+    form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => theme('placeholder', $dst))));
   }
 
   if (form_get_errors()) {
diff --git a/modules/path/path.module b/modules/path/path.module
index e48589c05..ba2251490 100644
--- a/modules/path/path.module
+++ b/modules/path/path.module
@@ -296,15 +296,15 @@ function path_save($edit) {
   $pid = $edit['pid'];
 
   if (!valid_url($src)) {
-    form_set_error('src', t('The system path %path is invalid.', array('%path' => "<em>$src</em>")));
+    form_set_error('src', t('The system path %path is invalid.', array('%path' => theme('placeholder', $src))));
   }
 
   if (!valid_url($dst)) {
-    form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => "<em>$dst</em>")));
+    form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => theme('placeholder', $dst))));
   }
 
   if (db_result(db_query("SELECT COUNT(dst) FROM {url_alias} WHERE pid != %d AND dst = '%s'", $pid, $dst))) {
-    form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => "<em>$dst</em>")));
+    form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => theme('placeholder', $dst))));
   }
 
   if (form_get_errors()) {
diff --git a/modules/poll.module b/modules/poll.module
index d5eae590a..933c1067a 100644
--- a/modules/poll.module
+++ b/modules/poll.module
@@ -307,9 +307,9 @@ function poll_view_voting(&$node, $teaser, $page, $block) {
   if ($node->choice) {
     $list = array();
     foreach ($node->choice as $i => $choice) {
-      $list[$i] = drupal_specialchars($choice['chtext']);
+      $list[$i] = check_plain($choice['chtext']);
     }
-    $form .= form_radios($page ? '' : $node->title, 'choice', -1, $list);
+    $form .= form_radios($page ? '' : check_plain($node->title), 'choice', -1, $list);
   }
   $form .= '</div>';
   $form .= form_hidden('nid', $node->nid);
@@ -336,12 +336,12 @@ function poll_view_results(&$node, $teaser, $page, $block) {
   // Output the divs for the text, bars and percentages
   $output .= '<div class="poll">';
   if ($block) {
-    $output .= '<div class="title">'. $node->title .'</div>';
+    $output .= '<div class="title">'. check_plain($node->title) .'</div>';
   }
   foreach ($node->choice as $i => $choice) {
     if ($choice['chtext'] != '') {
       $percentage = round($choice['chvotes'] * 100 / max($votestotal, 1));
-      $output .= '<div class="text">'. drupal_specialchars($choice['chtext']) .'</div>';
+      $output .= '<div class="text">'. check_plain($choice['chtext']) .'</div>';
       $output .= '<div class="bar">';
       $output .= '<div style="width: '. $percentage .'%;" class="foreground"></div>';
       $output .= '</div>';
@@ -360,7 +360,7 @@ function poll_view_results(&$node, $teaser, $page, $block) {
  */
 function poll_results() {
   if ($node = node_load(array('nid' => arg(1)))) {
-    drupal_set_title($node->title);
+    drupal_set_title(check_plain($node->title));
     print theme('page', node_show($node, 0));
   }
   else {
diff --git a/modules/poll/poll.module b/modules/poll/poll.module
index d5eae590a..933c1067a 100644
--- a/modules/poll/poll.module
+++ b/modules/poll/poll.module
@@ -307,9 +307,9 @@ function poll_view_voting(&$node, $teaser, $page, $block) {
   if ($node->choice) {
     $list = array();
     foreach ($node->choice as $i => $choice) {
-      $list[$i] = drupal_specialchars($choice['chtext']);
+      $list[$i] = check_plain($choice['chtext']);
     }
-    $form .= form_radios($page ? '' : $node->title, 'choice', -1, $list);
+    $form .= form_radios($page ? '' : check_plain($node->title), 'choice', -1, $list);
   }
   $form .= '</div>';
   $form .= form_hidden('nid', $node->nid);
@@ -336,12 +336,12 @@ function poll_view_results(&$node, $teaser, $page, $block) {
   // Output the divs for the text, bars and percentages
   $output .= '<div class="poll">';
   if ($block) {
-    $output .= '<div class="title">'. $node->title .'</div>';
+    $output .= '<div class="title">'. check_plain($node->title) .'</div>';
   }
   foreach ($node->choice as $i => $choice) {
     if ($choice['chtext'] != '') {
       $percentage = round($choice['chvotes'] * 100 / max($votestotal, 1));
-      $output .= '<div class="text">'. drupal_specialchars($choice['chtext']) .'</div>';
+      $output .= '<div class="text">'. check_plain($choice['chtext']) .'</div>';
       $output .= '<div class="bar">';
       $output .= '<div style="width: '. $percentage .'%;" class="foreground"></div>';
       $output .= '</div>';
@@ -360,7 +360,7 @@ function poll_view_results(&$node, $teaser, $page, $block) {
  */
 function poll_results() {
   if ($node = node_load(array('nid' => arg(1)))) {
-    drupal_set_title($node->title);
+    drupal_set_title(check_plain($node->title));
     print theme('page', node_show($node, 0));
   }
   else {
diff --git a/modules/profile.module b/modules/profile.module
index 8e9c2bdbc..d47caa400 100644
--- a/modules/profile.module
+++ b/modules/profile.module
@@ -107,7 +107,7 @@ function profile_browse() {
     $output .= theme('pager', NULL, 20);
 
     if ($field->type == 'selection' || $field->type == 'list') {
-      $title = strtr($field->page, array('%value' => $value));
+      $title = strtr($field->page, array('%value' => theme('placeholder', $value)));
     }
     else {
       $title = $field->page;
@@ -178,15 +178,15 @@ function profile_view_field($user, $field) {
   if ($value = $user->{$field->name}) {
     switch ($field->type) {
       case 'textfield':
-        return drupal_specialchars($value);
+        return check_plain($value);
       case 'textarea':
         return check_output($value);
       case 'selection':
-        return $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+        return $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
       case 'checkbox':
-        return $browse ? l(strip_tags($field->title), "profile/$field->name") : drupal_specialchars($field->title);
+        return $browse ? l($field->title, "profile/$field->name") : check_plain($field->title);
       case 'url':
-        return '<a href="'. check_url($value) .'">'. drupal_specialchars($value) .'</a>';
+        return '<a href="'. check_url($value) .'">'. check_plain($value) .'</a>';
       case 'date':
         list($format) = explode(' - ', variable_get('date_format_short', 'm/d/Y - H:i'), 2);
         // Note: we avoid PHP's date() because it does not handle dates before
@@ -203,7 +203,7 @@ function profile_view_field($user, $field) {
         $fields = array();
         foreach ($values as $value) {
           if ($value = trim($value)) {
-            $fields[] = $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+            $fields[] = $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
           }
         }
         return implode(', ', $fields);
@@ -226,7 +226,7 @@ function profile_view_profile($user) {
   while ($field = db_fetch_object($result)) {
     if ($value = profile_view_field($user, $field)) {
       $description = ($field->visibility == PROFILE_PRIVATE) ? t('The content of this field is private and only visible to yourself.') : '';
-      $title = ($field->type != 'checkbox') ? $field->title : '';
+      $title = ($field->type != 'checkbox') ? check_plain($field->title) : '';
       $fields[$field->category] .= form_item($title, $value, $description);
     }
   }
@@ -264,16 +264,16 @@ function profile_form_profile($edit, $user, $category) {
     switch ($field->type) {
       case 'textfield':
       case 'url':
-        $fields[$category] .= form_textfield($field->title, $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_textfield(check_plain($field->title), $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'textarea':
-        $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'list':
-        $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'checkbox':
-        $fields[$category] .= form_checkbox($field->title, $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_checkbox(check_plain($field->title), $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'selection':
         $options = array('--');
@@ -284,7 +284,7 @@ function profile_form_profile($edit, $user, $category) {
           }
         }
 
-        $fields[$category] .= form_select($field->title, $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
+        $fields[$category] .= form_select(check_plain($field->title), $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
         break;
       case 'date':
         $fields[$category] .= _profile_date_field($field, $edit);
@@ -338,7 +338,7 @@ function _profile_date_field($field, $edit) {
   }
   $output .= '</div>';
 
-  return form_item($field->title, $output, _profile_form_explanation($field), NULL, $field->required);
+  return form_item(check_plain($field->title), $output, _profile_form_explanation($field), NULL, $field->required);
 }
 
 /**
@@ -362,12 +362,12 @@ function profile_validate_profile($edit, $category) {
     if ($edit[$field->name]) {
       if ($field->type == 'url') {
         if (!valid_url($edit[$field->name], true)) {
-          form_set_error($field->name, t('The value provided for %field is not a valid URL.', array('%field' => "<em>$field->title</em>")));
-         }
+          form_set_error($field->name, t('The value provided for %field is not a valid URL.', array('%field' => theme('placeholder', $field->title))));
+        }
       }
     }
     else if ($field->required && !user_access('administer users')) {
-      form_set_error($field->name, t('The field %field is required.', array('%field' => "<em>$field->title</em>")));
+      form_set_error($field->name, t('The field %field is required.', array('%field' => theme('placeholder', $field->title))));
     }
   }
 
@@ -377,7 +377,7 @@ function profile_validate_profile($edit, $category) {
 function profile_categories() {
   $result = db_query("SELECT DISTINCT(category) FROM {profile_fields}");
   while ($category = db_fetch_object($result)) {
-    $data[] = array('name' => drupal_specialchars($category->category), 'title' => $category->category, 'weight' => 3);
+    $data[] = array('name' => check_plain($category->category), 'title' => $category->category, 'weight' => 3);
   }
   return $data;
 }
@@ -539,7 +539,7 @@ function profile_admin_overview() {
   $result = db_query('SELECT * FROM {profile_fields} ORDER BY category, weight');
   $rows = array();
   while ($field = db_fetch_object($result)) {
-    $rows[] = array($field->title, $field->name, _profile_field_types($field->type), $field->category, l(t('edit'), "admin/settings/profile/edit/$field->fid"), l(t('delete'), "admin/settings/profile/delete/$field->fid"));
+    $rows[] = array(check_plain($field->title), $field->name, _profile_field_types($field->type), $field->category, l(t('edit'), "admin/settings/profile/edit/$field->fid"), l(t('delete'), "admin/settings/profile/delete/$field->fid"));
   }
   if (count($rows) == 0) {
     $rows[] = array(array('data' => t('No fields defined.'), 'colspan' => '6'));
diff --git a/modules/profile/profile.module b/modules/profile/profile.module
index 8e9c2bdbc..d47caa400 100644
--- a/modules/profile/profile.module
+++ b/modules/profile/profile.module
@@ -107,7 +107,7 @@ function profile_browse() {
     $output .= theme('pager', NULL, 20);
 
     if ($field->type == 'selection' || $field->type == 'list') {
-      $title = strtr($field->page, array('%value' => $value));
+      $title = strtr($field->page, array('%value' => theme('placeholder', $value)));
     }
     else {
       $title = $field->page;
@@ -178,15 +178,15 @@ function profile_view_field($user, $field) {
   if ($value = $user->{$field->name}) {
     switch ($field->type) {
       case 'textfield':
-        return drupal_specialchars($value);
+        return check_plain($value);
       case 'textarea':
         return check_output($value);
       case 'selection':
-        return $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+        return $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
       case 'checkbox':
-        return $browse ? l(strip_tags($field->title), "profile/$field->name") : drupal_specialchars($field->title);
+        return $browse ? l($field->title, "profile/$field->name") : check_plain($field->title);
       case 'url':
-        return '<a href="'. check_url($value) .'">'. drupal_specialchars($value) .'</a>';
+        return '<a href="'. check_url($value) .'">'. check_plain($value) .'</a>';
       case 'date':
         list($format) = explode(' - ', variable_get('date_format_short', 'm/d/Y - H:i'), 2);
         // Note: we avoid PHP's date() because it does not handle dates before
@@ -203,7 +203,7 @@ function profile_view_field($user, $field) {
         $fields = array();
         foreach ($values as $value) {
           if ($value = trim($value)) {
-            $fields[] = $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+            $fields[] = $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
           }
         }
         return implode(', ', $fields);
@@ -226,7 +226,7 @@ function profile_view_profile($user) {
   while ($field = db_fetch_object($result)) {
     if ($value = profile_view_field($user, $field)) {
       $description = ($field->visibility == PROFILE_PRIVATE) ? t('The content of this field is private and only visible to yourself.') : '';
-      $title = ($field->type != 'checkbox') ? $field->title : '';
+      $title = ($field->type != 'checkbox') ? check_plain($field->title) : '';
       $fields[$field->category] .= form_item($title, $value, $description);
     }
   }
@@ -264,16 +264,16 @@ function profile_form_profile($edit, $user, $category) {
     switch ($field->type) {
       case 'textfield':
       case 'url':
-        $fields[$category] .= form_textfield($field->title, $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_textfield(check_plain($field->title), $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'textarea':
-        $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'list':
-        $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'checkbox':
-        $fields[$category] .= form_checkbox($field->title, $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
+        $fields[$category] .= form_checkbox(check_plain($field->title), $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
         break;
       case 'selection':
         $options = array('--');
@@ -284,7 +284,7 @@ function profile_form_profile($edit, $user, $category) {
           }
         }
 
-        $fields[$category] .= form_select($field->title, $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
+        $fields[$category] .= form_select(check_plain($field->title), $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
         break;
       case 'date':
         $fields[$category] .= _profile_date_field($field, $edit);
@@ -338,7 +338,7 @@ function _profile_date_field($field, $edit) {
   }
   $output .= '</div>';
 
-  return form_item($field->title, $output, _profile_form_explanation($field), NULL, $field->required);
+  return form_item(check_plain($field->title), $output, _profile_form_explanation($field), NULL, $field->required);
 }
 
 /**
@@ -362,12 +362,12 @@ function profile_validate_profile($edit, $category) {
     if ($edit[$field->name]) {
       if ($field->type == 'url') {
         if (!valid_url($edit[$field->name], true)) {
-          form_set_error($field->name, t('The value provided for %field is not a valid URL.', array('%field' => "<em>$field->title</em>")));
-         }
+          form_set_error($field->name, t('The value provided for %field is not a valid URL.', array('%field' => theme('placeholder', $field->title))));
+        }
       }
     }
     else if ($field->required && !user_access('administer users')) {
-      form_set_error($field->name, t('The field %field is required.', array('%field' => "<em>$field->title</em>")));
+      form_set_error($field->name, t('The field %field is required.', array('%field' => theme('placeholder', $field->title))));
     }
   }
 
@@ -377,7 +377,7 @@ function profile_validate_profile($edit, $category) {
 function profile_categories() {
   $result = db_query("SELECT DISTINCT(category) FROM {profile_fields}");
   while ($category = db_fetch_object($result)) {
-    $data[] = array('name' => drupal_specialchars($category->category), 'title' => $category->category, 'weight' => 3);
+    $data[] = array('name' => check_plain($category->category), 'title' => $category->category, 'weight' => 3);
   }
   return $data;
 }
@@ -539,7 +539,7 @@ function profile_admin_overview() {
   $result = db_query('SELECT * FROM {profile_fields} ORDER BY category, weight');
   $rows = array();
   while ($field = db_fetch_object($result)) {
-    $rows[] = array($field->title, $field->name, _profile_field_types($field->type), $field->category, l(t('edit'), "admin/settings/profile/edit/$field->fid"), l(t('delete'), "admin/settings/profile/delete/$field->fid"));
+    $rows[] = array(check_plain($field->title), $field->name, _profile_field_types($field->type), $field->category, l(t('edit'), "admin/settings/profile/edit/$field->fid"), l(t('delete'), "admin/settings/profile/delete/$field->fid"));
   }
   if (count($rows) == 0) {
     $rows[] = array(array('data' => t('No fields defined.'), 'colspan' => '6'));
diff --git a/modules/queue.module b/modules/queue.module
index b37d4b5fd..0aef36ebb 100644
--- a/modules/queue.module
+++ b/modules/queue.module
@@ -78,34 +78,34 @@ function queue_vote($node, $vote) {
       $node->moderate = 0;
       $node->promote = 1;
       node_save($node);
-      watchdog('content', t('Moderation: approved %title.', array('%title' => "<em>$node->title</em>")));
+      watchdog('content', t('Moderation: approved %title.', array('%title' => theme('placeholder', $node->title))));
       drupal_set_message(t('The post is promoted.'));
     }
     else if (variable_get('queue_threshold_dump', -2) >= $node->score) {
       if ($node->revisions) {
         node_revision_rollback($node, end(node_revision_list($node)));
-        watchdog('content', t('Moderation: declined %title (rollback).', array('%title' => "<em>$node->title</em>")));
+        watchdog('content', t('Moderation: declined %title (rollback).', array('%title' => theme('placeholder', $node->title))));
         drupal_set_message(t('The post has been declined and the previous version has been restored.'));
       }
       else {
         $node->moderate = 0;
         $node->status = 0;
         node_save($node);
-        watchdog('content', t('Moderation: declined %title.', array('%title' => "<em>$node->title</em>")));
+        watchdog('content', t('Moderation: declined %title.', array('%title' => theme('placeholder', $node->title))));
         drupal_set_message(t('The post has been declined.'));
       }
     }
     else if (variable_get('queue_threshold_expire', 8) <= $node->votes) {
       if ($node->revisions) {
         node_revision_rollback($node, end(node_revision_list($node)));
-        watchdog('content', t('Moderation: expired %title (rollback).', array('%title' => "<em>$node->title</em>")));
+        watchdog('content', t('Moderation: expired %title (rollback).', array('%title' => theme('placeholder', $node->title))));
         drupal_set_message(t('The post has expired and the previous version has been restored.'));
       }
       else {
         $node->moderate = 0;
         $node->status = 0;
         node_save($node);
-        watchdog('content', t('Moderation: expired %title.', array('%title' => "<em>$node->title</em>")));
+        watchdog('content', t('Moderation: expired %title.', array('%title' => theme('placeholder', $node->title))));
         drupal_set_message(t('The post has expired.'));
       }
     }
diff --git a/modules/search.module b/modules/search.module
index 7b8862239..8fa3f1e5d 100644
--- a/modules/search.module
+++ b/modules/search.module
@@ -503,7 +503,7 @@ function do_search($keywords, $type, $join = '', $where = '1', $variation = true
     $message = format_plural(count($refused),
                              'The word %words was not included because it is too short.',
                              'The words %words were not included because they were too short.');
-    drupal_set_message(strtr($message, array('%words' => '<em>'. drupal_specialchars(implode(', ', $refused)) .'</em>')));
+    drupal_set_message(strtr($message, array('%words' => theme('placeholder', implode(', ', $refused)))));
   }
 
   if (count($words) == 0) {
@@ -559,7 +559,7 @@ function search_view() {
     if ($type == '') {
       $type = 'node';
     }
-    drupal_goto('search/'. $type .'/'. urlencode($_POST['edit']['keys']));
+    drupal_goto('search/'. urlencode($type) .'/'. urlencode($_POST['edit']['keys']));
   }
   else if ($type == '') {
     // Note: search/node can not be a default tab because it would take on the
@@ -574,9 +574,9 @@ function search_view() {
     if (trim($keys)) {
       // Log the search keys:
       watchdog('search',
-        t('Search: %keys (%type).', array('%keys' => "<em>$keys</em>", '%type' => module_invoke($type, 'search', 'name'))),
+        t('Search: %keys (%type).', array('%keys' => theme('placeholder', $keys), '%type' => module_invoke($type, 'search', 'name'))),
         WATCHDOG_NOTICE,
-        l(t('results'), 'search', NULL, 'keys='. urlencode($keys) . '&type='. urlencode($type))
+        l(t('results'), 'search/'. urlencode($type) .'/'. urlencode($keys))
         );
 
       // Collect the search results:
@@ -833,7 +833,7 @@ function theme_search_item($item, $type) {
     $output = module_invoke($type, 'search_item', $item);
   }
   else {
-    $output = ' <dt class="title"><a href="'. $item['link'] .'">'. $item['title'] .'</a></dt>';
+    $output = ' <dt class="title"><a href="'. check_url($item['link']) .'">'. check_plain($item['title']) .'</a></dt>';
     $info = array();
     if ($item['type']) {
       $info[] = $item['type'];
diff --git a/modules/search/search.module b/modules/search/search.module
index 7b8862239..8fa3f1e5d 100644
--- a/modules/search/search.module
+++ b/modules/search/search.module
@@ -503,7 +503,7 @@ function do_search($keywords, $type, $join = '', $where = '1', $variation = true
     $message = format_plural(count($refused),
                              'The word %words was not included because it is too short.',
                              'The words %words were not included because they were too short.');
-    drupal_set_message(strtr($message, array('%words' => '<em>'. drupal_specialchars(implode(', ', $refused)) .'</em>')));
+    drupal_set_message(strtr($message, array('%words' => theme('placeholder', implode(', ', $refused)))));
   }
 
   if (count($words) == 0) {
@@ -559,7 +559,7 @@ function search_view() {
     if ($type == '') {
       $type = 'node';
     }
-    drupal_goto('search/'. $type .'/'. urlencode($_POST['edit']['keys']));
+    drupal_goto('search/'. urlencode($type) .'/'. urlencode($_POST['edit']['keys']));
   }
   else if ($type == '') {
     // Note: search/node can not be a default tab because it would take on the
@@ -574,9 +574,9 @@ function search_view() {
     if (trim($keys)) {
       // Log the search keys:
       watchdog('search',
-        t('Search: %keys (%type).', array('%keys' => "<em>$keys</em>", '%type' => module_invoke($type, 'search', 'name'))),
+        t('Search: %keys (%type).', array('%keys' => theme('placeholder', $keys), '%type' => module_invoke($type, 'search', 'name'))),
         WATCHDOG_NOTICE,
-        l(t('results'), 'search', NULL, 'keys='. urlencode($keys) . '&type='. urlencode($type))
+        l(t('results'), 'search/'. urlencode($type) .'/'. urlencode($keys))
         );
 
       // Collect the search results:
@@ -833,7 +833,7 @@ function theme_search_item($item, $type) {
     $output = module_invoke($type, 'search_item', $item);
   }
   else {
-    $output = ' <dt class="title"><a href="'. $item['link'] .'">'. $item['title'] .'</a></dt>';
+    $output = ' <dt class="title"><a href="'. check_url($item['link']) .'">'. check_plain($item['title']) .'</a></dt>';
     $info = array();
     if ($item['type']) {
       $info[] = $item['type'];
diff --git a/modules/statistics.module b/modules/statistics.module
index bc57b0ab2..8261758bc 100644
--- a/modules/statistics.module
+++ b/modules/statistics.module
@@ -183,7 +183,7 @@ function statistics_node_tracker() {
       $rows[] = array(array('data' => $pager, 'colspan' => '4'));
     }
 
-    drupal_set_title($node->title);
+    drupal_set_title(check_plain($node->title));
     print theme('page', theme('table', $header, $rows));
   }
   else {
diff --git a/modules/statistics/statistics.module b/modules/statistics/statistics.module
index bc57b0ab2..8261758bc 100644
--- a/modules/statistics/statistics.module
+++ b/modules/statistics/statistics.module
@@ -183,7 +183,7 @@ function statistics_node_tracker() {
       $rows[] = array(array('data' => $pager, 'colspan' => '4'));
     }
 
-    drupal_set_title($node->title);
+    drupal_set_title(check_plain($node->title));
     print theme('page', theme('table', $header, $rows));
   }
   else {
diff --git a/modules/taxonomy.module b/modules/taxonomy.module
index 17de7a520..9ebc1aebf 100644
--- a/modules/taxonomy.module
+++ b/modules/taxonomy.module
@@ -130,7 +130,7 @@ function taxonomy_save_vocabulary($edit) {
       db_query("INSERT INTO {vocabulary_node_types} (vid, type) VALUES (%d, '%s')", $edit['vid'], $type);
     }
     module_invoke_all('taxonomy', 'update', 'vocabulary', $edit);
-    $message = t('Updated vocabulary %name.', array('%name' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('Updated vocabulary %name.', array('%name' => theme('placeholder', $edit['name'])));
   }
   else if ($edit['vid']) {
     $message = taxonomy_del_vocabulary($edit['vid']);
@@ -142,7 +142,7 @@ function taxonomy_save_vocabulary($edit) {
       db_query("INSERT INTO {vocabulary_node_types} (vid, type) VALUES (%d, '%s')", $edit['vid'], $type);
     }
     module_invoke_all('taxonomy', 'insert', 'vocabulary', $edit);
-    $message = t('Created new vocabulary %name.', array('%name' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('Created new vocabulary %name.', array('%name' => theme('placeholder', $edit['name'])));
   }
 
   cache_clear_all();
@@ -236,7 +236,7 @@ function taxonomy_save_term($edit) {
 
     db_query('UPDATE {term_data} SET '. _taxonomy_prepare_update($data) .' WHERE tid = %d', $edit['tid']);
     module_invoke_all('taxonomy', 'update', 'term', $edit);
-    $message = t('The term %term has been updated.', array('%term' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('The term %term has been updated.', array('%term' => theme('placeholder', $edit['name'])));
   }
   else if ($edit['tid']) {
     return taxonomy_del_term($edit['tid']);
@@ -246,7 +246,7 @@ function taxonomy_save_term($edit) {
     $data = array('tid' => $edit['tid'], 'name' => $edit['name'], 'description' => $edit['description'], 'vid' => $edit['vid'], 'weight' => $edit['weight']);
     db_query('INSERT INTO {term_data} '. _taxonomy_prepare_insert($data, 1) .' VALUES '. _taxonomy_prepare_insert($data, 2));
     module_invoke_all('taxonomy', 'insert', 'term', $edit);
-    $message = t('Created new term %term.', array('%term' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('Created new term %term.', array('%term' => theme('placeholder', $edit['name'])));
   }
 
   db_query('DELETE FROM {term_relation} WHERE tid1 = %d OR tid2 = %d', $edit['tid'], $edit['tid']);
@@ -315,7 +315,7 @@ function taxonomy_del_term($tid) {
       db_query('DELETE FROM {term_node} WHERE tid = %d', $tid);
 
       module_invoke_all('taxonomy', 'delete', 'term', $term);
-      drupal_set_message(t('Deleted term %name.', array('%name' => '<em>'. $term->name .'</em>')));
+      drupal_set_message(t('Deleted term %name.', array('%name' => theme('placeholder', $term->name))));
     }
 
     $tids = $orphans;
@@ -331,7 +331,7 @@ function _taxonomy_confirm_del_term($tid) {
   $extra .= form_hidden('tid', $tid);
 
   $output = theme('confirm',
-                  t('Are you sure you want to delete the term %title?', array('%title' => '<em>'. $term->name .'</em>')),
+                  t('Are you sure you want to delete the term %title?', array('%title' => theme('placeholder', $term->name))),
                   'admin/taxonomy',
                   t('Deleting a term will delete all its children if there are any. This action cannot be undone.'),
                   t('Delete'),
@@ -357,13 +357,13 @@ function taxonomy_overview() {
         $types[] = $node_type ? $node_type : $type;
       }
 
-      $rows[] = array($vocabulary->name, implode(', ', $types), l(t('edit vocabulary'), "admin/taxonomy/edit/vocabulary/$vocabulary->vid"), l(t('add term'), "admin/taxonomy/add/term/$vocabulary->vid"), l(t('preview form'), "admin/taxonomy/preview/vocabulary/$vocabulary->vid"));
+      $rows[] = array(check_plain($vocabulary->name), implode(', ', $types), l(t('edit vocabulary'), "admin/taxonomy/edit/vocabulary/$vocabulary->vid"), l(t('add term'), "admin/taxonomy/add/term/$vocabulary->vid"), l(t('preview form'), "admin/taxonomy/preview/vocabulary/$vocabulary->vid"));
 
       $tree = taxonomy_get_tree($vocabulary->vid);
       if ($tree) {
         unset($data);
       foreach ($tree as $term) {
-        $data .= _taxonomy_depth($term->depth) .' '. $term->name .' ('. l(t('edit term'), "admin/taxonomy/edit/term/$term->tid") .')<br />';
+        $data .= _taxonomy_depth($term->depth) .' '. check_plain($term->name) .' ('. l(t('edit term'), "admin/taxonomy/edit/term/$term->tid") .')<br />';
       }
       $rows[] = array(array('data' => $data, 'colspan' => '5'));
       }
@@ -390,7 +390,7 @@ function taxonomy_form($vid, $value = 0, $help = NULL, $name = 'taxonomy') {
     $blank = '<'. t('none') .'>';
   }
 
-  return _taxonomy_term_select($vocabulary->name, $name, $value, $vid, $help, intval($vocabulary->multiple), $blank);
+  return _taxonomy_term_select(check_plain($vocabulary->name), $name, $value, $vid, $help, intval($vocabulary->multiple), $blank);
 }
 
 /**
diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module
index 17de7a520..9ebc1aebf 100644
--- a/modules/taxonomy/taxonomy.module
+++ b/modules/taxonomy/taxonomy.module
@@ -130,7 +130,7 @@ function taxonomy_save_vocabulary($edit) {
       db_query("INSERT INTO {vocabulary_node_types} (vid, type) VALUES (%d, '%s')", $edit['vid'], $type);
     }
     module_invoke_all('taxonomy', 'update', 'vocabulary', $edit);
-    $message = t('Updated vocabulary %name.', array('%name' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('Updated vocabulary %name.', array('%name' => theme('placeholder', $edit['name'])));
   }
   else if ($edit['vid']) {
     $message = taxonomy_del_vocabulary($edit['vid']);
@@ -142,7 +142,7 @@ function taxonomy_save_vocabulary($edit) {
       db_query("INSERT INTO {vocabulary_node_types} (vid, type) VALUES (%d, '%s')", $edit['vid'], $type);
     }
     module_invoke_all('taxonomy', 'insert', 'vocabulary', $edit);
-    $message = t('Created new vocabulary %name.', array('%name' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('Created new vocabulary %name.', array('%name' => theme('placeholder', $edit['name'])));
   }
 
   cache_clear_all();
@@ -236,7 +236,7 @@ function taxonomy_save_term($edit) {
 
     db_query('UPDATE {term_data} SET '. _taxonomy_prepare_update($data) .' WHERE tid = %d', $edit['tid']);
     module_invoke_all('taxonomy', 'update', 'term', $edit);
-    $message = t('The term %term has been updated.', array('%term' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('The term %term has been updated.', array('%term' => theme('placeholder', $edit['name'])));
   }
   else if ($edit['tid']) {
     return taxonomy_del_term($edit['tid']);
@@ -246,7 +246,7 @@ function taxonomy_save_term($edit) {
     $data = array('tid' => $edit['tid'], 'name' => $edit['name'], 'description' => $edit['description'], 'vid' => $edit['vid'], 'weight' => $edit['weight']);
     db_query('INSERT INTO {term_data} '. _taxonomy_prepare_insert($data, 1) .' VALUES '. _taxonomy_prepare_insert($data, 2));
     module_invoke_all('taxonomy', 'insert', 'term', $edit);
-    $message = t('Created new term %term.', array('%term' => '<em>'. $edit['name'] .'</em>'));
+    $message = t('Created new term %term.', array('%term' => theme('placeholder', $edit['name'])));
   }
 
   db_query('DELETE FROM {term_relation} WHERE tid1 = %d OR tid2 = %d', $edit['tid'], $edit['tid']);
@@ -315,7 +315,7 @@ function taxonomy_del_term($tid) {
       db_query('DELETE FROM {term_node} WHERE tid = %d', $tid);
 
       module_invoke_all('taxonomy', 'delete', 'term', $term);
-      drupal_set_message(t('Deleted term %name.', array('%name' => '<em>'. $term->name .'</em>')));
+      drupal_set_message(t('Deleted term %name.', array('%name' => theme('placeholder', $term->name))));
     }
 
     $tids = $orphans;
@@ -331,7 +331,7 @@ function _taxonomy_confirm_del_term($tid) {
   $extra .= form_hidden('tid', $tid);
 
   $output = theme('confirm',
-                  t('Are you sure you want to delete the term %title?', array('%title' => '<em>'. $term->name .'</em>')),
+                  t('Are you sure you want to delete the term %title?', array('%title' => theme('placeholder', $term->name))),
                   'admin/taxonomy',
                   t('Deleting a term will delete all its children if there are any. This action cannot be undone.'),
                   t('Delete'),
@@ -357,13 +357,13 @@ function taxonomy_overview() {
         $types[] = $node_type ? $node_type : $type;
       }
 
-      $rows[] = array($vocabulary->name, implode(', ', $types), l(t('edit vocabulary'), "admin/taxonomy/edit/vocabulary/$vocabulary->vid"), l(t('add term'), "admin/taxonomy/add/term/$vocabulary->vid"), l(t('preview form'), "admin/taxonomy/preview/vocabulary/$vocabulary->vid"));
+      $rows[] = array(check_plain($vocabulary->name), implode(', ', $types), l(t('edit vocabulary'), "admin/taxonomy/edit/vocabulary/$vocabulary->vid"), l(t('add term'), "admin/taxonomy/add/term/$vocabulary->vid"), l(t('preview form'), "admin/taxonomy/preview/vocabulary/$vocabulary->vid"));
 
       $tree = taxonomy_get_tree($vocabulary->vid);
       if ($tree) {
         unset($data);
       foreach ($tree as $term) {
-        $data .= _taxonomy_depth($term->depth) .' '. $term->name .' ('. l(t('edit term'), "admin/taxonomy/edit/term/$term->tid") .')<br />';
+        $data .= _taxonomy_depth($term->depth) .' '. check_plain($term->name) .' ('. l(t('edit term'), "admin/taxonomy/edit/term/$term->tid") .')<br />';
       }
       $rows[] = array(array('data' => $data, 'colspan' => '5'));
       }
@@ -390,7 +390,7 @@ function taxonomy_form($vid, $value = 0, $help = NULL, $name = 'taxonomy') {
     $blank = '<'. t('none') .'>';
   }
 
-  return _taxonomy_term_select($vocabulary->name, $name, $value, $vid, $help, intval($vocabulary->multiple), $blank);
+  return _taxonomy_term_select(check_plain($vocabulary->name), $name, $value, $vid, $help, intval($vocabulary->multiple), $blank);
 }
 
 /**
diff --git a/modules/upload.module b/modules/upload.module
index e6cbae3fc..768092136 100644
--- a/modules/upload.module
+++ b/modules/upload.module
@@ -169,7 +169,7 @@ function upload_nodeapi(&$node, $op, $arg) {
         $total_usersize = upload_count_size($user->uid) + $filesize;
 
         if ($maxsize && $total_size > $maxsize) {
-          form_set_error('upload', t('Error attaching file %name: total file size exceeded', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: total file size exceeded', array('%name' => theme('placeholder', $file->filename))));
           break;
         }
 
@@ -207,13 +207,13 @@ function upload_nodeapi(&$node, $op, $arg) {
         }
 
         if ($error['extension'] == count($user->roles) && $user->uid != 1) {
-          form_set_error('upload', t('Error attaching file %name: invalid extension', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: invalid extension', array('%name' => theme('placeholder', $file->filename))));
         }
         elseif ($error['uploadsize'] == count($user->roles) && $user->uid != 1) {
-          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => theme('placeholder', $file->filename))));
         }
         elseif ($error['usersize'] == count($user->roles) && $user->uid != 1) {
-          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => theme('placeholder', $file->filename))));
         }
         else {
           $key = 'upload_'. count($_SESSION['file_uploads']);
diff --git a/modules/upload/upload.module b/modules/upload/upload.module
index e6cbae3fc..768092136 100644
--- a/modules/upload/upload.module
+++ b/modules/upload/upload.module
@@ -169,7 +169,7 @@ function upload_nodeapi(&$node, $op, $arg) {
         $total_usersize = upload_count_size($user->uid) + $filesize;
 
         if ($maxsize && $total_size > $maxsize) {
-          form_set_error('upload', t('Error attaching file %name: total file size exceeded', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: total file size exceeded', array('%name' => theme('placeholder', $file->filename))));
           break;
         }
 
@@ -207,13 +207,13 @@ function upload_nodeapi(&$node, $op, $arg) {
         }
 
         if ($error['extension'] == count($user->roles) && $user->uid != 1) {
-          form_set_error('upload', t('Error attaching file %name: invalid extension', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: invalid extension', array('%name' => theme('placeholder', $file->filename))));
         }
         elseif ($error['uploadsize'] == count($user->roles) && $user->uid != 1) {
-          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => theme('placeholder', $file->filename))));
         }
         elseif ($error['usersize'] == count($user->roles) && $user->uid != 1) {
-          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => "<em>$file->filename</em>")));
+          form_set_error('upload', t('Error attaching file %name: exceeds maximum file size', array('%name' => theme('placeholder', $file->filename))));
         }
         else {
           $key = 'upload_'. count($_SESSION['file_uploads']);
diff --git a/modules/user.module b/modules/user.module
index 34caea9a0..4e873303f 100644
--- a/modules/user.module
+++ b/modules/user.module
@@ -216,13 +216,13 @@ function user_validate_name($name) {
   if (ereg('  ', $name)) return t('The username cannot contain multiple spaces in a row.');
   if (ereg("[^\x80-\xF7 [:alnum:]@_.-]", $name)) return t('The username contains an illegal character.');
   if (ereg('@', $name) && !eregi('@([0-9a-z](-?[0-9a-z])*.)+[a-z]{2}([zmuvtg]|fo|me)?$', $name)) return t('The username is not a valid authentication ID.');
-  if (strlen($name) > 56) return t('The username %name is too long: it must be less than 56 characters.', array('%name' => "<em>$name</em>"));
+  if (strlen($name) > 56) return t('The username %name is too long: it must be less than 56 characters.', array('%name' => theme('placeholder', $name)));
 }
 
 function user_validate_mail($mail) {
   if (!$mail) return t('You must enter an e-mail address.');
   if (!valid_email_address($mail)) {
-    return t('The e-mail address %mail is not valid.', array('%mail' => "<em>$mail</em>"));
+    return t('The e-mail address %mail is not valid.', array('%mail' => theme('placeholder', $mail)));
   }
 }
 
@@ -262,7 +262,7 @@ function user_validate_authmap($account, $authname, $module) {
   $result = db_query("SELECT COUNT(*) from {authmap} WHERE uid != %d AND authname = '%s'", $account->uid, $authname);
   if (db_result($result) > 0) {
     $name = module_invoke($module, 'info', 'name');
-    return t('The %u ID %s is already taken.', array('%u' => $name, '%s' => "<em>$authname</em>"));
+    return t('The %u ID %s is already taken.', array('%u' => $name, '%s' => theme('placeholder', $authname)));
   }
 }
 
@@ -594,7 +594,7 @@ function theme_user_picture($account) {
       $alt = t('%user\'s picture', array('%user' => $account->name ? $account->name : variable_get('anonymous', 'Anonymous')));
       $picture = theme('image', $picture, $alt, $alt, '', false);
       if ($account->uid) {
-        $picture = l($picture, "user/$account->uid", array('title' => t('View user profile.')));
+        $picture = l($picture, "user/$account->uid", array('title' => t('View user profile.')), NULL, NULL, FALSE, TRUE);
       }
 
       return "<div class=\"picture\">$picture</div>";
@@ -786,7 +786,7 @@ function user_login($edit = array(), $msg = '') {
   }
 
   if (user_deny('user', $edit['name'])) {
-    $error = t('The name %s has been denied access.', array('%s' => '<em>'. $edit['name'] .'</em>'));
+    $error = t('The name %s has been denied access.', array('%s' => theme('placeholder', $edit['name'])));
   }
   else if ($edit['name'] && $edit['pass']) {
 
@@ -795,7 +795,7 @@ function user_login($edit = array(), $msg = '') {
     }
 
     if ($user->uid) {
-      watchdog('user', t('Session opened for %name.', array('%name' => "<em>$user->name</em>")));
+      watchdog('user', t('Session opened for %name.', array('%name' => theme('placeholder', $user->name))));
 
       // Update the user table timestamp noting user has logged in.
       db_query("UPDATE {users} SET changed = '%d' WHERE uid = '%s'", time(), $user->uid);
@@ -807,9 +807,9 @@ function user_login($edit = array(), $msg = '') {
     }
     else {
       if (!$error) {
-        $error = t('Sorry.  Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password');
+        $error = t('Sorry. Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password');
       }
-      watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => '<em>'. $edit['name'] .'</em>', '%error' => '<em>'. $error .'</em>')));
+      watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => theme('placeholder', $edit['name']), '%error' => theme('placeholder', $error))));
     }
   }
 
@@ -851,10 +851,10 @@ function user_authenticate($name, $pass) {
   if (!$user->uid && $server && $result = user_get_authmaps("$name@$server")) {
     if (module_invoke(key($result), 'auth', $name, $pass, $server)) {
       $user = user_external_load("$name@$server");
-      watchdog('user', t('External load by %user using module %module.', array('%user' => "<em>$name@$server</em>", '%module' => '<em>'. key($result) .'</em>')));
+      watchdog('user', t('External load by %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', key($result)))));
     }
     else {
-      $error = t('Invalid password for %s.', array('%s' => "<em>$name@$server</em>"));
+      $error = t('Invalid password for %s.', array('%s' => theme('placeholder', $name .'@'. $server)));
     }
   }
 
@@ -868,7 +868,7 @@ function user_authenticate($name, $pass) {
             $account = user_load(array('name' => "$name@$server"));
             if (!$account->uid) { // Register this new user.
               $user = user_save('', array('name' => "$name@$server", 'pass' => user_password(), 'init' => "$name@$server", 'status' => 1, "authname_$module" => "$name@$server", 'roles' => array(_user_authenticated_id())));
-              watchdog('user', t('New external user: %user using module %module.', array('%user' => "<em>$name@$server</em>", '%module' => "<em>$module</em>")), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
+              watchdog('user', t('New external user: %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', $module))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
               break;
             }
           }
@@ -889,7 +889,7 @@ function _user_authenticated_id() {
 function user_logout() {
   global $user;
 
-  watchdog('user', t('Session closed for %name.', array('%name' => '<em>'. $user->name .'</em>')));
+  watchdog('user', t('Session closed for %name.', array('%name' => theme('placeholder', $user->name))));
 
   // Destroy the current session:
   session_destroy();
@@ -904,10 +904,10 @@ function user_pass() {
   $edit = $_POST['edit'];
 
   if ($edit['name'] && !($account = user_load(array('name' => $edit['name'], 'status' => 1)))) {
-    form_set_error('name', t('Sorry. The username %name is not recognized.', array('%name' => '<em>'. $edit['name'] .'</em>')));
+    form_set_error('name', t('Sorry. The username %name is not recognized.', array('%name' => theme('placeholder', $edit['name']))));
   }
   else if ($edit['mail'] && !($account = user_load(array('mail' => $edit['mail'], 'status' => 1)))) {
-    form_set_error('mail', t('Sorry. The e-mail address %email is not recognized.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
+    form_set_error('mail', t('Sorry. The e-mail address %email is not recognized.', array('%email' => theme('placeholder', $edit['mail']))));
   }
   if ($account) {
     $from = variable_get('site_mail', ini_get('sendmail_from'));
@@ -924,11 +924,11 @@ function user_pass() {
     $mail_success = user_mail($account->mail, $subject, $body, $headers);
 
     if ($mail_success) {
-      watchdog('user', t('Password mailed to %name at %email.', array('%name' => '<em>'. $account->name .'</em>', '%email' => '<em>'. $account->mail .'</em>')));
+      watchdog('user', t('Password mailed to %name at %email.', array('%name' => theme('placeholder', $account->mail))));
       drupal_set_message(t('Your password and further instructions have been sent to your e-mail address.'));
     }
     else {
-      watchdog('user', t('Error mailing password to %name at %email.', array('%name' => '<em>'. $account->name .'</em>', '%email' => '<em>'. $account->mail .'</em>')), WATCHDOG_ERROR);
+      watchdog('user', t('Error mailing password to %name at %email.', array('%name' => theme('placeholder', $account->name), '%email' => theme('placeholder', $account->mail))), WATCHDOG_ERROR);
       drupal_set_message(t('Unable to send mail. Please contact the site admin.'));
     }
     drupal_goto('user');
@@ -964,7 +964,7 @@ function user_register($edit = array()) {
       // TODO: Is this necessary? Won't session_write() replicate this?
       unset($edit['session']);
       $account = user_save('', array_merge(array('name' => $edit['name'], 'pass' => $pass, 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => array(_user_authenticated_id()), 'status' => (variable_get('user_register', 1) == 1 ? 1 : 0)), $edit));
-      watchdog('user', t('New user: %name %email.', array('%name' => '<em>'. $edit['name'] .'</em>', '%email' => '<em>&lt;'. $edit['mail'] .'&gt;</em>')), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit'));
+      watchdog('user', t('New user: %name %email.', array('%name' => theme('placeholder', $edit['name']), '%email' => theme('placeholder', '<'. $edit['mail'] .'>'))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit'));
 
       $variables = array('%username' => $edit['name'], '%site' => variable_get('site_name', 'drupal'), '%password' => $pass, '%uri' => $base_url, '%uri_brief' => substr($base_url, strlen('http://')), '%mailto' => $edit['mail'], '%date' => format_date(time()), '%login_uri' => url('user', NULL, NULL, TRUE), '%edit_uri' => url('user/'. $account->uid .'/edit', NULL, NULL, TRUE));
 
@@ -1057,10 +1057,10 @@ function user_edit_validate($uid, &$edit) {
     form_set_error('name', $error);
   }
   else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(name) = LOWER('%s')", $uid, $edit['name'])) > 0) {
-    form_set_error('name', t('The name %name is already taken.', array('%name' => '<em>'. $edit['name'] .'</em>')));
+    form_set_error('name', t('The name %name is already taken.', array('%name' => theme('placeholder', $edit['name']))));
   }
   else if (user_deny('user', $edit['name'])) {
-    form_set_error('name', t('The name %name has been denied access.', array('%name' => '<em>'. $edit['name'] .'</em>')));
+    form_set_error('name', t('The name %name has been denied access.', array('%name' => theme('placeholder', $edit['name']))));
   }
 
   // Validate the e-mail address:
@@ -1068,10 +1068,10 @@ function user_edit_validate($uid, &$edit) {
     form_set_error('mail', $error);
   }
   else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(mail) = LOWER('%s')", $uid, $edit['mail'])) > 0) {
-    form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
+    form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => theme('placeholder', $edit['mail']))));
   }
   else if (user_deny('mail', $edit['mail'])) {
-    form_set_error('mail', t('The e-mail address %email has been denied access.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
+    form_set_error('mail', t('The e-mail address %email has been denied access.', array('%email' => theme('placeholder', $edit['mail']))));
   }
 
   // Validate the user roles:
@@ -1150,7 +1150,7 @@ function user_edit($category = 'account') {
     }
     else {
       $output = theme('confirm',
-                      t('Are you sure you want to delete the account %name?', array('%name' => '<em>'. $account->name .'</em>')),
+                      t('Are you sure you want to delete the account %name?', array('%name' => theme('placeholder', $account->name))),
                       'user/'. $account->uid,
                       t('Deleting a user will remove all their submissions as well. This action cannot be undone.'),
                       t('Delete'));
@@ -1296,11 +1296,11 @@ function user_admin_create($edit = array()) {
     user_module_invoke('validate', $edit, $edit, 'account');
 
     if (!form_get_errors()) {
-      watchdog('user', t('New user: %name %email.', array('%name' => '<em>'. $edit['name'] .'</em>', '%email' => '<em>&lt;'. $edit['mail'] .'&gt;</em>')));
+      watchdog('user', t('New user: %name %email.', array('%name' => theme('placeholder', $edit['name']), '%email' => theme('placeholder', '<'. $edit['mail'] .'>'))));
 
       user_save('', array('name' => $edit['name'], 'pass' => $edit['pass'], 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => $edit['roles'], 'status' => 1));
 
-      drupal_set_message(t('Created a new user account.  No e-mail has been sent.'));
+      drupal_set_message(t('Created a new user account. No e-mail has been sent.'));
 
       return;
     }
@@ -1327,10 +1327,10 @@ function user_admin_access_check() {
 
   if ($op) {
     if (user_deny($edit['type'], $edit['test'])) {
-      drupal_set_message(t('%test is not allowed.', array('%test' => '<em>'. $edit['test'] .'</em>')));
+      drupal_set_message(t('%test is not allowed.', array('%test' => theme('placeholder', $edit['test']))));
     }
     else {
-      drupal_set_message(t('%test is allowed.', array('%test' => '<em>'. $edit['test'] .'</em>')));
+      drupal_set_message(t('%test is allowed.', array('%test' => theme('placeholder', $edit['test']))));
     }
   }
 
@@ -1383,7 +1383,7 @@ function user_admin_access_delete($aid = 0) {
     $edit = db_fetch_object(db_query('SELECT aid, type, status, mask FROM {access} WHERE aid = %d', $aid));
 
     $output = theme('confirm',
-                    t('Are you sure you want to delete the %type rule for %rule?', array('%type' => $access_types[$edit->type], '%rule' => '<em>'. $edit->mask .'</em>')),
+                    t('Are you sure you want to delete the %type rule for %rule?', array('%type' => $access_types[$edit->type], '%rule' => theme('placeholder', $edit->mask))),
                     'admin/access/rules',
                     t('This action cannot be undone.'),
                     t('Delete'),
@@ -1580,7 +1580,7 @@ function user_admin_role() {
     // Display the role form.
     $role = db_fetch_object(db_query('SELECT * FROM {role} WHERE rid = %d', $id));
 
-    $output .= form_textfield(t('Role name'), 'name', $role->name, 32, 64, t('The name for this role.  Example: "moderator", "editorial board", "site architect".'));
+    $output .= form_textfield(t('Role name'), 'name', $role->name, 32, 64, t('The name for this role. Example: "moderator", "editorial board", "site architect".'));
     $output .= form_submit(t('Save role'));
     $output .= form_submit(t('Delete role'));
 
@@ -1615,7 +1615,7 @@ function user_admin_account() {
     array('data' => t('Username'), 'field' => 'u.name'),
     array('data' => t('Status'), 'field' => 'u.status'),
     array('data' => t('Roles')),
-    array('data' => t('Last access'), 'field'  => 'u.changed', 'sort' => 'desc'),
+    array('data' => t('Last access'), 'field' => 'u.changed', 'sort' => 'desc'),
     t('Operations')
   );
   $sql = 'SELECT u.uid, u.name, u.status, u.changed FROM {users} u WHERE uid != 0';
diff --git a/modules/user/user.module b/modules/user/user.module
index 34caea9a0..4e873303f 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -216,13 +216,13 @@ function user_validate_name($name) {
   if (ereg('  ', $name)) return t('The username cannot contain multiple spaces in a row.');
   if (ereg("[^\x80-\xF7 [:alnum:]@_.-]", $name)) return t('The username contains an illegal character.');
   if (ereg('@', $name) && !eregi('@([0-9a-z](-?[0-9a-z])*.)+[a-z]{2}([zmuvtg]|fo|me)?$', $name)) return t('The username is not a valid authentication ID.');
-  if (strlen($name) > 56) return t('The username %name is too long: it must be less than 56 characters.', array('%name' => "<em>$name</em>"));
+  if (strlen($name) > 56) return t('The username %name is too long: it must be less than 56 characters.', array('%name' => theme('placeholder', $name)));
 }
 
 function user_validate_mail($mail) {
   if (!$mail) return t('You must enter an e-mail address.');
   if (!valid_email_address($mail)) {
-    return t('The e-mail address %mail is not valid.', array('%mail' => "<em>$mail</em>"));
+    return t('The e-mail address %mail is not valid.', array('%mail' => theme('placeholder', $mail)));
   }
 }
 
@@ -262,7 +262,7 @@ function user_validate_authmap($account, $authname, $module) {
   $result = db_query("SELECT COUNT(*) from {authmap} WHERE uid != %d AND authname = '%s'", $account->uid, $authname);
   if (db_result($result) > 0) {
     $name = module_invoke($module, 'info', 'name');
-    return t('The %u ID %s is already taken.', array('%u' => $name, '%s' => "<em>$authname</em>"));
+    return t('The %u ID %s is already taken.', array('%u' => $name, '%s' => theme('placeholder', $authname)));
   }
 }
 
@@ -594,7 +594,7 @@ function theme_user_picture($account) {
       $alt = t('%user\'s picture', array('%user' => $account->name ? $account->name : variable_get('anonymous', 'Anonymous')));
       $picture = theme('image', $picture, $alt, $alt, '', false);
       if ($account->uid) {
-        $picture = l($picture, "user/$account->uid", array('title' => t('View user profile.')));
+        $picture = l($picture, "user/$account->uid", array('title' => t('View user profile.')), NULL, NULL, FALSE, TRUE);
       }
 
       return "<div class=\"picture\">$picture</div>";
@@ -786,7 +786,7 @@ function user_login($edit = array(), $msg = '') {
   }
 
   if (user_deny('user', $edit['name'])) {
-    $error = t('The name %s has been denied access.', array('%s' => '<em>'. $edit['name'] .'</em>'));
+    $error = t('The name %s has been denied access.', array('%s' => theme('placeholder', $edit['name'])));
   }
   else if ($edit['name'] && $edit['pass']) {
 
@@ -795,7 +795,7 @@ function user_login($edit = array(), $msg = '') {
     }
 
     if ($user->uid) {
-      watchdog('user', t('Session opened for %name.', array('%name' => "<em>$user->name</em>")));
+      watchdog('user', t('Session opened for %name.', array('%name' => theme('placeholder', $user->name))));
 
       // Update the user table timestamp noting user has logged in.
       db_query("UPDATE {users} SET changed = '%d' WHERE uid = '%s'", time(), $user->uid);
@@ -807,9 +807,9 @@ function user_login($edit = array(), $msg = '') {
     }
     else {
       if (!$error) {
-        $error = t('Sorry.  Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password');
+        $error = t('Sorry. Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password');
       }
-      watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => '<em>'. $edit['name'] .'</em>', '%error' => '<em>'. $error .'</em>')));
+      watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => theme('placeholder', $edit['name']), '%error' => theme('placeholder', $error))));
     }
   }
 
@@ -851,10 +851,10 @@ function user_authenticate($name, $pass) {
   if (!$user->uid && $server && $result = user_get_authmaps("$name@$server")) {
     if (module_invoke(key($result), 'auth', $name, $pass, $server)) {
       $user = user_external_load("$name@$server");
-      watchdog('user', t('External load by %user using module %module.', array('%user' => "<em>$name@$server</em>", '%module' => '<em>'. key($result) .'</em>')));
+      watchdog('user', t('External load by %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', key($result)))));
     }
     else {
-      $error = t('Invalid password for %s.', array('%s' => "<em>$name@$server</em>"));
+      $error = t('Invalid password for %s.', array('%s' => theme('placeholder', $name .'@'. $server)));
     }
   }
 
@@ -868,7 +868,7 @@ function user_authenticate($name, $pass) {
             $account = user_load(array('name' => "$name@$server"));
             if (!$account->uid) { // Register this new user.
               $user = user_save('', array('name' => "$name@$server", 'pass' => user_password(), 'init' => "$name@$server", 'status' => 1, "authname_$module" => "$name@$server", 'roles' => array(_user_authenticated_id())));
-              watchdog('user', t('New external user: %user using module %module.', array('%user' => "<em>$name@$server</em>", '%module' => "<em>$module</em>")), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
+              watchdog('user', t('New external user: %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', $module))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
               break;
             }
           }
@@ -889,7 +889,7 @@ function _user_authenticated_id() {
 function user_logout() {
   global $user;
 
-  watchdog('user', t('Session closed for %name.', array('%name' => '<em>'. $user->name .'</em>')));
+  watchdog('user', t('Session closed for %name.', array('%name' => theme('placeholder', $user->name))));
 
   // Destroy the current session:
   session_destroy();
@@ -904,10 +904,10 @@ function user_pass() {
   $edit = $_POST['edit'];
 
   if ($edit['name'] && !($account = user_load(array('name' => $edit['name'], 'status' => 1)))) {
-    form_set_error('name', t('Sorry. The username %name is not recognized.', array('%name' => '<em>'. $edit['name'] .'</em>')));
+    form_set_error('name', t('Sorry. The username %name is not recognized.', array('%name' => theme('placeholder', $edit['name']))));
   }
   else if ($edit['mail'] && !($account = user_load(array('mail' => $edit['mail'], 'status' => 1)))) {
-    form_set_error('mail', t('Sorry. The e-mail address %email is not recognized.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
+    form_set_error('mail', t('Sorry. The e-mail address %email is not recognized.', array('%email' => theme('placeholder', $edit['mail']))));
   }
   if ($account) {
     $from = variable_get('site_mail', ini_get('sendmail_from'));
@@ -924,11 +924,11 @@ function user_pass() {
     $mail_success = user_mail($account->mail, $subject, $body, $headers);
 
     if ($mail_success) {
-      watchdog('user', t('Password mailed to %name at %email.', array('%name' => '<em>'. $account->name .'</em>', '%email' => '<em>'. $account->mail .'</em>')));
+      watchdog('user', t('Password mailed to %name at %email.', array('%name' => theme('placeholder', $account->mail))));
       drupal_set_message(t('Your password and further instructions have been sent to your e-mail address.'));
     }
     else {
-      watchdog('user', t('Error mailing password to %name at %email.', array('%name' => '<em>'. $account->name .'</em>', '%email' => '<em>'. $account->mail .'</em>')), WATCHDOG_ERROR);
+      watchdog('user', t('Error mailing password to %name at %email.', array('%name' => theme('placeholder', $account->name), '%email' => theme('placeholder', $account->mail))), WATCHDOG_ERROR);
       drupal_set_message(t('Unable to send mail. Please contact the site admin.'));
     }
     drupal_goto('user');
@@ -964,7 +964,7 @@ function user_register($edit = array()) {
       // TODO: Is this necessary? Won't session_write() replicate this?
       unset($edit['session']);
       $account = user_save('', array_merge(array('name' => $edit['name'], 'pass' => $pass, 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => array(_user_authenticated_id()), 'status' => (variable_get('user_register', 1) == 1 ? 1 : 0)), $edit));
-      watchdog('user', t('New user: %name %email.', array('%name' => '<em>'. $edit['name'] .'</em>', '%email' => '<em>&lt;'. $edit['mail'] .'&gt;</em>')), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit'));
+      watchdog('user', t('New user: %name %email.', array('%name' => theme('placeholder', $edit['name']), '%email' => theme('placeholder', '<'. $edit['mail'] .'>'))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit'));
 
       $variables = array('%username' => $edit['name'], '%site' => variable_get('site_name', 'drupal'), '%password' => $pass, '%uri' => $base_url, '%uri_brief' => substr($base_url, strlen('http://')), '%mailto' => $edit['mail'], '%date' => format_date(time()), '%login_uri' => url('user', NULL, NULL, TRUE), '%edit_uri' => url('user/'. $account->uid .'/edit', NULL, NULL, TRUE));
 
@@ -1057,10 +1057,10 @@ function user_edit_validate($uid, &$edit) {
     form_set_error('name', $error);
   }
   else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(name) = LOWER('%s')", $uid, $edit['name'])) > 0) {
-    form_set_error('name', t('The name %name is already taken.', array('%name' => '<em>'. $edit['name'] .'</em>')));
+    form_set_error('name', t('The name %name is already taken.', array('%name' => theme('placeholder', $edit['name']))));
   }
   else if (user_deny('user', $edit['name'])) {
-    form_set_error('name', t('The name %name has been denied access.', array('%name' => '<em>'. $edit['name'] .'</em>')));
+    form_set_error('name', t('The name %name has been denied access.', array('%name' => theme('placeholder', $edit['name']))));
   }
 
   // Validate the e-mail address:
@@ -1068,10 +1068,10 @@ function user_edit_validate($uid, &$edit) {
     form_set_error('mail', $error);
   }
   else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(mail) = LOWER('%s')", $uid, $edit['mail'])) > 0) {
-    form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
+    form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => theme('placeholder', $edit['mail']))));
   }
   else if (user_deny('mail', $edit['mail'])) {
-    form_set_error('mail', t('The e-mail address %email has been denied access.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
+    form_set_error('mail', t('The e-mail address %email has been denied access.', array('%email' => theme('placeholder', $edit['mail']))));
   }
 
   // Validate the user roles:
@@ -1150,7 +1150,7 @@ function user_edit($category = 'account') {
     }
     else {
       $output = theme('confirm',
-                      t('Are you sure you want to delete the account %name?', array('%name' => '<em>'. $account->name .'</em>')),
+                      t('Are you sure you want to delete the account %name?', array('%name' => theme('placeholder', $account->name))),
                       'user/'. $account->uid,
                       t('Deleting a user will remove all their submissions as well. This action cannot be undone.'),
                       t('Delete'));
@@ -1296,11 +1296,11 @@ function user_admin_create($edit = array()) {
     user_module_invoke('validate', $edit, $edit, 'account');
 
     if (!form_get_errors()) {
-      watchdog('user', t('New user: %name %email.', array('%name' => '<em>'. $edit['name'] .'</em>', '%email' => '<em>&lt;'. $edit['mail'] .'&gt;</em>')));
+      watchdog('user', t('New user: %name %email.', array('%name' => theme('placeholder', $edit['name']), '%email' => theme('placeholder', '<'. $edit['mail'] .'>'))));
 
       user_save('', array('name' => $edit['name'], 'pass' => $edit['pass'], 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => $edit['roles'], 'status' => 1));
 
-      drupal_set_message(t('Created a new user account.  No e-mail has been sent.'));
+      drupal_set_message(t('Created a new user account. No e-mail has been sent.'));
 
       return;
     }
@@ -1327,10 +1327,10 @@ function user_admin_access_check() {
 
   if ($op) {
     if (user_deny($edit['type'], $edit['test'])) {
-      drupal_set_message(t('%test is not allowed.', array('%test' => '<em>'. $edit['test'] .'</em>')));
+      drupal_set_message(t('%test is not allowed.', array('%test' => theme('placeholder', $edit['test']))));
     }
     else {
-      drupal_set_message(t('%test is allowed.', array('%test' => '<em>'. $edit['test'] .'</em>')));
+      drupal_set_message(t('%test is allowed.', array('%test' => theme('placeholder', $edit['test']))));
     }
   }
 
@@ -1383,7 +1383,7 @@ function user_admin_access_delete($aid = 0) {
     $edit = db_fetch_object(db_query('SELECT aid, type, status, mask FROM {access} WHERE aid = %d', $aid));
 
     $output = theme('confirm',
-                    t('Are you sure you want to delete the %type rule for %rule?', array('%type' => $access_types[$edit->type], '%rule' => '<em>'. $edit->mask .'</em>')),
+                    t('Are you sure you want to delete the %type rule for %rule?', array('%type' => $access_types[$edit->type], '%rule' => theme('placeholder', $edit->mask))),
                     'admin/access/rules',
                     t('This action cannot be undone.'),
                     t('Delete'),
@@ -1580,7 +1580,7 @@ function user_admin_role() {
     // Display the role form.
     $role = db_fetch_object(db_query('SELECT * FROM {role} WHERE rid = %d', $id));
 
-    $output .= form_textfield(t('Role name'), 'name', $role->name, 32, 64, t('The name for this role.  Example: "moderator", "editorial board", "site architect".'));
+    $output .= form_textfield(t('Role name'), 'name', $role->name, 32, 64, t('The name for this role. Example: "moderator", "editorial board", "site architect".'));
     $output .= form_submit(t('Save role'));
     $output .= form_submit(t('Delete role'));
 
@@ -1615,7 +1615,7 @@ function user_admin_account() {
     array('data' => t('Username'), 'field' => 'u.name'),
     array('data' => t('Status'), 'field' => 'u.status'),
     array('data' => t('Roles')),
-    array('data' => t('Last access'), 'field'  => 'u.changed', 'sort' => 'desc'),
+    array('data' => t('Last access'), 'field' => 'u.changed', 'sort' => 'desc'),
     t('Operations')
   );
   $sql = 'SELECT u.uid, u.name, u.status, u.changed FROM {users} u WHERE uid != 0';
-- 
cgit v1.2.3