diff --git a/design/admin/templates/class/edit.tpl b/design/admin/templates/class/edit.tpl
index 2ece3b38cee..c854a538777 100644
--- a/design/admin/templates/class/edit.tpl
+++ b/design/admin/templates/class/edit.tpl
@@ -87,7 +87,7 @@
 <div class="context-information">
 <p class="left modified">{'Last modified'|i18n( 'design/admin/class/edit' )}:&nbsp;{$class.modified|l10n( shortdatetime )},&nbsp;{$class.modifier.contentobject.name|wash}</p>
 {def $locale = fetch( 'content', 'locale', hash( 'locale_code', $language_code ) )}
-<p class="right translation">{$locale.intl_language_name}&nbsp;<img src="{$language_code|flag_icon}" width="18" height="12" alt="{$language_code}" style="vertical-align: middle;" /></p>
+<p class="right translation">{$locale.intl_language_name}&nbsp;<img src="{$language_code|flag_icon}" width="18" height="12" alt="{$language_code|wash}" style="vertical-align: middle;" /></p>
 {undef $locale}
 <div class="break"></div>
 </div>
diff --git a/design/admin/templates/class/view.tpl b/design/admin/templates/class/view.tpl
index daca59f08fe..9dd0e962b9e 100644
--- a/design/admin/templates/class/view.tpl
+++ b/design/admin/templates/class/view.tpl
@@ -36,7 +36,7 @@
 <div class="context-information">
 <p class="left modified">{'Last modified: %time, %username'|i18n( 'design/admin/class/view',, hash( '%username',$class.modifier.contentobject.name, '%time', $class.modified|l10n( shortdatetime ) ) )|wash}</p>
 {def $locale = fetch( 'content', 'locale', hash( 'locale_code', $language_code ) )}
-<p class="right translation">{$locale.intl_language_name}&nbsp;<img src="{$language_code|flag_icon}" width="18" height="12" alt="{$language_code}" style="vertical-align: middle;" /></p>
+<p class="right translation">{$locale.intl_language_name}&nbsp;<img src="{$language_code|flag_icon}" width="18" height="12" alt="{$language_code|wash}" style="vertical-align: middle;" /></p>
 {undef $locale}
 <div class="break"></div>
 </div>
diff --git a/design/admin/templates/content/search.tpl b/design/admin/templates/content/search.tpl
index 7c8772ea714..55f63f31041 100644
--- a/design/admin/templates/content/search.tpl
+++ b/design/admin/templates/content/search.tpl
@@ -38,7 +38,7 @@
 <div class="block">
 <label><input type="radio" name="SubTreeArray" value="1" />{'All content'|i18n('design/admin/content/search')}</label>
 {def $search_node = fetch('content', 'node', hash( 'node_id', $search_subtree_array.0 ))}
-<label><input type="radio" name="SubTreeArray" value="{$search_subtree_array.0}" checked="checked" />{'The same location'|i18n('design/admin/content/search')} ({$search_node.name|wash})</label>
+<label><input type="radio" name="SubTreeArray" value="{$search_subtree_array.0|wash}" checked="checked" />{'The same location'|i18n('design/admin/content/search')} ({$search_node.name|wash})</label>
 {undef $search_node}
 </div>
 {/if}
diff --git a/design/admin/templates/node/view/full.tpl b/design/admin/templates/node/view/full.tpl
index 68ecdb200c4..aa51946214c 100644
--- a/design/admin/templates/node/view/full.tpl
+++ b/design/admin/templates/node/view/full.tpl
@@ -44,7 +44,7 @@
 
 <div class="context-information">
 <p class="left modified">{'Last modified'|i18n( 'design/admin/node/view/full' )}: {$node.object.modified|l10n(shortdatetime)}, <a href={$node.object.current.creator.main_node.url_alias|ezurl}>{$node.object.current.creator.name|wash}</a> ({'Node ID'|i18n( 'design/admin/node/view/full' )}: {$node.node_id}, {'Object ID'|i18n( 'design/admin/node/view/full' )}: {$node.object.id})</p>
-<p class="right translation">{$node.object.current_language_object.locale_object.intl_language_name}&nbsp;<img src="{$node.object.current_language|flag_icon}" width="18" height="12" alt="{$language_code}" style="vertical-align: middle;" /></p>
+<p class="right translation">{$node.object.current_language_object.locale_object.intl_language_name}&nbsp;<img src="{$node.object.current_language|flag_icon}" width="18" height="12" alt="{$language_code|wash}" style="vertical-align: middle;" /></p>
 <div class="break"></div>
 </div>
 
diff --git a/design/admin/templates/page_search.tpl b/design/admin/templates/page_search.tpl
index aeb9101ebe8..b192b462848 100644
--- a/design/admin/templates/page_search.tpl
+++ b/design/admin/templates/page_search.tpl
@@ -68,7 +68,7 @@
                         {/foreach}
                     </select>
 
-                    <label{if $disabled} class="disabled"{/if}><input type="radio" name="SubTreeArray" value="{$search_node_id}" checked="checked" title="{$search_title|wash}" />{$search_title|wash}</label>
+                    <label{if $disabled} class="disabled"{/if}><input type="radio" name="SubTreeArray" value="{$search_node_id|wash}" checked="checked" title="{$search_title|wash}" />{$search_title|wash}</label>
                     {if $search_node_id|ne( 1 )}
                     <label{if $disabled} class="disabled"{/if}><input type="radio" name="SubTreeArray" value="1"{if $disabled} disabled="disabled"{else} title="{'Search in all content'|i18n( 'design/admin/pagelayout' )}"{/if} />{'Search in all content'|i18n( 'design/admin/pagelayout' )}</label>
                     {/if}
diff --git a/extension/ezoe/design/standard/templates/ezoe/upload_files.tpl b/extension/ezoe/design/standard/templates/ezoe/upload_files.tpl
index 14473055f53..3c3e44507e5 100644
--- a/extension/ezoe/design/standard/templates/ezoe/upload_files.tpl
+++ b/extension/ezoe/design/standard/templates/ezoe/upload_files.tpl
@@ -81,7 +81,7 @@ tinyMCEPopup.onInit.add( function(){
                         </tr>
                         {foreach $grouped_related_contentobjects.files as $file sequence array( bglight, bgdark ) as $sequence}
                             <tr class="{$sequence}">
-                                <td class="name">{$file.object.class_name|class_icon( small, $file.object.class_name )}&nbsp;<a href="JavaScript:eZOEPopupUtils.selectByEmbedId( {$file.object.id} )">{$file.object.name|wash|shorten( 35 )}</a></td>
+                                <td class="name">{$file.object.class_name|class_icon( small, $file.object.class_name )}&nbsp;<a href="JavaScript:eZOEPopupUtils.selectByEmbedId( {$file.object.id|wash('javascript')} )">{$file.object.name|wash|shorten( 35 )}</a></td>
                                 <td class="filetype">{$file.object.data_map.file.content.mime_type|wash}</td>
                                 <td class="filesize">{$file.object.data_map.file.content.filesize|si( byte )}</td>
                             </tr>
diff --git a/extension/ezoe/design/standard/templates/ezoe/upload_images.tpl b/extension/ezoe/design/standard/templates/ezoe/upload_images.tpl
index e23478b0a08..95bd21980b0 100644
--- a/extension/ezoe/design/standard/templates/ezoe/upload_images.tpl
+++ b/extension/ezoe/design/standard/templates/ezoe/upload_images.tpl
@@ -93,7 +93,7 @@ eZOEPopupUtils.settings.browseClassGenerator = function( n, hasImage ){
                     {foreach $grouped_related_contentobjects.images as $img}
 
                     <div class="image-thumbnail-item">
-                        <a title="{$img.object.name|wash}" href="JavaScript:eZOEPopupUtils.selectByEmbedId( {$img.object.id} )" class="contenttype_image">
+                        <a title="{$img.object.name|wash}" href="JavaScript:eZOEPopupUtils.selectByEmbedId( {$img.object.id|wash('javascript')} )" class="contenttype_image">
                         {attribute_view_gui attribute=$img.object.data_map[ $img.image_attribute ] image_class=small}
                         </a>
                     </div>
diff --git a/extension/ezoe/design/standard/templates/ezoe/upload_objects.tpl b/extension/ezoe/design/standard/templates/ezoe/upload_objects.tpl
index 6dcacd57045..b589aa2114c 100755
--- a/extension/ezoe/design/standard/templates/ezoe/upload_objects.tpl
+++ b/extension/ezoe/design/standard/templates/ezoe/upload_objects.tpl
@@ -80,7 +80,7 @@ tinyMCEPopup.onInit.add( function(){
                     </tr>
                     {foreach $grouped_related_contentobjects.objects as $relation sequence array( bglight, bgdark ) as $sequence}
                         <tr class="{$sequence}">
-                            <td class="name">{$relation.object.class_name|class_icon( small, $relation.object.class_name )}&nbsp;<a href="JavaScript:eZOEPopupUtils.selectByEmbedId( {$relation.object.id} )">{$relation.object.name|wash|shorten( 35 )}</a></td>
+                            <td class="name">{$relation.object.class_name|class_icon( small, $relation.object.class_name )}&nbsp;<a href="JavaScript:eZOEPopupUtils.selectByEmbedId( {$relation.object.id|wash('javascript')} )">{$relation.object.name|wash|shorten( 35 )}</a></td>
                             <td class="class">{$relation.object.class_name|wash}</td>
                         </tr>
                     {/foreach}
diff --git a/extension/ezoe/modules/ezoe/relations.php b/extension/ezoe/modules/ezoe/relations.php
index 47f09988148..7c20173165f 100644
--- a/extension/ezoe/modules/ezoe/relations.php
+++ b/extension/ezoe/modules/ezoe/relations.php
@@ -97,7 +97,7 @@
 
 if ( !$embedObject instanceof eZContentObject || !$embedObject->canRead()  )
 {
-   echo ezpI18n::tr( 'design/standard/ezoe', 'Invalid parameter: %parameter = %value', null, array( '%parameter' => 'EmbedID', '%value' => $Params['EmbedID'] ) );
+   echo ezpI18n::tr( 'design/standard/ezoe', 'Invalid parameter: %parameter = %value', null, array( '%parameter' => 'EmbedID', '%value' => (int)$Params['EmbedID'] ) );
    eZExecution::cleanExit();
 }
 
diff --git a/extension/ezoe/modules/ezoe/upload.php b/extension/ezoe/modules/ezoe/upload.php
index db5cf8505c3..0b7b72869c7 100755
--- a/extension/ezoe/modules/ezoe/upload.php
+++ b/extension/ezoe/modules/ezoe/upload.php
@@ -121,7 +121,7 @@
         }
 
         $uploadVersion = $uploadedOk['contentobject']->currentVersion();
-        $newObjectID = $uploadedOk['contentobject']->attribute( 'id' );
+        $newObjectID = (int)$uploadedOk['contentobject']->attribute( 'id' );
 
         foreach ( $uploadVersion->dataMap() as $key => $attr )
         {
@@ -201,7 +201,7 @@
             eZContentObject::RELATION_EMBED
         );
         echo '<html><head><title>HiddenUploadFrame</title><script type="text/javascript">';
-        echo 'window.parent.eZOEPopupUtils.selectByEmbedId( ' . $newObjectID . ', ' . $newObjectNodeID . ', "' . $newObjectName . '" );';
+        echo 'window.parent.eZOEPopupUtils.selectByEmbedId( ' . $newObjectID . ', ' . $newObjectNodeID . ', ' . json_encode( $newObjectName ) . ' );';
         echo '</script></head><body></body></html>';
     }
     catch ( InvalidArgumentException $e )