diff --git a/mod/data/classes/template.php b/mod/data/classes/template.php
index fef8999476895..ff36ae5d3e3a5 100644
--- a/mod/data/classes/template.php
+++ b/mod/data/classes/template.php
@@ -993,7 +993,7 @@ private function get_field_input(
                 $errors .= $renderer->notification(get_string(
                     'missingfieldtype',
                     'data',
-                    (object)['name' => $field->field->name]
+                    (object)['name' => s($field->field->name)]
                 ));
             }
         } else {
diff --git a/mod/data/export_form.php b/mod/data/export_form.php
index 75f27f4b5d269..470596afe6e23 100644
--- a/mod/data/export_form.php
+++ b/mod/data/export_form.php
@@ -71,7 +71,7 @@ function definition() {
         $exportfields = [];
         $unsupportedfields = [];
         foreach ($this->_datafields as $field) {
-            $label = get_string('fieldnametype', 'data', (object)['name' => $field->field->name, 'type' => $field->name()]);
+            $label = get_string('fieldnametype', 'data', (object)['name' => s($field->field->name), 'type' => $field->name()]);
             if ($field->text_export_supported()) {
                 $numfieldsthatcanbeselected++;
                 $exportfields[] = $mform->createElement('advcheckbox', 'field_' . $field->field->id, '', $label,
diff --git a/mod/data/field.php b/mod/data/field.php
index f5385b839aedf..171e4aa055b0c 100644
--- a/mod/data/field.php
+++ b/mod/data/field.php
@@ -240,7 +240,7 @@
                 } else {
                     $fieldtypename = $field->name();
                 }
-                echo $OUTPUT->confirm('<strong>' . $fieldtypename . ': ' . $field->field->name . '</strong><br /><br />' .
+                echo $OUTPUT->confirm('<strong>' . $fieldtypename . ': ' . s($field->field->name) . '</strong><br /><br />' .
                         get_string('confirmdeletefield', 'data'),
                         'field.php?d=' . $data->id . '&mode=delete&fid=' . $fid . '&confirm=1',
                         'field.php?d=' . $data->id,
@@ -410,7 +410,7 @@
         $actionmenutemplate = $actionmenu->export_for_template($OUTPUT);
 
         $table->data[] = [
-            $field->field->name,
+            s($field->field->name),
             $fieltypedata,
             $field->field->required ? get_string('yes') : get_string('no'),
             shorten_text($field->field->description, 30),
@@ -435,9 +435,9 @@
         echo '<optgroup label="'.get_string('fields', 'data').'">';
         foreach ($fields as $field) {
             if ($data->defaultsort == $field->id) {
-                echo '<option value="'.$field->id.'" selected="selected">'.$field->name.'</option>';
+                echo '<option value="'.$field->id.'" selected="selected">'.s($field->name).'</option>';
             } else {
-                echo '<option value="'.$field->id.'">'.$field->name.'</option>';
+                echo '<option value="'.$field->id.'">'.s($field->name).'</option>';
             }
         }
         echo '</optgroup>';
diff --git a/mod/data/field/checkbox/field.class.php b/mod/data/field/checkbox/field.class.php
index d022e9b1477c8..f4b4c3417d265 100644
--- a/mod/data/field/checkbox/field.class.php
+++ b/mod/data/field/checkbox/field.class.php
@@ -66,7 +66,7 @@ function display_add_field($recordid = 0, $formdata = null) {
         }
 
         $str = '<div title="' . s($this->field->description) . '">';
-        $str .= '<fieldset><legend><span class="accesshide">'.$this->field->name;
+        $str .= '<fieldset><legend><span class="accesshide">'.s($this->field->name);
         if ($this->field->required) {
             $str .= '$nbsp;' . get_string('requiredelement', 'form');
             $str .= '</span></legend>';
diff --git a/mod/data/field/file/field.class.php b/mod/data/field/file/field.class.php
index 16fe7ce15d87e..2e455ca59e8a4 100644
--- a/mod/data/field/file/field.class.php
+++ b/mod/data/field/file/field.class.php
@@ -70,7 +70,7 @@ function display_add_field($recordid = 0, $formdata = null) {
 
         // database entry label
         $html = '<div title="' . s($this->field->description) . '">';
-        $html .= '<fieldset><legend><span class="accesshide">'.$this->field->name;
+        $html .= '<fieldset><legend><span class="accesshide">'.s($this->field->name);
 
         if ($this->field->required) {
             $html .= '&nbsp;' . get_string('requiredelement', 'form') . '</span></legend>';
@@ -105,7 +105,7 @@ function display_add_field($recordid = 0, $formdata = null) {
     }
 
     function display_search_field($value = '') {
-        return '<label class="accesshide" for="f_' . $this->field->id . '">' . $this->field->name . '</label>' .
+        return '<label class="accesshide" for="f_' . $this->field->id . '">' . s($this->field->name) . '</label>' .
                '<input type="text" size="16" id="f_'.$this->field->id.'" name="f_'.$this->field->id.'" ' .
                     'value="'.s($value).'" class="form-control"/>';
     }
diff --git a/mod/data/field/latlong/field.class.php b/mod/data/field/latlong/field.class.php
index 4d25d261ecc16..24e147596f7f8 100644
--- a/mod/data/field/latlong/field.class.php
+++ b/mod/data/field/latlong/field.class.php
@@ -77,7 +77,7 @@ function display_add_field($recordid = 0, $formdata = null) {
             }
         }
         $str = '<div title="'.s($this->field->description).'">';
-        $str .= '<fieldset><legend><span class="accesshide">'.$this->field->name.'</span></legend>';
+        $str .= '<fieldset><legend><span class="accesshide">'.s($this->field->name).'</span></legend>';
         $str .= '<table class="form-inline"><tr><td align="right">';
         $classes = 'mod-data-input form-control-static';
         $str .= '<label for="field_'.$this->field->id.'_0" class="' . $classes . '">' . get_string('latitude', 'data');
diff --git a/mod/data/field/multimenu/field.class.php b/mod/data/field/multimenu/field.class.php
index f8490569cf2f2..301f109bf5f19 100644
--- a/mod/data/field/multimenu/field.class.php
+++ b/mod/data/field/multimenu/field.class.php
@@ -74,7 +74,7 @@ function display_add_field($recordid = 0, $formdata = null) {
         $str .= '<input name="field_' . $this->field->id . '[xxx]" type="hidden" value="xxx"/>'; // hidden field - needed for empty selection
 
         $str .= '<label for="field_' . $this->field->id . '">';
-        $str .= '<legend><span class="accesshide">' . $this->field->name;
+        $str .= '<legend><span class="accesshide">' . s($this->field->name);
 
         if ($this->field->required) {
             $str .= '&nbsp;' . get_string('requiredelement', 'form') . '</span></legend>';
@@ -119,7 +119,7 @@ function display_search_field($value = '') {
 
         static $c = 0;
 
-        $str = '<label class="accesshide" for="f_' . $this->field->id . '">' . $this->field->name . '</label>';
+        $str = '<label class="accesshide" for="f_' . $this->field->id . '">' . s($this->field->name) . '</label>';
         $str .= '<select id="f_'.$this->field->id.'" name="f_'.$this->field->id.'[]" multiple="multiple" class="form-control">';
 
         // display only used options
diff --git a/mod/data/field/picture/field.class.php b/mod/data/field/picture/field.class.php
index 877f0fb9c0121..cb79968bbeec8 100644
--- a/mod/data/field/picture/field.class.php
+++ b/mod/data/field/picture/field.class.php
@@ -87,7 +87,7 @@ function display_add_field($recordid = 0, $formdata = null) {
             $itemid = file_get_unused_draft_itemid();
         }
         $str = '<div title="' . s($this->field->description) . '">';
-        $str .= '<fieldset><legend><span class="accesshide">'.$this->field->name;
+        $str .= '<fieldset><legend><span class="accesshide">'.s($this->field->name);
 
         if ($this->field->required) {
             $str .= '&nbsp;' . get_string('requiredelement', 'form') . '</span></legend>';
diff --git a/mod/data/field/radiobutton/field.class.php b/mod/data/field/radiobutton/field.class.php
index 61577cbe5e97f..7b17ac935a95a 100644
--- a/mod/data/field/radiobutton/field.class.php
+++ b/mod/data/field/radiobutton/field.class.php
@@ -69,7 +69,7 @@ function display_add_field($recordid = 0, $formdata = null) {
         }
 
         $str = '<div title="' . s($this->field->description) . '">';
-        $str .= '<fieldset><legend><span class="accesshide">' . $this->field->name;
+        $str .= '<fieldset><legend><span class="accesshide">' . s($this->field->name);
 
         if ($this->field->required) {
             $str .= '&nbsp;' . get_string('requiredelement', 'form') . '</span></legend>';
diff --git a/mod/data/field/text/field.class.php b/mod/data/field/text/field.class.php
index da86094637e61..9d246d8432136 100644
--- a/mod/data/field/text/field.class.php
+++ b/mod/data/field/text/field.class.php
@@ -50,7 +50,7 @@ public function get_data_content_preview(int $recordid): stdClass {
     }
 
     function display_search_field($value = '') {
-        return '<label class="accesshide" for="f_' . $this->field->id . '">' . $this->field->name.'</label>' .
+        return '<label class="accesshide" for="f_' . $this->field->id . '">' . s($this->field->name) . '</label>' .
                '<input type="text" class="form-control" size="16" id="f_' . $this->field->id . '" ' .
                'name="f_' . $this->field->id . '" value="' . s($value) . '" />';
     }
diff --git a/mod/data/field/textarea/field.class.php b/mod/data/field/textarea/field.class.php
index 0857e2427db68..ec8babd4f2d2f 100644
--- a/mod/data/field/textarea/field.class.php
+++ b/mod/data/field/textarea/field.class.php
@@ -203,7 +203,7 @@ function display_add_field($recordid = 0, $formdata = null) {
 
 
     function display_search_field($value = '') {
-        return '<label class="accesshide" for="f_' . $this->field->id . '">' . $this->field->name . '</label>' .
+        return '<label class="accesshide" for="f_' . $this->field->id . '">' . s($this->field->name) . '</label>' .
                '<input type="text" size="16" id="f_' . $this->field->id . '" name="f_' . $this->field->id . '" ' .
                'value="' . s($value) . '" class="form-control"/>';
     }
diff --git a/mod/data/lib.php b/mod/data/lib.php
index 16796b4c8af86..464e6dadd8924 100644
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -380,7 +380,7 @@ function display_add_field($recordid=0, $formdata=null) {
         }
 
         $str = '<div title="' . s($this->field->description) . '">';
-        $str .= '<label for="field_'.$this->field->id.'"><span class="accesshide">'.$this->field->name.'</span>';
+        $str .= '<label for="field_'.$this->field->id.'"><span class="accesshide">'.s($this->field->name).'</span>';
         if ($this->field->required) {
             $image = $OUTPUT->pix_icon('req', get_string('requiredelement', 'form'));
             $str .= html_writer::div($image, 'inline-req');
@@ -1713,9 +1713,9 @@ function data_print_preference_form($data, $perpage, $search, $sort='', $order='
         echo '<optgroup label="'.get_string('fields', 'data').'">';
         foreach ($fields as $field) {
             if ($field->id == $sort) {
-                echo '<option value="'.$field->id.'" selected="selected">'.$field->name.'</option>';
+                echo '<option value="'.$field->id.'" selected="selected">'.s($field->name).'</option>';
             } else {
-                echo '<option value="'.$field->id.'">'.$field->name.'</option>';
+                echo '<option value="'.$field->id.'">'.s($field->name).'</option>';
             }
         }
         echo '</optgroup>';
diff --git a/mod/data/templates/defaulttemplate_asearchtemplate.mustache b/mod/data/templates/defaulttemplate_asearchtemplate.mustache
index 5defadef0c877..6e6af1b6f79c1 100644
--- a/mod/data/templates/defaulttemplate_asearchtemplate.mustache
+++ b/mod/data/templates/defaulttemplate_asearchtemplate.mustache
@@ -47,7 +47,7 @@
         {{#fields}}
             <div class="form-group col">
                 <div class="font-weight-bold mb-2">{{fieldname}}</div>
-                {{fieldcontent}}
+                {{{fieldcontent}}}
             </div>
         {{/fields}}
 
diff --git a/mod/data/templates/defaulttemplate_listtemplate.mustache b/mod/data/templates/defaulttemplate_listtemplate.mustache
index 372019d61fe16..89a31796cf397 100644
--- a/mod/data/templates/defaulttemplate_listtemplate.mustache
+++ b/mod/data/templates/defaulttemplate_listtemplate.mustache
@@ -57,7 +57,7 @@
         {{#fields}}
             <div class="row my-3 align-items-start justify-content-start">
                 <div class="col-4 col-lg-3 font-weight-bold">{{fieldname}}</div>
-                <div class="col-8 col-lg-9 ml-n3">{{fieldcontent}}</div>
+                <div class="col-8 col-lg-9 ml-n3">{{{fieldcontent}}}</div>
             </div>
         {{/fields}}
         {{#tags}}
diff --git a/mod/data/templates/defaulttemplate_rsstemplate.mustache b/mod/data/templates/defaulttemplate_rsstemplate.mustache
index c20129801e99d..edea2e1b21eb4 100644
--- a/mod/data/templates/defaulttemplate_rsstemplate.mustache
+++ b/mod/data/templates/defaulttemplate_rsstemplate.mustache
@@ -38,7 +38,7 @@
         {{#fields}}
             <div class="mt-4">
                 <span class="font-weight-bold">{{fieldname}}</span>
-                <p class="mt-2">{{fieldcontent}}</p>
+                <p class="mt-2">{{{fieldcontent}}}</p>
             </div>
         {{/fields}}
     </div>
diff --git a/mod/data/templates/defaulttemplate_singletemplate.mustache b/mod/data/templates/defaulttemplate_singletemplate.mustache
index b5da68d629937..11bd04f2b3224 100644
--- a/mod/data/templates/defaulttemplate_singletemplate.mustache
+++ b/mod/data/templates/defaulttemplate_singletemplate.mustache
@@ -58,7 +58,7 @@
         {{#fields}}
             <div class="mt-4">
                 <span class="font-weight-bold">{{fieldname}}</span>
-                <p class="mt-2">{{fieldcontent}}</p>
+                <p class="mt-2">{{{fieldcontent}}}</p>
             </div>
         {{/fields}}
         ##otherfields##