diff --git a/gulliver/js/ext/min/ext-all.js b/gulliver/js/ext/min/ext-all.js
index df4d5cb75..201d51449 100644
--- a/gulliver/js/ext/min/ext-all.js
+++ b/gulliver/js/ext/min/ext-all.js
@@ -13,6 +13,7 @@ this.warning=function(title,msg,fn){Ext.MessageBox.show({id:'warningMessageBox',
 this.error=function(title,msg,fn){Ext.MessageBox.show({id:'errorMessageBox',title:title,msg:msg,buttons:Ext.MessageBox.OK,animEl:'mb9',fn:fn!=undefined?fn:function(){},icon:Ext.MessageBox.ERROR});}
 this.notify=function(title,msg,type,time)
 {Ext.msgBoxSlider.msg(title,msg,type,time);}
+this.escapeHtml=function(v){var pre=document.createElement('pre');var text=document.createTextNode(v);pre.appendChild(text);return pre.innerHTML;}
 this.getBrowser=function(){var browsersList=["opera","msie","firefox","chrome","safari","trident"],browserMeta=navigator.userAgent.toLowerCase(),name='Unknown',version='',screen={width:Ext.getBody().getViewSize().width,height:Ext.getBody().getViewSize().height};for(var i=0;i<browsersList.length;i++){if((name==="")&&(browserMeta.indexOf(browsersList[i])!==-1)){name=browsersList[i];version=String(parseFloat(browserMeta.substr(browserMeta.indexOf(browsersList[i])+browsersList[i].length+1)));break;}}
 return{name:name,version:version,screen:screen}};this.createInfoPanel=function(url,params,columnsSize){var labelColumnWidth=170;var valueColumnWidth=350;params=params||{};if(typeof columnsSize!=='undefined'){labelColumnWidth=columnsSize[0]||labelColumnWidth;valueColumnWidth=columnsSize[1]||valueColumnWidth;}
 return new Ext.grid.GridPanel({store:new Ext.data.GroupingStore({autoLoad:true,proxy:new Ext.data.HttpProxy({url:url,method:'POST'}),baseParams:params,reader:new Ext.data.JsonReader({fields:[{name:'label'},{name:'value'},{name:'section'}]}),groupField:'section'}),columns:[{width:labelColumnWidth,dataIndex:"label",renderer:function(v){return"<b><font class='selectText' color=\"#465070\">"+v+"</font></b>";},align:"right"},{width:valueColumnWidth,dataIndex:"value",renderer:function(v){return"<b class='selectText'>"+v+"</b>";}},{hidden:true,dataIndex:"section"}],autoHeight:true,columnLines:true,trackMouseOver:false,disableSelection:true,view:new Ext.grid.GroupingView({forceFit:true,headersDisabled:true,groupTextTpl:'{group}'}),loadMask:true});};this.cookie={create:function(name,value,days){if(days){var date=new Date();date.setTime(date.getTime()+(days*24*60*60*1000));var expires="; expires="+date.toGMTString();}else var expires="";document.cookie=name+"="+value+expires+"; path=/";},read:function(name){var nameEQ=name+"=";var ca=document.cookie.split(';');for(var i=0;i<ca.length;i++){var c=ca[i];while(c.charAt(0)==' ')c=c.substring(1,c.length);if(c.indexOf(nameEQ)==0)return c.substring(nameEQ.length,c.length);}
diff --git a/gulliver/js/ext/pmos-common.js b/gulliver/js/ext/pmos-common.js
index 56bd84ef6..9f2e2a5fb 100644
--- a/gulliver/js/ext/pmos-common.js
+++ b/gulliver/js/ext/pmos-common.js
@@ -68,6 +68,14 @@ PMExtJSCommon = function() {
   {
     Ext.msgBoxSlider.msg(title, msg, type, time);
   }
+  //TODO we need to review how many places using this kind of validation
+  this.escapeHtml = function (v) {
+      var pre = document.createElement('pre');
+      var text = document.createTextNode( v );
+      pre.appendChild(text);
+
+      return pre.innerHTML;
+  }
 
     this.getBrowser = function () {
         var browsersList = ["opera", "msie", "firefox", "chrome", "safari", "trident"],
diff --git a/workflow/engine/classes/SpoolRun.php b/workflow/engine/classes/SpoolRun.php
index a11d9d7d0..7ef0547a5 100644
--- a/workflow/engine/classes/SpoolRun.php
+++ b/workflow/engine/classes/SpoolRun.php
@@ -369,16 +369,17 @@ class SpoolRun
     }
 
     /**
-     * handle all recipients to compose the mail
+     * Handle all recipients to compose the mail
      *
-     * @param none
-     * @return boolean true or exception
+     * @return void
+     *
+     * @see SpoolRun::sendMail()
      */
     private function handleEnvelopeTo()
     {
-        $hold = array();
-        $holdcc = array();
-        $holdbcc = array();
+        $hold = [];
+        $holdcc = [];
+        $holdbcc = [];
         $text = trim($this->fileData['to']);
 
         $textcc = '';
@@ -399,10 +400,15 @@ class SpoolRun
                     $this->fileData['envelope_to'][] = "$val";
                 }
             }
+
         } elseif ($text != '') {
             $this->fileData['envelope_to'][] = "$text";
         } else {
-            $this->fileData['envelope_to'] = Array();
+            $this->fileData['envelope_to'] = [];
+        }
+
+        if (empty($this->fileData['envelope_to'])){
+            $this->updateSpoolError('Invalid address: ' . $text);
         }
 
         //CC
@@ -417,7 +423,7 @@ class SpoolRun
         } elseif ($textcc != '') {
             $this->fileData['envelope_cc'][] = "$textcc";
         } else {
-            $this->fileData['envelope_cc'] = Array();
+            $this->fileData['envelope_cc'] = [];
         }
 
         //BCC
@@ -432,7 +438,7 @@ class SpoolRun
         } elseif ($textbcc != '') {
             $this->fileData['envelope_bcc'][] = "$textbcc";
         } else {
-            $this->fileData['envelope_bcc'] = Array();
+            $this->fileData['envelope_bcc'] = [];
         }
 
     }
@@ -520,36 +526,66 @@ class SpoolRun
                                 }
                             }
                             //To
-                            foreach ($this->fileData['envelope_to'] as $sEmail) {
-                                if (strpos($sEmail, '<') !== false) {
-                                    preg_match($this->longMailEreg, $sEmail, $matches);
-                                    $sTo = trim($matches[3]);
-                                    $sToName = trim($matches[1]);
-                                    $phpMailer->AddAddress($sTo, $sToName);
+                            foreach ($this->fileData['envelope_to'] as $email) {
+                                if (strpos($email, '<') !== false) {
+                                    preg_match($this->longMailEreg, $email, $matches);
+                                    $toAddress = '';
+                                    if (!empty($matches[3])) {
+                                        $toAddress = trim($matches[3]);
+                                    }
+                                    $toName = '';
+                                    if (!empty($matches[1])) {
+                                        $toName = trim($matches[1]);
+                                    }
+                                    if (!empty($toAddress)) {
+                                        $phpMailer->AddAddress($toAddress, $toName);
+                                    } else {
+                                        throw new Exception('Invalid address: ' . $email);
+                                    }
                                 } else {
-                                    $phpMailer->AddAddress($sEmail);
+                                    $phpMailer->AddAddress($email);
                                 }
                             }
                             //CC
-                            foreach ($this->fileData['envelope_cc'] as $sEmail) {
-                                if (strpos($sEmail, '<') !== false) {
-                                    preg_match($this->longMailEreg, $sEmail, $matches);
-                                    $sTo = trim($matches[3]);
-                                    $sToName = trim($matches[1]);
-                                    $phpMailer->AddCC($sTo, $sToName);
+                            foreach ($this->fileData['envelope_cc'] as $email) {
+                                if (strpos($email, '<') !== false) {
+                                    preg_match($this->longMailEreg, $email, $matches);
+                                    $ccAddress = '';
+                                    if (!empty($matches[3])) {
+                                        $ccAddress = trim($matches[3]);
+                                    }
+                                    $ccName = '';
+                                    if (!empty($matches[1])) {
+                                        $ccName = trim($matches[1]);
+                                    }
+                                    if (!empty($ccAddress)) {
+                                        $phpMailer->AddCC($ccAddress, $ccName);
+                                    } else {
+                                        throw new Exception('Invalid address: ' . $email);
+                                    }
                                 } else {
-                                    $phpMailer->AddCC($sEmail);
+                                    $phpMailer->AddCC($email);
                                 }
                             }
                             //BCC
-                            foreach ($this->fileData['envelope_bcc'] as $sEmail) {
-                                if (strpos($sEmail, '<') !== false) {
-                                    preg_match($this->longMailEreg, $sEmail, $matches);
-                                    $sTo = trim($matches[3]);
-                                    $sToName = trim($matches[1]);
-                                    $phpMailer->AddBCC($sTo, $sToName);
+                            foreach ($this->fileData['envelope_bcc'] as $email) {
+                                if (strpos($email, '<') !== false) {
+                                    preg_match($this->longMailEreg, $email, $matches);
+                                    $bccAddress = '';
+                                    if (!empty($matches[3])) {
+                                        $bccAddress = trim($matches[3]);
+                                    }
+                                    $bccName = '';
+                                    if (!empty($matches[1])) {
+                                        $bccName = trim($matches[1]);
+                                    }
+                                    if (!empty($bccAddress)) {
+                                        $phpMailer->AddBCC($bccAddress, $bccName);
+                                    } else {
+                                        throw new Exception('Invalid address: ' . $email);
+                                    }
                                 } else {
-                                    $phpMailer->AddBCC($sEmail);
+                                    $phpMailer->AddBCC($email);
                                 }
                             }
                             //IsHtml
diff --git a/workflow/engine/methods/mails/emailsAjax.php b/workflow/engine/methods/mails/emailsAjax.php
index f8fb1adf3..903c1275e 100644
--- a/workflow/engine/methods/mails/emailsAjax.php
+++ b/workflow/engine/methods/mails/emailsAjax.php
@@ -130,7 +130,6 @@ switch ($req) {
         $tasTitleDefault = G::LoadTranslation('ID_TASK_NOT_RELATED');
         while ($result->next()) {
             $row = $result->getRow();
-            $row['APP_MSG_FROM'] = htmlentities($row['APP_MSG_FROM'], ENT_QUOTES, "UTF-8");
             $row['APP_MSG_STATUS'] = ucfirst($row['APP_MSG_STATUS']);
 
             switch ($filterBy) {
diff --git a/workflow/engine/templates/mails/emailList.js b/workflow/engine/templates/mails/emailList.js
index 2b91ac7db..fe9f76865 100644
--- a/workflow/engine/templates/mails/emailList.js
+++ b/workflow/engine/templates/mails/emailList.js
@@ -44,7 +44,8 @@ Ext.onReady(function(){
       }
     }
     metadata.attr = 'ext:qtip="' + data + '" style="'+ style +' white-space: normal; "';
-    return data;
+
+    return PMExt.escapeHtml(data);
   };
 
     var dateFrom = new Ext.form.DateField({