diff --git a/workflow/engine/methods/cases/proxyDataCombobox.php b/workflow/engine/methods/cases/proxyDataCombobox.php
index a0d65d2df..7c279d4d9 100755
--- a/workflow/engine/methods/cases/proxyDataCombobox.php
+++ b/workflow/engine/methods/cases/proxyDataCombobox.php
@@ -16,6 +16,7 @@ $G_FORM->parseFile($filename, SYS_LANG, true);
 
 G::LoadClass("case");
 G::LoadClass("pmFunctions");
+G::LoadSystem('inputfilter');
 
 //Load the variables
 $oCase = new Cases();
@@ -70,5 +71,5 @@ foreach ($aResult as $field) {
 }
 
 $response["records"] = $array;
-
-echo G::json_encode($response);
+$filter = new InputFilter();
+echo G::json_encode($filter->xssFilterHard($response));
diff --git a/workflow/engine/methods/dbConnections/dbConnectionsAjax.php b/workflow/engine/methods/dbConnections/dbConnectionsAjax.php
index 2325d37da..eb7670381 100755
--- a/workflow/engine/methods/dbConnections/dbConnectionsAjax.php
+++ b/workflow/engine/methods/dbConnections/dbConnectionsAjax.php
@@ -344,12 +344,14 @@ switch ($action) {
         break;
     case 'showEncodes':
         //G::LoadThirdParty( 'pear/json', 'class.json' );
-        //$oJSON = new Services_JSON();
+        //$oJSON =
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
         $engine = $_POST['engine'];
 
         if ($engine != "0") {
             $dbs = new dbConnections();
-            echo Bootstrap::json_encode( $dbs->getEncondeList( $engine ) );
+            echo Bootstrap::json_encode($dbs->getEncondeList($filter->xssFilterHard($engine)));
 
         } else {
             echo '[["0","..."]]';
diff --git a/workflow/engine/methods/setup/upgrade_SystemAjax.php b/workflow/engine/methods/setup/upgrade_SystemAjax.php
index ba760dd99..937074e88 100755
--- a/workflow/engine/methods/setup/upgrade_SystemAjax.php
+++ b/workflow/engine/methods/setup/upgrade_SystemAjax.php
@@ -34,6 +34,7 @@ if (isset( $_POST['id'] ))
 
 G::LoadClass( 'languages' );
 G::LoadSystem( 'database_mysql' );
+G::LoadSystem('inputfilter');
 
 $aUpgradeData = unserialize( file_get_contents( PATH_DATA . 'log' . PATH_SEP . "upgrade.data.bin" ) );
 $aWorkspaces = $aUpgradeData['workspaces'];
@@ -60,7 +61,7 @@ if (is_array( $aWorkspaces ) && count( $aWorkspaces ) > 0) {
     print "<table cellpadding=0><tr><td><img src='/images/ajax-loader.gif' border=0/></td><td>";
     print "<div style='border-style:solid;border-width:1px; border-color: #A1C868; width:300px; height:19px;' >";
     print "<div style='color:#FFF; height:16px; text-align:center; padding-top:3px; background-image: url(/skins/green/images/bm.jpg); background-repeat: repeat-x; width: {$gauge}px' ></div> </div>";
-    print "</td><td width='40%'><font color=black> Upgrading the workspace </font><b><font color=green>$workspace</font></b></td><td width=250 align=right>| $id Remaining</td></tr></table>";
+    print "</td><td width='40%'><font color=black> Upgrading the workspace </font><b><font color=green>".$filter->xssFilterHard($workspace)."</font></b></td><td width=250 align=right>| ".$filter->xssFilterHard($id)." Remaining</td></tr></table>";
     file_put_contents( PATH_DATA . 'log' . PATH_SEP . "upgrade.data.bin", serialize( $aUpgradeData ) );
 } else {
     print "<table cellpadding=0><tr><td>&nbsp;&nbsp;&nbsp;&nbsp;</td><td>";
diff --git a/workflow/engine/methods/users/users_Ajax.php b/workflow/engine/methods/users/users_Ajax.php
index 889029897..14895ec0a 100644
--- a/workflow/engine/methods/users/users_Ajax.php
+++ b/workflow/engine/methods/users/users_Ajax.php
@@ -91,11 +91,11 @@ try {
             $oTasks = new Tasks();
             switch ((int) $_POST['TU_RELATION']) {
                 case 1:
-                    echo $oTasks->assignUser($_POST['TAS_UID'], $_POST['USR_UID'], $_POST['TU_TYPE']);
+                    echo htmlentities($oTasks->assignUser($_POST['TAS_UID'], $_POST['USR_UID'], $_POST['TU_TYPE']), ENT_QUOTES | ENT_HTML5, 'UTF-8');
                     G::auditlog("AssignUserTask","Assign a User to a Task -> ".$_POST['TAS_UID'].' User UID -> '.$_POST['USR_UID']);
                     break;
                 case 2:
-                    echo $oTasks->assignGroup($_POST['TAS_UID'], $_POST['USR_UID'], $_POST['TU_TYPE']);
+                    echo htmlentities($oTasks->assignGroup($_POST['TAS_UID'], $_POST['USR_UID'], $_POST['TU_TYPE']), ENT_QUOTES | ENT_HTML5, 'UTF-8');
                     G::auditlog("AssignGroupTask","Assign a Group to a Task -> ".$_POST['TAS_UID'].' User UID -> '.$_POST['USR_UID']);
                     break;
             }
diff --git a/workflow/engine/templates/cases/cases_Load.php b/workflow/engine/templates/cases/cases_Load.php
index 29daf4d79..634248017 100755
--- a/workflow/engine/templates/cases/cases_Load.php
+++ b/workflow/engine/templates/cases/cases_Load.php
@@ -1,7 +1,6 @@
 <?php
 G::LoadSystem('inputfilter');
 $filter = new InputFilter();
-$_POST['qs'] = $filter->xssFilterHard($_POST['qs']);
 ?>
 <html>
   <style type="text/css">
@@ -13,9 +12,9 @@ $_POST['qs'] = $filter->xssFilterHard($_POST['qs']);
    }
   </style>
   <body onresize="autoResizeScreen()" onload="autoResizeScreen()">
-  <iframe name="casesFrame" id="casesFrame" src ="../cases/main_init<?php echo $_POST['qs'];?>" width="99%" height="768" frameborder="0">
-    <p>Your browser does not support iframes.</p>
-  </iframe>
+<iframe name="casesFrame" id="casesFrame" src ="../cases/main_init<?php echo $filter->xssFilterHard($_POST['qs']);?>" width="99%" height="768" frameborder="0">
+	<p>Your browser does not support iframes.</p>
+</iframe>
   </body>
   <script>
     if ( document.getElementById('pm_submenu') )
diff --git a/workflow/engine/templates/reportTables/mainLoad.php b/workflow/engine/templates/reportTables/mainLoad.php
index cbd3937dd..3be5caa4c 100755
--- a/workflow/engine/templates/reportTables/mainLoad.php
+++ b/workflow/engine/templates/reportTables/mainLoad.php
@@ -20,7 +20,7 @@ if(isset($_GET['gui'])) {
 }
 </style>
 <body onresize="autoResizeScreen()" onload="autoResizeScreen()">
-<iframe name="frameMain" id="frameMain" src ="../reportTables/mainInit?PRO_UID=<?php echo $filter->xssFilterHard($gui)?>" width="99%" height="200" frameborder="0">
+<iframe name="frameMain" id="frameMain" src ="../reportTables/mainInit?PRO_UID=<?php echo $filter->xssFilterHard($gui);?>" width="99%" height="200" frameborder="0">
   <p>Your browser does not support iframes.</p>
 </iframe>
 </body>
diff --git a/workflow/public_html/skins/ajax.js b/workflow/public_html/skins/ajax.js
deleted file mode 100755
index 76b92e3dc..000000000
--- a/workflow/public_html/skins/ajax.js
+++ /dev/null
@@ -1,128 +0,0 @@
-// Popup code
-var gPopupMask = null;
-var gPopupContainer = null;
-var gPopFrame = null;
-var gReturnFunc;
-var gPopupIsShown = false;
-
-var gHideSelects = false;
-
-
-var gTabIndexes = new Array();
-// Pre-defined list of tags we want to disable/enable tabbing into
-var gTabbableTags = new Array("A","BUTTON","TEXTAREA","INPUT","IFRAME");
-
-// If using Mozilla or Firefox, use Tab-key trap.
-if (!document.all) {
-	document.onkeypress = keyDownHandler;
-}
-
-function myEmptyCallback() {
-}
-
-function get_xmlhttp() {
-        try {
-                xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
-        } catch (e) {
-                try {
-                        xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
-                } catch (E) {
-                        xmlhttp = false;
-                }
-        }
-        if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
-                xmlhttp = new XMLHttpRequest();
-        }
-        return xmlhttp;
-}
-
-function isdefined( variable) {
-    return (typeof(window[variable]) == "undefined")?  false: true;
-}
-
-//DAN Nov 24, 2006
-//parameter asyncronuos was added to work in syncronous mode
-// usage: ajax_init(_,_,_,_,false);
-function ajax_init( ajax_server,div_container, values, callback,asyncronuos)
-{   // DAN Nov 24, 2006. variable asyncronuos was added
-	asyncronuos = (asyncronuos!=false)?true:false;
-
-	var objetus;
-    objetus = get_xmlhttp();
-
-    try{  // DAN Nov 24, 2006. variable asyncronuos instead of true
-    objetus.open("GET", ajax_server + "?" + values, asyncronuos);
-
-  }catch(ss)
-  {
-  	alert("error"+ss.message);
-  }
-    objetus.onreadystatechange=function() {
-        if ( objetus.readyState == 1 )
-        {
-            document.getElementById(div_container).style.display = "";
-            document.getElementById(div_container).innerHTML = "...";
-
-        }
-        else if ( objetus.readyState==4)
-        {
-            if( objetus.status==200)
-            {
-                document.getElementById(div_container).innerHTML = objetus.responseText;
-                if ( callback != '' )
-                  callback();
-            }
-            else
-            {
-                window.alert('error-['+ objetus.status +']-' + objetus.responseText );
-            }
-        }
-    }
-    objetus.send(null);
-}
-
-function ajax_init_2( ajax_server, div, values, callback )
-{
-	var objetus;
-    objetus = get_xmlhttp();
-    objetus.open ("GET", ajax_server + "?" + values, true);
-    objetus.onreadystatechange=function() {
-        if ( objetus.readyState == 1 )
-        {
-            //document.getElementById(div_container).style.display = "";
-            //document.getElementById(div_container).innerHTML = "...";
-            div.style.display = "";
-            div.innerHTML = "...";
-        }
-        else if ( objetus.readyState==4)
-        {
-            if( objetus.status==200)
-            {
-                //document.getElementById(div_container).innerHTML = objetus.responseText;
-                div.innerHTML = objetus.responseText;
-                if ( callback != '' )
-                  callback();
-            }
-            else
-            {
-                window.alert('error-['+ objetus.status +']-' + objetus.responseText );
-            }
-        }
-    }
-    objetus.send(null);
-}
-function iframe_get_xmlhttp() {
-  try {
-    xmlhttp = new ActiveXObject('Msxml2.XMLHTTP');
-  } catch (e) {
-    try {
-      xmlhttp = new ActiveXObject('Microsoft.XMLHTTP');
-    } catch (E) {
-      xmlhttp = false;
-    }
-  }
-  if (!xmlhttp && typeof XMLHttpRequest != 'undefined') {
-    xmlhttp = new XMLHttpRequest();
-  }
-  return xmlhttp;
-}
\ No newline at end of file