diff --git a/src/www/diag_authentication.php b/src/www/diag_authentication.php
index a4721cf59..e5d1c1f00 100644
--- a/src/www/diag_authentication.php
+++ b/src/www/diag_authentication.php
@@ -117,7 +117,7 @@ include("head.inc");
                 </tr>
                 <tr>
                   <td style="width:22%">&nbsp;</td>
-                  <td style="width:78%"><input id="save" name="save" type="submit" class="btn btn-primary" value="<?=gettext("Test");?>" /></td>
+                  <td style="width:78%"><input id="save" name="save" type="submit" class="btn btn-primary" value="<?= html_safe(gettext('Test')) ?>" /></td>
                 </tr>
               </tbody>
             </table>
diff --git a/src/www/diag_backup.php b/src/www/diag_backup.php
index 5c9b13e9b..7ab41e3a3 100644
--- a/src/www/diag_backup.php
+++ b/src/www/diag_backup.php
@@ -371,7 +371,7 @@ $( document ).ready(function() {
                 </tr>
                 <tr>
                   <td>
-                    <input name="download" type="submit" class="btn btn-primary" value="<?=gettext("Download configuration"); ?>" />
+                    <input name="download" type="submit" class="btn btn-primary" value="<?= html_safe(gettext('Download configuration')) ?>" />
                   </td>
                 </tr>
                 <tr>
@@ -416,7 +416,7 @@ $( document ).ready(function() {
                 </tr>
                 <tr>
                   <td>
-                    <input name="restore" type="submit" class="btn btn-primary" id="restore" value="<?=gettext("Restore configuration"); ?>" />
+                    <input name="restore" type="submit" class="btn btn-primary" id="restore" value="<?= html_safe(gettext('Restore configuration')) ?>" />
                   </td>
                 </tr>
                 <tr>
diff --git a/src/www/diag_defaults.php b/src/www/diag_defaults.php
index c3dee0e39..e5bfe9e48 100644
--- a/src/www/diag_defaults.php
+++ b/src/www/diag_defaults.php
@@ -85,8 +85,8 @@ $(document).ready(function() {
           </ul>
           <p><strong><?=gettext("Are you sure you want to proceed?");?></strong></p>
           <div class="btn-group">
-             <input type="submit" name="Submit" class="btn btn-primary" value="<?=gettext("Yes");?>" />
-             <a href="/" class="btn btn-default"><?=gettext("No");?></a>
+            <input type="submit" name="Submit" class="btn btn-primary" value="<?= html_safe(gettext('Yes')) ?>" />
+            <a href="/" class="btn btn-default"><?=gettext("No");?></a>
           </div>
         </form>
       </section>
diff --git a/src/www/diag_dns.php b/src/www/diag_dns.php
index 32b5a415a..bbbb63711 100644
--- a/src/www/diag_dns.php
+++ b/src/www/diag_dns.php
@@ -1,31 +1,31 @@
 <?php
 
 /*
-    Copyright (C) 2016 Deciso B.V.
-    Copyright (C) 2009 Jim Pingle <jimp@pfsense.org>
-    All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-    this list of conditions and the following disclaimer.
-
-    2. Redistributions in binary form must reproduce the above copyright
-    notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
-    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
-    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-    POSSIBILITY OF SUCH DAMAGE.
-*/
+ * Copyright (C) 2016 Deciso B.V.
+ * Copyright (C) 2009 Jim Pingle <jimp@pfsense.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
 
 require_once("guiconfig.inc");
 
@@ -147,7 +147,7 @@ include("head.inc"); ?>
                   <tr>
                     <td></td>
                     <td>
-                      <input type="submit" class="btn btn-primary btn-fixed" value="<?=gettext("DNS Lookup");?>" />
+                      <input type="submit" class="btn btn-primary btn-fixed" value="<?= html_safe(gettext('DNS Lookup')) ?>" />
                     </td>
                   </tr>
                 </tfoot>
diff --git a/src/www/diag_dump_states.php b/src/www/diag_dump_states.php
index 9d45bb84b..ae774b0ed 100644
--- a/src/www/diag_dump_states.php
+++ b/src/www/diag_dump_states.php
@@ -114,9 +114,9 @@ include("head.inc");
                       <input type="text" name="filter" value="<?=!empty($_POST['filter']) ? htmlspecialchars($_POST['filter']) : "";?>"/>
                     </td>
                     <td>
-                      <input type="submit" class="btn btn-primary" value="<?=gettext("Filter");?>" />
+                      <input type="submit" class="btn btn-primary" value="<?= html_safe(gettext('Filter')) ?>" />
                       <?php if (!empty($_POST['filter']) && (is_ipaddr($_POST['filter']) || is_subnet($_POST['filter']))): ?>
-                      <input type="submit" class="btn btn-primary" name="killfilter" value="<?=gettext("Kill");?>" />
+                      <input type="submit" class="btn btn-primary" name="killfilter" value="<?= html_safe(gettext('Kill')) ?>" />
                       <?php endif; ?>
                     </td>
                   </tr>
diff --git a/src/www/diag_logs_filter_summary.php b/src/www/diag_logs_filter_summary.php
index 5fcdbb36b..e9e8c7b90 100644
--- a/src/www/diag_logs_filter_summary.php
+++ b/src/www/diag_logs_filter_summary.php
@@ -391,7 +391,7 @@ include("head.inc"); ?>
                   <td>
                     <form method="post">
                       <div class="pull-right">
-                        <input name="clear" type="submit" class="btn" value="<?= gettext("Clear log");?>" />
+                        <input name="clear" type="submit" class="btn" value="<?= html_safe(gettext('Clear log')) ?>" />
                       </div>
                     </form>
                   </td>
diff --git a/src/www/diag_logs_settings.php b/src/www/diag_logs_settings.php
index 6ef25a3c0..91b390d05 100644
--- a/src/www/diag_logs_settings.php
+++ b/src/www/diag_logs_settings.php
@@ -430,7 +430,7 @@ $(document).ready(function() {
                   <tr>
                     <td><a id="help_for_resetlogs" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext('Reset Logs') ?></td>
                     <td>
-                      <input name="resetlogs" id="resetlogs" type="submit" class="btn btn-default" value="<?=gettext("Reset Log Files"); ?>"/>
+                      <input name="resetlogs" id="resetlogs" type="submit" class="btn btn-default" value="<?= html_safe(gettext('Reset Log Files')) ?>"/>
                       <div class="hidden" data-for="help_for_resetlogs">
                         <?= gettext("Note: Clears all local log files and reinitializes them as empty logs. This also restarts the DHCP daemon. Use the Save button first if you have made any setting changes."); ?>
                       </div>
diff --git a/src/www/diag_packet_capture.php b/src/www/diag_packet_capture.php
index 8b5b58a48..82485d1ec 100644
--- a/src/www/diag_packet_capture.php
+++ b/src/www/diag_packet_capture.php
@@ -1,30 +1,30 @@
 <?php
 
 /*
-    Copyright (C) 2014-2016 Deciso B.V.
-    Copyright (C) 2007 Scott Dale
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-    this list of conditions and the following disclaimer.
-
-    2. Redistributions in binary form must reproduce the above copyright
-    notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
-    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
-    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-    POSSIBILITY OF SUCH DAMAGE.
-*/
+ * Copyright (C) 2014-2016 Deciso B.V.
+ * Copyright (C) 2007 Scott Dale
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
 
 require_once("guiconfig.inc");
 require_once("interfaces.inc");
@@ -451,15 +451,15 @@ include("fbegin.inc");
                     <td>
 <?php
                     if (capture_running()):?>
-                      <input type="submit" class="btn" name="stop" value="<?=gettext("Stop");?>"/>
+                      <input type="submit" class="btn" name="stop" value="<?= html_safe(gettext('Stop')) ?>"/>
 <?php
                     else:?>
-                      <input type="submit" class="btn" name="start" value="<?=gettext("Start");?>"/>
+                      <input type="submit" class="btn" name="start" value="<?= html_safe(gettext('Start')) ?>"/>
 <?php
                     if (file_exists('/tmp/packetcapture.cap')):?>
                       <button type="button" id="view" class="btn"> <?=gettext("View Capture");?> </button>
                       <a href="?download" type="submit" class="btn"><?=gettext("Download Capture");?></a>
-                      <input type="submit" class="btn" name="remove" value="<?=gettext("Delete Capture");?>"/>
+                      <input type="submit" class="btn" name="remove" value="<?= html_safe(gettext('Delete Capture')) ?>"/>
 <?php
                     endif;
                     endif;?>
diff --git a/src/www/diag_resetstate.php b/src/www/diag_resetstate.php
index c014ff75e..598e06340 100644
--- a/src/www/diag_resetstate.php
+++ b/src/www/diag_resetstate.php
@@ -1,33 +1,32 @@
 <?php
 
 /*
-    Copyright (C) 2014-2016 Deciso B.V.
-    Copyright (C) 2004-2009 Scott Ullrich <sullrich@gmail.com>
-    Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>
-    All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-
-    2. Redistributions in binary form must reproduce the above copyright
-       notice, this list of conditions and the following disclaimer in the
-       documentation and/or other materials provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
-    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
-    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-    POSSIBILITY OF SUCH DAMAGE.
-*/
-
+ * Copyright (C) 2014-2016 Deciso B.V.
+ * Copyright (C) 2004-2009 Scott Ullrich <sullrich@gmail.com>
+ * Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
 
 require_once("guiconfig.inc");
 
@@ -92,7 +91,7 @@ include("head.inc");
 <?php
               endif; ?>
                 <br/><br/>
-                <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Reset"); ?>" />
+                <input name="Submit" type="submit" class="btn btn-primary" value="<?= html_safe(gettext('Reset')) ?>" />
                 <br/><br/>
               </form>
             </div>
diff --git a/src/www/firewall_nat_edit.php b/src/www/firewall_nat_edit.php
index ef1c3293c..2cd01ee8c 100644
--- a/src/www/firewall_nat_edit.php
+++ b/src/www/firewall_nat_edit.php
@@ -569,12 +569,11 @@ $( document ).ready(function() {
                   <td>
                     <div class="input-group">
                       <select id="proto" name="protocol" class="selectpicker" data-live-search="true" data-size="5" data-width="auto">
-<?php                foreach (get_protocols() as $proto):
-?>
-              <option value="<?=strtolower($proto);?>" <?= strtolower($proto) == $pconfig['protocol'] ? "selected=\"selected\"" : ""; ?>>
-                          <?=$proto;?>
+<?php foreach (get_protocols() as $proto): ?>
+                        <option value="<?=strtolower($proto);?>" <?= strtolower($proto) == $pconfig['protocol'] ? "selected=\"selected\"" : ""; ?>>
+                          <?= $proto ?>
                         </option>
-<?php                endforeach; ?>
+<?php endforeach ?>
               </select>
                     </div>
                     <div class="hidden" data-for="help_for_proto">
@@ -586,7 +585,7 @@ $( document ).ready(function() {
                 <tr class="advanced_opt_src visible">
                   <td><?=gettext("Source"); ?></td>
                   <td>
-                    <input type="button" class="btn btn-default" value="<?=gettext("Advanced"); ?>" id="showadvancedboxsrc" />
+                    <input type="button" class="btn btn-default" value="<?= html_safe(gettext('Advanced')) ?>" id="showadvancedboxsrc" />
                     <div class="hidden" data-for="help_for_source">
                       <?=gettext("Show source address and port range"); ?>
                     </div>
diff --git a/src/www/firewall_rules_edit.php b/src/www/firewall_rules_edit.php
index deeac515c..1f4415af6 100644
--- a/src/www/firewall_rules_edit.php
+++ b/src/www/firewall_rules_edit.php
@@ -934,7 +934,7 @@ include("head.inc");
                   <tr class="advanced_opt_src visible">
                     <td><?=gettext("Source"); ?></td>
                     <td>
-                      <input type="button" class="btn btn-default" value="<?=gettext("Advanced"); ?>" id="showadvancedboxsrc" />
+                      <input type="button" class="btn btn-default" value="<?= html_safe(gettext('Advanced')) ?>" id="showadvancedboxsrc" />
                       <div class="hidden" data-for="help_for_source">
                         <?=gettext("Show source address and port range"); ?>
                       </div>
@@ -1245,7 +1245,7 @@ include("head.inc");
                   <tr>
                     <td><?=gettext("Advanced Options");?></td>
                     <td>
-                      <input id="toggleAdvanced" type="button" class="btn btn-default" value="<?=gettext("Show/Hide"); ?>" />
+                      <input id="toggleAdvanced" type="button" class="btn btn-default" value="<?= html_safe(gettext('Show/Hide')) ?>" />
                     </td>
                   </tr>
                   <tr class="opt_advanced hidden">
diff --git a/src/www/firewall_schedule_edit.php b/src/www/firewall_schedule_edit.php
index f6458ed27..c8e778ff0 100644
--- a/src/www/firewall_schedule_edit.php
+++ b/src/www/firewall_schedule_edit.php
@@ -991,8 +991,8 @@ $( function() { $('#iform td').css({ 'background-color' : '' }); })
                       <tr>
                         <td>&nbsp;</td>
                         <td>
-                          <input type="button" value="<?=gettext("Add Time");?>"  class="btn btn-default"  onclick="javascript:processEntries();" />&nbsp;&nbsp;&nbsp;
-                          <input type="button" value="<?=gettext("Clear Selection");?>" class="btn btn-default" onclick="javascript:clearCalendar(); clearTime(); clearDescr();" />
+                          <input type="button" value="<?= html_safe(gettext('Add Time')) ?>" class="btn btn-default" onclick="javascript:processEntries();" />&nbsp;&nbsp;&nbsp;
+                          <input type="button" value="<?= html_safe(gettext('Clear Selection')) ?>" class="btn btn-default" onclick="javascript:clearCalendar(); clearTime(); clearDescr();" />
                         </td>
                       </tr>
                       <tr>
diff --git a/src/www/firewall_scrub_edit.php b/src/www/firewall_scrub_edit.php
index 889d9f841..d0ed46d58 100644
--- a/src/www/firewall_scrub_edit.php
+++ b/src/www/firewall_scrub_edit.php
@@ -423,7 +423,7 @@ include("head.inc");
                     <td><a id="help_for_srcport" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Source port"); ?></td>
                     <td>
                       <div>
-                          <input type="button" class="btn btn-default" value="<?=gettext("Advanced"); ?>" id="show_srcport_adv" />
+                        <input type="button" class="btn btn-default" value="<?= html_safe(gettext('Advanced')) ?>" id="show_srcport_adv" />
                       </div>
                       <div id="show_srcport" style="display:none;">
                       <table class="table table-condensed">