diff --git a/src/www/diag_confbak.php b/src/www/diag_confbak.php
index 9c2930f01..acac3ec62 100644
--- a/src/www/diag_confbak.php
+++ b/src/www/diag_confbak.php
@@ -226,7 +226,7 @@ include("fbegin.inc");
                             <tr>
                                 <td>
                                     <input name="save" type="submit" class="btn btn-primary"
-                                           value="<?= gettext("Save"); ?>"/>
+                                           value="<?= html_safe(gettext('Save')); ?>"/>
                                 </td>
                                 <td>
                                     <?= gettext('Be aware of how much space is consumed by backups before adjusting this value.'); ?>
diff --git a/src/www/diag_logs_settings.php b/src/www/diag_logs_settings.php
index c634a43f1..6ef25a3c0 100644
--- a/src/www/diag_logs_settings.php
+++ b/src/www/diag_logs_settings.php
@@ -550,7 +550,7 @@ $(document).ready(function() {
                 <table class="table table-striped opnsense_standard_table_form">
                   <tr>
                     <td style="width:22%"></td>
-                    <td style="width:78%"><input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" onclick="enable_change(true)" />
+                    <td style="width:78%"><input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" onclick="enable_change(true)" />
                     </td>
                   </tr>
                 </table>
diff --git a/src/www/firewall_nat_1to1_edit.php b/src/www/firewall_nat_1to1_edit.php
index 014639f11..37154c1d0 100644
--- a/src/www/firewall_nat_1to1_edit.php
+++ b/src/www/firewall_nat_1to1_edit.php
@@ -427,8 +427,8 @@ include("head.inc");
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_nat_1to1.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_nat_1to1.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/firewall_nat_edit.php b/src/www/firewall_nat_edit.php
index b9e36f72f..ef1c3293c 100644
--- a/src/www/firewall_nat_edit.php
+++ b/src/www/firewall_nat_edit.php
@@ -1094,8 +1094,8 @@ $( document ).ready(function() {
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                    <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_nat.php'" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                    <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_nat.php'" />
                     <?php if (isset($id)): ?>
                     <input id="entryid" name="id" type="hidden" value="<?=$id;?>" />
                     <?php endif; ?>
diff --git a/src/www/firewall_nat_npt_edit.php b/src/www/firewall_nat_npt_edit.php
index 752a08ea5..94d419010 100644
--- a/src/www/firewall_nat_npt_edit.php
+++ b/src/www/firewall_nat_npt_edit.php
@@ -262,8 +262,8 @@ include("head.inc");
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_nat_npt.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_nat_npt.php'" />
                       <?php if (isset($id)): ?>
                         <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
                       <?php endif; ?>
diff --git a/src/www/firewall_nat_out_edit.php b/src/www/firewall_nat_out_edit.php
index 1cac8aa8c..c8c08fa62 100644
--- a/src/www/firewall_nat_out_edit.php
+++ b/src/www/firewall_nat_out_edit.php
@@ -820,8 +820,8 @@ include("head.inc");
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                    <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_nat_out.php'" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                    <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_nat_out.php'" />
 <?php
                     if (isset($id)):
 ?>
diff --git a/src/www/firewall_rules_edit.php b/src/www/firewall_rules_edit.php
index 4c926a9af..deeac515c 100644
--- a/src/www/firewall_rules_edit.php
+++ b/src/www/firewall_rules_edit.php
@@ -1521,8 +1521,8 @@ include("head.inc");
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                        <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_rules.php?if=<?= !empty($pconfig['floating']) ? 'FloatingRules' : $pconfig['interface'] ?>'" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                        <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_rules.php?if=<?= !empty($pconfig['floating']) ? 'FloatingRules' : $pconfig['interface'] ?>'" />
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/firewall_schedule_edit.php b/src/www/firewall_schedule_edit.php
index 940695cc8..f6458ed27 100644
--- a/src/www/firewall_schedule_edit.php
+++ b/src/www/firewall_schedule_edit.php
@@ -1156,8 +1156,8 @@ $( function() { $('#iform td').css({ 'background-color' : '' }); })
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                        <input id="submit" name="submit" type="submit" onclick="return checkForRanges();" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                        <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_schedule.php'" />
+                        <input id="submit" name="submit" type="submit" onclick="return checkForRanges();" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                        <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_schedule.php'" />
                         <?php if (isset($id)): ?>
                           <input name="id" type="hidden" value="<?=$id;?>" />
                         <?php endif; ?>
diff --git a/src/www/firewall_scrub.php b/src/www/firewall_scrub.php
index 98ca6f8e0..12a02b135 100644
--- a/src/www/firewall_scrub.php
+++ b/src/www/firewall_scrub.php
@@ -276,7 +276,7 @@ $( document ).ready(function() {
                     <tr>
                       <td></td>
                       <td>
-                          <input name="Submit" id="save" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                          <input name="Submit" id="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                       </td>
                     </tr>
                     </tbody>
diff --git a/src/www/firewall_scrub_edit.php b/src/www/firewall_scrub_edit.php
index 243e15154..889d9f841 100644
--- a/src/www/firewall_scrub_edit.php
+++ b/src/www/firewall_scrub_edit.php
@@ -666,8 +666,8 @@ include("head.inc");
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                        <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_scrub.php'" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                        <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_scrub.php'" />
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/firewall_virtual_ip_edit.php b/src/www/firewall_virtual_ip_edit.php
index 907bd225d..1984e8e92 100644
--- a/src/www/firewall_virtual_ip_edit.php
+++ b/src/www/firewall_virtual_ip_edit.php
@@ -470,8 +470,8 @@ $( document ).ready(function() {
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/firewall_virtual_ip.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/firewall_virtual_ip.php'" />
                       <?php if (isset($id) && $a_vip[$id]): ?>
                         <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/interfaces.php b/src/www/interfaces.php
index 015af84af..8c589701c 100644
--- a/src/www/interfaces.php
+++ b/src/www/interfaces.php
@@ -3560,8 +3560,8 @@ include("head.inc");
                       <tr>
                         <td style="width:22%"></td>
                         <td style="width:78%">
-                          <input id="save" name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                          <input id="cancel" type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces.php'" />
+                          <input id="save" name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                          <input id="cancel" type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces.php'" />
                           <input name="if" type="hidden" id="if" value="<?=$if;?>" />
 <?php
                           if ($pconfig['if'] == $a_ppps[$pppid]['if']) : ?>
diff --git a/src/www/interfaces_bridge_edit.php b/src/www/interfaces_bridge_edit.php
index 8b6899977..5b23b46c0 100644
--- a/src/www/interfaces_bridge_edit.php
+++ b/src/www/interfaces_bridge_edit.php
@@ -620,8 +620,8 @@ $(document).ready(function() {
                       <td style="width:22%">&nbsp;</td>
                       <td style="width:78%">
                         <input type="hidden" name="bridgeif" value="<?=$pconfig['bridgeif']; ?>" />
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                        <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_bridge.php'" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                        <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_bridge.php'" />
 <?php if (isset($id)): ?>
                         <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
 <?php endif; ?>
diff --git a/src/www/interfaces_gif_edit.php b/src/www/interfaces_gif_edit.php
index efc8c882d..e188e5e1b 100644
--- a/src/www/interfaces_gif_edit.php
+++ b/src/www/interfaces_gif_edit.php
@@ -267,8 +267,8 @@ include("head.inc");
                     <td>&nbsp;</td>
                     <td>
                       <input type="hidden" name="gifif" value="<?=$pconfig['gifif']; ?>" />
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_gif.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_gif.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
                       <?php endif; ?>
diff --git a/src/www/interfaces_gre_edit.php b/src/www/interfaces_gre_edit.php
index 40cba3eb7..752f13837 100644
--- a/src/www/interfaces_gre_edit.php
+++ b/src/www/interfaces_gre_edit.php
@@ -256,8 +256,8 @@ include("head.inc");
                     <td style="width:22%">&nbsp;</td>
                     <td style="width:78%">
                       <input type="hidden" name="greif" value="<?=$pconfig['greif']; ?>" />
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_gre.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_gre.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/interfaces_groups_edit.php b/src/www/interfaces_groups_edit.php
index e0e6ac3d4..fa22b4891 100644
--- a/src/www/interfaces_groups_edit.php
+++ b/src/www/interfaces_groups_edit.php
@@ -194,8 +194,8 @@ legacy_html_escape_form_data($pconfig);
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_groups.php'" />
+                      <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_groups.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/interfaces_lagg_edit.php b/src/www/interfaces_lagg_edit.php
index 888201db5..3f9b8e2fe 100644
--- a/src/www/interfaces_lagg_edit.php
+++ b/src/www/interfaces_lagg_edit.php
@@ -297,8 +297,8 @@ legacy_html_escape_form_data($pconfig);
                     <td style="width:22%">&nbsp;</td>
                     <td style="width:78%">
                       <input type="hidden" name="laggif" value="<?=$pconfig['laggif']; ?>" />
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_lagg.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_lagg.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/interfaces_ppps_edit.php b/src/www/interfaces_ppps_edit.php
index 85b8e6e5f..e86ffdcc2 100644
--- a/src/www/interfaces_ppps_edit.php
+++ b/src/www/interfaces_ppps_edit.php
@@ -807,8 +807,8 @@ include("head.inc");
                       <tr>
                         <td style="width:22%">&nbsp;</td>
                         <td style="width:78%">
-                          <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                          <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_ppps.php'" />
+                          <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                          <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_ppps.php'" />
                           <input name="ptpid" type="hidden" value="<?=$pconfig['ptpid'];?>" />
                           <?php if (isset($id)): ?>
                             <input name="id" type="hidden" value="<?=$id;?>" />
diff --git a/src/www/interfaces_vlan_edit.php b/src/www/interfaces_vlan_edit.php
index 717025ea1..1cb35f460 100644
--- a/src/www/interfaces_vlan_edit.php
+++ b/src/www/interfaces_vlan_edit.php
@@ -226,8 +226,8 @@ legacy_html_escape_form_data($pconfig);
                     <td style="width:22%">&nbsp;</td>
                     <td style="width:78%">
                       <input type="hidden" name="vlanif" value="<?=$pconfig['vlanif']; ?>" />
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_vlan.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_vlan.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/interfaces_wireless_edit.php b/src/www/interfaces_wireless_edit.php
index 75fdec1aa..4afd48b76 100644
--- a/src/www/interfaces_wireless_edit.php
+++ b/src/www/interfaces_wireless_edit.php
@@ -182,8 +182,8 @@ include("head.inc");
                   <td>
                     <input type="hidden" name="mode" value="<?=isset($pconfig['mode']) ? $pconfig['mode'] : 'bss' ?>" />
                     <input type="hidden" name="cloneif" value="<?=$pconfig['cloneif']; ?>" />
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                    <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/interfaces_wireless.php'" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                    <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/interfaces_wireless.php'" />
                     <?php if (isset($id)): ?>
                     <input name="id" type="hidden" value="<?=$id;?>" />
                     <?php endif; ?>
diff --git a/src/www/services_dhcp.php b/src/www/services_dhcp.php
index 67c95fb53..26e13df16 100644
--- a/src/www/services_dhcp.php
+++ b/src/www/services_dhcp.php
@@ -1098,7 +1098,7 @@ include("head.inc");
 <?php
                         endif; ?>
                         <input name="if" type="hidden" value="<?=$if;?>" />
-                        <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>"  />
+                        <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>"  />
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/services_dhcp_edit.php b/src/www/services_dhcp_edit.php
index ef5580de5..8131d5ef4 100644
--- a/src/www/services_dhcp_edit.php
+++ b/src/www/services_dhcp_edit.php
@@ -504,8 +504,8 @@ include("head.inc");
                 <tr>
                   <td></td>
                   <td>
-                    <input name="Submit" type="submit" class="formbtn btn btn-primary" value="<?=gettext("Save");?>" />
-                    <input type="button" class="formbtn btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_dhcp.php?if=<?= html_safe($if) ?>'" />
+                    <input name="Submit" type="submit" class="formbtn btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                    <input type="button" class="formbtn btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/services_dhcp.php?if=<?= html_safe($if) ?>'" />
 <?php
                   if (isset($id)): ?>
                     <input name="id" type="hidden" value="<?=$id;?>" />
diff --git a/src/www/services_dhcp_relay.php b/src/www/services_dhcp_relay.php
index 01fcbf636..d7a3e170f 100644
--- a/src/www/services_dhcp_relay.php
+++ b/src/www/services_dhcp_relay.php
@@ -171,7 +171,7 @@ include("head.inc");
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" onclick="enable_change(true)" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" onclick="enable_change(true)" />
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/services_dhcpv6.php b/src/www/services_dhcpv6.php
index 1e7b4631a..024b33951 100644
--- a/src/www/services_dhcpv6.php
+++ b/src/www/services_dhcpv6.php
@@ -746,7 +746,7 @@ if (isset($config['interfaces'][$if]['dhcpd6track6allowoverride'])) {
                       <td>&nbsp;</td>
                       <td>
                         <input name="if" type="hidden" value="<?=$if;?>" />
-                        <input name="submit" type="submit" class="formbtn btn btn-primary" value="<?=gettext("Save");?>"/>
+                        <input name="submit" type="submit" class="formbtn btn btn-primary" value="<?=html_safe(gettext('Save'));?>"/>
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/services_dhcpv6_edit.php b/src/www/services_dhcpv6_edit.php
index 57601b6fe..b363d8e4c 100644
--- a/src/www/services_dhcpv6_edit.php
+++ b/src/www/services_dhcpv6_edit.php
@@ -234,8 +234,8 @@ include("head.inc");
                   <tr>
                     <td></td>
                     <td>
-                      <input name="Submit" type="submit" class="formbtn btn btn-primary" value="<?=gettext("Save");?>" />
-                      <input type="button" class="formbtn btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_dhcpv6.php?if=<?= html_safe($if) ?>'" />
+                      <input name="Submit" type="submit" class="formbtn btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                      <input type="button" class="formbtn btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/services_dhcpv6.php?if=<?= html_safe($if) ?>'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
                       <?php endif; ?>
diff --git a/src/www/services_dhcpv6_relay.php b/src/www/services_dhcpv6_relay.php
index 0de0c7e4a..0c37225fa 100644
--- a/src/www/services_dhcpv6_relay.php
+++ b/src/www/services_dhcpv6_relay.php
@@ -173,7 +173,7 @@ include("head.inc");
                     <tr>
                       <td></td>
                       <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/services_dnsmasq.php b/src/www/services_dnsmasq.php
index 33c09c868..cbcb85d33 100644
--- a/src/www/services_dnsmasq.php
+++ b/src/www/services_dnsmasq.php
@@ -392,7 +392,7 @@ $( document ).ready(function() {
                 <tr>
                   <td></td>
                   <td>
-                    <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                    <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                   </td>
                 </tr>
                 <tr>
diff --git a/src/www/services_dnsmasq_domainoverride_edit.php b/src/www/services_dnsmasq_domainoverride_edit.php
index 630784e72..b8d0c3d01 100644
--- a/src/www/services_dnsmasq_domainoverride_edit.php
+++ b/src/www/services_dnsmasq_domainoverride_edit.php
@@ -194,8 +194,8 @@ include("head.inc");
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                        <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_dnsmasq.php'" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                        <input type="button" class="btn btn-default" value="<?=html_safe(gettext('Cancel'));?>" onclick="window.location.href='/services_dnsmasq.php'" />
                         <?php if (isset($id)): ?>
                         <input name="id" type="hidden" value="<?=$id;?>" />
                         <?php endif; ?>
diff --git a/src/www/services_dnsmasq_edit.php b/src/www/services_dnsmasq_edit.php
index 4d7c896a4..b0f3beba7 100644
--- a/src/www/services_dnsmasq_edit.php
+++ b/src/www/services_dnsmasq_edit.php
@@ -277,8 +277,8 @@ include("head.inc");
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                    <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_dnsmasq.php'" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                    <input type="button" class="btn btn-default" value="<?=html_safe(gettext("Cancel"));?>" onclick="window.location.href='/services_dnsmasq.php'" />
                     <?php if (isset($id)): ?>
                     <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
                     <?php endif; ?>
diff --git a/src/www/services_ntpd.php b/src/www/services_ntpd.php
index 9a4910b0a..29cd8e7b1 100644
--- a/src/www/services_ntpd.php
+++ b/src/www/services_ntpd.php
@@ -418,7 +418,7 @@ include("head.inc");
                   <tr>
                     <td style="width:22%">&nbsp;</td>
                     <td style="width:78%">
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                     </td>
                   </tr>
                 </tbody>
diff --git a/src/www/services_ntpd_gps.php b/src/www/services_ntpd_gps.php
index d30bac85d..4bc4ce25c 100644
--- a/src/www/services_ntpd_gps.php
+++ b/src/www/services_ntpd_gps.php
@@ -522,7 +522,7 @@ SureGPS =    #Sure Electronics SKG16B
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                       </td>
                     </tr>
                   </tbody>
diff --git a/src/www/services_ntpd_pps.php b/src/www/services_ntpd_pps.php
index 61807becb..b1e6b7596 100644
--- a/src/www/services_ntpd_pps.php
+++ b/src/www/services_ntpd_pps.php
@@ -185,7 +185,7 @@ include("head.inc");
                     <tr>
                       <td></td>
                       <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                       </td>
                     </tr>
                   </tbody>
diff --git a/src/www/services_opendns.php b/src/www/services_opendns.php
index d0020b8e2..ff88d077b 100644
--- a/src/www/services_opendns.php
+++ b/src/www/services_opendns.php
@@ -212,8 +212,8 @@ include 'head.inc';
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext('Save');?>" />
-                    <input name="test" type="submit" class="btn btn-primary" value="<?=gettext('Test/Update');?>" />
+                    <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                    <input name="test" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Test/Update'));?>" />
                   </td>
                 </tr>
               </tbody>
diff --git a/src/www/services_router_advertisements.php b/src/www/services_router_advertisements.php
index 9225a43c1..823833d9b 100644
--- a/src/www/services_router_advertisements.php
+++ b/src/www/services_router_advertisements.php
@@ -408,7 +408,7 @@ include("head.inc");
                     <td>&nbsp;</td>
                     <td>
                       <input name="if" type="hidden" value="<?=$if;?>" />
-                      <input name="Submit" type="submit" class="formbtn btn btn-primary" value="<?=gettext("Save");?>" />
+                      <input name="Submit" type="submit" class="formbtn btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                     </td>
                   </tr>
                 </table>
diff --git a/src/www/services_unbound.php b/src/www/services_unbound.php
index 16a3dbd1c..611f92db9 100644
--- a/src/www/services_unbound.php
+++ b/src/www/services_unbound.php
@@ -351,7 +351,7 @@ include_once("head.inc");
                       <tr>
                         <td></td>
                         <td>
-                          <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                          <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                         </td>
                       </tr>
                       <tr>
diff --git a/src/www/services_unbound_acls.php b/src/www/services_unbound_acls.php
index 2a37e3ce5..03c767c31 100644
--- a/src/www/services_unbound_acls.php
+++ b/src/www/services_unbound_acls.php
@@ -326,7 +326,7 @@ if (!isset($_GET['act'])) {
                   <td>&nbsp;</td>
                   <td>
                       &nbsp;<br />&nbsp;
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                       <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_unbound_acls.php'" />
                   </td>
                 </tr>
diff --git a/src/www/services_unbound_domainoverride_edit.php b/src/www/services_unbound_domainoverride_edit.php
index c42ac9f3b..aee66be57 100644
--- a/src/www/services_unbound_domainoverride_edit.php
+++ b/src/www/services_unbound_domainoverride_edit.php
@@ -149,7 +149,7 @@ include("head.inc");
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                        <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                         <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_unbound_overrides.php'" />
                         <?php if (isset($id)): ?>
                         <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
diff --git a/src/www/services_unbound_host_edit.php b/src/www/services_unbound_host_edit.php
index b67590979..51f916597 100644
--- a/src/www/services_unbound_host_edit.php
+++ b/src/www/services_unbound_host_edit.php
@@ -255,7 +255,7 @@ include("head.inc");
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                       <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/services_unbound_overrides.php'" />
                       <?php if (isset($id)): ?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
diff --git a/src/www/system_advanced_admin.php b/src/www/system_advanced_admin.php
index 48e3fe488..6c5094c5a 100644
--- a/src/www/system_advanced_admin.php
+++ b/src/www/system_advanced_admin.php
@@ -839,7 +839,7 @@ $(document).ready(function() {
             <table class="table table-striped opnsense_standard_table_form">
               <tr>
                 <td style="width:22%"></td>
-                <td style="width:78%"><input name="Submit" type="submit" class="btn btn-primary" value="<?= gettext("Save") ?>" /></td>
+                <td style="width:78%"><input name="Submit" type="submit" class="btn btn-primary" value="<?= html_safe(gettext('Save')) ?>" /></td>
               </tr>
             </table>
           </div>
diff --git a/src/www/system_advanced_firewall.php b/src/www/system_advanced_firewall.php
index d40ffcdc0..7cdfd4d7e 100644
--- a/src/www/system_advanced_firewall.php
+++ b/src/www/system_advanced_firewall.php
@@ -694,7 +694,7 @@ include("head.inc");
             <table class="table table-striped opnsense_standard_table_form">
               <tr>
                 <td style="width:22%"></td>
-                <td style="width:78%"><input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" /></td>
+                <td style="width:78%"><input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" /></td>
               </tr>
             </table>
           </div>
diff --git a/src/www/system_advanced_misc.php b/src/www/system_advanced_misc.php
index 68ab05805..b13626df0 100644
--- a/src/www/system_advanced_misc.php
+++ b/src/www/system_advanced_misc.php
@@ -557,7 +557,7 @@ include("head.inc");
               <tr>
                 <td style="width:22%"></td>
                 <td style="width:78%">
-                  <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                  <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                 </td>
               </tr>
             </table>
diff --git a/src/www/system_advanced_sysctl.php b/src/www/system_advanced_sysctl.php
index 1b5f4721a..8d7c7b2e3 100644
--- a/src/www/system_advanced_sysctl.php
+++ b/src/www/system_advanced_sysctl.php
@@ -221,8 +221,8 @@ $( document ).ready(function() {
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
-                    <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/system_advanced_sysctl.php'" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
+                    <input type="button" class="btn btn-default" value="<?=html_safe(gettext("Cancel"));?>" onclick="window.location.href='/system_advanced_sysctl.php'" />
 
 <?php
                     if (isset($id)) :?>
diff --git a/src/www/system_authservers.php b/src/www/system_authservers.php
index b9e1155cb..7b4113ab8 100644
--- a/src/www/system_authservers.php
+++ b/src/www/system_authservers.php
@@ -848,7 +848,7 @@ endif; ?>
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                    <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
 <?php if (isset($id)) :
 ?>
                     <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
diff --git a/src/www/system_camanager.php b/src/www/system_camanager.php
index 616073c68..6c12399ba 100644
--- a/src/www/system_camanager.php
+++ b/src/www/system_camanager.php
@@ -681,7 +681,7 @@ $main_buttons = array(
             <tr>
               <td style="width:22%">&nbsp;</td>
               <td style="width:78%">
-                <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
               </td>
             </tr>
           </table>
diff --git a/src/www/system_certmanager.php b/src/www/system_certmanager.php
index ac148badc..42aee7f4c 100644
--- a/src/www/system_certmanager.php
+++ b/src/www/system_certmanager.php
@@ -1212,7 +1212,7 @@ $( document ).ready(function() {
               <tr>
                 <td style="width:22%">&nbsp;</td>
                 <td style="width:78%">
-                  <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                  <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                 </td>
               </tr>
             </table>
diff --git a/src/www/system_crlmanager.php b/src/www/system_crlmanager.php
index 014f4d428..4a70bbeb4 100644
--- a/src/www/system_crlmanager.php
+++ b/src/www/system_crlmanager.php
@@ -416,7 +416,7 @@ include("head.inc");
               <tr>
                 <td style="width:22%">&nbsp;</td>
                 <td style="width:78%">
-                  <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                  <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
 <?php
                   if (isset($id)) :?>
                   <input name="id" type="hidden" value="<?=$id;?>" />
@@ -451,7 +451,7 @@ include("head.inc");
               <tr>
                 <td>&nbsp;</td>
                 <td>
-                  <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                  <input id="submit" name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                   <input name="id" type="hidden" value="<?=$id;?>" />
                   <input name="act" type="hidden" value="<?=$act;?>" />
                 </td>
diff --git a/src/www/system_gateway_groups_edit.php b/src/www/system_gateway_groups_edit.php
index 944c4219f..818d7fc06 100644
--- a/src/www/system_gateway_groups_edit.php
+++ b/src/www/system_gateway_groups_edit.php
@@ -302,8 +302,8 @@ $( document ).ready(function() {
                   <tr>
                     <td></td>
                     <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                      <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/system_gateway_groups.php'" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                      <input type="button" class="btn btn-default" value="<?=html_safe(gettext("Cancel"));?>" onclick="window.location.href='/system_gateway_groups.php'" />
 <?php
                       if (isset($id)) :?>
                       <input name="id" type="hidden" value="<?=$id;?>" />
diff --git a/src/www/system_gateways_edit.php b/src/www/system_gateways_edit.php
index 1f9b5af0c..369bafadd 100644
--- a/src/www/system_gateways_edit.php
+++ b/src/www/system_gateways_edit.php
@@ -735,7 +735,7 @@ $( document ).ready(function() {
                 <tr>
                   <td>&nbsp;</td>
                   <td>
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                     <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>"
                            onclick="window.location.href='<?=isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/system_gateways.php';?>'" />
 <?php
diff --git a/src/www/system_general.php b/src/www/system_general.php
index 4e2523c46..1cbe3e263 100644
--- a/src/www/system_general.php
+++ b/src/www/system_general.php
@@ -490,7 +490,7 @@ include("head.inc");
             <tr>
               <td style="width:22%"></td>
               <td>
-                <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
               </td>
             </tr>
           </table>
diff --git a/src/www/system_groupmanager.php b/src/www/system_groupmanager.php
index fc99dcf7c..302514f97 100644
--- a/src/www/system_groupmanager.php
+++ b/src/www/system_groupmanager.php
@@ -345,8 +345,8 @@ $( document ).ready(function() {
               <tr>
                 <td></td>
                 <td>
-                  <input name="save" id="save" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                  <input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>" onclick="window.location.href='/system_groupmanager.php'" />
+                  <input name="save" id="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                  <input type="button" class="btn btn-default" value="<?=html_safe(gettext("Cancel"));?>" onclick="window.location.href='/system_groupmanager.php'" />
 <?php
                   if (isset($id)) :?>
                   <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
diff --git a/src/www/system_usermanager_addprivs.php b/src/www/system_usermanager_addprivs.php
index d5a2e4bf6..00a97dec3 100644
--- a/src/www/system_usermanager_addprivs.php
+++ b/src/www/system_usermanager_addprivs.php
@@ -243,8 +243,8 @@ include("head.inc");
               <tr>
                 <td>&nbsp;</td>
                 <td>
-                  <input type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
-                  <input class="btn btn-default" type="button" value="<?=gettext("Cancel");?>" onclick="history.back()" />
+                  <input type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
+                  <input class="btn btn-default" type="button" value="<?=html_safe(gettext("Cancel"));?>" onclick="history.back()" />
                 </td>
               </tr>
             </table>
diff --git a/src/www/system_usermanager_passwordmg.php b/src/www/system_usermanager_passwordmg.php
index 87524a960..05b004a62 100644
--- a/src/www/system_usermanager_passwordmg.php
+++ b/src/www/system_usermanager_passwordmg.php
@@ -167,7 +167,7 @@ include("head.inc");
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+                      <input name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
                     </td>
                   </tr>
                 </table>
diff --git a/src/www/vpn_ipsec.php b/src/www/vpn_ipsec.php
index 5c8163c30..a8044b226 100644
--- a/src/www/vpn_ipsec.php
+++ b/src/www/vpn_ipsec.php
@@ -644,7 +644,7 @@ $( document ).ready(function() {
                     </tr>
                     <tr>
                       <td colspan=9>
-                        <input type="submit" name="save" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                        <input type="submit" name="save" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                       </td>
                     </tr>
                 </tbody>
diff --git a/src/www/vpn_ipsec_keys_edit.php b/src/www/vpn_ipsec_keys_edit.php
index f33ede9cf..03e1f0e6e 100644
--- a/src/www/vpn_ipsec_keys_edit.php
+++ b/src/www/vpn_ipsec_keys_edit.php
@@ -161,7 +161,7 @@ include("head.inc");
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
 <?php                 if (isset($id) && isset($config['ipsec']['mobilekey'][$id])) :
 ?>
                       <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
diff --git a/src/www/vpn_ipsec_mobile.php b/src/www/vpn_ipsec_mobile.php
index 7551f9d8a..829178bdb 100644
--- a/src/www/vpn_ipsec_mobile.php
+++ b/src/www/vpn_ipsec_mobile.php
@@ -552,7 +552,7 @@ endforeach;
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                      <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                     </td>
                   </tr>
                 </table>
diff --git a/src/www/vpn_ipsec_phase1.php b/src/www/vpn_ipsec_phase1.php
index f775d36a3..c8a57c8a7 100644
--- a/src/www/vpn_ipsec_phase1.php
+++ b/src/www/vpn_ipsec_phase1.php
@@ -1089,7 +1089,7 @@ endif; ?>
                       <?php
 endif; ?>
                       <input name="ikeid" type="hidden" value="<?=$pconfig['ikeid'];?>" />
-                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                      <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                     </td>
                   </tr>
                 </tbody>
diff --git a/src/www/vpn_ipsec_phase2.php b/src/www/vpn_ipsec_phase2.php
index c9869b65a..8c77dc7d2 100644
--- a/src/www/vpn_ipsec_phase2.php
+++ b/src/www/vpn_ipsec_phase2.php
@@ -764,7 +764,7 @@ endif; ?>
                     <input name="remoteid_type" type="hidden" value="mobile" />
 <?php
                  endif; ?>
-                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                    <input name="Submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                     <input name="ikeid" type="hidden" value="<?=$pconfig['ikeid'];?>" />
                     <input name="uniqid" type="hidden" value="<?=$pconfig['uniqid'];?>" />
                   </td>
diff --git a/src/www/vpn_ipsec_settings.php b/src/www/vpn_ipsec_settings.php
index cd07bbc8d..58bcc16c8 100644
--- a/src/www/vpn_ipsec_settings.php
+++ b/src/www/vpn_ipsec_settings.php
@@ -225,7 +225,7 @@ if (isset($input_errors) && count($input_errors) > 0) {
                     <tr>
                       <td>&nbsp;</td>
                       <td>
-                        <input name="submit" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                        <input name="submit" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                       </td>
                     </tr>
                   </table>
diff --git a/src/www/vpn_openvpn_client.php b/src/www/vpn_openvpn_client.php
index fae3d72c1..3d7adab3c 100644
--- a/src/www/vpn_openvpn_client.php
+++ b/src/www/vpn_openvpn_client.php
@@ -1152,7 +1152,7 @@ $( document ).ready(function() {
           <tr>
             <td>&nbsp;</td>
             <td style="width:78%">
-              <input name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+              <input name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
               <input name="act" type="hidden" value="<?=$act;?>" />
 <?php
               if (isset($id) && $a_client[$id]) :?>
diff --git a/src/www/vpn_openvpn_csc.php b/src/www/vpn_openvpn_csc.php
index 6a68bfbc1..9f18c058b 100644
--- a/src/www/vpn_openvpn_csc.php
+++ b/src/www/vpn_openvpn_csc.php
@@ -664,7 +664,7 @@ if ($act!="new" && $act!="edit") {
                   <tr>
                     <td>&nbsp;</td>
                     <td>
-                      <input name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                      <input name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                       <input name="act" type="hidden" value="<?=$act;?>" />
 <?php
                       if (isset($id)) :?>
diff --git a/src/www/vpn_openvpn_server.php b/src/www/vpn_openvpn_server.php
index 9999ae091..f0f91d6cf 100644
--- a/src/www/vpn_openvpn_server.php
+++ b/src/www/vpn_openvpn_server.php
@@ -1600,7 +1600,7 @@ endif; ?>
                     <tr>
                       <td style="width:22%">&nbsp;</td>
                       <td style="width:78%">
-                        <input name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
+                        <input name="save" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save')); ?>" />
                         <input name="act" type="hidden" value="<?=$act;?>" />
 <?php
                         if (isset($id) && $a_server[$id]) :?>
diff --git a/src/www/widgets/widgets/rss.widget.php b/src/www/widgets/widgets/rss.widget.php
index dd04e0fe3..affe2aae1 100644
--- a/src/www/widgets/widgets/rss.widget.php
+++ b/src/www/widgets/widgets/rss.widget.php
@@ -130,7 +130,7 @@ if (!empty($config['widgets']['rsswidgettextlength']) && is_numeric($config['wid
       </tr>
       <tr>
         <td colspan="2">
-          <input id="submitc" name="submitc" type="submit" class="btn btn-primary formbtn" value="<?= gettext('Save') ?>" />
+          <input id="submitc" name="submitc" type="submit" class="btn btn-primary formbtn" value="<?= html_safe(gettext('Save')) ?>" />
         </td>
       </tr>
     </table>
diff --git a/src/www/widgets/widgets/services_status.widget.php b/src/www/widgets/widgets/services_status.widget.php
index b0d699802..4eb637bba 100644
--- a/src/www/widgets/widgets/services_status.widget.php
+++ b/src/www/widgets/widgets/services_status.widget.php
@@ -58,7 +58,7 @@ if (isset($_POST['servicestatusfilter'])) {
         </tr>
         <tr>
           <td>
-            <input id="submitd" name="submitd" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
+            <input id="submitd" name="submitd" type="submit" class="btn btn-primary" value="<?=html_safe(gettext('Save'));?>" />
           </td>
         </tr>
       </tbody>
diff --git a/src/www/widgets/widgets/system_log.widget.php b/src/www/widgets/widgets/system_log.widget.php
index e8da54fc2..34e56e4d1 100644
--- a/src/www/widgets/widgets/system_log.widget.php
+++ b/src/www/widgets/widgets/system_log.widget.php
@@ -61,7 +61,7 @@ require_once('diag_logs_common.inc');
           </select>
         </td>
         <td>
-          <input id="submit_system_log_widget" name="submit_system_log_widget" type="submit" class="btn btn-primary formbtn" value="<?= gettext('Save') ?>">
+          <input id="submit_system_log_widget" name="submit_system_log_widget" type="submit" class="btn btn-primary formbtn" value="<?= html_safe(gettext('Save')) ?>">
         </td>
       </tr>
     </table>
diff --git a/src/www/widgets/widgets/thermal_sensors.widget.php b/src/www/widgets/widgets/thermal_sensors.widget.php
index e8d87a990..668458ef4 100644
--- a/src/www/widgets/widgets/thermal_sensors.widget.php
+++ b/src/www/widgets/widgets/thermal_sensors.widget.php
@@ -181,7 +181,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         </tr>
         <tr>
           <td colspan="2">
-            <input type="submit" id="thermal_sensors_widget_submit" name="thermal_sensors_widget_submit" class="btn btn-primary formbtn" value="<?= gettext('Save') ?>" />
+            <input type="submit" id="thermal_sensors_widget_submit" name="thermal_sensors_widget_submit" class="btn btn-primary formbtn" value="<?= html_safe(gettext('Save')) ?>" />
           </td>
         </tr>
         <tr>