diff -ur squirrelmail-webmail-1.4.22/functions/addressbook.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/addressbook.php
--- squirrelmail-webmail-1.4.22/functions/addressbook.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/addressbook.php	2012-07-05 18:12:36.000000000 +0900
@@ -154,7 +154,7 @@
      * display address book init errors.
      */
     if ($abook_init_error!='' && $showerr) {
-        $abook_init_error = htmlspecialchars($abook_init_error);
+        $abook_init_error = sq_htmlspecialchars($abook_init_error);
         error_box($abook_init_error,$color);
     }
 
diff -ur squirrelmail-webmail-1.4.22/functions/display_messages.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/display_messages.php
--- squirrelmail-webmail-1.4.22/functions/display_messages.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/display_messages.php	2012-07-05 18:12:36.000000000 +0900
@@ -32,7 +32,7 @@
     }
     
     $string .= sprintf (_("Click here to return to %s"),
-                  htmlspecialchars(imap_utf7_decode_local($mailbox))).
+                  sq_htmlspecialchars(imap_utf7_decode_local($mailbox))).
               '</a></td></tr>';
     error_box($string, $color);
 }
diff -ur squirrelmail-webmail-1.4.22/functions/forms.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/forms.php
--- squirrelmail-webmail-1.4.22/functions/forms.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/forms.php	2012-07-05 18:12:36.000000000 +0900
@@ -23,8 +23,8 @@
  */
 function addInputField($type, $name = null, $value = null, $attributes = '') {
     return '<input type="'.$type.'"'.
-        ($name  !== null ? ' name="'.htmlspecialchars($name).'"'   : '').
-        ($value !== null ? ' value="'.htmlspecialchars($value).'"' : '').
+        ($name  !== null ? ' name="'.sq_htmlspecialchars($name).'"'   : '').
+        ($value !== null ? ' value="'.sq_htmlspecialchars($value).'"' : '').
         $attributes . " />\n";
 }
 
@@ -89,16 +89,16 @@
     if(count($values) == 1) {
         $k = key($values); $v = array_pop($values);
         return addHidden($name, ($usekeys ? $k:$v)).
-            htmlspecialchars($v) . "\n";
+            sq_htmlspecialchars($v) . "\n";
     }
 
-    $ret = '<select name="'.htmlspecialchars($name) . "\">\n";
+    $ret = '<select name="'.sq_htmlspecialchars($name) . "\">\n";
     foreach ($values as $k => $v) {
         if(!$usekeys) $k = $v;
         $ret .= '<option value="' .
-            htmlspecialchars( $k ) . '"' .
+            sq_htmlspecialchars( $k ) . '"' .
             (($default == $k) ? ' selected="selected"' : '') .
-            '>' . htmlspecialchars($v) ."</option>\n";
+            '>' . sq_htmlspecialchars($v) ."</option>\n";
     }
     $ret .= "</select>\n";
 
@@ -123,9 +123,9 @@
  * Textarea form element.
  */
 function addTextArea($name, $text = '', $cols = 40, $rows = 10, $attr = '') {
-    return '<textarea name="'.htmlspecialchars($name).'" '.
+    return '<textarea name="'.sq_htmlspecialchars($name).'" '.
         'rows="'.(int)$rows .'" cols="'.(int)$cols.'" '.
-        $attr . '>'.htmlspecialchars($text) ."</textarea>\n";
+        $attr . '>'.sq_htmlspecialchars($text) ."</textarea>\n";
 }
 
 /**
@@ -156,7 +156,7 @@
         $enctype = ' enctype="'.$enctype.'"';
     }
     if($charset) {
-        $charset = ' accept-charset="'.htmlspecialchars($charset).'"';
+        $charset = ' accept-charset="'.sq_htmlspecialchars($charset).'"';
     }
 
     $form_string = '<form action="'. $action .'" method="'. $method .'"'.
diff -ur squirrelmail-webmail-1.4.22/functions/i18n.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/i18n.php
--- squirrelmail-webmail-1.4.22/functions/i18n.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/i18n.php	2012-07-05 18:14:36.000000000 +0900
@@ -184,7 +184,7 @@
     }
 
     /* All HTML special characters are 7 bit and can be replaced first */
-    if (! $save_html) $string = htmlspecialchars ($string);
+    if (! $save_html) $string = sq_htmlspecialchars ($string);
     $charset = strtolower($charset);
 
     set_my_charset();
@@ -1153,3 +1153,16 @@
         }
     }
 }
+// wrapper of htmlspecialchars
+// In PHP 5.4, defualt value of htmlspecialchars 3rd parameter is changed
+// from 'ISO8859-1' to 'UTF-8',
+// but if in ja_JP mode, html data encoding is 'EUC-JP', not 'UTF-8'.
+// htmlspecialchars discard invalid encoding characters,
+// so in ja_JP mode, EUC-JP characters are discarded.
+function sq_htmlspecialchars($string) {
+    $encoding = 'iso8859-1';
+    if (function_exists('mb_internal_encoding')) {
+        $encoding = mb_internal_encoding();
+    }
+    return htmlspecialchars($string, ENT_COMPAT | ENT_HTML401, $encoding);
+}
diff -ur squirrelmail-webmail-1.4.22/functions/imap_general.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_general.php
--- squirrelmail-webmail-1.4.22/functions/imap_general.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_general.php	2012-07-05 18:12:36.000000000 +0900
@@ -367,7 +367,7 @@
         $cmd = explode(' ',$query);
         $cmd = strtolower($cmd[0]);
         if ($query != '' &&  $cmd != 'login') {
-            $string .= ("Query:") . ' '. htmlspecialchars($query)
+            $string .= ("Query:") . ' '. sq_htmlspecialchars($query)
             . '<br />' . "</font><br />\n";
         }
         error_box($string,$color);
@@ -399,9 +399,9 @@
                 _("ERROR: Could not complete request.") .
                 "</b><br />\n" .
                 _("Query:") . ' ' .
-                htmlspecialchars($query) . '<br />' .
+                sq_htmlspecialchars($query) . '<br />' .
                 _("Reason Given:") . ' ' .
-                htmlspecialchars($message) . "</font><br />\n";
+                sq_htmlspecialchars($message) . "</font><br />\n";
             error_box($string,$color);
             echo '</body></html>';
             exit;
@@ -414,9 +414,9 @@
             _("ERROR: Bad or malformed request.") .
             "</b><br />\n" .
             _("Query:") . ' '.
-            htmlspecialchars($query) . '<br />' .
+            sq_htmlspecialchars($query) . '<br />' .
             _("Server responded:") . ' ' .
-            htmlspecialchars($message) . "</font><br />\n";
+            sq_htmlspecialchars($message) . "</font><br />\n";
         error_box($string,$color);
         echo '</body></html>';
         exit;
@@ -427,9 +427,9 @@
             _("ERROR: IMAP server closed the connection.") .
             "</b><br />\n" .
             _("Query:") . ' '.
-            htmlspecialchars($query) . '<br />' .
+            sq_htmlspecialchars($query) . '<br />' .
             _("Server responded:") . ' ' .
-            htmlspecialchars($message) . "</font><br />\n";
+            sq_htmlspecialchars($message) . "</font><br />\n";
         error_box($string,$color);
         echo '</body></html>';
         exit;
@@ -440,9 +440,9 @@
             _("ERROR: Unknown IMAP response.") .
             "</b><br />\n" .
             _("Query:") . ' '.
-            htmlspecialchars($query) . '<br />' .
+            sq_htmlspecialchars($query) . '<br />' .
             _("Server responded:") . ' ' .
-            htmlspecialchars($message) . "</font><br />\n";
+            sq_htmlspecialchars($message) . "</font><br />\n";
         error_box($string,$color);
        /* the error is displayed but because we don't know the reponse we
           return the result anyway */
@@ -588,7 +588,7 @@
         if (!$hide) {
             if ($response != 'NO') {
                 /* "BAD" and anything else gets reported here. */
-                $message = htmlspecialchars($message);
+                $message = sq_htmlspecialchars($message);
                 set_up_language($squirrelmail_language, true);
                 require_once(SM_PATH . 'functions/display_messages.php');
                 if ($response == 'BAD') {
@@ -599,7 +599,7 @@
                 if (isset($read) && is_array($read)) {
                     $string .= '<br />' . _("Read data:") . "<br />\n";
                     foreach ($read as $line) {
-                        $string .= htmlspecialchars($line) . "<br />\n";
+                        $string .= sq_htmlspecialchars($line) . "<br />\n";
                     }
                 }
                 error_box($string,$color);
diff -ur squirrelmail-webmail-1.4.22/functions/imap_mailbox.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_mailbox.php
--- squirrelmail-webmail-1.4.22/functions/imap_mailbox.php	2011-05-03 15:41:53.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_mailbox.php	2012-07-05 18:12:36.000000000 +0900
@@ -254,7 +254,7 @@
     if (strstr($mailbox, '../') || substr($mailbox, 0, 1) == '/') {
         global $color;
         include_once(SM_PATH . 'functions/display_messages.php');
-        error_box(sprintf(_("Invalid mailbox name: %s"),htmlspecialchars($mailbox)),$color);
+        error_box(sprintf(_("Invalid mailbox name: %s"),sq_htmlspecialchars($mailbox)),$color);
         sqimap_logout($imap_stream);
         die('</body></html>');
     }
@@ -555,16 +555,16 @@
                     $box2 = $boxes_part['formatted'];
                     break;
                   default:  /* default, long names, style = 0 */
-                    $box2 = str_replace(' ', '&nbsp;', htmlspecialchars(imap_utf7_decode_local($boxes_part['unformatted-disp'])));
+                    $box2 = str_replace(' ', '&nbsp;', sq_htmlspecialchars(imap_utf7_decode_local($boxes_part['unformatted-disp'])));
                     break;
                 }
             }
             $box2 = str_replace(array('<','>'), array('&lt;','&gt;') , $box2);
 
             if ($show_selected != 0 && in_array($lowerbox, $show_selected) ) {
-                $mbox_options .= '<option value="' . htmlspecialchars($box) .'" selected="selected">'.$box2.'</option>' . "\n";
+                $mbox_options .= '<option value="' . sq_htmlspecialchars($box) .'" selected="selected">'.$box2.'</option>' . "\n";
             } else {
-                $mbox_options .= '<option value="' . htmlspecialchars($box) .'">'.$box2.'</option>' . "\n";
+                $mbox_options .= '<option value="' . sq_htmlspecialchars($box) .'">'.$box2.'</option>' . "\n";
             }
         }
     }
diff -ur squirrelmail-webmail-1.4.22/functions/imap_messages.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_messages.php
--- squirrelmail-webmail-1.4.22/functions/imap_messages.php	2011-04-19 03:42:49.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_messages.php	2012-07-05 18:12:36.000000000 +0900
@@ -786,7 +786,7 @@
                  _("ERROR: Could not complete request.") .
                  '</b><br />' .
                  _("Unknown response from IMAP server:") . ' 1.' .
-                 htmlspecialchars($read) . "</font><br />\n";
+                 sq_htmlspecialchars($read) . "</font><br />\n";
                  break;
         }
         $i = strpos($read,'(',$i_space+5);
diff -ur squirrelmail-webmail-1.4.22/functions/imap_search.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_search.php
--- squirrelmail-webmail-1.4.22/functions/imap_search.php	2011-04-27 04:05:34.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/imap_search.php	2012-07-05 18:12:36.000000000 +0900
@@ -97,7 +97,7 @@
         if (strstr($errors,'* SEARCH')) {
             return array();
         }
-        echo '<!-- '.htmlspecialchars($errors) .' -->';
+        echo '<!-- '.sq_htmlspecialchars($errors) .' -->';
     }
 
 
diff -ur squirrelmail-webmail-1.4.22/functions/mailbox_display.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/mailbox_display.php
--- squirrelmail-webmail-1.4.22/functions/mailbox_display.php	2011-05-16 07:02:24.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/mailbox_display.php	2012-07-05 18:12:36.000000000 +0900
@@ -110,10 +110,10 @@
             if ($senderNames_part[1]) {
                 $senderName .= decodeHeader($senderNames_part[1]);
             } else {
-                $senderName .= htmlspecialchars($senderNames_part[0]);
+                $senderName .= sq_htmlspecialchars($senderNames_part[0]);
             }
 
-            $senderFrom .= htmlspecialchars($senderNames_part[0]);
+            $senderFrom .= sq_htmlspecialchars($senderNames_part[0]);
         }
     }
     $senderName = str_replace('&nbsp;',' ',$senderName);
@@ -530,8 +530,8 @@
     $form_name = "FormMsgs" . $safe_name;
     echo '<form name="' . $form_name . '" method="post" action="move_messages.php">' ."\n" .
         '<input type="hidden" name="smtoken" value="'.sm_generate_security_token().'">' . "\n" .
-        '<input type="hidden" name="mailbox" value="'.htmlspecialchars($mailbox).'">' . "\n" .
-        '<input type="hidden" name="startMessage" value="'.htmlspecialchars($start_msg).'">' . "\n";
+        '<input type="hidden" name="mailbox" value="'.sq_htmlspecialchars($mailbox).'">' . "\n" .
+        '<input type="hidden" name="startMessage" value="'.sq_htmlspecialchars($start_msg).'">' . "\n";
     
     echo '<table border="0" width="100%" cellpadding="0" cellspacing="0">';
     echo '<tr><td>';
diff -ur squirrelmail-webmail-1.4.22/functions/mime.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/mime.php
--- squirrelmail-webmail-1.4.22/functions/mime.php	2011-07-12 13:53:35.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/mime.php	2012-07-05 18:12:36.000000000 +0900
@@ -43,7 +43,7 @@
          '<center>';
         $errormessage  = _("SquirrelMail could not decode the bodystructure of the message");
         $errormessage .= '<br />'._("The bodystructure provided by your IMAP server:").'<br /><br />';
-        $errormessage .= '<table><tr><td>' . htmlspecialchars($read) . '</td></tr></table>';
+        $errormessage .= '<table><tr><td>' . sq_htmlspecialchars($read) . '</td></tr></table>';
         plain_error_message( $errormessage, $color );
         echo '</body></html>';
         exit;
@@ -540,7 +540,7 @@
             '<a href="'.$defaultlink.'">'.decodeHeader($display_filename).'</a>&nbsp;</td>' .
             '<td><small><b>' . show_readable_size($header->size) .
             '</b>&nbsp;&nbsp;</small></td>' .
-            '<td><small>[ '.htmlspecialchars($type0).'/'.htmlspecialchars($type1).' ]&nbsp;</small></td>' .
+            '<td><small>[ '.sq_htmlspecialchars($type0).'/'.htmlspecialchars($type1).' ]&nbsp;</small></td>' .
             '<td><small>';
         $attachments .= '<b>' . $description . '</b>';
         $attachments .= '</small></td><td><small>&nbsp;';
@@ -671,7 +671,7 @@
             $iLastMatch = $i;
             $j = $i;
             if ($htmlsave) {
-                $ret .= htmlspecialchars($res[1]);
+                $ret .= sq_htmlspecialchars($res[1]);
             } else {
                 $ret .= $res[1];
             }
@@ -696,7 +696,7 @@
                         $replace = charset_decode($res[2],$replace);
                     } elseif ($htmlsave) {
                         // string is not converted, but still sanitized
-                        $replace = htmlspecialchars($replace);
+                        $replace = sq_htmlspecialchars($replace);
                     }
                     $ret.= $replace;
                     break;
@@ -712,7 +712,7 @@
                         $replace = charset_decode($res[2], $replace);
                     } elseif ($htmlsave) {
                         // string is not converted, but still sanizited
-                        $replace = htmlspecialchars($replace);
+                        $replace = sq_htmlspecialchars($replace);
                     }
                     $ret .= $replace;
                     break;
@@ -731,7 +731,7 @@
         }
 
         if (!$encoded && $htmlsave) {
-            $ret .= htmlspecialchars($chunk);
+            $ret .= sq_htmlspecialchars($chunk);
         } else {
             $ret .= $chunk;
         }
diff -ur squirrelmail-webmail-1.4.22/functions/options.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/options.php
--- squirrelmail-webmail-1.4.22/functions/options.php	2011-07-12 13:36:01.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/options.php	2012-07-05 18:12:36.000000000 +0900
@@ -305,7 +305,7 @@
     }
 
     function createWidget_Info() {
-        $result = htmlspecialchars($this->value) . "\n";
+        $result = sq_htmlspecialchars($this->value) . "\n";
         return $result;
     }
 
@@ -341,9 +341,9 @@
         $result = "<input type=\"" 
                 . ($password ? 'password' : 'text') 
                 . "\" name=\"new_$this->name\" value=\""
-                . htmlspecialchars($this->value)
+                . sq_htmlspecialchars($this->value)
                 . "\" size=\"$width\" $this->script /> " 
-                . htmlspecialchars($this->trailing_text) . "\n";
+                . sq_htmlspecialchars($this->trailing_text) . "\n";
         return $result;
     }
 
@@ -384,14 +384,14 @@
             foreach ($this->possible_values as $real_value => $disp_value) {
                 $result .= "\n" . '<input type="radio" name="new_' . $this->name 
                          . '" id="new_' . $this->name . '_' 
-                         . ($this->htmlencoded ? $real_value : htmlspecialchars($real_value))
+                         . ($this->htmlencoded ? $real_value : sq_htmlspecialchars($real_value))
                          . '" value="'
-                         . ($this->htmlencoded ? $real_value : htmlspecialchars($real_value))
+                         . ($this->htmlencoded ? $real_value : sq_htmlspecialchars($real_value))
                          . '"' . ($real_value == $this->value ? ' checked="checked"' : '')
                          . ' /> <label for="new_' . $this->name . '_'
-                         . ($this->htmlencoded ? $real_value : htmlspecialchars($real_value))
+                         . ($this->htmlencoded ? $real_value : sq_htmlspecialchars($real_value))
                          . '">'
-                         . ($this->htmlencoded ? $disp_value : htmlspecialchars($disp_value))
+                         . ($this->htmlencoded ? $disp_value : sq_htmlspecialchars($disp_value))
                          . '</label>';
                 if ($this->size != SMOPT_SIZE_TINY)
                     $result .= '<br />';
@@ -437,7 +437,7 @@
         foreach ($this->possible_values as $real_value => $disp_value) {
             /* Start the next new option string. */
             $new_option = '<option value="' .
-                ($this->htmlencoded ? $real_value : htmlspecialchars($real_value)) . '"';
+                ($this->htmlencoded ? $real_value : sq_htmlspecialchars($real_value)) . '"';
 
             // multiple select lists have possibly more than one default selection
             if ($multiple_select) {
@@ -455,13 +455,13 @@
             }
 
             /* Add the display value to our option string. */
-            $new_option .= '>' . ($this->htmlencoded ? $disp_value : htmlspecialchars($disp_value)) . "</option>\n";
+            $new_option .= '>' . ($this->htmlencoded ? $disp_value : sq_htmlspecialchars($disp_value)) . "</option>\n";
             /* And add the new option string to our select tag. */
             $result .= $new_option;
         }
 
         /* Close the select tag and return our happy result. */
-        $result .= '</select>' . htmlspecialchars($this->trailing_text) . "\n";
+        $result .= '</select>' . sq_htmlspecialchars($this->trailing_text) . "\n";
         return $result;
     }
 
@@ -520,7 +520,7 @@
 
             } else {
                 /* Start the next new option string. */
-                $new_option = '<option value="' . htmlspecialchars($real_value) . '"';
+                $new_option = '<option value="' . sq_htmlspecialchars($real_value) . '"';
 
                 // multiple select lists have possibly more than one default selection
                 if ($multiple_select) {
@@ -538,13 +538,13 @@
                 }
 
                 /* Add the display value to our option string. */
-                $new_option .= '>' . htmlspecialchars($disp_value) . "</option>\n";
+                $new_option .= '>' . sq_htmlspecialchars($disp_value) . "</option>\n";
             }
             /* And add the new option string to our select tag. */
             $result .= $new_option;
         }
         /* Close the select tag and return our happy result. */
-        $result .= '</select>' . htmlspecialchars($this->trailing_text) . "\n";
+        $result .= '</select>' . sq_htmlspecialchars($this->trailing_text) . "\n";
         return $result;
     }
 
@@ -560,7 +560,7 @@
         }
         $result = "<textarea name=\"new_$this->name\" rows=\"$rows\" "
                 . "cols=\"$cols\" $this->script>"
-                . htmlspecialchars($this->value) . "</textarea>\n";
+                . sq_htmlspecialchars($this->value) . "</textarea>\n";
         return ($result);
     }
 
@@ -628,7 +628,7 @@
                     . '" id="new_' . $this->name . '" value="' . SMPREF_YES
                     . "\" $yes_chk " . $this->script . ' />&nbsp;'
                     . '<label for="new_' . $this->name . '">' 
-                    . htmlspecialchars($this->trailing_text) . '</label>';
+                    . sq_htmlspecialchars($this->trailing_text) . '</label>';
         }
 
         // radio buttons...
@@ -639,13 +639,13 @@
             $yes_option = '<input type="radio" name="new_' . $this->name 
                         . '" id="new_' . $this->name . '_yes"'
                         . ' value="' . SMPREF_YES . "\"$yes_chk $this->script />&nbsp;"
-                        . '<label for="new_' . $this->name . '_yes">' . (!empty($this->yes_text) ? htmlspecialchars($this->yes_text) : _("Yes")) . '</label>';
+                        . '<label for="new_' . $this->name . '_yes">' . (!empty($this->yes_text) ? sq_htmlspecialchars($this->yes_text) : _("Yes")) . '</label>';
 
             /* Build the no choice. */
             $no_option = '<input type="radio" name="new_' . $this->name
                        . '" id="new_' . $this->name . '_no"'
                        . ' value="' . SMPREF_NO . "\"$no_chk $this->script />&nbsp;"
-                       . '<label for="new_' . $this->name . '_no">' . (!empty($this->no_text) ? htmlspecialchars($this->no_text) : _("No")) . '</label>';
+                       . '<label for="new_' . $this->name . '_no">' . (!empty($this->no_text) ? sq_htmlspecialchars($this->no_text) : _("No")) . '</label>';
     
             /* Build the combined "boolean widget". */
             $result = "$yes_option&nbsp;&nbsp;&nbsp;&nbsp;$no_option";
@@ -657,7 +657,7 @@
 
     function createWidget_Hidden() {
         $result = '<input type="hidden" name="new_' . $this->name
-                . '" value="' . htmlspecialchars($this->value)
+                . '" value="' . sq_htmlspecialchars($this->value)
                 . '" ' . $this->script . ' />';
         return ($result);
     }
@@ -733,7 +733,7 @@
 
                     // Start the next new option string.
                     //
-                    $result .= '<option value="' . htmlspecialchars($value) . '"';
+                    $result .= '<option value="' . sq_htmlspecialchars($value) . '"';
 
                     // having a selected item in the edit list doesn't have
                     // any meaning, but maybe someone will think of a way to
@@ -748,7 +748,7 @@
 
                     // Add the display value to our option string.
                     //
-                    $result .= '>' . htmlspecialchars($value) . "</option>\n";
+                    $result .= '>' . sq_htmlspecialchars($value) . "</option>\n";
 
                 }
 
@@ -783,8 +783,8 @@
                     else $bgcolor = 4;
 
                     $result .= '<tr bgcolor="' . $color[$bgcolor] . '">'
-                             . '<td width="1%"><input type="checkbox" name="new_' . $this->name . '[' . ($index++) . ']" id="' . $this->name . '_list_item_' . $key . '" value="' . htmlspecialchars($value) . '"></td>'
-                             . '<td><label for="' . $this->name . '_list_item_' . $key . '">' . htmlspecialchars($value) . '</label></td>'
+                             . '<td width="1%"><input type="checkbox" name="new_' . $this->name . '[' . ($index++) . ']" id="' . $this->name . '_list_item_' . $key . '" value="' . sq_htmlspecialchars($value) . '"></td>'
+                             . '<td><label for="' . $this->name . '_list_item_' . $key . '">' . sq_htmlspecialchars($value) . '</label></td>'
                              . "</tr>\n";
 
                 }
@@ -821,9 +821,9 @@
     function createWidget_Submit() {
 
         $result = "<input type=\"submit\" name=\"$this->name\" value=\""
-                . htmlspecialchars($this->comment)
+                . sq_htmlspecialchars($this->comment)
                 . "\" $this->script />" 
-                . htmlspecialchars($this->trailing_text) . "\n";
+                . sq_htmlspecialchars($this->trailing_text) . "\n";
 
         return $result;
 
@@ -944,7 +944,7 @@
 function create_hidden_element($name, $value) {
     $result = '<input type="hidden" '
             . 'name="' . $name . '" '
-            . 'value="' . htmlspecialchars($value) . '" />';
+            . 'value="' . sq_htmlspecialchars($value) . '" />';
     return ($result);
 }
 
diff -ur squirrelmail-webmail-1.4.22/functions/page_header.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/page_header.php
--- squirrelmail-webmail-1.4.22/functions/page_header.php	2011-07-12 12:44:14.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/functions/page_header.php	2012-07-05 18:12:36.000000000 +0900
@@ -268,7 +268,7 @@
 
     echo "<body text=\"$color[8]\" bgcolor=\"$color[4]\" link=\"$color[7]\" vlink=\"$color[7]\" alink=\"$color[7]\" $onload>\n\n";
     /** Here is the header and wrapping table **/
-    $shortBoxName = htmlspecialchars(imap_utf7_decode_local(
+    $shortBoxName = sq_htmlspecialchars(imap_utf7_decode_local(
                       readShortMailboxName($mailbox, $delimiter)));
     if ( $shortBoxName == 'INBOX' ) {
         $shortBoxName = _("INBOX");
diff -ur squirrelmail-webmail-1.4.22/plugins/bug_report/bug_report.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/bug_report/bug_report.php
--- squirrelmail-webmail-1.4.22/plugins/bug_report/bug_report.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/bug_report/bug_report.php	2012-07-05 18:12:36.000000000 +0900
@@ -163,7 +163,7 @@
     $body_top .= "----------------------------------------------\n";
 }
 
-$body = htmlspecialchars($body_top . $body);
+$body = sq_htmlspecialchars($body_top . $body);
 
 ?>
     <br />
diff -ur squirrelmail-webmail-1.4.22/plugins/calendar/calendar.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/calendar.php
--- squirrelmail-webmail-1.4.22/plugins/calendar/calendar.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/calendar.php	2012-07-05 18:12:36.000000000 +0900
@@ -114,11 +114,11 @@
                     $calbar = $calendardata[$cdate][$calfoo['key']];
                     // FIXME: how to display multiline task
                     $title = '['. $calfoo['key']. '] ' .
-                        str_replace(array("\r","\n"),array(' ',' '),htmlspecialchars($calbar['message']));
+                        str_replace(array("\r","\n"),array(' ',' '),sq_htmlspecialchars($calbar['message']));
                     // FIXME: link to nowhere
                     echo "<a href=\"#\" style=\"text-decoration:none; color: "
                         .($calbar['priority']==1 ? $color[1] : $color[6])
-                        ."\" title=\"$title\">".htmlspecialchars($calbar['title'])."</a><br />\n";
+                        ."\" title=\"$title\">".sq_htmlspecialchars($calbar['title'])."</a><br />\n";
                     $i=$i+1;
                     if($i==2){
                         break;
diff -ur squirrelmail-webmail-1.4.22/plugins/calendar/day.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/day.php
--- squirrelmail-webmail-1.4.22/plugins/calendar/day.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/day.php	2012-07-05 18:12:36.000000000 +0900
@@ -127,9 +127,9 @@
                         html_tag( 'td', date_intl(_("H:i"),mktime($ehour,$eminute,0,1,1,0)) . $elength, 'left' ) .
                         html_tag( 'td', '', 'left' ) . '[';
                             echo ($calbar['priority']==1) ? 
-                                "<font color=\"$color[1]\">".htmlspecialchars($calbar['title']).'</font>' : 
-                                htmlspecialchars($calbar['title']);
-                            echo'] <div style="margin-left:10px">'.nl2br(htmlspecialchars($calbar['message'])).'</div>' .
+                                "<font color=\"$color[1]\">".sq_htmlspecialchars($calbar['title']).'</font>' : 
+                                sq_htmlspecialchars($calbar['title']);
+                            echo'] <div style="margin-left:10px">'.nl2br(sq_htmlspecialchars($calbar['message'])).'</div>' .
                         html_tag( 'td',
                             "<font size=\"-1\"><nobr>\n" .
                             "<a href=\"event_edit.php?year=$year&amp;month=$month&amp;day=$day&amp;hour=".
diff -ur squirrelmail-webmail-1.4.22/plugins/calendar/event_create.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/event_create.php
--- squirrelmail-webmail-1.4.22/plugins/calendar/event_create.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/event_create.php	2012-07-05 18:12:36.000000000 +0900
@@ -160,11 +160,11 @@
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td', _("Title:"), 'right', $color[4] ) . "\n" .
-                    html_tag( 'td', htmlspecialchars($event_title,ENT_NOQUOTES), 'left', $color[4] ) . "\n"
+                    html_tag( 'td', sq_htmlspecialchars($event_title,ENT_NOQUOTES), 'left', $color[4] ) . "\n"
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td', _("Message:"), 'right', $color[4] ) . "\n" .
-                    html_tag( 'td', nl2br(htmlspecialchars($event_text,ENT_NOQUOTES)), 'left', $color[4] ) . "\n"
+                    html_tag( 'td', nl2br(sq_htmlspecialchars($event_text,ENT_NOQUOTES)), 'left', $color[4] ) . "\n"
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td',
diff -ur squirrelmail-webmail-1.4.22/plugins/calendar/event_delete.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/event_delete.php
--- squirrelmail-webmail-1.4.22/plugins/calendar/event_delete.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/event_delete.php	2012-07-05 18:12:36.000000000 +0900
@@ -74,11 +74,11 @@
                ) .
                html_tag( 'tr',
                    html_tag( 'td', _("Title:"), 'right', $color[4] ) .
-                   html_tag( 'td', htmlspecialchars($tmparray['title']), 'left', $color[4] )
+                   html_tag( 'td', sq_htmlspecialchars($tmparray['title']), 'left', $color[4] )
                ) .
                html_tag( 'tr',
                    html_tag( 'td', _("Message:"), 'right', $color[4] ) .
-                   html_tag( 'td', nl2br(htmlspecialchars($tmparray['message'])), 'left', $color[4] )
+                   html_tag( 'td', nl2br(sq_htmlspecialchars($tmparray['message'])), 'left', $color[4] )
                ) .
                html_tag( 'tr',
                    html_tag( 'td',
diff -ur squirrelmail-webmail-1.4.22/plugins/calendar/event_edit.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/event_edit.php
--- squirrelmail-webmail-1.4.22/plugins/calendar/event_edit.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/calendar/event_edit.php	2012-07-05 18:12:36.000000000 +0900
@@ -174,11 +174,11 @@
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td', _("Title:") , 'right', $color[4] ) ."\n" .
-                    html_tag( 'td', htmlspecialchars($tmparray['title']) , 'left', $color[4] ) ."\n"
+                    html_tag( 'td', sq_htmlspecialchars($tmparray['title']) , 'left', $color[4] ) ."\n"
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td', _("Message:") , 'right', $color[4] ) ."\n" .
-                    html_tag( 'td', nl2br(htmlspecialchars($tmparray['message'])) , 'left', $color[4] ) ."\n"
+                    html_tag( 'td', nl2br(sq_htmlspecialchars($tmparray['message'])) , 'left', $color[4] ) ."\n"
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("to:") . "<br />\n", '', $color[4], 'colspan="2"' ) ."\n"
@@ -198,11 +198,11 @@
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td', _("Title:") , 'right', $color[4] ) ."\n" .
-                    html_tag( 'td', htmlspecialchars($event_title) , 'left', $color[4] ) ."\n"
+                    html_tag( 'td', sq_htmlspecialchars($event_title) , 'left', $color[4] ) ."\n"
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td', _("Message:") , 'right', $color[4] ) ."\n" .
-                    html_tag( 'td', nl2br(htmlspecialchars($event_text)) , 'left', $color[4] ) ."\n"
+                    html_tag( 'td', nl2br(sq_htmlspecialchars($event_text)) , 'left', $color[4] ) ."\n"
                 ) .
                 html_tag( 'tr',
                     html_tag( 'td',
diff -ur squirrelmail-webmail-1.4.22/plugins/filters/options.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/filters/options.php
--- squirrelmail-webmail-1.4.22/plugins/filters/options.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/filters/options.php	2012-07-05 18:12:36.000000000 +0900
@@ -203,7 +203,7 @@
                 html_tag( 'td', '', 'left' ) .
                     '<input type="text" size="32" name="filter_what" value="';
         if (isset($filters[$theid]['what'])) {
-            echo htmlspecialchars($filters[$theid]['what']);
+            echo sq_htmlspecialchars($filters[$theid]['what']);
         }
         echo '" />'.
                 '</td>'.
@@ -265,7 +265,7 @@
         printf( _("If %s contains %s then move to %s"),
             '<b>'.$filters[$i]['where'].'</b>',
             '<b>'.$filters[$i]['what'].'</b>',
-            '<b>'.htmlspecialchars(imap_utf7_decode_local($fdr)).'</b>');
+            '<b>'.sq_htmlspecialchars(imap_utf7_decode_local($fdr)).'</b>');
         echo '</td></tr>';
 
     }
diff -ur squirrelmail-webmail-1.4.22/plugins/filters/spamoptions.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/filters/spamoptions.php
--- squirrelmail-webmail-1.4.22/plugins/filters/spamoptions.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/filters/spamoptions.php	2012-07-05 18:12:36.000000000 +0900
@@ -199,7 +199,7 @@
     echo html_tag( 'p', '', 'center' ) .
          '[<a href="spamoptions.php?action=spam">' . _("Edit") . '</a>]' .
          ' - [<a href="../../src/options.php">' . _("Done") . '</a>]</center><br /><br />';
-    printf( _("Spam is sent to %s."), ($filters_spam_folder?'<b>'.htmlspecialchars(imap_utf7_decode_local($filters_spam_folder)).'</b>':'[<i>'._("not set yet").'</i>]' ) );
+    printf( _("Spam is sent to %s."), ($filters_spam_folder?'<b>'.sq_htmlspecialchars(imap_utf7_decode_local($filters_spam_folder)).'</b>':'[<i>'._("not set yet").'</i>]' ) );
     echo '<br />';
     printf( _("Spam scan is limited to %s."), '<b>' . ( ($filters_spam_scan == 'new')?_("Unread messages only"):_("All messages") ) . '</b>' );
     echo '</p>'.
diff -ur squirrelmail-webmail-1.4.22/plugins/fortune/fortune_functions.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/fortune/fortune_functions.php
--- squirrelmail-webmail-1.4.22/plugins/fortune/fortune_functions.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/fortune/fortune_functions.php	2012-07-05 18:12:36.000000000 +0900
@@ -30,7 +30,7 @@
     if (!$exist) {
         $sMsg = sprintf(_("%s is not found."),$fortune_location);
     } else {
-        $sMsg = htmlspecialchars(shell_exec($fortune_location . ' -s'));
+        $sMsg = sq_htmlspecialchars(shell_exec($fortune_location . ' -s'));
     }
     
     
diff -ur squirrelmail-webmail-1.4.22/plugins/info/functions.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/info/functions.php
--- squirrelmail-webmail-1.4.22/plugins/info/functions.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/info/functions.php	2012-07-05 18:12:36.000000000 +0900
@@ -30,7 +30,7 @@
     $sid = sqimap_session_id();
     $results = array();
     $query = "$sid ".trim($string)."\r\n";
-    print "<tr><td>".htmlspecialchars($query)."</td></tr>";
+    print "<tr><td>".sq_htmlspecialchars($query)."</td></tr>";
     fputs ($imap_stream, $query);
     $response = sqimap_read_data_list($imap_stream, $sid, false, $responses, $message);
     array_push($response, $message);
@@ -43,7 +43,7 @@
             print_response($value);
         }
         else {
-            print htmlspecialchars($value)."<br>\n";
+            print sq_htmlspecialchars($value)."<br>\n";
         }
     }
 }
diff -ur squirrelmail-webmail-1.4.22/plugins/info/options.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/info/options.php
--- squirrelmail-webmail-1.4.22/plugins/info/options.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/info/options.php	2012-07-05 18:12:36.000000000 +0900
@@ -75,7 +75,7 @@
 print "<tr><td bgcolor=\"".$color[4]."\"><b>Server Capability response:</b><br>\n";
 
 foreach($caps_array[0] as $value) {
-    print htmlspecialchars($value);
+    print sq_htmlspecialchars($value);
 }
 
 print "</td></tr><tr><td>\n";
@@ -94,8 +94,8 @@
     }
 }
 else {
-    print 'folder_prefix = ' . htmlspecialchars($folder_prefix) . "<br>\n".
-          'default_charset = ' . htmlspecialchars($default_charset) . "\n";
+    print 'folder_prefix = ' . sq_htmlspecialchars($folder_prefix) . "<br>\n".
+          'default_charset = ' . sq_htmlspecialchars($default_charset) . "\n";
 }
 
 print "<br></td></tr></table></center><br>\n";
diff -ur squirrelmail-webmail-1.4.22/plugins/listcommands/mailout.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/listcommands/mailout.php
--- squirrelmail-webmail-1.4.22/plugins/listcommands/mailout.php	2011-02-01 22:06:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/listcommands/mailout.php	2012-07-05 18:12:36.000000000 +0900
@@ -39,7 +39,7 @@
     $out_string = _("This will send a message to %s requesting that you will be unsubscribed from this list. It will try to unsubscribe the adress below.");
     break;
 default:
-    error_box(sprintf(_("Unknown action: %s"),htmlspecialchars($action)), $color);
+    error_box(sprintf(_("Unknown action: %s"),sq_htmlspecialchars($action)), $color);
     exit;
 }
 
@@ -52,7 +52,7 @@
     html_tag( 'td', '', 'left' );
 
 
-printf( $out_string, htmlspecialchars($send_to) );
+printf( $out_string, sq_htmlspecialchars($send_to) );
 
 echo '<form method="post" action="../../src/compose.php">'.
      '<input type="hidden" name="smtoken" value="' . sm_generate_security_token() . '" />';
@@ -65,20 +65,20 @@
     echo '<select name="identity">';
     foreach($idents as $nr=>$data) {
         echo '<option value="' . $nr . '">' .
-            htmlspecialchars(
+            sq_htmlspecialchars(
                 $data['full_name'].' <'.
                 $data['email_address'] . ">\n");
     }
     echo '</select>' . "\n" ;
 } else {
-    echo htmlspecialchars('"'.$idents[0]['full_name'].'" <'.$idents[0]['email_address'].'>');
+    echo sq_htmlspecialchars('"'.$idents[0]['full_name'].'" <'.$idents[0]['email_address'].'>');
 }
 
 echo '<br /><br />'
-. '<input type="hidden" name="send_to" value="' . htmlspecialchars($send_to) . '">'
-. '<input type="hidden" name="subject" value="' . htmlspecialchars($subject) . '">'
-. '<input type="hidden" name="body" value="' . htmlspecialchars($body) . '">'
-. '<input type="hidden" name="mailbox" value="' . htmlspecialchars($mailbox) . '">'
+. '<input type="hidden" name="send_to" value="' . sq_htmlspecialchars($send_to) . '">'
+. '<input type="hidden" name="subject" value="' . sq_htmlspecialchars($subject) . '">'
+. '<input type="hidden" name="body" value="' . sq_htmlspecialchars($body) . '">'
+. '<input type="hidden" name="mailbox" value="' . sq_htmlspecialchars($mailbox) . '">'
 . '<input type="submit" name="send" value="' . _("Send Mail") . '"><br /><br />'
 . '</form></td></tr></table></body></html>';
 
diff -ur squirrelmail-webmail-1.4.22/plugins/mail_fetch/fetch.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/mail_fetch/fetch.php
--- squirrelmail-webmail-1.4.22/plugins/mail_fetch/fetch.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/mail_fetch/fetch.php	2012-07-05 18:12:36.000000000 +0900
@@ -34,7 +34,7 @@
 function Mail_Fetch_Status($msg) {
     echo html_tag( 'table',
              html_tag( 'tr',
-                 html_tag( 'td', htmlspecialchars( $msg ) , 'left' )
+                 html_tag( 'td', sq_htmlspecialchars( $msg ) , 'left' )
                      ),
                    '', '', 'width="90%"' );
     flush();
@@ -82,7 +82,7 @@
         '<option value="all" selected>..' . _("All") . "...\n";
     for ($i=0;$i<$mailfetch_server_number;$i++) {
         echo "<option value=\"$i\">" .
-            htmlspecialchars((($mailfetch_alias_[$i]=='')?$mailfetch_server_[$i]:$mailfetch_alias_[$i])) .
+            sq_htmlspecialchars((($mailfetch_alias_[$i]=='')?$mailfetch_server_[$i]:$mailfetch_alias_[$i])) .
             '</option>' . "\n";
     }
     echo            '</select>' .
@@ -94,7 +94,7 @@
         if ($mailfetch_pass_[$i]=='') {
             echo html_tag( 'tr',
                      html_tag( 'td', _("Password for") . ' <b>' .
-                         htmlspecialchars((($mailfetch_alias_[$i]=='')?$mailfetch_server_[$i]:$mailfetch_alias_[$i])) .
+                         sq_htmlspecialchars((($mailfetch_alias_[$i]=='')?$mailfetch_server_[$i]:$mailfetch_alias_[$i])) .
                          '</b>: &nbsp; &nbsp; ',
                          'right' ) .
                      html_tag( 'td', '<input type="password" name="pass_' . $i . '">', 'left' )
@@ -137,7 +137,7 @@
         html_tag( 'table',
             html_tag( 'tr',
                 html_tag( 'td', '<b>' . _("Fetching from ") .
-                    htmlspecialchars((($mailfetch_alias_[$i_loop] == '')?$mailfetch_server:$mailfetch_alias_[$i_loop])) .
+                    sq_htmlspecialchars((($mailfetch_alias_[$i_loop] == '')?$mailfetch_server:$mailfetch_alias_[$i_loop])) .
                     '</b>',
                 'center' ) ,
             '', $color[9] ) ,
@@ -227,7 +227,7 @@
             }
             $Count = $pop3->login($mailfetch_user, $mailfetch_pass);
             if (($Count == false || $Count == -1) && $pop3->ERROR != '') {
-                Mail_Fetch_Status(_("Login Failed:") . ' ' . htmlspecialchars($pop3->ERROR) );
+                Mail_Fetch_Status(_("Login Failed:") . ' ' . sq_htmlspecialchars($pop3->ERROR) );
                 Mail_Fetch_Status(_("Saving UIDL"));
                 setPref($data_dir,$username,"mailfetch_uidl_$i_loop", $mailfetch_uidl[$i-1]);
 
@@ -266,7 +266,7 @@
                 if( $pop3->delete($i) ) {
                     Mail_Fetch_Status(sprintf(_("Message %d deleted from remote server!"), $i));
                 } else {
-                    Mail_Fetch_Status(_("Delete failed:") . htmlspecialchars($pop3->ERROR) );
+                    Mail_Fetch_Status(_("Delete failed:") . sq_htmlspecialchars($pop3->ERROR) );
                 }
             }
         } else {
diff -ur squirrelmail-webmail-1.4.22/plugins/mail_fetch/options.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/mail_fetch/options.php
--- squirrelmail-webmail-1.4.22/plugins/mail_fetch/options.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/mail_fetch/options.php	2012-07-05 18:12:36.000000000 +0900
@@ -316,7 +316,7 @@
             echo '<b>' . _("Server Name:") . '</b> <select name="mf_sn">';
             for ($i=0;$i<$mailfetch_server_number;$i++) {
                 echo "<option value=\"$i\">" .
-                    htmlspecialchars( (($mailfetch_alias_[$i]=='')?$mailfetch_server_[$i]:$mailfetch_alias_[$i])) . "</option>";
+                    sq_htmlspecialchars( (($mailfetch_alias_[$i]=='')?$mailfetch_server_[$i]:$mailfetch_alias_[$i])) . "</option>";
             }
             echo '</select>'.
                  '&nbsp;&nbsp;<INPUT TYPE=submit name=mf_action_mod value="' . _("Modify") . '">'.
@@ -342,7 +342,7 @@
                     html_tag( 'td',
                         "<INPUT TYPE=\"hidden\" NAME=\"mf_sn\" VALUE=\"$mf_sn\">" .
                         '<INPUT TYPE="hidden" NAME="mf_action" VALUE="confirm_delete">' .
-                        '<br>' . _("Selected Server:") . " <b>" . htmlspecialchars($mailfetch_server_[$mf_sn]) . "</b><br>" .
+                        '<br>' . _("Selected Server:") . " <b>" . sq_htmlspecialchars($mailfetch_server_[$mf_sn]) . "</b><br>" .
                         _("Confirm delete of selected server?") . '<br><br>' .
                         '<input type=submit name=submit_mailfetch value="' . _("Confirm Delete") . '">' .
                         '<br></form>' ,
@@ -369,23 +369,23 @@
             html_tag( 'table' ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Server:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_server" value="' . htmlspecialchars($mailfetch_server_[$mf_sn]) . '" size="40">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_server" value="' . sq_htmlspecialchars($mailfetch_server_[$mf_sn]) . '" size="40">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Port:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_port" value="' . htmlspecialchars($mailfetch_port_[$mf_sn]) . '" size="40">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_port" value="' . sq_htmlspecialchars($mailfetch_port_[$mf_sn]) . '" size="40">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Alias:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_alias" value="' . htmlspecialchars($mailfetch_alias_[$mf_sn]) . '" size="40">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_alias" value="' . sq_htmlspecialchars($mailfetch_alias_[$mf_sn]) . '" size="40">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Username:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_user" value="' . htmlspecialchars($mailfetch_user_[$mf_sn]) . '" size="20">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_user" value="' . sq_htmlspecialchars($mailfetch_user_[$mf_sn]) . '" size="20">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Password:"), 'right' ) .
-                    html_tag( 'td', '<input type="password" name="mf_pass" value="' . htmlspecialchars($mailfetch_pass_[$mf_sn]) . '" size="20">', 'left' )
+                    html_tag( 'td', '<input type="password" name="mf_pass" value="' . sq_htmlspecialchars($mailfetch_pass_[$mf_sn]) . '" size="20">', 'left' )
                 ) .
                 html_tag( 'tr' ) .
                     html_tag( 'th', _("Store in Folder:"), 'right' ) .
diff -ur squirrelmail-webmail-1.4.22/plugins/message_details/message_details_bottom.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/message_details/message_details_bottom.php
--- squirrelmail-webmail-1.4.22/plugins/message_details/message_details_bottom.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/message_details/message_details_bottom.php	2012-07-05 18:12:36.000000000 +0900
@@ -215,7 +215,7 @@
 			$entities["$entStr"]['contenttype']=$reg[2].'/'.$reg[3];
 		    }	
    		} else if (!$nameset && preg_match("/^.*(name=\s*)\"(.*)\".*/i",$line,$reg)) {
-		    $name = htmlspecialchars($reg[2]);
+		    $name = sq_htmlspecialchars($reg[2]);
 		    $content[$content_indx]['name'] = decodeHeader($name);
 		    $nameset = true;
 		    if (isset($entities["$entStr"])) {
@@ -246,7 +246,7 @@
         }
     } 	
 */
-    $line = htmlspecialchars($line);
+    $line = sq_htmlspecialchars($line);
     $message_body .= "$pre"."$line"."$end".'<br />'."\r\n";
 }
 
diff -ur squirrelmail-webmail-1.4.22/plugins/newmail/newmail_opt.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/newmail/newmail_opt.php
--- squirrelmail-webmail-1.4.22/plugins/newmail/newmail_opt.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/newmail/newmail_opt.php	2012-07-05 18:12:36.000000000 +0900
@@ -159,8 +159,8 @@
             if ($fname == $media) {
                 echo 'selected="selected" ';
             }
-            echo 'value="' . htmlspecialchars($fname) . '">' .
-                htmlspecialchars($entry) . "</option>\n";
+            echo 'value="' . sq_htmlspecialchars($fname) . '">' .
+                sq_htmlspecialchars($entry) . "</option>\n";
         }
     }
     $d->close();
@@ -174,8 +174,8 @@
             html_tag( 'tr', "\n" .
                 html_tag( 'td', _("Current File:"), 'right', '', 'nowrap' ) .
                     html_tag( 'td', '<input type="hidden" value="' .
-                        htmlspecialchars($media) . '" name="media_default">' .
-                        htmlspecialchars($media_output) . '', 'left' )
+                        sq_htmlspecialchars($media) . '" name="media_default">' .
+                        sq_htmlspecialchars($media_output) . '', 'left' )
              ) . "\n";
 }
 echo html_tag( 'tr', "\n" .
diff -ur squirrelmail-webmail-1.4.22/plugins/newmail/setup.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/newmail/setup.php
--- squirrelmail-webmail-1.4.22/plugins/newmail/setup.php	2011-07-12 12:19:15.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/newmail/setup.php	2012-07-05 18:12:36.000000000 +0900
@@ -242,7 +242,7 @@
 
         if ($totalNew > 0 && $newmail_enable == 'on' && $newmail_media != '' && $newmail_media != '(none)') {
             $newmail_media=sqm_baseuri().'plugins/newmail/sounds/'.basename($newmail_media);
-            echo '<embed src="'.htmlspecialchars($newmail_media)
+            echo '<embed src="'.sq_htmlspecialchars($newmail_media)
                 ."\" hidden=\"true\" autostart=\"true\" width=\"2\" height=\"2\">\n";
         }
         if ($totalNew > 0 && $newmail_popup == 'on') {
diff -ur squirrelmail-webmail-1.4.22/plugins/newmail/testsound.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/newmail/testsound.php
--- squirrelmail-webmail-1.4.22/plugins/newmail/testsound.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/newmail/testsound.php	2012-07-05 18:12:36.000000000 +0900
@@ -34,7 +34,7 @@
 echo html_tag( 'table',
          html_tag( 'tr',
              html_tag( 'td',
-                    '<embed src="'.htmlspecialchars($sound).'" hidden="true" autostart="true" width="2" height="2">'.
+                    '<embed src="'.sq_htmlspecialchars($sound).'" hidden="true" autostart="true" width="2" height="2">'.
                     '<br>'.
                     '<b>' . _("Loading the sound...") . '</b><br>'.
                     '<form>'.
diff -ur squirrelmail-webmail-1.4.22/plugins/spamcop/options.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/spamcop/options.php
--- squirrelmail-webmail-1.4.22/plugins/spamcop/options.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/spamcop/options.php	2012-07-05 18:12:36.000000000 +0900
@@ -130,7 +130,7 @@
 	    '<small>(' . _("see below") . ')</small>','right','','valign="top"');
 	  ?>
 	  <td valign="top"><form method="post" action="options.php">
-	    <input type="text" size="30" name="ID" value="<?php echo htmlspecialchars($spamcop_id) ?>" />
+	    <input type="text" size="30" name="ID" value="<?php echo sq_htmlspecialchars($spamcop_id) ?>" />
 	    <input type="hidden" name="action" value="save_id" />
 	    <?php
 		echo '<input type="submit" value="' . _("Save ID") . "\" />\n";
diff -ur squirrelmail-webmail-1.4.22/plugins/spamcop/spamcop.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/spamcop/spamcop.php
--- squirrelmail-webmail-1.4.22/plugins/spamcop/spamcop.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/spamcop/spamcop.php	2012-07-05 18:12:36.000000000 +0900
@@ -130,8 +130,8 @@
   echo '<input type="button" value="' . _("Close Window") . "\" onClick=\"window.close(); return true;\" />\n";
 } else {
    ?><form method="post" action="<?php echo sqm_baseuri(); ?>src/right_main.php">
-  <input type="hidden" name="mailbox" value="<?php echo htmlspecialchars($mailbox) ?>" />
-  <input type="hidden" name="startMessage" value="<?php echo htmlspecialchars($startMessage) ?>" />
+  <input type="hidden" name="mailbox" value="<?php echo sq_htmlspecialchars($mailbox) ?>" />
+  <input type="hidden" name="startMessage" value="<?php echo sq_htmlspecialchars($startMessage) ?>" />
    <?php
   echo '<input type="submit" value="' . _("Cancel / Done") . "\" />\n";
 }
@@ -147,9 +147,9 @@
    $form_action = sqm_baseuri() . 'src/compose.php';
 ?>  <form method="post" action="<?php echo $form_action?>">
   <input type="hidden" name="smtoken" value="<?php echo sm_generate_security_token(); ?>" />
-  <input type="hidden" name="mailbox" value="<?php echo htmlspecialchars($mailbox) ?>" />
-  <input type="hidden" name="spamcop_is_composing" value="<?php echo htmlspecialchars($passed_id) ?>" />
-  <input type="hidden" name="send_to" value="<?php echo htmlspecialchars($report_email)?>" />
+  <input type="hidden" name="mailbox" value="<?php echo sq_htmlspecialchars($mailbox) ?>" />
+  <input type="hidden" name="spamcop_is_composing" value="<?php echo sq_htmlspecialchars($passed_id) ?>" />
+  <input type="hidden" name="send_to" value="<?php echo sq_htmlspecialchars($report_email)?>" />
   <input type="hidden" name="subject" value="reply anyway" />
   <input type="hidden" name="identity" value="0" />
   <input type="hidden" name="session" value="<?php echo $session?>" />
@@ -171,7 +171,7 @@
    } ?>
   <input type="hidden" name="action" value="submit" />
   <input type="hidden" name="oldverbose" value="1" />
-  <input type="hidden" name="spam" value="<?php echo htmlspecialchars($spam_message); ?>" />
+  <input type="hidden" name="spam" value="<?php echo sq_htmlspecialchars($spam_message); ?>" />
 <?php
   echo '<input type="submit" name="x1" value="' . _("Send Spam Report") . "\" />";
  }
diff -ur squirrelmail-webmail-1.4.22/plugins/translate/setup.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/translate/setup.php
--- squirrelmail-webmail-1.4.22/plugins/translate/setup.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/plugins/translate/setup.php	2012-07-05 18:12:36.000000000 +0900
@@ -226,7 +226,7 @@
     }
 
     if (! is_null($charset))
-        echo ' accept-charset="'.htmlspecialchars($charset).'"';
+        echo ' accept-charset="'.sq_htmlspecialchars($charset).'"';
 
     echo ">\n";
 
@@ -251,7 +251,7 @@
     <input type="hidden" name="doit" value="done" />
     <input type="hidden" name="intl" value="1" />
     <input type="hidden" name="tt" value="urltext" />
-    <input type="hidden" name="urltext" value="<?php echo htmlspecialchars($message); ?>" />
+    <input type="hidden" name="urltext" value="<?php echo sq_htmlspecialchars($message); ?>" />
     <select name="lp"><?php
         echo translate_lang_opt('zh_CN',  '',     'zh_en',
                             sprintf( _("%s to %s"),_("Chinese, Simplified"),_("English"))) .
diff -ur squirrelmail-webmail-1.4.22/src/addrbook_search.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/addrbook_search.php
--- squirrelmail-webmail-1.4.22/src/addrbook_search.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/addrbook_search.php	2012-07-05 18:12:36.000000000 +0900
@@ -138,7 +138,7 @@
     echo "</tr>\n";
     
     while (list($undef, $row) = each($res)) {
-        $email = htmlspecialchars(addcslashes(AddressBook::full_address($row), "'"), ENT_QUOTES);
+        $email = sq_htmlspecialchars(addcslashes(AddressBook::full_address($row), "'"), ENT_QUOTES);
         if ($line % 2) { 
             $tr_bgcolor = $color[12];
         } else {
@@ -153,12 +153,12 @@
              '<a href="javascript:bcc_address(' . 
                                  "'" . $email . "');\">"._("Bcc")."</a></small>",
         'center', '', 'valign="top" width="5%" nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['name']), 'left', '', 'valign="top" nowrap' ) .
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['name']), 'left', '', 'valign="top" nowrap' ) .
         html_tag( 'td', '&nbsp;' .
              '<a href="javascript:to_and_close(' .
-                 "'" . $email . "');\">" . htmlspecialchars($row['email']) . '</a>'
+                 "'" . $email . "');\">" . sq_htmlspecialchars($row['email']) . '</a>'
         , 'left', '', 'valign="top"' ) .
-        html_tag( 'td', htmlspecialchars($row['label']), 'left', '', 'valign="top" nowrap' );
+        html_tag( 'td', sq_htmlspecialchars($row['label']), 'left', '', 'valign="top" nowrap' );
         if ($includesource) {
             echo html_tag( 'td', '&nbsp;' . $row['source'], 'left', '', 'valign="top" nowrap' );
         }
diff -ur squirrelmail-webmail-1.4.22/src/addrbook_search_html.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/addrbook_search_html.php
--- squirrelmail-webmail-1.4.22/src/addrbook_search_html.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/addrbook_search_html.php	2012-07-05 18:12:36.000000000 +0900
@@ -136,15 +136,15 @@
         echo html_tag( 'tr', '', '', $tr_bgcolor, 'nowrap' ) .
         html_tag( 'td',
              '<input type="checkbox" name="send_to_search[T' . $line . ']" value = "' .
-             htmlspecialchars($email) . '" />&nbsp;' . _("To") . '&nbsp;' .
+             sq_htmlspecialchars($email) . '" />&nbsp;' . _("To") . '&nbsp;' .
              '<input type="checkbox" name="send_to_search[C' . $line . ']" value = "' .
-             htmlspecialchars($email) . '" />&nbsp;' . _("Cc") . '&nbsp;' .
+             sq_htmlspecialchars($email) . '" />&nbsp;' . _("Cc") . '&nbsp;' .
              '<input type="checkbox" name="send_to_search[B' . $line . ']" value = "' .
-             htmlspecialchars($email) . '" />&nbsp;' . _("Bcc") . '&nbsp;' ,
+             sq_htmlspecialchars($email) . '" />&nbsp;' . _("Bcc") . '&nbsp;' ,
         'center', '', 'width="5%" nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['lastname']) . ' ' . htmlspecialchars($row['firstname']) . '&nbsp;', 'left', '', 'nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['email']) . '&nbsp;', 'left', '', 'nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['label']) . '&nbsp;', 'left', '', 'nowrap' );
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['lastname']) . ' ' . htmlspecialchars($row['firstname']) . '&nbsp;', 'left', '', 'nowrap' ) .
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['email']) . '&nbsp;', 'left', '', 'nowrap' ) .
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['label']) . '&nbsp;', 'left', '', 'nowrap' );
             } else {
         echo html_tag( 'tr', '', '', $tr_bgcolor, 'nowrap' ) .
         html_tag( 'td',
@@ -155,9 +155,9 @@
             addCheckBox('send_to_search[B'.$line.']', FALSE, $email).
             '&nbsp;' . _("Bcc") . '&nbsp;' ,
         'center', '', 'width="5%" nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['name']) . '&nbsp;', 'left', '', 'nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['email']) . '&nbsp;', 'left', '', 'nowrap' ) .
-        html_tag( 'td', '&nbsp;' . htmlspecialchars($row['label']) . '&nbsp;', 'left', '', 'nowrap' );
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['name']) . '&nbsp;', 'left', '', 'nowrap' ) .
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['email']) . '&nbsp;', 'left', '', 'nowrap' ) .
+        html_tag( 'td', '&nbsp;' . sq_htmlspecialchars($row['label']) . '&nbsp;', 'left', '', 'nowrap' );
             }
 
          if ($includesource) {
diff -ur squirrelmail-webmail-1.4.22/src/addressbook.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/addressbook.php
--- squirrelmail-webmail-1.4.22/src/addressbook.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/addressbook.php	2012-07-05 18:12:36.000000000 +0900
@@ -345,7 +345,7 @@
                                  html_tag( 'tr',
                                      html_tag( 'td',
                                                "\n". '<strong><font color="' . $color[2] .
-                                               '">' . _("ERROR") . ': ' . htmlspecialchars($abook->error) . '</font></strong>' ."\n",
+                                               '">' . _("ERROR") . ': ' . sq_htmlspecialchars($abook->error) . '</font></strong>' ."\n",
                                                'center' )
                                            ),
                                        'center', '', 'width="100%"' );
@@ -400,7 +400,7 @@
             html_tag( 'tr',
                 html_tag( 'td',
                     "\n". '<br /><strong><font color="' . $color[2] .
-                    '">' . _("ERROR") . ': ' . htmlspecialchars($formerror) . '</font></strong>' ."\n",
+                    '">' . _("ERROR") . ': ' . sq_htmlspecialchars($formerror) . '</font></strong>' ."\n",
                     'center' )
                 ),
             'center', '', 'width="100%"' );
@@ -412,7 +412,7 @@
     /* Get and sort address list */
     $alist = $abook->list_addr();
     if(!is_array($alist)) {
-        $abook->error = htmlspecialchars($abook->error);
+        $abook->error = sq_htmlspecialchars($abook->error);
         plain_error_message($abook->error, $color);
         exit;
     }
@@ -522,8 +522,8 @@
                             '&nbsp;' ,
                             'center', '', 'valign="top" width="1%"' );
                 }
-                echo html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . htmlspecialchars($row['nickname']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) . 
-                    html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . htmlspecialchars($row['lastname']) . ' ' . htmlspecialchars($row['firstname']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) .
+                echo html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . sq_htmlspecialchars($row['nickname']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) . 
+                    html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . sq_htmlspecialchars($row['lastname']) . ' ' . htmlspecialchars($row['firstname']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) .
                     html_tag( 'td', '', 'left', '', 'valign="top" width="10%" nowrap' ) . '&nbsp;';
             } else {
                 echo html_tag( 'tr', '', '', $tr_bgcolor);
@@ -538,16 +538,16 @@
                             '&nbsp;' ,
                             'center', '', 'valign="top" width="1%"' );
                 }
-                echo html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . htmlspecialchars($row['nickname']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) .
-                    html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . htmlspecialchars($row['name']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) .
+                echo html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . sq_htmlspecialchars($row['nickname']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) .
+                    html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . sq_htmlspecialchars($row['name']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%" nowrap' ) .
                     html_tag( 'td', '', 'left', '', 'valign="top" width="10%" nowrap' ) . '&nbsp;';
             }
             $email = $abook->full_address($row);
             echo addHidden($row['backend'] . ':' . $row['nickname'], rawurlencode($email))
                . makeComposeLink('src/compose.php?send_to='.rawurlencode($email),
-                    htmlspecialchars($row['email'])).
+                    sq_htmlspecialchars($row['email'])).
                 '&nbsp;</td>'."\n".
-                html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . htmlspecialchars($row['label']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%"' );
+                html_tag( 'td', '&nbsp;<label for="' . $row['backend'] . '_' . urlencode($row['nickname']) . '">' . sq_htmlspecialchars($row['label']) . '</label>&nbsp;', 'left', '', 'valign="top" width="10%"' );
 
             // add extra column if third party backend needs it
             if ($abook->add_extra_field) {
diff -ur squirrelmail-webmail-1.4.22/src/compose.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/compose.php
--- squirrelmail-webmail-1.4.22/src/compose.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/compose.php	2012-07-05 18:12:36.000000000 +0900
@@ -1158,7 +1158,7 @@
             if (isset($identity) && $identity == $nr) {
                 echo ' selected="selected"';
             }
-            echo '>' . htmlspecialchars(
+            echo '>' . sq_htmlspecialchars(
                     $data['full_name'] . ' <' .
                     $data['email_address'] . '>') .
                 "</option>\n";
@@ -1225,10 +1225,10 @@
             } else {
                 echo "\n\n".($prefix_sig==true? "-- \n":'').decodeHeader($signature,false,false,true);
             }
-            echo "\n\n".htmlspecialchars(decodeHeader($body,false,false,true));
+            echo "\n\n".sq_htmlspecialchars(decodeHeader($body,false,false,true));
         }
         else {
-            echo "\n\n".htmlspecialchars(decodeHeader($body,false,false,true));
+            echo "\n\n".sq_htmlspecialchars(decodeHeader($body,false,false,true));
             if ($default_charset == 'iso-2022-jp') {
                 echo "\n\n".($prefix_sig==true? "-- \n":'').mb_convert_encoding($signature, 'EUC-JP');
             }else{
@@ -1236,7 +1236,7 @@
             }
         }
     } else {
-        echo htmlspecialchars(decodeHeader($body,false,false,true));
+        echo sq_htmlspecialchars(decodeHeader($body,false,false,true));
     }
     echo '</textarea><br />' . "\n" .
         '      </td>' . "\n" .
@@ -1684,7 +1684,7 @@
             return $succes;
         } else {
             $msg  = '<br />'.sprintf(_("Error: Draft folder %s does not exist."),
-                htmlspecialchars($draft_folder));
+                sq_htmlspecialchars($draft_folder));
             plain_error_message($msg, $color);
             return false;
         }
diff -ur squirrelmail-webmail-1.4.22/src/folders_rename_getname.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/folders_rename_getname.php
--- squirrelmail-webmail-1.4.22/src/folders_rename_getname.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/folders_rename_getname.php	2012-07-05 18:12:36.000000000 +0900
@@ -64,7 +64,7 @@
 
 if (strpos($displayable_old, $delimiter)) {
     $old_name = substr($displayable_old, strrpos($displayable_old, $delimiter)+1);
-    $parent = htmlspecialchars(substr($displayable_old, 
+    $parent = sq_htmlspecialchars(substr($displayable_old, 
                                       0, 
                                       strrpos($displayable_old, $delimiter))
             . ' ' . $delimiter);
diff -ur squirrelmail-webmail-1.4.22/src/options_highlight.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/options_highlight.php
--- squirrelmail-webmail-1.4.22/src/options_highlight.php	2011-05-16 07:02:24.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/options_highlight.php	2012-07-05 18:12:36.000000000 +0900
@@ -179,11 +179,11 @@
                         $links,
                     'left', $color[4], 'width="20%" nowrap' ) .
                     html_tag( 'td',
-                        htmlspecialchars($message_highlight_list[$i]['name']) ,
+                        sq_htmlspecialchars($message_highlight_list[$i]['name']) ,
                     'left' ) .
                     html_tag( 'td',
                         $match_type . ' = ' .
-                        htmlspecialchars($message_highlight_list[$i]['value']) ,
+                        sq_htmlspecialchars($message_highlight_list[$i]['value']) ,
                     'left' ) ,
                 '', '#' . $message_highlight_list[$i]['color'] ) . "\n";
     }
diff -ur squirrelmail-webmail-1.4.22/src/options_identities.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/options_identities.php
--- squirrelmail-webmail-1.4.22/src/options_identities.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/options_identities.php	2012-07-05 18:12:36.000000000 +0900
@@ -174,7 +174,7 @@
     $str = '';
     $str .= '<tr' . $bgcolor . ">\n";
     $str .= '  <td style="white-space: nowrap;text-align:right;">' . $title . ' </td>' . "\n";
-    $str .= '  <td> <input type="text" name="' . $name . '" size="50" value="'. htmlspecialchars($data) . '"> </td>' . "\n";
+    $str .= '  <td> <input type="text" name="' . $name . '" size="50" value="'. sq_htmlspecialchars($data) . '"> </td>' . "\n";
     $str .= '</tr>';
 
     return $str;
@@ -185,7 +185,7 @@
     $str = '';
     $str .= '<tr' . $bgcolor . ">\n";
     $str .= '  <td style="white-space: nowrap;text-align:right;">' . $title . ' </td>' . "\n";
-    $str .= '  <td> <textarea name="' . $name . '" cols="50" rows="5">'. htmlspecialchars($data) . '</textarea> </td>' . "\n";
+    $str .= '  <td> <textarea name="' . $name . '" cols="50" rows="5">'. sq_htmlspecialchars($data) . '</textarea> </td>' . "\n";
     $str .= '</tr>';
 
     return $str;
diff -ur squirrelmail-webmail-1.4.22/src/printer_friendly_bottom.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/printer_friendly_bottom.php
--- squirrelmail-webmail-1.4.22/src/printer_friendly_bottom.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/printer_friendly_bottom.php	2012-07-05 18:12:36.000000000 +0900
@@ -131,7 +131,7 @@
      ) . "\n" .
      html_tag( 'tr',
          html_tag( 'td', _("Date").':&nbsp;', 'left' ) .
-         html_tag( 'td', htmlspecialchars($date), 'left' )
+         html_tag( 'td', sq_htmlspecialchars($date), 'left' )
      ) . "\n" .
      html_tag( 'tr',
          html_tag( 'td', _("To").':&nbsp;', 'left','','valign="top"' ) .
@@ -280,7 +280,7 @@
             html_tag( 'td',show_readable_size($header->size), 'left') .
             '</tr><tr>' .
             html_tag( 'td',_("Type:"), 'right') .
-            html_tag( 'td',htmlspecialchars($type0).'/'.htmlspecialchars($type1), 'left') . 
+            html_tag( 'td',sq_htmlspecialchars($type0).'/'.htmlspecialchars($type1), 'left') . 
             '</tr>';
         if (! empty($description)) {
             $attachments .= $description;
diff -ur squirrelmail-webmail-1.4.22/src/read_body.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/read_body.php
--- squirrelmail-webmail-1.4.22/src/read_body.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/read_body.php	2012-07-05 18:12:36.000000000 +0900
@@ -458,7 +458,7 @@
     $env[_("Cc")] = formatRecipientString($header->cc, "cc");
     $env[_("Bcc")] = formatRecipientString($header->bcc, "bcc");
     if ($default_use_priority) {
-        $env[_("Priority")] = htmlspecialchars(getPriorityStr($header->priority));
+        $env[_("Priority")] = sq_htmlspecialchars(getPriorityStr($header->priority));
     }
     if ($show_xmailer_default) {
         $env[_("Mailer")] = decodeHeader($header->xmailer);
diff -ur squirrelmail-webmail-1.4.22/src/right_main.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/right_main.php
--- squirrelmail-webmail-1.4.22/src/right_main.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/right_main.php	2012-07-05 18:12:36.000000000 +0900
@@ -174,7 +174,7 @@
 
 do_hook('right_main_after_header');
 if (isset($note)) {
-    echo html_tag( 'div', '<b>' . htmlspecialchars($note) .'</b>', 'center' ) . "<br />\n";
+    echo html_tag( 'div', '<b>' . sq_htmlspecialchars($note) .'</b>', 'center' ) . "<br />\n";
 }
 
 if ( sqgetGlobalVar('just_logged_in', $just_logged_in, SQ_SESSION) ) {
diff -ur squirrelmail-webmail-1.4.22/src/search.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/search.php
--- squirrelmail-webmail-1.4.22/src/search.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/search.php	2012-07-05 18:12:36.000000000 +0900
@@ -238,7 +238,7 @@
             $showbox = imap_utf7_decode_local($mailbox);
         }
         echo html_tag( 'div', '<b><big>' . _("Folder:") . ' '.
-            htmlspecialchars($showbox) .'</big></b>','center') . "\n";
+            sq_htmlspecialchars($showbox) .'</big></b>','center') . "\n";
 
         $msg_cnt_str = get_msgcnt_str(1, $cnt, $cnt);
         $toggle_all = get_selectall_link(1, $sort);
@@ -246,7 +246,7 @@
         $safe_name = preg_replace("/[^0-9A-Za-z_]/", '_', $mailbox);
         $form_name = "FormMsgs" . $safe_name;
         echo '<form name="' . $form_name . '" method="post" action="move_messages.php">' ."\n" .
-             '<input type="hidden" name="mailbox" value="'.htmlspecialchars($mailbox).'">' . "\n" .
+             '<input type="hidden" name="mailbox" value="'.sq_htmlspecialchars($mailbox).'">' . "\n" .
              '<input type="hidden" name="startMessage" value="1">' . "\n" .
              addHidden('smtoken', sm_generate_security_token()) . "\n";
 
@@ -371,9 +371,9 @@
         } else {
             echo html_tag( 'tr', '', '', $color[4] );
         }
-        echo html_tag( 'td', htmlspecialchars(imap_utf7_decode_local($saved_attributes['saved_folder'][$i + 1])), 'left', '', 'width="35%"' )
-        . html_tag( 'td', htmlspecialchars($saved_attributes['saved_what'][$i + 1]), 'left' )
-        . html_tag( 'td', htmlspecialchars($saved_attributes['saved_where'][$i + 1]), 'center' )
+        echo html_tag( 'td', sq_htmlspecialchars(imap_utf7_decode_local($saved_attributes['saved_folder'][$i + 1])), 'left', '', 'width="35%"' )
+        . html_tag( 'td', sq_htmlspecialchars($saved_attributes['saved_what'][$i + 1]), 'left' )
+        . html_tag( 'td', sq_htmlspecialchars($saved_attributes['saved_where'][$i + 1]), 'center' )
         . html_tag( 'td', '', 'right' )
         .   '<a href="search.php'
         .     '?mailbox=' . urlencode($saved_attributes['saved_folder'][$i + 1])
@@ -420,9 +420,9 @@
             }
             if (isset($attributes['search_what'][$i]) &&
                 !empty($attributes['search_what'][$i])) {
-            echo html_tag( 'td', htmlspecialchars(imap_utf7_decode_local($attributes['search_folder'][$i])), 'left', '', 'width="35%"' )
-               . html_tag( 'td', htmlspecialchars($attributes['search_what'][$i]), 'left' )
-               . html_tag( 'td', htmlspecialchars($attributes['search_where'][$i]), 'center' )
+            echo html_tag( 'td', sq_htmlspecialchars(imap_utf7_decode_local($attributes['search_folder'][$i])), 'left', '', 'width="35%"' )
+               . html_tag( 'td', sq_htmlspecialchars($attributes['search_what'][$i]), 'left' )
+               . html_tag( 'td', sq_htmlspecialchars($attributes['search_where'][$i]), 'center' )
                . html_tag( 'td', '', 'right' )
                .   "<a href=\"search.php?count=$i&amp;submit=save&amp;smtoken=" . sm_generate_security_token() . '">'
                .     _("save")
diff -ur squirrelmail-webmail-1.4.22/src/vcard.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/vcard.php
--- squirrelmail-webmail-1.4.22/src/vcard.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/vcard.php	2012-07-05 18:12:36.000000000 +0900
@@ -97,14 +97,14 @@
 } else {
     echo '<tr><td align="center">' .
          sprintf(_("vCard Version %s is not supported. Some information might not be converted correctly."),
-                 htmlspecialchars($vcard_nice['version'])) .
+                 sq_htmlspecialchars($vcard_nice['version'])) .
          "</td></tr>\n";
     $vcard_nice['firstname'] = '';
     $vcard_nice['lastname'] = '';
 }
 
 foreach ($vcard_nice as $k => $v) {
-    $v = htmlspecialchars($v);
+    $v = sq_htmlspecialchars($v);
     $v = trim($v);
     $vcard_safe[$k] = trim(nl2br($v));
 }
@@ -166,44 +166,44 @@
      '<select name="addaddr[label]">';
 
 if (isset($vcard_nice['url'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['url']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['url']) .
         '">' . _("Web Page") . "</option>\n";
 }
 if (isset($vcard_nice['adr'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['adr']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['adr']) .
         '">' . _("Address") . "</option>\n";
 }
 if (isset($vcard_nice['title'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['title']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['title']) .
         '">' . _("Title") . "</option>\n";
 }
 if (isset($vcard_nice['org'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['org']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['org']) .
         '">' . _("Organization / Department") . "</option>\n";
 }
 if (isset($vcard_nice['title'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['title']) .
-        '; ' . htmlspecialchars($vcard_nice['org']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['title']) .
+        '; ' . sq_htmlspecialchars($vcard_nice['org']) .
         '">' . _("Title &amp; Org. / Dept.") . "</option>\n";
 }
 if (isset($vcard_nice['tel;work'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['tel;work']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['tel;work']) .
         '">' . _("Work Phone") . "</option>\n";
 }
 if (isset($vcard_nice['tel;home'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['tel;home']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['tel;home']) .
         '">' . _("Home Phone") . "</option>\n";
 }
 if (isset($vcard_nice['tel;cell'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['tel;cell']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['tel;cell']) .
         '">' . _("Cellular Phone") . "</option>\n";
 }
 if (isset($vcard_nice['tel;fax'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['tel;fax']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['tel;fax']) .
         '">' . _("Fax") . "</option>\n";
 }
 if (isset($vcard_nice['note'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['note']) .
+    echo '<option value="' . sq_htmlspecialchars($vcard_nice['note']) .
         '">' . _("Note") . "</option>\n";
 }
 echo '</select>';
@@ -212,7 +212,7 @@
 <tr><td colspan="2" align="center">
 <?php
 echo '<input name="addaddr[email]" type="hidden" value="' .
-        htmlspecialchars(!empty($vcard_nice['email;internet'])?$vcard_nice['email;internet']:'') . '" />' .
+        sq_htmlspecialchars(!empty($vcard_nice['email;internet'])?$vcard_nice['email;internet']:'') . '" />' .
      '<input name="addaddr[firstname]" type="hidden" value="' .
         $vcard_safe['firstname'] . '" />' .
      '<input name="addaddr[lastname]" type="hidden" value="' .
diff -ur squirrelmail-webmail-1.4.22/src/view_header.php squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/view_header.php
--- squirrelmail-webmail-1.4.22/src/view_header.php	2011-01-06 11:44:03.000000000 +0900
+++ squirrelmail-webmail-1.4.22-PHP54jaJP_20120705taka2/src/view_header.php	2012-07-05 18:12:36.000000000 +0900
@@ -46,7 +46,7 @@
     $cnum = 0;
 
     for ($i=1; $i < count($read); $i++) {
-        $line = htmlspecialchars($read[$i]);
+        $line = sq_htmlspecialchars($read[$i]);
         switch (true) {
             case (preg_match('/^&gt;/i', $line)):
                 $second[$i] = $line;