diff --git a/adm/board_form.php b/adm/board_form.php
index 87c2f1a0f..b66e4537f 100644
--- a/adm/board_form.php
+++ b/adm/board_form.php
@@ -1242,7 +1242,7 @@ $pg_anchor = '<ul class="anchor">
                 <label for="bo_<?php echo $i ?>_subj">여분필드 <?php echo $i ?> 제목</label>
                 <input type="text" name="bo_<?php echo $i ?>_subj" id="bo_<?php echo $i ?>_subj" value="<?php echo get_text($board['bo_'.$i.'_subj']) ?>" class="frm_input">
                 <label for="bo_<?php echo $i ?>">여분필드 <?php echo $i ?> 값</label>
-                <input type="text" name="bo_<?php echo $i ?>" value="<?php echo get_text($board['bo_'.$i]) ?>" id="bo_<?php echo $i ?>" class="frm_input">
+                <input type="text" name="bo_<?php echo $i ?>" value="<?php echo get_text($board['bo_'.$i]) ?>" id="bo_<?php echo $i ?>" class="frm_input extra-value-input">
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_<?php echo $i ?>" value="1" id="chk_grp_<?php echo $i ?>">
diff --git a/adm/boardgroup_list_update.php b/adm/boardgroup_list_update.php
index fbf9e2f1a..53d66c8e9 100644
--- a/adm/boardgroup_list_update.php
+++ b/adm/boardgroup_list_update.php
@@ -18,16 +18,16 @@ if(!$count)
 for ($i=0; $i<$count; $i++)
 {
     $k     = $_POST['chk'][$i];
-    $gr_id = $_POST['group_id'][$k];
-    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
+    $gr_id = preg_replace('/[^a-z0-9_]/i', '', $_POST['group_id'][$k]);
+    $gr_subject = sql_real_escape_string(strip_tags($_POST['gr_subject'][$k]));
 
     if($_POST['act_button'] == '선택수정') {
         $sql = " update {$g5['group_table']}
                     set gr_subject    = '{$gr_subject}',
-                        gr_device     = '{$_POST['gr_device'][$k]}',
-                        gr_admin      = '{$_POST['gr_admin'][$k]}',
-                        gr_use_access = '{$_POST['gr_use_access'][$k]}',
-                        gr_order      = '{$_POST['gr_order'][$k]}'
+                        gr_device     = '".sql_real_escape_string($_POST['gr_device'][$k])."',
+                        gr_admin      = '".sql_real_escape_string($_POST['gr_admin'][$k])."',
+                        gr_use_access = '".sql_real_escape_string($_POST['gr_use_access'][$k])."',
+                        gr_order      = '".sql_real_escape_string($_POST['gr_order'][$k])."'
                   where gr_id         = '{$gr_id}' ";
         if ($is_admin != 'super')
             $sql .= " and gr_admin    = '{$_POST['gr_admin'][$k]}' ";
diff --git a/adm/boardgroupmember_update.php b/adm/boardgroupmember_update.php
index 95f8372b3..56de9c4cc 100644
--- a/adm/boardgroupmember_update.php
+++ b/adm/boardgroupmember_update.php
@@ -48,7 +48,7 @@ else if ($w == 'd' || $w == 'ld')
     check_admin_token();
 
     for($i=0; $i<$count; $i++) {
-        $gm_id = $_POST['chk'][$i];
+        $gm_id = (int) $_POST['chk'][$i];
         $sql = " select * from {$g5['group_member_table']} where gm_id = '$gm_id' ";
         $gm = sql_fetch($sql);
         if (!$gm['gm_id']) {
diff --git a/adm/config_form_update.php b/adm/config_form_update.php
index 56f196a9f..fa49b6ea5 100644
--- a/adm/config_form_update.php
+++ b/adm/config_form_update.php
@@ -28,6 +28,14 @@ $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',',
 
 $_POST['cf_title'] = strip_tags($_POST['cf_title']);
 
+$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key');
+
+foreach( $check_keys as $key ){
+    if ( isset($_POST[$key]) && $_POST[$key] ){
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-]/i', '', $_POST[$key]);
+    }
+}
+
 $sql = " update {$g5['config_table']}
             set cf_title = '{$_POST['cf_title']}',
                 cf_admin = '{$_POST['cf_admin']}',
diff --git a/adm/css/admin.css b/adm/css/admin.css
index 86af09271..3ec245ead 100644
--- a/adm/css/admin.css
+++ b/adm/css/admin.css
@@ -404,6 +404,9 @@ tfoot th {}
 #anc_bo_extra label {display:inline-block;width:100px}
 #anc_bo_extra input {margin-right:10px}
 
+/* 게시판 여분필드 값 input style 로빈아빠님 제안 */
+#anc_bo_extra input.extra-value-input {width:calc(100% - 370px);}
+
 /* 접속자집계 목록 */
 .tbl_visit_list td {text-align:center}
 .visit_bar {position:relative}
diff --git a/adm/member_form_update.php b/adm/member_form_update.php
index 54b90839b..e124ec6d6 100644
--- a/adm/member_form_update.php
+++ b/adm/member_form_update.php
@@ -33,9 +33,14 @@ if($_POST['mb_certify_case'] && $_POST['mb_certify']) {
 $mb_zip1 = substr($_POST['mb_zip'], 0, 3);
 $mb_zip2 = substr($_POST['mb_zip'], 3);
 
+$mb_email = isset($_POST['mb_email']) ? get_email_address(trim($_POST['mb_email'])) : '';
+$mb_nick = isset($_POST['mb_nick']) ? trim(strip_tags($_POST['mb_nick'])) : '';
+
+if ($msg = valid_mb_nick($mb_nick))     alert($msg, "", true, true);
+
 $sql_common = "  mb_name = '{$_POST['mb_name']}',
-                 mb_nick = '{$_POST['mb_nick']}',
-                 mb_email = '{$_POST['mb_email']}',
+                 mb_nick = '{$mb_nick}',
+                 mb_email = '{$mb_email}',
                  mb_homepage = '{$_POST['mb_homepage']}',
                  mb_tel = '{$_POST['mb_tel']}',
                  mb_hp = '{$mb_hp}',
@@ -74,13 +79,13 @@ if ($w == '')
         alert('이미 존재하는 회원아이디입니다.\\nＩＤ : '.$mb['mb_id'].'\\n이름 : '.$mb['mb_name'].'\\n닉네임 : '.$mb['mb_nick'].'\\n메일 : '.$mb['mb_email']);
 
     // 닉네임중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$_POST['mb_nick']}' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$mb_nick}' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 닉네임입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
 
     // 이메일중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$_POST['mb_email']}' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$mb_email}' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 이메일입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
@@ -104,13 +109,13 @@ else if ($w == 'u')
         alert($mb['mb_id'].' : 로그인 중인 관리자 레벨은 수정 할 수 없습니다.');
 
     // 닉네임중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$_POST['mb_nick']}' and mb_id <> '$mb_id' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_nick = '{$mb_nick}' and mb_id <> '$mb_id' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 닉네임입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
 
     // 이메일중복체크
-    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$_POST['mb_email']}' and mb_id <> '$mb_id' ";
+    $sql = " select mb_id, mb_name, mb_nick, mb_email from {$g5['member_table']} where mb_email = '{$mb_email}' and mb_id <> '$mb_id' ";
     $row = sql_fetch($sql);
     if ($row['mb_id'])
         alert('이미 존재하는 이메일입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
diff --git a/adm/menu_list_update.php b/adm/menu_list_update.php
index 324f26209..3aaf18b11 100644
--- a/adm/menu_list_update.php
+++ b/adm/menu_list_update.php
@@ -23,7 +23,7 @@ for ($i=0; $i<$count; $i++)
 
     $code    = $_POST['code'][$i];
     $me_name = $_POST['me_name'][$i];
-    $me_link = preg_match('/^javascript/i', $_POST['me_link'][$i]) ? G5_URL : strip_tags($_POST['me_link'][$i]);
+    $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags($_POST['me_link'][$i]);
     
     if(!$code || !$me_name || !$me_link)
         continue;
diff --git a/adm/point_list_delete.php b/adm/point_list_delete.php
index 5d59e942e..fb064b3bf 100644
--- a/adm/point_list_delete.php
+++ b/adm/point_list_delete.php
@@ -16,9 +16,11 @@ for ($i=0; $i<$count; $i++)
 {
     // 실제 번호를 넘김
     $k = $_POST['chk'][$i];
+    $po_id = (int) $_POST['po_id'][$k];
+    $str_mb_id = sql_real_escape_string($_POST['mb_id'][$k]);
 
     // 포인트 내역정보
-    $sql = " select * from {$g5['point_table']} where po_id = '{$_POST['po_id'][$k]}' ";
+    $sql = " select * from {$g5['point_table']} where po_id = '{$po_id}' ";
     $row = sql_fetch($sql);
 
     if(!$row['po_id'])
@@ -39,19 +41,19 @@ for ($i=0; $i<$count; $i++)
     }
 
     // 포인트 내역삭제
-    $sql = " delete from {$g5['point_table']} where po_id = '{$_POST['po_id'][$k]}' ";
+    $sql = " delete from {$g5['point_table']} where po_id = '{$po_id}' ";
     sql_query($sql);
 
     // po_mb_point에 반영
     $sql = " update {$g5['point_table']}
                 set po_mb_point = po_mb_point - '{$row['po_point']}'
-                where mb_id = '{$_POST['mb_id'][$k]}'
-                  and po_id > '{$_POST['po_id'][$k]}' ";
+                where mb_id = '{$str_mb_id}'
+                  and po_id > '{$po_id}' ";
     sql_query($sql);
 
     // 포인트 UPDATE
     $sum_point = get_point_sum($_POST['mb_id'][$k]);
-    $sql= " update {$g5['member_table']} set mb_point = '$sum_point' where mb_id = '{$_POST['mb_id'][$k]}' ";
+    $sql= " update {$g5['member_table']} set mb_point = '$sum_point' where mb_id = '{$str_mb_id}' ";
     sql_query($sql);
 }
 
diff --git a/adm/sms_admin/_common.php b/adm/sms_admin/_common.php
index 23e15e5ef..3c53259a8 100644
--- a/adm/sms_admin/_common.php
+++ b/adm/sms_admin/_common.php
@@ -13,6 +13,7 @@ if (!strstr($_SERVER['SCRIPT_NAME'], 'install.php')) {
 }
 
 $sv = isset($_REQUEST['sv']) ? get_search_string($_REQUEST['sv']) : '';
+$st = (isset($_REQUEST['st']) && $st) ? substr(get_search_string($_REQUEST['st']), 0, 12) : '';
 
 if( isset($token) ){
     $token = @htmlspecialchars(strip_tags($token), ENT_QUOTES);
diff --git a/adm/sms_admin/emoticon_move.php b/adm/sms_admin/emoticon_move.php
index 075c7b4a4..4e04cf496 100644
--- a/adm/sms_admin/emoticon_move.php
+++ b/adm/sms_admin/emoticon_move.php
@@ -12,7 +12,7 @@ $g5['title'] = '이모티콘그룹 이동';
 include_once(G5_PATH.'/head.sub.php');
 
 $list = array();    //배열 변수 초기화
-$fo_no_list = isset($_POST['fo_no']) ? implode(',', $_POST['fo_no']) : '';
+$fo_no_list = isset($_POST['fo_no']) ? clean_xss_tags(strip_tags(implode(',', $_POST['fo_no']))) : '';
 
 $sql = " select * from {$g5['sms5_form_group_table']} order by fg_no ";
 $result = sql_query($sql);
diff --git a/adm/sms_admin/form_group_update.php b/adm/sms_admin/form_group_update.php
index ee8b1627a..d5257dcea 100644
--- a/adm/sms_admin/form_group_update.php
+++ b/adm/sms_admin/form_group_update.php
@@ -11,8 +11,8 @@ if ($w == 'u') // 업데이트
         // 실제 번호를 넘김
         $k = $_POST['chk'][$i];
         $fg_no = (int) $_POST['fg_no'][$k];
-        $fg_name = strip_tags($_POST['fg_name'][$k]);
-        $fg_member = strip_tags($_POST['fg_member'][$k]);
+        $fg_name = isset($_POST['fg_name'][$k]) ? addslashes(strip_tags($_POST['fg_name'][$k])) : '';
+        $fg_member = isset($_POST['fg_member'][$k]) ? addslashes(strip_tags($_POST['fg_member'][$k])) : '';
 
         if (!is_numeric($fg_no))
             alert('그룹 고유번호가 없습니다.');
@@ -83,7 +83,7 @@ else // 등록
     if (!strlen(trim($fg_name)))
         alert('그룹명을 입력해주세요');
 
-    $fg_name = strip_tags($fg_name);
+    $fg_name = addslashes(strip_tags($fg_name));
 
     $res = sql_fetch("select fg_name from {$g5['sms5_form_group_table']} where fg_name = '$fg_name'");
     if ($res)
diff --git a/adm/sms_admin/history_num.php b/adm/sms_admin/history_num.php
index f53dfb407..043fdd3f0 100644
--- a/adm/sms_admin/history_num.php
+++ b/adm/sms_admin/history_num.php
@@ -11,15 +11,15 @@ $g5['title'] = "문자전송 내역 (번호별)";
 
 if ($page < 1) $page = 1;
 
+if( isset($st) && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){
+    $st = '';
+}
+
 if ($st && trim($sv))
     $sql_search = " and $st like '%$sv%' ";
 else
     $sql_search = "";
 
-if( isset($st) && !in_array($st, array('hs_name', 'hs_hp', 'bk_no')) ){
-    $st = '';
-}
-
 $total_res = sql_fetch("select count(*) as cnt from {$g5['sms5_history_table']} where 1 $sql_search");
 $total_count = $total_res['cnt'];
 
diff --git a/adm/sms_admin/num_book_update.php b/adm/sms_admin/num_book_update.php
index 0a13c641f..079c5eae1 100644
--- a/adm/sms_admin/num_book_update.php
+++ b/adm/sms_admin/num_book_update.php
@@ -12,6 +12,9 @@ $is_hp_exist = false;
 
 $bk_hp = get_hp($bk_hp);
 
+$bk_memo = strip_tags($bk_memo);
+$bk_name = strip_tags($bk_name);
+
 if ($w=='u') // 업데이트
 {
     if (!$bg_no) $bg_no = 0;
@@ -21,8 +24,6 @@ if ($w=='u') // 업데이트
     if (!strlen(trim($bk_name)))
         alert('이름을 입력해주세요');
 
-    $bk_name = strip_tags($bk_name);
-
     if ($bk_hp == '')
         alert('휴대폰번호만 입력 가능합니다.');
 /*
@@ -48,7 +49,7 @@ if ($w=='u') // 업데이트
             sql_query("update {$g5['sms5_book_group_table']} set bg_receipt = bg_receipt - 1, bg_reject = bg_reject + 1 where bg_no='$bg_no'");
     }
 
-    sql_query("update {$g5['sms5_book_table']} set bg_no='$bg_no', bk_name='$bk_name', bk_hp='$bk_hp', bk_receipt='$bk_receipt', bk_datetime='".G5_TIME_YMDHIS."', bk_memo='".addslashes($bk_memo)."' where bk_no='$bk_no'");
+    sql_query("update {$g5['sms5_book_table']} set bg_no='$bg_no', bk_name='".addslashes($bk_name)."', bk_hp='$bk_hp', bk_receipt='$bk_receipt', bk_datetime='".G5_TIME_YMDHIS."', bk_memo='".addslashes($bk_memo)."' where bk_no='$bk_no'");
     if ($res['mb_id']){ //만약에 mb_id가 있다면...
         // 휴대폰번호 중복체크
         $sql = " select mb_id from {$g5['member_table']} where mb_id <> '{$res['mb_id']}' and mb_hp = '{$bk_hp}' ";
diff --git a/adm/sms_admin/num_book_write.php b/adm/sms_admin/num_book_write.php
index 06896f81e..665673472 100644
--- a/adm/sms_admin/num_book_write.php
+++ b/adm/sms_admin/num_book_write.php
@@ -121,7 +121,7 @@ include_once(G5_ADMIN_PATH."/admin.head.php");
     <tr>
         <th scope="row"><label for="bk_memo">메모</label></th>
         <td>
-            <textarea name="bk_memo" id="bk_memo"><?php echo $write['bk_memo']?></textarea>
+            <textarea name="bk_memo" id="bk_memo"><?php echo html_purifier($write['bk_memo']); ?></textarea>
         </td>
     </tr>
     </tbody>
diff --git a/bbs/delete_comment.php b/bbs/delete_comment.php
index c7727398d..11e08715d 100644
--- a/bbs/delete_comment.php
+++ b/bbs/delete_comment.php
@@ -53,8 +53,8 @@ $comment_reply = substr($write['wr_comment_reply'], 0, $len);
 $sql = " select count(*) as cnt from {$write_table}
             where wr_comment_reply like '{$comment_reply}%'
             and wr_id <> '{$comment_id}'
-            and wr_parent = '{$write[wr_parent]}'
-            and wr_comment = '{$write[wr_comment]}'
+            and wr_parent = '{$write['wr_parent']}'
+            and wr_comment = '{$write['wr_comment']}'
             and wr_is_comment = 1 ";
 $row = sql_fetch($sql);
 if ($row['cnt'] && !$is_admin)
diff --git a/bbs/password_lost2.php b/bbs/password_lost2.php
index 1dbb5209a..fade9a22f 100644
--- a/bbs/password_lost2.php
+++ b/bbs/password_lost2.php
@@ -11,7 +11,7 @@ if (!chk_captcha()) {
     alert('자동등록방지 숫자가 틀렸습니다.');
 }
 
-$email = trim($_POST['mb_email']);
+$email = get_email_address(trim($_POST['mb_email']));
 
 if (!$email)
     alert_close('메일주소 오류입니다.');
diff --git a/config.php b/config.php
index c6991a07a..1d0a318ec 100644
--- a/config.php
+++ b/config.php
@@ -5,7 +5,7 @@
 ********************/
 
 define('G5_VERSION', '그누보드5');
-define('G5_GNUBOARD_VER', '5.3.2.5');
+define('G5_GNUBOARD_VER', '5.3.2.6');
 
 // 이 상수가 정의되지 않으면 각각의 개별 페이지는 별도로 실행될 수 없음
 define('_GNUBOARD_', true);
diff --git a/lib/common.lib.php b/lib/common.lib.php
index 9c0459ddc..a15f7be4e 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -294,6 +294,7 @@ function get_file($bo_table, $wr_id)
     while ($row = sql_fetch_array($result))
     {
         $no = $row['bf_no'];
+        $bf_content = $row['bf_content'] ? html_purifier($row['bf_content']) : '';
         $file[$no]['href'] = G5_BBS_URL."/download.php?bo_table=$bo_table&amp;wr_id=$wr_id&amp;no=$no" . $qstr;
         $file[$no]['download'] = $row['bf_download'];
         // 4.00.11 - 파일 path 추가
@@ -301,8 +302,8 @@ function get_file($bo_table, $wr_id)
         $file[$no]['size'] = get_filesize($row['bf_filesize']);
         $file[$no]['datetime'] = $row['bf_datetime'];
         $file[$no]['source'] = addslashes($row['bf_source']);
-        $file[$no]['bf_content'] = $row['bf_content'];
-        $file[$no]['content'] = get_text($row['bf_content']);
+        $file[$no]['bf_content'] = $bf_content;
+        $file[$no]['content'] = get_text($bf_content);
         //$file[$no]['view'] = view_file_link($row['bf_file'], $file[$no]['content']);
         $file[$no]['view'] = view_file_link($row['bf_file'], $row['bf_width'], $row['bf_height'], $file[$no]['content']);
         $file[$no]['file'] = $row['bf_file'];
diff --git a/plugin/lgxpay/AuthOnlyReq.php b/plugin/lgxpay/AuthOnlyReq.php
index 571d7d9c9..e1eb02e9c 100644
--- a/plugin/lgxpay/AuthOnlyReq.php
+++ b/plugin/lgxpay/AuthOnlyReq.php
@@ -165,8 +165,8 @@ $_SESSION['lgd_certify'] = $payReqMap;
 <input type="hidden" name="LGD_ENCODING" value="UTF-8"/>
 <?php
 foreach ($payReqMap as $key => $value) {
-    $key = htmlspecialchars(strip_tags($key));
-    $value = htmlspecialchars(strip_tags($value));
+    $key = htmlspecialchars(strip_tags($key), ENT_QUOTES);
+    $value = htmlspecialchars(strip_tags($value), ENT_QUOTES);
     echo "<input type='hidden' name='$key' id='$key' value='$value'/>".PHP_EOL;
 }
 ?>