diff --git a/adm/admin.lib.php b/adm/admin.lib.php
index e0fd39dee..91524913d 100644
--- a/adm/admin.lib.php
+++ b/adm/admin.lib.php
@@ -477,7 +477,7 @@ function admin_check_xss_params($params){
 
         if( is_array($value) ){
             admin_check_xss_params($value);
-        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/onload=.*/ius', $value)) ){
+        } else if ( preg_match('/<\s?[^\>]*\/?\s?>/i', $value) && (preg_match('/script.*?\/script/ius', $value) || preg_match('/[onload|onerror]=.*/ius', $value)) ){
             alert('요청 쿼리에 잘못된 스크립트문장이 있습니다.\\nXSS 공격일수도 있습니다.');
             die();
         }
diff --git a/adm/board_form.php b/adm/board_form.php
index d6033e561..3614116b1 100644
--- a/adm/board_form.php
+++ b/adm/board_form.php
@@ -869,7 +869,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_content_head">상단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_content_head", get_text($board['bo_content_head'], 0)); ?>
+                <?php echo editor_html("bo_content_head", get_text(html_purifier($board['bo_content_head']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_content_head" value="1" id="chk_grp_content_head">
@@ -881,7 +881,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_content_tail">하단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_content_tail", get_text($board['bo_content_tail'], 0)); ?>
+                <?php echo editor_html("bo_content_tail", get_text(html_purifier($board['bo_content_tail']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_content_tail" value="1" id="chk_grp_content_tail">
@@ -893,7 +893,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_mobile_content_head">모바일 상단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_mobile_content_head", get_text($board['bo_mobile_content_head'], 0)); ?>
+                <?php echo editor_html("bo_mobile_content_head", get_text(html_purifier($board['bo_mobile_content_head']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_mobile_content_head" value="1" id="chk_grp_mobile_content_head">
@@ -905,7 +905,7 @@ $pg_anchor = '<ul class="anchor">
         <tr>
             <th scope="row"><label for="bo_mobile_content_tail">모바일 하단 내용</label></th>
             <td>
-                <?php echo editor_html("bo_mobile_content_tail", get_text($board['bo_mobile_content_tail'], 0)); ?>
+                <?php echo editor_html("bo_mobile_content_tail", get_text(html_purifier($board['bo_mobile_content_tail']), 0)); ?>
             </td>
             <td class="td_grpset">
                 <input type="checkbox" name="chk_grp_mobile_content_tail" value="1" id="chk_grp_mobile_content_tail">
diff --git a/adm/board_list_update.php b/adm/board_list_update.php
index 90a1c5d33..c3faae7d9 100644
--- a/adm/board_list_update.php
+++ b/adm/board_list_update.php
@@ -29,19 +29,21 @@ if ($_POST['act_button'] == "선택수정") {
                 alert('최고관리자가 아닌 경우 다른 관리자의 게시판('.$board_table[$k].')은 수정이 불가합니다.');
         }
 
+        $p_bo_subject = is_array($_POST['bo_subject']) ? strip_tags($_POST['bo_subject'][$k]) : '';
+
         $sql = " update {$g5['board_table']}
-                    set gr_id               = '".sql_real_escape_string($_POST['gr_id'][$k])."',
-                        bo_subject          = '".sql_real_escape_string($_POST['bo_subject'][$k])."',
-                        bo_device           = '".sql_real_escape_string($_POST['bo_device'][$k])."',
-                        bo_skin             = '".sql_real_escape_string($_POST['bo_skin'][$k])."',
-                        bo_mobile_skin      = '".sql_real_escape_string($_POST['bo_mobile_skin'][$k])."',
-                        bo_read_point       = '".sql_real_escape_string($_POST['bo_read_point'][$k])."',
-                        bo_write_point      = '".sql_real_escape_string($_POST['bo_write_point'][$k])."',
-                        bo_comment_point    = '".sql_real_escape_string($_POST['bo_comment_point'][$k])."',
-                        bo_download_point   = '".sql_real_escape_string($_POST['bo_download_point'][$k])."',
-                        bo_use_search       = '".sql_real_escape_string($_POST['bo_use_search'][$k])."',
-                        bo_use_sns          = '".sql_real_escape_string($_POST['bo_use_sns'][$k])."',
-                        bo_order            = '".sql_real_escape_string($_POST['bo_order'][$k])."'
+                    set gr_id               = '".sql_real_escape_string(strip_tags($_POST['gr_id'][$k]))."',
+                        bo_subject          = '".$p_bo_subject."',
+                        bo_device           = '".sql_real_escape_string(strip_tags($_POST['bo_device'][$k]))."',
+                        bo_skin             = '".sql_real_escape_string(strip_tags($_POST['bo_skin'][$k]))."',
+                        bo_mobile_skin      = '".sql_real_escape_string(strip_tags($_POST['bo_mobile_skin'][$k]))."',
+                        bo_read_point       = '".sql_real_escape_string(strip_tags($_POST['bo_read_point'][$k]))."',
+                        bo_write_point      = '".sql_real_escape_string(strip_tags($_POST['bo_write_point'][$k]))."',
+                        bo_comment_point    = '".sql_real_escape_string(strip_tags($_POST['bo_comment_point'][$k]))."',
+                        bo_download_point   = '".sql_real_escape_string(strip_tags($_POST['bo_download_point'][$k]))."',
+                        bo_use_search       = '".sql_real_escape_string(strip_tags($_POST['bo_use_search'][$k]))."',
+                        bo_use_sns          = '".sql_real_escape_string(strip_tags($_POST['bo_use_sns'][$k]))."',
+                        bo_order            = '".sql_real_escape_string(strip_tags($_POST['bo_order'][$k]))."'
                   where bo_table            = '".sql_real_escape_string($_POST['board_table'][$k])."' ";
 
         sql_query($sql);
diff --git a/adm/boardgroup_list_update.php b/adm/boardgroup_list_update.php
index 53d66c8e9..e6abcb6b7 100644
--- a/adm/boardgroup_list_update.php
+++ b/adm/boardgroup_list_update.php
@@ -19,7 +19,8 @@ for ($i=0; $i<$count; $i++)
 {
     $k     = $_POST['chk'][$i];
     $gr_id = preg_replace('/[^a-z0-9_]/i', '', $_POST['group_id'][$k]);
-    $gr_subject = sql_real_escape_string(strip_tags($_POST['gr_subject'][$k]));
+    $gr_subject = is_array($_POST['gr_subject']) ? strip_tags($_POST['gr_subject'][$k]) : '';
+    $gr_admin = is_array($_POST['gr_admin']) ? strip_tags($_POST['gr_admin'][$k]) : '';
 
     if($_POST['act_button'] == '선택수정') {
         $sql = " update {$g5['group_table']}
@@ -30,7 +31,7 @@ for ($i=0; $i<$count; $i++)
                         gr_order      = '".sql_real_escape_string($_POST['gr_order'][$k])."'
                   where gr_id         = '{$gr_id}' ";
         if ($is_admin != 'super')
-            $sql .= " and gr_admin    = '{$_POST['gr_admin'][$k]}' ";
+            $sql .= " and gr_admin    = '{$gr_admin}' ";
         sql_query($sql);
     } else if($_POST['act_button'] == '선택삭제') {
         $row = sql_fetch(" select count(*) as cnt from {$g5['board_table']} where gr_id = '$gr_id' ");
diff --git a/adm/config_form.php b/adm/config_form.php
index a963723ef..c1960e7c0 100644
--- a/adm/config_form.php
+++ b/adm/config_form.php
@@ -1339,7 +1339,7 @@ include_once('_rewrite_config_form.php');
                 <label for="cf_<?php echo $i ?>_subj">여분필드<?php echo $i ?> 제목</label>
                 <input type="text" name="cf_<?php echo $i ?>_subj" value="<?php echo get_text($config['cf_'.$i.'_subj']) ?>" id="cf_<?php echo $i ?>_subj" class="frm_input" size="30">
                 <label for="cf_<?php echo $i ?>">여분필드<?php echo $i ?> 값</label>
-                <input type="text" name="cf_<?php echo $i ?>" value="<?php echo get_sanitize_input($config['cf_'.$i]); ?>" id="cf_<?php echo $i ?>" class="frm_input" size="30">
+                <input type="text" name="cf_<?php echo $i ?>" value="<?php echo get_sanitize_input($config['cf_'.$i]); ?>" id="cf_<?php echo $i ?>" class="frm_input extra-value-input" size="30">
             </td>
         </tr>
         <?php } ?>
diff --git a/adm/config_form_update.php b/adm/config_form_update.php
index c8aff3bd9..50a6bbf32 100644
--- a/adm/config_form_update.php
+++ b/adm/config_form_update.php
@@ -28,11 +28,11 @@ $cf_social_servicelist = !empty($_POST['cf_social_servicelist']) ? implode(',',
 
 $_POST['cf_title'] = strip_tags($_POST['cf_title']);
 
-$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key');
+$check_keys = array('cf_lg_mid', 'cf_lg_mert_key', 'cf_cert_kcb_cd', 'cf_cert_kcp_cd', 'cf_editor', 'cf_recaptcha_site_key', 'cf_recaptcha_secret_key', 'cf_naver_clientid', 'cf_naver_secret', 'cf_facebook_appid', 'cf_facebook_secret', 'cf_twitter_key', 'cf_twitter_secret', 'cf_google_clientid', 'cf_google_secret', 'cf_googl_shorturl_apikey', 'cf_kakao_rest_key', 'cf_kakao_client_secret', 'cf_kakao_js_apikey', 'cf_payco_clientid', 'cf_payco_secret');
 
 foreach( $check_keys as $key ){
     if ( isset($_POST[$key]) && $_POST[$key] ){
-        $_POST[$key] = preg_replace('/[^a-z0-9_\-]/i', '', $_POST[$key]);
+        $_POST[$key] = preg_replace('/[^a-z0-9_\-\.]/i', '', $_POST[$key]);
     }
 }
 
diff --git a/adm/contentform.php b/adm/contentform.php
index b7bedd389..4a8eeb1c6 100644
--- a/adm/contentform.php
+++ b/adm/contentform.php
@@ -35,6 +35,7 @@ if(!sql_query(" select co_skin from {$g5['content_table']} limit 1 ", false)) {
 
 $html_title = "내용";
 $g5['title'] = $html_title.' 관리';
+$readonly = '';
 
 if ($w == "u")
 {
@@ -86,11 +87,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row">내용</th>
-        <td><?php echo editor_html('co_content', get_text($co['co_content'], 0)); ?></td>
+        <td><?php echo editor_html('co_content', get_text(html_purifier($co['co_content']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row">모바일 내용</th>
-        <td><?php echo editor_html('co_mobile_content', get_text($co['co_mobile_content'], 0)); ?></td>
+        <td><?php echo editor_html('co_mobile_content', get_text(html_purifier($co['co_mobile_content']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row"><label for="co_skin">스킨 디렉토리<strong class="sound_only">필수</strong></label></th>
@@ -104,6 +105,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
             <?php echo get_mobile_skin_select('content', 'co_mobile_skin', 'co_mobile_skin', $co['co_mobile_skin'], 'required'); ?>
         </td>
     </tr>
+    <!--
     <tr>
         <th scope="row"><label for="co_tag_filter_use">태그 필터링 사용</label></th>
         <td>
@@ -114,6 +116,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
             </select>
         </td>
     </tr>
+    -->
     <tr>
         <th scope="row"><label for="co_include_head">상단 파일 경로</label></th>
         <td>
diff --git a/adm/contentformupdate.php b/adm/contentformupdate.php
index f1fdc39f9..41170884b 100644
--- a/adm/contentformupdate.php
+++ b/adm/contentformupdate.php
@@ -24,6 +24,7 @@ $co_id = preg_replace('/[^a-z0-9_]/i', '', $co_id);
 $co_subject = strip_tags($co_subject);
 $co_include_head = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_head, 0, 255));
 $co_include_tail = preg_replace(array("#[\\\]+$#", "#(<\?php|<\?)#i"), "", substr($co_include_tail, 0, 255));
+$co_tag_filter_use = isset($_POST['co_tag_filter_use']) ? (int) $_POST['co_tag_filter_use'] : 1;
 
 // 관리자가 자동등록방지를 사용해야 할 경우
 if (($co_row['co_include_head'] !== $co_include_head || $co_row['co_include_tail'] !== $co_include_tail) && function_exists('get_admin_captcha_by') && get_admin_captcha_by()){
diff --git a/adm/css/admin.css b/adm/css/admin.css
index 29b66458b..ae55bacc2 100644
--- a/adm/css/admin.css
+++ b/adm/css/admin.css
@@ -404,8 +404,8 @@ tfoot th {}
 #anc_bo_extra label {display:inline-block;width:100px}
 #anc_bo_extra input {margin-right:10px}
 
-/* 게시판 여분필드 값 input style 로빈아빠님 제안 */
-#anc_bo_extra input.extra-value-input {width:calc(100% - 370px);}
+/* 환경설정 및 게시판 여분필드 값 input style 로빈아빠님 제안 */
+#anc_bo_extra input.extra-value-input, #anc_cf_extra input.extra-value-input{width:calc(100% - 370px);}
 
 /* 접속자집계 목록 */
 .tbl_visit_list td {text-align:center}
diff --git a/adm/faqform.php b/adm/faqform.php
index 72f4438bd..f5791df49 100644
--- a/adm/faqform.php
+++ b/adm/faqform.php
@@ -54,11 +54,11 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row">질문</th>
-        <td><?php echo editor_html('fa_subject', get_text($fa['fa_subject'], 0)); ?></td>
+        <td><?php echo editor_html('fa_subject', get_text(html_purifier($fa['fa_subject']), 0)); ?></td>
     </tr>
     <tr>
         <th scope="row">답변</th>
-        <td><?php echo editor_html('fa_content', get_text($fa['fa_content'], 0)); ?></td>
+        <td><?php echo editor_html('fa_content', get_text(html_purifier($fa['fa_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>
diff --git a/adm/faqmasterform.php b/adm/faqmasterform.php
index d48f69e49..4ac3f6f80 100644
--- a/adm/faqmasterform.php
+++ b/adm/faqmasterform.php
@@ -117,25 +117,25 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     <tr>
         <th scope="row">상단 내용</th>
         <td>
-            <?php echo editor_html('fm_head_html', get_text($fm['fm_head_html'], 0)); ?>
+            <?php echo editor_html('fm_head_html', get_text(html_purifier($fm['fm_head_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">하단 내용</th>
         <td>
-            <?php echo editor_html('fm_tail_html', get_text($fm['fm_tail_html'], 0)); ?>
+            <?php echo editor_html('fm_tail_html', get_text(html_purifier($fm['fm_tail_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">모바일상단 내용</th>
         <td>
-            <?php echo editor_html('fm_mobile_head_html', get_text($fm['fm_mobile_head_html'], 0)); ?>
+            <?php echo editor_html('fm_mobile_head_html', get_text(html_purifier($fm['fm_mobile_head_html']), 0)); ?>
         </td>
     </tr>
     <tr>
         <th scope="row">모바일하단 내용</th>
         <td>
-            <?php echo editor_html('fm_mobile_tail_html', get_text($fm['fm_mobile_tail_html'], 0)); ?>
+            <?php echo editor_html('fm_mobile_tail_html', get_text(html_purifier($fm['fm_mobile_tail_html']), 0)); ?>
         </td>
     </tr>
     </tbody>
diff --git a/adm/mail_form.php b/adm/mail_form.php
index b93d3a5c7..547beadf0 100644
--- a/adm/mail_form.php
+++ b/adm/mail_form.php
@@ -44,7 +44,7 @@ include_once('./admin.head.php');
     </tr>
     <tr>
         <th scope="row"><label for="ma_content">메일 내용<strong class="sound_only">필수</strong></label></th>
-        <td><?php echo editor_html("ma_content", get_text($ma['ma_content'], 0)); ?></td>
+        <td><?php echo editor_html("ma_content", get_text(html_purifier($ma['ma_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>
diff --git a/adm/member_form_update.php b/adm/member_form_update.php
index 89824f0a1..a0c87eb9d 100644
--- a/adm/member_form_update.php
+++ b/adm/member_form_update.php
@@ -120,6 +120,28 @@ else if ($w == 'u')
     if ($row['mb_id'])
         alert('이미 존재하는 이메일입니다.\\nＩＤ : '.$row['mb_id'].'\\n이름 : '.$row['mb_name'].'\\n닉네임 : '.$row['mb_nick'].'\\n메일 : '.$row['mb_email']);
 
+    if ($mb_password)
+        $sql_password = " , mb_password = '".get_encrypt_string($mb_password)."' ";
+    else
+        $sql_password = "";
+
+    if ($passive_certify)
+        $sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
+    else
+        $sql_certify = "";
+
+    $sql = " update {$g5['member_table']}
+                set {$sql_common}
+                     {$sql_password}
+                     {$sql_certify}
+                where mb_id = '{$mb_id}' ";
+    sql_query($sql);
+}
+else
+    alert('제대로 된 값이 넘어오지 않았습니다.');
+
+if( $w == '' || $w == 'u' ){
+
     $mb_dir = substr($mb_id,0,2);
     $mb_icon_img = get_mb_icon_name($mb_id).'.gif';
 
@@ -212,26 +234,7 @@ else if ($w == 'u')
             }
         }
     }
-
-    if ($mb_password)
-        $sql_password = " , mb_password = '".get_encrypt_string($mb_password)."' ";
-    else
-        $sql_password = "";
-
-    if ($passive_certify)
-        $sql_certify = " , mb_email_certify = '".G5_TIME_YMDHIS."' ";
-    else
-        $sql_certify = "";
-
-    $sql = " update {$g5['member_table']}
-                set {$sql_common}
-                     {$sql_password}
-                     {$sql_certify}
-                where mb_id = '{$mb_id}' ";
-    sql_query($sql);
 }
-else
-    alert('제대로 된 값이 넘어오지 않았습니다.');
 
 run_event('admin_member_form_update', $w, $mb_id);
 
diff --git a/adm/menu_list.php b/adm/menu_list.php
index 4a6c25127..4ff7db524 100644
--- a/adm/menu_list.php
+++ b/adm/menu_list.php
@@ -76,7 +76,7 @@ $colspan = 7;
         <td class="td_category<?php echo $sub_menu_class; ?>">
             <input type="hidden" name="code[]" value="<?php echo substr($row['me_code'], 0, 2) ?>">
             <label for="me_name_<?php echo $i; ?>" class="sound_only"><?php echo $sub_menu_info; ?> 메뉴<strong class="sound_only"> 필수</strong></label>
-            <input type="text" name="me_name[]" value="<?php echo $me_name; ?>" id="me_name_<?php echo $i; ?>" required class="required tbl_input full_input">
+            <input type="text" name="me_name[]" value="<?php echo get_sanitize_input($me_name); ?>" id="me_name_<?php echo $i; ?>" required class="required tbl_input full_input">
         </td>
         <td>
             <label for="me_link_<?php echo $i; ?>" class="sound_only">링크<strong class="sound_only"> 필수</strong></label>
diff --git a/adm/menu_list_update.php b/adm/menu_list_update.php
index 3aaf18b11..f7f4cf882 100644
--- a/adm/menu_list_update.php
+++ b/adm/menu_list_update.php
@@ -20,9 +20,11 @@ $count = count($_POST['code']);
 for ($i=0; $i<$count; $i++)
 {
     $_POST = array_map_deep('trim', $_POST);
+    
+    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags($_POST['me_link'][$i], 1) : '';
 
-    $code    = $_POST['code'][$i];
-    $me_name = $_POST['me_name'][$i];
+    $code    = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
+    $me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
     $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags($_POST['me_link'][$i]);
     
     if(!$code || !$me_name || !$me_link)
@@ -56,13 +58,13 @@ for ($i=0; $i<$count; $i++)
 
     // 메뉴 등록
     $sql = " insert into {$g5['menu_table']}
-                set me_code         = '$me_code',
-                    me_name         = '$me_name',
-                    me_link         = '$me_link',
-                    me_target       = '{$_POST['me_target'][$i]}',
-                    me_order        = '{$_POST['me_order'][$i]}',
-                    me_use          = '{$_POST['me_use'][$i]}',
-                    me_mobile_use   = '{$_POST['me_mobile_use'][$i]}' ";
+                set me_code         = '".$me_code."',
+                    me_name         = '".$me_name."',
+                    me_link         = '".$me_link."',
+                    me_target       = '".sql_real_escape_string(strip_tags($_POST['me_target'][$i]))."',
+                    me_order        = '".sql_real_escape_string(strip_tags($_POST['me_order'][$i]))."',
+                    me_use          = '".sql_real_escape_string(strip_tags($_POST['me_use'][$i]))."',
+                    me_mobile_use   = '".sql_real_escape_string(strip_tags($_POST['me_mobile_use'][$i]))."' ";
     sql_query($sql);
 }
 
diff --git a/adm/newwinform.php b/adm/newwinform.php
index 10aab222d..371aea64a 100644
--- a/adm/newwinform.php
+++ b/adm/newwinform.php
@@ -114,7 +114,7 @@ include_once (G5_ADMIN_PATH.'/admin.head.php');
     </tr>
     <tr>
         <th scope="row"><label for="nw_content">내용</label></th>
-        <td><?php echo editor_html('nw_content', get_text($nw['nw_content'], 0)); ?></td>
+        <td><?php echo editor_html('nw_content', get_text(html_purifier($nw['nw_content']), 0)); ?></td>
     </tr>
     </tbody>
     </table>
diff --git a/adm/qa_config.php b/adm/qa_config.php
index 312dcd8cd..92e9a4632 100644
--- a/adm/qa_config.php
+++ b/adm/qa_config.php
@@ -282,25 +282,25 @@ if(!isset($qaconfig['qa_include_head'])) {
         <tr>
             <th scope="row"><label for="qa_content_head">상단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_content_head", get_text($qaconfig['qa_content_head'], 0)); ?>
+                <?php echo editor_html("qa_content_head", get_text(html_purifier($qaconfig['qa_content_head']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_content_tail">하단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_content_tail", get_text($qaconfig['qa_content_tail'], 0)); ?>
+                <?php echo editor_html("qa_content_tail", get_text(html_purifier($qaconfig['qa_content_tail']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_mobile_content_head">모바일 상단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_mobile_content_head", get_text($qaconfig['qa_mobile_content_head'], 0)); ?>
+                <?php echo editor_html("qa_mobile_content_head", get_text(html_purifier($qaconfig['qa_mobile_content_head']), 0)); ?>
             </td>
         </tr>
         <tr>
             <th scope="row"><label for="qa_mobile_content_tail">모바일 하단 내용</label></th>
             <td>
-                <?php echo editor_html("qa_mobile_content_tail", get_text($qaconfig['qa_mobile_content_tail'], 0)); ?>
+                <?php echo editor_html("qa_mobile_content_tail", get_text(html_purifier($qaconfig['qa_mobile_content_tail']), 0)); ?>
             </td>
         </tr>
         <tr>
diff --git a/adm/sms_admin/history_view.php b/adm/sms_admin/history_view.php
index 498d7fe03..43e144fa4 100644
--- a/adm/sms_admin/history_view.php
+++ b/adm/sms_admin/history_view.php
@@ -131,22 +131,22 @@ function all_send()
     <tr>
         <td><?php echo $re_vnum--?></td>
         <!-- <td><input type=checkbox></td> -->
-        <!-- <td><?php echo $res[wr_message]; ?></span></td>-->
-        <!-- <td><?php echo $res[wr_reply]; ?></td>-->
+        <!-- <td><?php echo $res['wr_message']; ?></span></td>-->
+        <!-- <td><?php echo $res['wr_reply']; ?></td>-->
         <td><?php echo $res['wr_datetime']?></td>
         <td><?php echo number_format($res['wr_total'])?></td>
         <td><?php echo number_format($res['wr_success'])?></td>
         <td><?php echo number_format($res['wr_failure'])?></td>
         <td class="td_mng">
             <a href="./history_view.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res['wr_no']?>&amp;wr_renum=<?php echo $res['wr_renum']?>" class="btn btn_03">수정</a>
-            <!-- <a href="./history_del.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res[wr_no]?>&amp;wr_renum=<?php echo $res[wr_renum]?>">삭제</a> -->
+            <!-- <a href="./history_del.php?page=<?php echo $page?>&amp;st=<?php echo $st?>&amp;sv=<?php echo $sv?>&amp;wr_no=<?php echo $res['wr_no']?>&amp;wr_renum=<?php echo $res['wr_renum']?>">삭제</a> -->
         </td>
     </tr>
     <?php } ?>
     </tbody>
     </table>
-    <?php } ?>
     </div>
+    <?php } ?>
 
     <?php
     if( $write['wr_memo'] ){
diff --git a/adm/visit_list.php b/adm/visit_list.php
index 02ce73f10..46744e99f 100644
--- a/adm/visit_list.php
+++ b/adm/visit_list.php
@@ -73,7 +73,7 @@ $result = sql_query($sql);
             }
 
             $title = str_replace(array('<', '>', '&'), array("&lt;", "&gt;", "&amp;"), $referer);
-            $link = '<a href="'.$row['vi_referer'].'" target="_blank">';
+            $link = '<a href="'.get_text($row['vi_referer']).'" target="_blank">';
             $link = str_replace('&', "&amp;", $link);
             $link2 = '</a>';
         }
diff --git a/adm/visit_search.php b/adm/visit_search.php
index 67e0f9188..e29a0e382 100644
--- a/adm/visit_search.php
+++ b/adm/visit_search.php
@@ -92,7 +92,7 @@ $listall = '<a href="'.$_SERVER['SCRIPT_NAME'].'">처음</a>'; //페이지 처
             }
 
             $title = str_replace(array("<", ">"), array("&lt;", "&gt;"), $referer);
-            $link = '<a href="'.$row['vi_referer'].'" target="_blank" title="'.$title.'">';
+            $link = '<a href="'.get_text($row['vi_referer']).'" target="_blank" title="'.$title.'">';
         }
 
         if ($is_admin == 'super')
diff --git a/bbs/alert.php b/bbs/alert.php
index fbac90876..18d5053c2 100644
--- a/bbs/alert.php
+++ b/bbs/alert.php
@@ -31,8 +31,8 @@ include_once(G5_PATH.'/head.sub.php');
 $msg = isset($msg) ? strip_tags($msg) : '';
 $msg2 = str_replace("\\n", "<br>", $msg);
 
-$url = clean_xss_tags($url);
-if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER']);
+$url = clean_xss_tags($url, 1);
+if (!$url) $url = clean_xss_tags($_SERVER['HTTP_REFERER'], 1);
 
 $url = preg_replace("/[\<\>\'\"\\\'\\\"\(\)]/", "", $url);
 $url = preg_replace('/\r\n|\r|\n|[^\x20-\x7e]/','', $url);
diff --git a/bbs/board.php b/bbs/board.php
index 05c0f8878..b131a8e9f 100644
--- a/bbs/board.php
+++ b/bbs/board.php
@@ -19,7 +19,7 @@ if (!$bo_table) {
 $g5['board_title'] = ((G5_IS_MOBILE && $board['bo_mobile_subject']) ? $board['bo_mobile_subject'] : $board['bo_subject']);
 
 // wr_id 값이 있으면 글읽기
-if (isset($wr_id) && $wr_id) {
+if ((isset($wr_id) && $wr_id) || (isset($wr_seo_title) && $wr_seo_title)) {
     // 글이 없을 경우 해당 게시판 목록으로 이동
     if (!$write['wr_id']) {
         $msg = '글이 존재하지 않습니다.\\n\\n글이 삭제되었거나 이동된 경우입니다.';
diff --git a/bbs/confirm.php b/bbs/confirm.php
index 5e71c009a..1d54d1384 100644
--- a/bbs/confirm.php
+++ b/bbs/confirm.php
@@ -5,11 +5,11 @@ include_once(G5_PATH.'/head.sub.php');
 $pattern1 = "/[\<\>\'\"\\\'\\\"\(\)]/";
 $pattern2 = "/\r\n|\r|\n|[^\x20-\x7e]/";
 
-$url1 = preg_replace($pattern1, "", clean_xss_tags($url1));
+$url1 = preg_replace($pattern1, "", clean_xss_tags($url1, 1));
 $url1 = preg_replace($pattern2, "", $url1);
-$url2 = preg_replace($pattern1, "", clean_xss_tags($url2));
+$url2 = preg_replace($pattern1, "", clean_xss_tags($url2, 1));
 $url2 = preg_replace($pattern2, "", $url2);
-$url3 = preg_replace($pattern1, "", clean_xss_tags($url3));
+$url3 = preg_replace($pattern1, "", clean_xss_tags($url3, 1));
 $url3 = preg_replace($pattern2, "", $url3);
 
 // url 체크
@@ -31,12 +31,12 @@ if (confirm(conf)) {
 <article id="confirm_check">
 <header>
     <hgroup>
-        <h1><?php echo $header; ?></h1> <!-- 수행 중이던 작업 내용 -->
+        <h1><?php echo get_text(strip_tags($header)); ?></h1> <!-- 수행 중이던 작업 내용 -->
         <h2>아래 내용을 확인해 주세요.</h2>
     </hgroup>
 </header>
 <p>
-    <?php echo $msg; ?>
+    <?php echo get_text(strip_tags($msg)); ?>
 </p>
 
 <a href="<?php echo $url1; ?>">확인</a>
diff --git a/bbs/content.php b/bbs/content.php
index 31afdb8e1..9098192a3 100644
--- a/bbs/content.php
+++ b/bbs/content.php
@@ -35,6 +35,8 @@ if ($co['co_include_head'] && is_include_path_check($co['co_include_head']))
 else
     include_once('./_head.php');
 
+// KVE-2019-0828 취약점 내용
+$co['co_tag_filter_use'] = 1;
 $str = conv_content($co['co_content'], $co['co_html'], $co['co_tag_filter_use']);
 
 // $src 를 $dst 로 변환
diff --git a/bbs/download.php b/bbs/download.php
index 8a98a32e1..1d9d7676c 100644
--- a/bbs/download.php
+++ b/bbs/download.php
@@ -25,8 +25,12 @@ if (!$file['bf_file'])
 // JavaScript 불가일 때
 if($js != 'on' && $board['bo_download_point'] < 0) {
     $msg = $file['bf_source'].' 파일을 다운로드 하시면 포인트가 차감('.number_format($board['bo_download_point']).'점)됩니다.\\n포인트는 게시물당 한번만 차감되며 다음에 다시 다운로드 하셔도 중복하여 차감하지 않습니다.\\n그래도 다운로드 하시겠습니까?';
-    $url1 = G5_BBS_URL.'/download.php?'.clean_query_string($_SERVER['QUERY_STRING']).'&amp;js=on';
+    $url1 = G5_BBS_URL.'/download.php?'.clean_query_string($_SERVER['QUERY_STRING'], false).'&js=on';
     $url2 = clean_xss_tags($_SERVER['HTTP_REFERER']);
+    
+    if( $url2 && stripos($url2, $_SERVER['REQUEST_URI']) !== false ){
+        $url2 = G5_BBS_URL.'/board.php?'.clean_query_string($_SERVER['QUERY_STRING'], false);
+    }
 
     //$url1 = 확인link, $url2=취소link
     // 특정주소로 이동시키려면 $url3 이용
diff --git a/bbs/login.php b/bbs/login.php
index 3cb6c0863..3bfb79390 100644
--- a/bbs/login.php
+++ b/bbs/login.php
@@ -8,7 +8,7 @@ if( function_exists('social_check_login_before') ){
 $g5['title'] = '로그인';
 include_once('./_head.sub.php');
 
-$url = $_GET['url'];
+$url = strip_tags($_GET['url']);
 
 // url 체크
 check_url_host($url);
diff --git a/bbs/move_update.php b/bbs/move_update.php
index c1fdfbc17..667698455 100644
--- a/bbs/move_update.php
+++ b/bbs/move_update.php
@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+$act = isset($act) ? strip_tags($act) : '';
+
 // 게시판 관리자 이상 복사, 이동 가능
 if ($is_admin != 'board' && $is_admin != 'group' && $is_admin != 'super')
     alert_close('게시판 관리자 이상 접근이 가능합니다.');
@@ -125,7 +127,7 @@ while ($row = sql_fetch_array($result))
                         // 제이프로님 코드제안 적용
                         $copy_file_name = ($bo_table !== $move_bo_table) ? $row3['bf_file'] : $row2['wr_id'].'_copy_'.$insert_id.'_'.$row3['bf_file'];
                         @copy($src_dir.'/'.$row3['bf_file'], $dst_dir.'/'.$copy_file_name);
-                        @chmod($dst_dir.'/'.$row3['bf_file'], G5_FILE_PERMISSION);
+                        @chmod($dst_dir.'/'.$copy_file_name, G5_FILE_PERMISSION);
                     }
 
                     $sql = " insert into {$g5['board_file_table']}
@@ -197,8 +199,12 @@ if ($sw == 'move')
     for ($i=0; $i<count($save); $i++)
     {
         if( isset($save[$i]['bf_file']) && $save[$i]['bf_file'] ){
-            for ($k=0; $k<count($save[$i]['bf_file']); $k++)
+            for ($k=0; $k<count($save[$i]['bf_file']); $k++) {
                 @unlink($save[$i]['bf_file'][$k]);
+
+                // 썸네일 파일 삭제, 먼지손 님 코드 제안
+                delete_board_thumbnail($bo_table, basename($save[$i]['bf_file'][$k]));
+            }
         }
 
         sql_query(" delete from $write_table where wr_parent = '{$save[$i]['wr_id']}' ");
diff --git a/bbs/view_image.php b/bbs/view_image.php
index 196df9f4c..c7a7edca7 100644
--- a/bbs/view_image.php
+++ b/bbs/view_image.php
@@ -12,10 +12,10 @@ if ( ! preg_match('/(jpg|jpeg|png|gif|bmp)$/i', $extension) ){
     alert_close('이미지 확장자가 아닙니다.');
 }
 
-if(strpos($filename, 'data/editor')) {
+if(strpos($filename, G5_DATA_DIR.'/editor')) {
     $editor_file = strstr($filename, 'editor');
     $filepath = G5_DATA_PATH.'/'.$editor_file;
-} else if(strpos($filename, 'data/qa')) {
+} else if(strpos($filename, G5_DATA_DIR.'/qa')) {
     $editor_file = strstr($filename, 'qa');
     $filepath = G5_DATA_PATH.'/'.$editor_file;
 } else {
diff --git a/bbs/visit_insert.inc.php b/bbs/visit_insert.inc.php
index 50a9bc709..b8154e215 100644
--- a/bbs/visit_insert.inc.php
+++ b/bbs/visit_insert.inc.php
@@ -13,8 +13,8 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
     $remote_addr = escape_trim($_SERVER['REMOTE_ADDR']);
     $referer = "";
     if (isset($_SERVER['HTTP_REFERER']))
-        $referer = escape_trim(clean_xss_tags($_SERVER['HTTP_REFERER']));
-    $user_agent  = escape_trim(clean_xss_tags($_SERVER['HTTP_USER_AGENT']));
+        $referer = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_REFERER'])));
+    $user_agent  = escape_trim(clean_xss_tags(strip_tags($_SERVER['HTTP_USER_AGENT'])));
     $vi_browser = '';
     $vi_os = '';
     $vi_device = '';
diff --git a/extend/sms5.extend.php b/extend/sms5.extend.php
index eee1022ef..dbef097cf 100644
--- a/extend/sms5.extend.php
+++ b/extend/sms5.extend.php
@@ -23,6 +23,8 @@ $g5['sms5_book_group_table']      = $g5['sms5_prefix'] . 'book_group';
 $g5['sms5_form_table']            = $g5['sms5_prefix'] . 'form';
 $g5['sms5_form_group_table']      = $g5['sms5_prefix'] . 'form_group';
 
+$sms5 = array();
+
 if (!empty($config['cf_sms_use'])) {
 
     $sms5 = sql_fetch("select * from {$g5['sms5_config_table']} ", false);
diff --git a/head.sub.php b/head.sub.php
index e83d4be49..e1e0cf9a9 100644
--- a/head.sub.php
+++ b/head.sub.php
@@ -19,6 +19,9 @@ else {
     $g5_head_title .= " | ".$config['cf_title'];
 }
 
+$g5['title'] = strip_tags($g5['title']);
+$g5_head_title = strip_tags($g5_head_title);
+
 // 현재 접속자
 // 게시판 제목에 ' 포함되면 오류 발생
 $g5['lo_location'] = addslashes($g5['title']);
diff --git a/install/ajax.install.check.php b/install/ajax.install.check.php
index d03777ec5..fd5616f73 100644
--- a/install/ajax.install.check.php
+++ b/install/ajax.install.check.php
@@ -19,7 +19,7 @@ $mysql_host  = safe_install_string_check($_POST['mysql_host'], 'json');
 $mysql_user  = safe_install_string_check($_POST['mysql_user'], 'json');
 $mysql_pass  = safe_install_string_check($_POST['mysql_pass'], 'json');
 $mysql_db    = safe_install_string_check($_POST['mysql_db'], 'json');
-$table_prefix= safe_install_string_check($_POST['table_prefix']);
+$table_prefix= safe_install_string_check(preg_replace('/[^a-zA-Z0-9_]/', '_', $_POST['table_prefix']));
 
 $tmp_str = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '';
 $ajax_token = md5($tmp_str.$_SERVER['REMOTE_ADDR'].$_SERVER['DOCUMENT_ROOT']);
diff --git a/install/install_config.php b/install/install_config.php
index 67d804f3d..468c89372 100644
--- a/install/install_config.php
+++ b/install/install_config.php
@@ -168,7 +168,7 @@ function frm_install_submit(f)
         alert('TABLE명 접두사'+reg_msg); f.table_prefix.focus(); return false;
     }
 
-    if(/^[a-z][a-z0-9]/i.test(f.admin_id.value) == false) {
+    if(/^[a-z]+[a-z0-9]{2,19}$/i.test(f.admin_id.value) == false) {
         alert('최고관리자 회원 ID는 첫자는 반드시 영문자 그리고 영문자와 숫자로만 만드셔야 합니다.');
         f.admin_id.focus();
         return false;
diff --git a/install/install_db.php b/install/install_db.php
index d8eadb22d..7190e753f 100644
--- a/install/install_db.php
+++ b/install/install_db.php
@@ -33,6 +33,10 @@ $admin_pass  = $_POST['admin_pass'];
 $admin_name  = $_POST['admin_name'];
 $admin_email = $_POST['admin_email'];
 
+if (preg_match("/[^0-9a-z_]+/i", $admin_id)) {
+    die('<div class="ins_inner"><p>관리자 아이디는 영문자, 숫자, _ 만 입력하세요.</p><div class="inner_btn"><a href="./install_config.php">뒤로가기</a></div></div>');
+}
+
 $dblink = sql_connect($mysql_host, $mysql_user, $mysql_pass, $mysql_db);
 if (!$dblink) {
 ?>
diff --git a/lib/common.lib.php b/lib/common.lib.php
index 7c3e76cc3..6cbd04979 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -2859,6 +2859,11 @@ function module_exec_check($exe, $type)
         } else {
             // 바이너리 파일인지
             if($is_linux) {
+
+                if ( !function_exists('exec') ) {
+                    alert('exec 함수실행이 불가능하므로 사용할수 없습니다.');
+                }
+
                 $search = false;
                 $isbinary = true;
                 $executable = true;
@@ -2989,13 +2994,17 @@ function get_search_string($stx)
 }
 
 // XSS 관련 태그 제거
-function clean_xss_tags($str)
+function clean_xss_tags($str, $check_entities=0)
 {
     $str_len = strlen($str);
     
     $i = 0;
     while($i <= $str_len){
         $result = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $str);
+        
+        if( $check_entities ){
+            $result = str_replace(array('&colon;', '&lpar;', '&rpar;', '&NewLine;', '&Tab;'), '', $result);
+        }
 
         if((string)$result === (string)$str) break;
 
@@ -3561,7 +3570,7 @@ function get_head_title($title){
     global $g5;
 
     if( isset($g5['board_title']) && $g5['board_title'] ){
-        $title = $g5['board_title'];
+        $title = strip_tags($g5['board_title']);
     }
 
     return $title;
@@ -3637,6 +3646,11 @@ function get_call_func_cache($func, $args=array()){
 function is_include_path_check($path='', $is_input='')
 {
     if( $path ){
+
+        if( strlen($path) > 255 ){
+            return false;
+        }
+
         if ($is_input){
             // 장태진 @jtjisgod <jtjisgod@gmail.com> 추가
             // 보안 목적 : rar wrapper 차단
@@ -3692,14 +3706,17 @@ function is_include_path_check($path='', $is_input='')
             if( preg_match('/\/data\/(file|editor|qa|cache|member|member_image|session|tmp)\/[A-Za-z0-9_]{1,20}\//i', $replace_path) ){
                 return false;
             }
-            if( preg_match('/\.\.\//i', $replace_path) && preg_match('/plugin\//i', $replace_path) && preg_match('/okname\//i', $replace_path) ){
+            if( (preg_match('/\.\.\//i', $replace_path) || preg_match('/^\/.*/i', $replace_path)) && preg_match('/plugin\//i', $replace_path) && preg_match('/okname\//i', $replace_path) ){
+                return false;
+            }
+            if( substr_count($replace_path, './') > 5 ){
                 return false;
             }
         }
 
         $extension = pathinfo($path, PATHINFO_EXTENSION);
         
-        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf)$/i', $extension)) {
+        if($extension && preg_match('/(jpg|jpeg|png|gif|bmp|conf|php\-x)$/i', $extension)) {
             return false;
         }
     }
diff --git a/lib/latest.lib.php b/lib/latest.lib.php
index 3455977a1..da89910d1 100644
--- a/lib/latest.lib.php
+++ b/lib/latest.lib.php
@@ -47,7 +47,6 @@ function latest($skin_dir='', $bo_table, $rows=10, $subject_len=40, $cache_time=
         $board = get_board_db($bo_table, true);
 
         $bo_subject = get_text($board['bo_subject']);
-        $board['bo_use_sideview'] = 0;  // not use sideview
 
         $tmp_write_table = $g5['write_prefix'] . $bo_table; // 게시판 테이블 전체이름
         $sql = " select * from {$tmp_write_table} where wr_is_comment = 0 order by wr_num limit 0, {$rows} ";
diff --git a/lib/uri.lib.php b/lib/uri.lib.php
index 286fabccc..bf1da941a 100644
--- a/lib/uri.lib.php
+++ b/lib/uri.lib.php
@@ -304,13 +304,13 @@ function get_nginx_conf_rules($return_string=false){
         $rules[] = $add_rules;
     }
 
-    $rules[] = "rewrite ^{$base_path}content/([0-9a-zA-Z_]+)$ {$base_path}bbs/content.php?co_id=$1&rewrite=1 break;";
-    $rules[] = "rewrite ^{$base_path}content/([^/]+)/$ {$base_path}bbs/content.php?co_seo_title=$1&rewrite=1 break;";
-    $rules[] = "rewrite ^{$base_path}rss/([0-9a-zA-Z_]+)$ {$base_path}bbs/rss.php?bo_table=$1 break;";
-    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)$ {$base_path}bbs/board.php?bo_table=$1&rewrite=1 break;";
-    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/write$ {$base_path}bbs/write.php?bo_table=$1&rewrite=1 break;";
-    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([^/]+)/$ {$base_path}bbs/board.php?bo_table=$1&wr_seo_title=$2&rewrite=1 break;";
-    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([0-9]+)$ {$base_path}bbs/board.php?bo_table=$1&wr_id=$2&rewrite=1 break;";
+    $rules[] = "rewrite ^{$base_path}content/([0-9a-zA-Z_]+)$ {$base_path}".G5_BBS_DIR."/content.php?co_id=$1&rewrite=1 break;";
+    $rules[] = "rewrite ^{$base_path}content/([^/]+)/$ {$base_path}".G5_BBS_DIR."/content.php?co_seo_title=$1&rewrite=1 break;";
+    $rules[] = "rewrite ^{$base_path}rss/([0-9a-zA-Z_]+)$ {$base_path}".G5_BBS_DIR."/rss.php?bo_table=$1 break;";
+    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)$ {$base_path}".G5_BBS_DIR."/board.php?bo_table=$1&rewrite=1 break;";
+    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/write$ {$base_path}".G5_BBS_DIR."/write.php?bo_table=$1&rewrite=1 break;";
+    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([^/]+)/$ {$base_path}".G5_BBS_DIR."/board.php?bo_table=$1&wr_seo_title=$2&rewrite=1 break;";
+    $rules[] = "rewrite ^{$base_path}([0-9a-zA-Z_]+)/([0-9]+)$ {$base_path}".G5_BBS_DIR."/board.php?bo_table=$1&wr_id=$2&rewrite=1 break;";
     $rules[] = '}';
     $rules[] = '#### '.G5_VERSION.' nginx rules END #####';
 
diff --git a/plugin/okname/hpcert1.php b/plugin/okname/hpcert1.php
index 45c64bd8f..d81aaeb73 100644
--- a/plugin/okname/hpcert1.php
+++ b/plugin/okname/hpcert1.php
@@ -1,8 +1,14 @@
 <?php
 include_once('./_common.php');
 
-if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
-    die('bad request');
+$check_arrays = array('exe', 'svcTxSeqno', 'name', 'birthday', 'gender', 'ntvFrnrTpCd', 'mblTelCmmCd', 'mbphnNo', 'rsv1', 'rsv2', 'rsv3', 'returnMsg', 'returnUrl', 'inTpBit', 'hsCertMsrCd', 'hsCertRqstCausCd', 'memId', 'clientIp', 'clientDomain', 'endPointURL', 'logPath');
+
+foreach($check_arrays as $key){
+    if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
+        die('bad request');
+    }
+
+    $$key = '';
 }
 
 // 금일 인증시도 회수 체크
diff --git a/plugin/okname/hpcert2.php b/plugin/okname/hpcert2.php
index e28d03d45..ab8d24240 100644
--- a/plugin/okname/hpcert2.php
+++ b/plugin/okname/hpcert2.php
@@ -1,8 +1,14 @@
 <?php
 include_once('./_common.php');
 
-if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
-    die('bad request');
+$check_arrays = array('exe', 'keypath', 'memId', 'endPointURL', 'logPath');
+
+foreach($check_arrays as $key){
+    if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
+        die('bad request');
+    }
+
+    $$key = '';
 }
 
 // KISA 취약점 내용(KVE-2018-0291) hpcert1.php의 $cmd 함수에 대한 인자 값은 hpcert_config.php 파일에서 설정되나, 이를 다른 페이지에서 포함한 뒤 호출할 시 임의 값 설정 가능
diff --git a/plugin/okname/ipin1.php b/plugin/okname/ipin1.php
index f694ea693..620b3c582 100644
--- a/plugin/okname/ipin1.php
+++ b/plugin/okname/ipin1.php
@@ -1,8 +1,14 @@
 <?php
 include_once('./_common.php');
 
-if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
-    die('bad request');
+$check_arrays = array('exe', 'keypath', 'memid', 'reserved1', 'reserved2', 'EndPointURL', 'logpath', 'option');
+
+foreach($check_arrays as $key){
+    if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
+        die('bad request');
+    }
+
+    $$key = '';
 }
 
 // 금일 인증시도 회수 체크
diff --git a/plugin/okname/ipin2.php b/plugin/okname/ipin2.php
index 11b86753c..323789e6d 100644
--- a/plugin/okname/ipin2.php
+++ b/plugin/okname/ipin2.php
@@ -1,8 +1,14 @@
 <?php
 include_once('./_common.php');
 
-if( isset($_REQUEST['exe']) && isset($exe) && $exe ){
-    die('bad request');
+$check_arrays = array('exe', 'keypath', 'memid', 'EndPointURL', 'cpubkey', 'csig', 'encdata', 'logpath', 'option');
+
+foreach($check_arrays as $key){
+    if( isset($_REQUEST[$key]) && $_REQUEST[$key] ){
+        die('bad request');
+    }
+
+    $$key = '';
 }
 
 include('./ipin.config.php');
diff --git a/plugin/sms5/sms5.lib.php b/plugin/sms5/sms5.lib.php
index 6f872e300..da8f530e1 100644
--- a/plugin/sms5/sms5.lib.php
+++ b/plugin/sms5/sms5.lib.php
@@ -164,8 +164,8 @@ if($config['cf_sms_type'] == 'LMS') {
         }
 
         function Init() {
-            $this->Data     = "";   // 발송하기 위한 패킷내용이 배열로 들어간다.
-            $this->Result   = "";   // 발송결과값이 배열로 들어간다.
+            $this->Data     = array();   // 발송하기 위한 패킷내용이 배열로 들어간다.
+            $this->Result   = array();   // 발송결과값이 배열로 들어간다.
         }
 
         function Add($strDest, $strCallBack, $strCaller, $strSubject, $strURL, $strData, $strDate="", $nCount) {
@@ -260,7 +260,7 @@ if($config['cf_sms_type'] == 'LMS') {
                     $this->Result[] = "$phone:$code";
                     $this->Log[] = $puts;
                 }
-                $this->Data = "";
+                $this->Data = array();
                 return true;
                 exit;
             }
@@ -284,7 +284,7 @@ if($config['cf_sms_type'] == 'LMS') {
             }
 
             fclose($fsocket);
-            $this->Data = "";
+            $this->Data = array();
             return true;
         }
     }
@@ -431,7 +431,7 @@ if($config['cf_sms_type'] == 'LMS') {
                     $this->Result[] = "$phone:$code";
                     $this->Log[] = $puts;
                 }
-                $this->Data = "";
+                $this->Data = array();
                 return true;
                 exit;
             }
@@ -463,7 +463,7 @@ if($config['cf_sms_type'] == 'LMS') {
                 if ($count++%1000 == 0) sleep(5);
             }
             fclose($fsocket);
-            $this->Data = "";
+            $this->Data = array();
             return true;
         }
     }
diff --git a/plugin/syndi/ping.php b/plugin/syndi/ping.php
index fe5610c01..ff869b876 100644
--- a/plugin/syndi/ping.php
+++ b/plugin/syndi/ping.php
@@ -29,7 +29,7 @@ $feed_updated = date('Y-m-d\TH:i:s\+09:00', G5_SERVER_TIME);
 $find         = array('&amp;', '&nbsp;'); # 찾아서
 $replace      = array('&', ' '); # 바꾼다
 
-$content      = str_replace( $find, $replace, $write['wr_content'] );
+$content      = str_replace( $find, $replace, html_purifier($write['wr_content']) );
 $summary      = str_replace( $find, $replace, strip_tags($write['wr_content']) );
 
 Header("Content-type: text/xml");
diff --git a/theme/basic/head.sub.php b/theme/basic/head.sub.php
index 4488420ff..1a01570ec 100644
--- a/theme/basic/head.sub.php
+++ b/theme/basic/head.sub.php
@@ -13,6 +13,9 @@ else {
     $g5_head_title .= " | ".$config['cf_title'];
 }
 
+$g5['title'] = strip_tags($g5['title']);
+$g5_head_title = strip_tags($g5_head_title);
+
 // 현재 접속자
 // 게시판 제목에 ' 포함되면 오류 발생
 $g5['lo_location'] = addslashes($g5['title']);