From 309583b8e10be533dcb3724146356d40437022c1 Mon Sep 17 00:00:00 2001
From: Brady Miller <brady.g.miller@gmail.com>
Date: Sat, 19 Jan 2019 12:43:08 -0800
Subject: [PATCH] consolidate attr_url function (#2143)

---
 custom/export_qrda_xml.php                         |   2 +-
 interface/billing/billing_report.php               |   2 +-
 interface/billing/era_payments.php                 |   2 +-
 interface/billing/sl_eob_invoice.php               |   2 +-
 interface/billing/sl_eob_search.php                |   8 +-
 interface/cmsportal/list_requests.php              |   2 +-
 interface/drugs/add_edit_drug.php                  |   4 +-
 interface/drugs/add_edit_lot.php                   |   4 +-
 interface/drugs/destroy_lot.php                    |   2 +-
 interface/fax/fax_dispatch.php                     |   4 +-
 interface/fax/faxq.php                             |  20 ++--
 interface/forms_admin/forms_admin.php              |   8 +-
 interface/language/lang_constant.php               |   2 +-
 interface/language/lang_definition.php             |   4 +-
 interface/language/lang_language.php               |   2 +-
 interface/language/lang_manage.php                 |   2 +-
 interface/language/language.php                    |   8 +-
 interface/main/authorizations/authorizations.php   |   4 +-
 .../main/authorizations/authorizations_full.php    |   2 +-
 interface/main/dated_reminders/dated_reminders.php |   2 +-
 interface/main/finder/dynamic_finder.php           |   2 +-
 interface/main/finder/patient_select.php           |   4 +-
 interface/main/holidays/import_holidays.php        |   2 +-
 interface/main/main_info.php                       |  14 +--
 interface/main/main_screen.php                     |  12 +-
 interface/main/messages/lab_results_messages.php   |   2 +-
 interface/main/messages/messages.php               |  14 +--
 interface/main/onotes/office_comments_full.php     |   4 +-
 library/edihistory/edih_997_error.php              |   2 +-
 library/edihistory/edih_csv_data.php               | 124 ++++++++++-----------
 30 files changed, 133 insertions(+), 133 deletions(-)

diff --git a/custom/export_qrda_xml.php b/custom/export_qrda_xml.php
index 7b05d5151..d36572e68 100644
--- a/custom/export_qrda_xml.php
+++ b/custom/export_qrda_xml.php
@@ -1516,7 +1516,7 @@ fclose($fileQRDAOPen);
 <center>
 <form>
 <p class="text">
-    <a href="qrda_download.php?qrda_fname=<?php echo attr(urlencode($qrda_fname)); ?>&csrf_token_form=<?php echo attr(urlencode($_SESSION['csrf_token'])); ?>"><?php echo xlt("Download QRDA Category III File");?></a>
+    <a href="qrda_download.php?qrda_fname=<?php echo attr_url($qrda_fname); ?>&csrf_token_form=<?php echo attr_url($_SESSION['csrf_token']); ?>"><?php echo xlt("Download QRDA Category III File");?></a>
 </p>
 <textarea rows='50' cols='500' style='width:95%' readonly>
 <?php echo trim($xml->getXml()); ?>
diff --git a/interface/billing/billing_report.php b/interface/billing/billing_report.php
index 0d72a7d36..ecc828c35 100644
--- a/interface/billing/billing_report.php
+++ b/interface/billing/billing_report.php
@@ -1161,7 +1161,7 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
                                     }
 
                                     if ($crow['process_time']) {
-                                        $lhtml .= "<br>\n&nbsp;" . text(oeFormatShortDate(substr($crow['process_time'], 0, 10))) . text(substr($crow['process_time'], 10, 6)) . " " . xlt("Claim was generated to file") . " " . "<a href='get_claim_file.php?key=" . attr($crow['process_file']) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='top.restoreSession()'>" . text($crow['process_file']) . "</a>";
+                                        $lhtml .= "<br>\n&nbsp;" . text(oeFormatShortDate(substr($crow['process_time'], 0, 10))) . text(substr($crow['process_time'], 10, 6)) . " " . xlt("Claim was generated to file") . " " . "<a href='get_claim_file.php?key=" . attr_url($crow['process_file']) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='top.restoreSession()'>" . text($crow['process_file']) . "</a>";
                                         ++$lcount;
                                     }
 
diff --git a/interface/billing/era_payments.php b/interface/billing/era_payments.php
index 6fb60db09..0e10ec866 100644
--- a/interface/billing/era_payments.php
+++ b/interface/billing/era_payments.php
@@ -124,7 +124,7 @@ if ($_FILES['form_erafile']['size']) {
          var paydate = f.check_date.value;
          var post_to_date = f.post_to_date.value;
          var deposit_date = f.deposit_date.value;
-         window.open('sl_eob_process.php?eraname=<?php echo attr(urlencode($eraname)); ?>&debug=' + debug + '&paydate=' + paydate + '&post_to_date=' + post_to_date + '&deposit_date=' + deposit_date + '&original=original' + '&InsId=<?php echo attr(urlencode($hidden_type_code)); ?>' + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>' , '_blank');
+         window.open('sl_eob_process.php?eraname=' + <?php echo js_url($eraname); ?> + '&debug=' + encodeURIComponent(debug) + '&paydate=' + encodeURIComponent(paydate) + '&post_to_date=' + encodeURIComponent(post_to_date) + '&deposit_date=' + encodeURIComponent(deposit_date) + '&original=original' + '&InsId=' + <?php echo js_url($hidden_type_code); ?> + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank');
          return false;
         <?php
         }
diff --git a/interface/billing/sl_eob_invoice.php b/interface/billing/sl_eob_invoice.php
index 7582cdfa5..0eecd2a7b 100644
--- a/interface/billing/sl_eob_invoice.php
+++ b/interface/billing/sl_eob_invoice.php
@@ -444,7 +444,7 @@ $pdrow = sqlQuery("select billing_note from patient_data where pid = ? limit 1",
         </div>
     </div>
     <div class="row">
-        <form action='sl_eob_invoice.php?id=<?php echo attr(urlencode($trans_id)); ?>' method='post' onsubmit='return validate(this)'>
+        <form action='sl_eob_invoice.php?id=<?php echo attr_url($trans_id); ?>' method='post' onsubmit='return validate(this)'>
             <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>"/>
             <input type="hidden" name="isPosting" value="<?php echo attr($from_posting); ?>"/>
             <fieldset>
diff --git a/interface/billing/sl_eob_search.php b/interface/billing/sl_eob_search.php
index a0d9ed28b..33edd495c 100644
--- a/interface/billing/sl_eob_search.php
+++ b/interface/billing/sl_eob_search.php
@@ -758,9 +758,9 @@ if (($_REQUEST['form_print'] || $_REQUEST['form_download'] || $_REQUEST['form_em
                         </div>
                         <div class="col-xs-1">
                             <label class="control-label oe-large" for="only_with_debt"><?php echo xlt('Pt Debt'); ?>:</label>
-                                
+
                             <label class="control-label oe-small" for="only_with_debt"><?php echo xlt('Debt'); ?>:</label>
-                                
+
                             <div class="text-center">
                                 <input <?php echo $_REQUEST['only_with_debt'] ? 'checked=checked' : ''; ?>
                                     type="checkbox" name="only_with_debt" id="only_with_debt"/>
@@ -1104,7 +1104,7 @@ if (($_REQUEST['form_print'] || $_REQUEST['form_download'] || $_REQUEST['form_em
                                            onclick="return npopup(<?php echo attr(addslashes($row['pid'])) ?>)"><?php echo text($row['lname']) . ', ' . text($row['fname']); ?></a>
                                     </td>
                                     <td class="detail">&nbsp;
-                                        <a href="sl_eob_invoice.php?isPosting=1&id=<?php echo attr(urlencode($row['id'])); ?>"
+                                        <a href="sl_eob_invoice.php?isPosting=1&id=<?php echo attr_url($row['id']); ?>"
                                            target="_blank"><?php echo text($row['pid']) . '.' . text($row['encounter']); ?></a>
                                     </td>
                                     <td class="detail">&nbsp;<?php echo text(oeFormatShortDate($svcdate)); ?></td>
@@ -1210,7 +1210,7 @@ if (($_REQUEST['form_print'] || $_REQUEST['form_download'] || $_REQUEST['form_em
         var f = document.forms[0];
         var debug = f.form_without.checked ? '1' : '0';
         var paydate = f.form_paydate.value;
-        window.open('sl_eob_process.php?eraname=<?php echo attr(urlencode($eraname)); ?>&debug=' + debug + '&paydate=' + paydate + '&original=original' + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_blank');
+        window.open('sl_eob_process.php?eraname=' + <?php echo js_url($eraname); ?> + '&debug=' + encodeURIComponent(debug) + '&paydate=' + encodeURIComponent(paydate) + '&original=original' + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank');
         return false;
     }
 
diff --git a/interface/cmsportal/list_requests.php b/interface/cmsportal/list_requests.php
index fecd24679..d1fc0b501 100644
--- a/interface/cmsportal/list_requests.php
+++ b/interface/cmsportal/list_requests.php
@@ -152,7 +152,7 @@ function openRequest(postid, type) {
  //
  // To open results in the same frame:
  if (type.indexOf('Demographics') == 0) {
-  document.location.href = 'patient_select.php?postid=' + postid + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>';
+  document.location.href = 'patient_select.php?postid=' + postid + '&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>';
  } else
  if (type.indexOf('Insurance') == 0) {
   document.location.href = 'insurance_form.php?postid=' + postid;
diff --git a/interface/drugs/add_edit_drug.php b/interface/drugs/add_edit_drug.php
index 048771a78..b0dfae833 100644
--- a/interface/drugs/add_edit_drug.php
+++ b/interface/drugs/add_edit_drug.php
@@ -330,7 +330,7 @@ if (($_POST['form_save'] || $_POST['form_delete']) && !$alertmsg) {
 
     echo " if (opener.refreshme) opener.refreshme();\n";
     if ($new_drug) {
-        echo " window.location.href='add_edit_lot.php?drug=" . attr(urlencode($drug_id)) . "&lot=0'\n";
+        echo " window.location.href='add_edit_lot.php?drug=" . attr_url($drug_id) . "&lot=0'\n";
     } else {
         echo " window.close();\n";
     }
@@ -363,7 +363,7 @@ if ($drug_id) {
 }
 ?>
 
-<form class="form" method='post' name='theform' action='add_edit_drug.php?drug=<?php echo attr(urlencode($drug_id)); ?>'>
+<form class="form" method='post' name='theform' action='add_edit_drug.php?drug=<?php echo attr_url($drug_id); ?>'>
 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 <center>
 
diff --git a/interface/drugs/add_edit_lot.php b/interface/drugs/add_edit_lot.php
index cd499d4b7..f02cd588a 100644
--- a/interface/drugs/add_edit_lot.php
+++ b/interface/drugs/add_edit_lot.php
@@ -371,7 +371,7 @@ if ($_POST['form_save'] || $_POST['form_delete']) {
 }
 ?>
 
-<form method='post' name='theform' action='add_edit_lot.php?drug=<?php echo attr(urlencode($drug_id)); ?>&lot=<?php echo attr(urlencode($lot_id)); ?>'
+<form method='post' name='theform' action='add_edit_lot.php?drug=<?php echo attr_url($drug_id); ?>&lot=<?php echo attr_url($lot_id); ?>'
  onsubmit='return validate()'>
 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 <center>
@@ -544,7 +544,7 @@ while ($lrow = sqlFetchArray($lres)) {
 <?php if ($lot_id) { ?>
 &nbsp;
 <input type='button' value='<?php echo xla('Destroy...'); ?>'
- onclick="window.location.href='destroy_lot.php?drug=<?php echo attr(urlencode($drug_id)); ?>&lot=<?php echo attr(urlencode($lot_id)); ?>'" />
+ onclick="window.location.href='destroy_lot.php?drug=<?php echo attr_url($drug_id); ?>&lot=<?php echo attr_url($lot_id); ?>'" />
 <?php } ?>
 
 &nbsp;
diff --git a/interface/drugs/destroy_lot.php b/interface/drugs/destroy_lot.php
index ddc11f02a..7ebf41661 100644
--- a/interface/drugs/destroy_lot.php
+++ b/interface/drugs/destroy_lot.php
@@ -106,7 +106,7 @@ if ($_POST['form_save']) {
   "AND inventory_id = ?", array($drug_id,$lot_id));
 ?>
 
-<form method='post' name='theform' action='destroy_lot.php?drug=<?php echo attr(urlencode($drug_id)); ?>&lot=<?php echo attr(urlencode($lot_id)); ?>'>
+<form method='post' name='theform' action='destroy_lot.php?drug=<?php echo attr_url($drug_id); ?>&lot=<?php echo attr_url($lot_id); ?>'>
 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 
 <center>
diff --git a/interface/fax/fax_dispatch.php b/interface/fax/fax_dispatch.php
index 5385ce294..cd11724bf 100644
--- a/interface/fax/fax_dispatch.php
+++ b/interface/fax/fax_dispatch.php
@@ -517,7 +517,7 @@ div.section {
   // This loads the patient's list of recent encounters:
   f.form_copy_sn_visit.options.length = 0;
   f.form_copy_sn_visit.options[0] = new Option('Loading...', '0');
-  $.getScript("fax_dispatch_newpid.php?p=" + encodeURIComponent(pid) + "&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>");
+  $.getScript("fax_dispatch_newpid.php?p=" + encodeURIComponent(pid) + "&csrf_token_form=" + <?php echo js_url(collectCsrfToken()); ?>);
 <?php } ?>
  }
 
@@ -620,7 +620,7 @@ div.section {
 <center><h2><?php echo xlt('Dispatch Received Document'); ?></h2></center>
 
 <form method='post' name='theform'
- action='fax_dispatch.php?<?php echo ($mode == 'fax') ? 'file' : 'scan'; ?>=<?php echo attr(urlencode($filename)); ?>' onsubmit='return validate()'>
+ action='fax_dispatch.php?<?php echo ($mode == 'fax') ? 'file' : 'scan'; ?>=<?php echo attr_url($filename); ?>' onsubmit='return validate()'>
 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 
 <p><input type='checkbox' name='form_cb_copy' value='1'
diff --git a/interface/fax/faxq.php b/interface/fax/faxq.php
index d54335195..99a70eb66 100644
--- a/interface/fax/faxq.php
+++ b/interface/fax/faxq.php
@@ -146,33 +146,33 @@ function refreshme() {
 
 // Process click on filename to view.
 function dodclick(ffname) {
- cascwin('fax_view.php?file=' + encodeURIComponent(ffname) + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_blank', 600, 475,
+ cascwin('fax_view.php?file=' + encodeURIComponent(ffname) + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank', 600, 475,
   "resizable=1,scrollbars=1");
  return false;
 }
 
 // Process click on Job ID to view.
 function dojclick(jobid) {
- cascwin('fax_view.php?jid=' + encodeURIComponent(jobid) + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_blank', 600, 475,
+ cascwin('fax_view.php?jid=' + encodeURIComponent(jobid) + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank', 600, 475,
   "resizable=1,scrollbars=1");
  return false;
 }
 
 // Process scanned document filename to view.
 function dosvclick(sfname) {
- cascwin('fax_view.php?scan=' + encodeURIComponent(sfname) + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_blank', 600, 475,
+ cascwin('fax_view.php?scan=' + encodeURIComponent(sfname) + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank', 600, 475,
   "resizable=1,scrollbars=1");
  return false;
 }
 
 // Process click to pop up the fax dispatch window.
 function domclick(ffname) {
-    dlgopen('fax_dispatch.php?file=' + encodeURIComponent(ffname) + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_blank', 850, 550, '', 'Fax Dispatch');
+    dlgopen('fax_dispatch.php?file=' + encodeURIComponent(ffname) + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank', 850, 550, '', 'Fax Dispatch');
 }
 
 // Process click to pop up the scanned document dispatch window.
 function dosdclick(sfname) {
-    dlgopen('fax_dispatch.php?scan=' + encodeURIComponent(sfname) + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_blank', 850, 550, '', 'Scanned Dispatch');
+    dlgopen('fax_dispatch.php?scan=' + encodeURIComponent(sfname) + '&csrf_token_form=' + <?php echo js_url(collectCsrfToken()); ?>, '_blank', 850, 550, '', 'Scanned Dispatch');
 }
 
 </script>
@@ -230,9 +230,9 @@ foreach ($mlines as $matches) {
     $bgcolor = "#" . (($encount & 1) ? "ddddff" : "ffdddd");
     echo "    <tr class='detail' bgcolor='" . attr($bgcolor) . "'>\n";
     echo "     <td onclick='dodclick(\"" . attr(addslashes($ffname)) . "\")'>";
-    echo "<a href='fax_view.php?file=" . attr(urlencode($ffname)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='return false'>" . text($ffbase) . "</a></td>\n";
+    echo "<a href='fax_view.php?file=" . attr_url($ffname) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='return false'>" . text($ffbase) . "</a></td>\n";
     echo "     <td onclick='domclick(\"" . attr(addslashes($ffname)) . "\")'>";
-    echo "<a href='fax_dispatch.php?file=" . attr(urlencode($ffname)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='return false'>" . xlt('Dispatch') . "</a></td>\n";
+    echo "<a href='fax_dispatch.php?file=" . attr_url($ffname) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='return false'>" . xlt('Dispatch') . "</a></td>\n";
     echo "     <td>" . text($matches[3]) . "</td>\n";
     echo "     <td>" . text($matches[2]) . "</td>\n";
     echo "     <td align='right'>" . text($matches[1]) . "</td>\n";
@@ -271,7 +271,7 @@ foreach ($dlines as $matches) {
     $bgcolor = "#" . (($encount & 1) ? "ddddff" : "ffdddd");
     echo "    <tr class='detail' bgcolor='" . attr($bgcolor) . "'>\n";
     echo "     <td onclick='dojclick(\"" . attr(addslashes($jobid)) . "\")'>" .
-     "<a href='fax_view.php?jid=" . attr(urlencode($jobid)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='return false'>" .
+     "<a href='fax_view.php?jid=" . attr_url($jobid) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='return false'>" .
      "$jobid</a></td>\n";
     echo "     <td>" . text($matches[5]) . "</td>\n";
     echo "     <td>" . text($matches[6]) . "</td>\n";
@@ -301,10 +301,10 @@ foreach ($slines as $sline) {
     $sfdate = date('Y-m-d H:i', $sline[9]);
     echo "    <tr class='detail' bgcolor='" . attr($bgcolor) . "'>\n";
     echo "     <td onclick='dosvclick(\"" . attr(addslashes($sfname)) . "\")'>" .
-     "<a href='fax_view.php?scan=" . attr(urlencode($sfname)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='return false'>" .
+     "<a href='fax_view.php?scan=" . attr_url($sfname) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='return false'>" .
      "$sfname</a></td>\n";
     echo "     <td onclick='dosdclick(\"" . attr(addslashes($sfname)) . "\")'>";
-    echo "<a href='fax_dispatch.php?scan=" . attr(urlencode($sfname)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='return false'>" . xlt('Dispatch') . "</a></td>\n";
+    echo "<a href='fax_dispatch.php?scan=" . attr_url($sfname) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='return false'>" . xlt('Dispatch') . "</a></td>\n";
     echo "     <td>". text($sfdate) . "</td>\n";
     echo "     <td align='right'>" . text($sline[7]) . "</td>\n";
     echo "    </tr>\n";
diff --git a/interface/forms_admin/forms_admin.php b/interface/forms_admin/forms_admin.php
index 1fa56349d..9face4907 100644
--- a/interface/forms_admin/forms_admin.php
+++ b/interface/forms_admin/forms_admin.php
@@ -116,9 +116,9 @@ if ($bigdata != false) {
     if ($registry['sql_run'] == 0) {
         echo "<td bgcolor='" . attr($color) . "' width='10%'><span class='text'>" . xlt('registered') . "</span>";
     } elseif ($registry['state'] == "0") {
-        echo "<td bgcolor='#FFCCCC' width='10%'><a class='link_submit' href='./forms_admin.php?id=" . attr(urlencode($registry['id'])) . "&method=enable&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . xlt('disabled') . "</a>";
+        echo "<td bgcolor='#FFCCCC' width='10%'><a class='link_submit' href='./forms_admin.php?id=" . attr_url($registry['id']) . "&method=enable&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . xlt('disabled') . "</a>";
     } else {
-        echo "<td bgcolor='#CCFFCC' width='10%'><a class='link_submit' href='./forms_admin.php?id=" . attr(urlencode($registry['id'])) . "&method=disable&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . xlt('enabled') . "</a>";
+        echo "<td bgcolor='#CCFFCC' width='10%'><a class='link_submit' href='./forms_admin.php?id=" . attr_url($registry['id']) . "&method=disable&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . xlt('enabled') . "</a>";
     }
         ?></td>
         <td bgcolor="<?php echo attr($color); ?>" width="10%">
@@ -135,7 +135,7 @@ if ($bigdata != false) {
         if ($registry['sql_run']) {
             echo "<span class='text'>" . xlt('DB installed') . "</span>";
         } else {
-            echo "<a class='link_submit' href='./forms_admin.php?id=" . attr(urlencode($registry['id'])) . "&method=install_db&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . xlt('install DB') . "</a>";
+            echo "<a class='link_submit' href='./forms_admin.php?id=" . attr_url($registry['id']) . "&method=install_db&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . xlt('install DB') . "</a>";
         }
         ?>
         </td>
@@ -211,7 +211,7 @@ foreach ($inDir as $fname) {
         </td>
         <td bgcolor="<?php echo $color?>" width="10%"><?php
         if ($phpState == "PHP extracted") {
-            echo '<a class=link_submit href="./forms_admin.php?name=' . attr(urlencode($fname)) . '&method=register&csrf_token_form=' . attr(urlencode(collectCsrfToken())) . '">' . xlt('register') . '</a>';
+            echo '<a class=link_submit href="./forms_admin.php?name=' . attr_url($fname) . '&method=register&csrf_token_form=' . attr_url(collectCsrfToken()) . '">' . xlt('register') . '</a>';
         } else {
             echo '<span class=text>' . xlt('n/a') . '</span>';
         }
diff --git a/interface/language/lang_constant.php b/interface/language/lang_constant.php
index 072833860..da4232f4e 100644
--- a/interface/language/lang_constant.php
+++ b/interface/language/lang_constant.php
@@ -68,7 +68,7 @@ if ($_POST['add']) {
 ?>
 
 <TABLE>
-<FORM name="cons_form" METHOD=POST ACTION="?m=constant&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onsubmit="return top.restoreSession()">
+<FORM name="cons_form" METHOD=POST ACTION="?m=constant&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onsubmit="return top.restoreSession()">
 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 <TR>
     <TD><?php echo xlt('constant name'); ?></TD>
diff --git a/interface/language/lang_definition.php b/interface/language/lang_definition.php
index 862072a0e..75f909e3e 100644
--- a/interface/language/lang_definition.php
+++ b/interface/language/lang_definition.php
@@ -37,7 +37,7 @@ if (!$thisauth) {
 ?>
 
   <table>
-    <form name='filterform' id='filterform' method='post' action='?m=definition&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>' onsubmit="return top.restoreSession()">
+    <form name='filterform' id='filterform' method='post' action='?m=definition&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>' onsubmit="return top.restoreSession()">
     <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 
     <tr>
@@ -204,7 +204,7 @@ if ($_POST['edit']) {
     $res = SqlStatement($sql, $bind_sql_array);
 
         $isResults = false; //flag to record whether there are any results
-    echo ('<table><FORM METHOD=POST ACTION="?m=definition&csrf_token_form=' . attr(urlencode(collectCsrfToken())) . '" onsubmit="return top.restoreSession()">');
+    echo ('<table><FORM METHOD=POST ACTION="?m=definition&csrf_token_form=' . attr_url(collectCsrfToken()) . '" onsubmit="return top.restoreSession()">');
     echo ('<input type="hidden" name="csrf_token_form" value="' . attr(collectCsrfToken()) . '" />');
     // only english definitions
     if ($lang_id==1) {
diff --git a/interface/language/lang_language.php b/interface/language/lang_language.php
index 9a79b3d38..128e0b1fd 100644
--- a/interface/language/lang_language.php
+++ b/interface/language/lang_language.php
@@ -64,7 +64,7 @@ if ($_POST['add']) {
 ?>
 
 <TABLE>
-<FORM name="lang_form" METHOD=POST ACTION="?m=language&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onsubmit="return top.restoreSession()">
+<FORM name="lang_form" METHOD=POST ACTION="?m=language&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onsubmit="return top.restoreSession()">
 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 <TR>
     <TD><?php  echo xlt('Language Code'); ?>:</TD>
diff --git a/interface/language/lang_manage.php b/interface/language/lang_manage.php
index 0cd92718a..0531dccfc 100644
--- a/interface/language/lang_manage.php
+++ b/interface/language/lang_manage.php
@@ -193,7 +193,7 @@ if ($_POST['check'] || $_POST['synchronize']) {
 ?>
 
 <TABLE>
-<FORM name="manage_form" METHOD=POST ACTION="?m=manage&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onsubmit="return top.restoreSession()">
+<FORM name="manage_form" METHOD=POST ACTION="?m=manage&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onsubmit="return top.restoreSession()">
     <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
   <TR>
     <TD><INPUT TYPE="submit" name="check" value="<?php echo xla('Check'); ?>"></TD>
diff --git a/interface/language/language.php b/interface/language/language.php
index 3df394244..83c8bfc62 100644
--- a/interface/language/language.php
+++ b/interface/language/language.php
@@ -34,10 +34,10 @@ require_once("language.inc.php");
 <table>
  <tr>
   <td class="small" colspan='4'>
-   <a href="?m=definition&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onclick="top.restoreSession()"><?php echo xlt('Edit Definitions'); ?></a> |
-   <a href="?m=language&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onclick="top.restoreSession()"><?php echo xlt('Add Language'); ?></a> |
-   <a href="?m=constant&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onclick="top.restoreSession()"><?php echo xlt('Add Constant'); ?></a> |
-   <a href="?m=manage&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>" onclick="top.restoreSession()"><?php echo xlt('Manage Translations'); ?></a>
+   <a href="?m=definition&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onclick="top.restoreSession()"><?php echo xlt('Edit Definitions'); ?></a> |
+   <a href="?m=language&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onclick="top.restoreSession()"><?php echo xlt('Add Language'); ?></a> |
+   <a href="?m=constant&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onclick="top.restoreSession()"><?php echo xlt('Add Constant'); ?></a> |
+   <a href="?m=manage&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>" onclick="top.restoreSession()"><?php echo xlt('Manage Translations'); ?></a>
   </td>
  </tr>
 </table>
diff --git a/interface/main/authorizations/authorizations.php b/interface/main/authorizations/authorizations.php
index 79537d871..0ebca74ce 100644
--- a/interface/main/authorizations/authorizations.php
+++ b/interface/main/authorizations/authorizations.php
@@ -189,12 +189,12 @@ if ($authorize) {
         // Clicking the patient name will load both frames for that patient,
         // as demographics.php takes care of loading the bottom frame.
         echo "<a href='$rootdir/patient_file/summary/demographics.php?set_pid=" .
-            attr(urlencode($ppid)) . "' target='RTop' onclick='top.restoreSession()'>";
+            attr_url($ppid) . "' target='RTop' onclick='top.restoreSession()'>";
 
         echo "<span class='bold'>" . text($name{"fname"}) . " " .
         text($name{"lname"}) . "</span></a><br>" .
         "<a class=link_submit href='authorizations.php?mode=authorize" .
-        "&pid=" . attr(urlencode($ppid)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='top.restoreSession()'>" .
+        "&pid=" . attr_url($ppid) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='top.restoreSession()'>" .
         xlt('Authorize') . "</a></td>\n";
 
         /****
diff --git a/interface/main/authorizations/authorizations_full.php b/interface/main/authorizations/authorizations_full.php
index b30a720cf..0a0b77993 100644
--- a/interface/main/authorizations/authorizations_full.php
+++ b/interface/main/authorizations/authorizations_full.php
@@ -121,7 +121,7 @@ if ($authorize) {
 
         echo "<tr><td valign=top><span class=bold>". text($name{"fname"} . " " . $name{"lname"}) .
              "</span><br><a class=link_submit href='authorizations_full.php?mode=authorize&pid=" .
-             attr(urlencode($ppid)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='top.restoreSession()'>" . xlt('Authorize') . "</a></td>\n";
+             attr_url($ppid) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "' onclick='top.restoreSession()'>" . xlt('Authorize') . "</a></td>\n";
         echo "<td valign=top><span class=bold>".xlt('Billing').
              ":</span><span class=text><br>" . $patient{"billing"} . "</td>\n";
         echo "<td valign=top><span class=bold>".xlt('Transactions').
diff --git a/interface/main/dated_reminders/dated_reminders.php b/interface/main/dated_reminders/dated_reminders.php
index 31bbbb029..78e8dd705 100644
--- a/interface/main/dated_reminders/dated_reminders.php
+++ b/interface/main/dated_reminders/dated_reminders.php
@@ -104,7 +104,7 @@ if (isset($_POST['drR'])) {
                dlgopen('<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders_add.php', '_drAdd', 700, 500);
              }else{
                top.restoreSession();
-               dlgopen('<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders_add.php?mID='+encodeURIComponent(id)+'&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_drAdd', 700, 500);
+               dlgopen('<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders_add.php?mID='+encodeURIComponent(id)+'&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>', '_drAdd', 700, 500);
              }
            }
 
diff --git a/interface/main/finder/dynamic_finder.php b/interface/main/finder/dynamic_finder.php
index cd4e2629f..ff1d9611f 100644
--- a/interface/main/finder/dynamic_finder.php
+++ b/interface/main/finder/dynamic_finder.php
@@ -194,7 +194,7 @@ while ($row = sqlFetchArray($res)) {
         <div class="row">
             <div class="col-sm-12">
                 <!-- form used to open a new top level window when a patient row is clicked -->
-                <form name='fnew' method='post' target='_blank' action='../main_screen.php?auth=login&site=<?php echo attr(urlencode($_SESSION['site_id'])); ?>'>
+                <form name='fnew' method='post' target='_blank' action='../main_screen.php?auth=login&site=<?php echo attr_url($_SESSION['site_id']); ?>'>
                     <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
                     <input type='hidden' name='patientID' value='0'/>
                 </form>
diff --git a/interface/main/finder/patient_select.php b/interface/main/finder/patient_select.php
index 497f90a93..d7353e10f 100644
--- a/interface/main/finder/patient_select.php
+++ b/interface/main/finder/patient_select.php
@@ -269,7 +269,7 @@ if ($popup) {
  <tr>
   <td class='text'>
     <?php if ($from_page == "cdr_report") { ?>
-   <a href='../../reports/cqm.php?report_id=<?php echo attr(urlencode($report_id)); ?>' class='css_button' onclick='top.restoreSession()'><span><?php echo xlt("Return To Report Results"); ?></span></a>
+   <a href='../../reports/cqm.php?report_id=<?php echo attr_url($report_id); ?>' class='css_button' onclick='top.restoreSession()'><span><?php echo xlt("Return To Report Results"); ?></span></a>
     <?php } else { ?>
    <a href="./patient_select_help.php" target=_new onclick='top.restoreSession()'>[<?php echo xlt('Help'); ?>]&nbsp</a>
     <?php } ?>
@@ -281,7 +281,7 @@ if ($popup) {
   </td>
   <td>
     <?php if ($from_page == "cdr_report") { ?>
-    <?php echo "<a href='patient_select.php?from_page=cdr_report&pass_id=" . attr(urlencode($pass_id)) . "&report_id=" . attr(urlencode($report_id)) . "&itemized_test_id=" . attr(urlencode($itemized_test_id)) . "&numerator_label=" . attr(urlencode($row['numerator_label'])) . "&print_patients=1&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' class='css_button' onclick='top.restoreSession()'><span>" . xlt("Print Entire Listing") . "</span></a>"; ?>
+    <?php echo "<a href='patient_select.php?from_page=cdr_report&pass_id=" . attr_url($pass_id) . "&report_id=" . attr_url($report_id) . "&itemized_test_id=" . attr_url($itemized_test_id) . "&numerator_label=" . attr_url($row['numerator_label']) . "&print_patients=1&csrf_token_form=" . attr_url(collectCsrfToken()) . "' class='css_button' onclick='top.restoreSession()'><span>" . xlt("Print Entire Listing") . "</span></a>"; ?>
     <?php } ?> &nbsp;
   </td>
   <td class='text' align='right'>
diff --git a/interface/main/holidays/import_holidays.php b/interface/main/holidays/import_holidays.php
index 0cbb889ea..6a8080b31 100644
--- a/interface/main/holidays/import_holidays.php
+++ b/interface/main/holidays/import_holidays.php
@@ -138,7 +138,7 @@ if ($saved) {
                         <?php $filename=$path[count($path)-1];?>
                         <?php unset($path[count($path)-1]);?>
 
-                        <a href="#" onclick='window.open("import_holidays.php?download_file=1&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>")'><?php echo text($csv_file_data['date']);?></a>
+                        <a href="#" onclick='window.open("import_holidays.php?download_file=1&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>")'><?php echo text($csv_file_data['date']);?></a>
                     <?php
                     } else {
                         echo xlt('File not found');
diff --git a/interface/main/main_info.php b/interface/main/main_info.php
index 274f82ad3..dac844194 100644
--- a/interface/main/main_info.php
+++ b/interface/main/main_info.php
@@ -49,34 +49,34 @@ if (isset($_SESSION['viewtype'])) {
 }
 
 // this allows us to keep our selected providers between screens -- JRM
-$pcuStr = "pc_username=" . attr(urlencode($_SESSION['authUser']));
+$pcuStr = "pc_username=" . attr_url($_SESSION['authUser']);
 if (isset($_SESSION['pc_username'])) {
     $pcuStr = "";
     if (!empty($_SESSION['pc_username']) && is_array($_SESSION['pc_username']) && count($_SESSION['pc_username']) > 1) {
         // loop over the array of values in pc_username to build
         // a list of pc_username HTTP vars
         foreach ($_SESSION['pc_username'] as $pcu) {
-            $pcuStr .= "&pc_username[]=" . attr(urlencode($pcu));
+            $pcuStr .= "&pc_username[]=" . attr_url($pcu);
         }
     } else {
         // two possibilities here
         // 1) pc_username is an array with a single element
         // 2) pc_username is just a string, not an array
         if (is_string($_SESSION['pc_username'])) {
-            $pcuStr .= "&pc_username[]=" . attr(urlencode($_SESSION['pc_username']));
+            $pcuStr .= "&pc_username[]=" . attr_url($_SESSION['pc_username']);
         } else {
-            $pcuStr .= "&pc_username[]=" . attr(urlencode($_SESSION['pc_username'][0]));
+            $pcuStr .= "&pc_username[]=" . attr_url($_SESSION['pc_username'][0]);
         }
     }
 }
 
 // different frame source page depending on session vars
 if ($_SESSION['userauthorized'] && $GLOBALS['docs_see_entire_calendar']) {
-    $framesrc = "calendar/index.php?module=PostCalendar&viewtype=" . attr(urlencode($viewtype)) . "&func=view";
+    $framesrc = "calendar/index.php?module=PostCalendar&viewtype=" . attr_url($viewtype) . "&func=view";
 } else if ($_SESSION['userauthorized']) {
-    $framesrc = "calendar/index.php?module=PostCalendar&viewtype=" . attr(urlencode($viewtype)) . "&func=view&" . $pcuStr;
+    $framesrc = "calendar/index.php?module=PostCalendar&viewtype=" . attr_url($viewtype) . "&func=view&" . $pcuStr;
 } else {
-    $framesrc = "calendar/index.php?module=PostCalendar&func=view&viewtype=" . attr(urlencode($viewtype));
+    $framesrc = "calendar/index.php?module=PostCalendar&func=view&viewtype=" . attr_url($viewtype);
 }
 ?>
 
diff --git a/interface/main/main_screen.php b/interface/main/main_screen.php
index 733b40f59..8f3542a0a 100644
--- a/interface/main/main_screen.php
+++ b/interface/main/main_screen.php
@@ -68,7 +68,7 @@ function doAuth() {
 <center>
 <h2><?php echo text($title); ?></h2>
 <form method="post"
- action="main_screen.php?auth=login&site=<?php echo attr(urlencode($_GET['site'])); ?>"
+ action="main_screen.php?auth=login&site=<?php echo attr_url($_GET['site']); ?>"
  target="_top" name="challenge_form">
     <?php
     posted_to_hidden('new_login_session_management');
@@ -236,24 +236,24 @@ if ($GLOBALS['password_expiration_days'] != 0) {
 
 if ($is_expired) {
   //display the php file containing the password expiration message.
-    $frame1url = "pwd_expires_alert.php?csrf_token_form=" . attr(urlencode(collectCsrfToken()));
+    $frame1url = "pwd_expires_alert.php?csrf_token_form=" . attr_url(collectCsrfToken());
     $frame1target = "adm";
 } else if (!empty($_POST['patientID'])) {
     $patientID = 0 + $_POST['patientID'];
     if (empty($_POST['encounterID'])) {
         // Open patient summary screen (without a specific encounter)
-        $frame1url = "../patient_file/summary/demographics.php?set_pid=" . attr(urlencode($patientID));
+        $frame1url = "../patient_file/summary/demographics.php?set_pid=" . attr_url($patientID);
         $frame1target = "pat";
     } else {
         // Open patient summary screen with a specific encounter
         $encounterID = 0 + $_POST['encounterID'];
-        $frame1url = "../patient_file/summary/demographics.php?set_pid=" . attr(urlencode($patientID)) . "&set_encounterid=" . attr(urlencode($encounterID));
+        $frame1url = "../patient_file/summary/demographics.php?set_pid=" . attr_url($patientID) . "&set_encounterid=" . attr_url($encounterID);
         $frame1target = "pat";
     }
 } else if (isset($_GET['mode']) && $_GET['mode'] == "loadcalendar") {
-    $frame1url = "calendar/index.php?pid=" . attr(urlencode($_GET['pid']));
+    $frame1url = "calendar/index.php?pid=" . attr_url($_GET['pid']);
     if (isset($_GET['date'])) {
-        $frame1url .= "&date=" . attr(urlencode($_GET['date']));
+        $frame1url .= "&date=" . attr_url($_GET['date']);
     }
 
     $frame1target = "cal";
diff --git a/interface/main/messages/lab_results_messages.php b/interface/main/messages/lab_results_messages.php
index fa515dfc6..95e771e34 100644
--- a/interface/main/messages/lab_results_messages.php
+++ b/interface/main/messages/lab_results_messages.php
@@ -48,7 +48,7 @@ function lab_results_messages($set_pid, $rid, $provider_id = "")
             if ($thisauth) {
                 // Send lab result message to the ordering provider when there is a new lab report.
                 $pname = getPatientName($set_pid);
-                $link = "<a href='../../orders/orders_results.php?review=1&set_pid=" . attr(urlencode($set_pid)) . "'" .
+                $link = "<a href='../../orders/orders_results.php?review=1&set_pid=" . attr_url($set_pid) . "'" .
                 " onclick='return top.restoreSession()'>here</a>";
                 $note = "Patient $pname's lab results have arrived. Please click $link to review them.<br/>";
                 $note_type = "Lab Results";
diff --git a/interface/main/messages/messages.php b/interface/main/messages/messages.php
index 2ccf4b840..c8d989ff7 100644
--- a/interface/main/messages/messages.php
+++ b/interface/main/messages/messages.php
@@ -378,7 +378,7 @@ if (!empty($_REQUEST['go'])) { ?>
                         // Display the Messages page layout.
                         echo "<form name='form_patient' id='new_note'
                                 class='form-horizontal' 
-                                action=\"messages.php?showall=" . attr(urlencode($showall)) . "&sortby=" . attr(urlencode($sortby)) . "&sortorder=" . attr(urlencode($sortorder)) . "&begin=" . attr(urlencode($begin)) . "&$activity_string_html\" 
+                                action=\"messages.php?showall=" . attr_url($showall) . "&sortby=" . attr_url($sortby) . "&sortorder=" . attr_url($sortorder) . "&begin=" . attr_url($begin) . "&$activity_string_html\" 
                                 method='post'>
                                 <input type=hidden name=noteid id=noteid value='" . attr($noteid) . "'>
                                 <input type=hidden name=task id=task value=add>";
@@ -544,7 +544,7 @@ if (!empty($_REQUEST['go'])) { ?>
                                             while ($gprow = sqlFetchArray($tmp)) {
                                                 echo "   <a href='";
                                                 echo $GLOBALS['webroot'] . "/interface/orders/single_order_results.php?orderid=";
-                                                echo attr(urlencode($gprow['id1']));
+                                                echo attr_url($gprow['id1']);
                                                 echo "' target='_blank' onclick='top.restoreSession()'>";
                                                 echo text($gprow['id1']);
                                                 echo "</a>\n";
@@ -697,8 +697,8 @@ if (!empty($_REQUEST['go'])) { ?>
                                         text($name) . "</td><td width=5></td></tr>
                                         </table></td>
                                     <td style=\"border-bottom: 1px #000000 solid; border-right: 1px #000000 solid;\">
-                                        <table cellspacing=0 cellpadding=0 width=100%><tr><td width=5></td><td class=\"text\"><a href=\"messages.php?showall=" . attr(urlencode($showall)) . "&sortby=" . attr(urlencode($sortby)) . "&sortorder=" . attr(urlencode($sortorder)) . "&begin=" . attr(urlencode($begin)) . "&task=edit&noteid=" .
-                                        attr(urlencode($myrow['id'])) . "&$activity_string_html\" onclick=\"top.restoreSession()\">" .
+                                        <table cellspacing=0 cellpadding=0 width=100%><tr><td width=5></td><td class=\"text\"><a href=\"messages.php?showall=" . attr_url($showall) . "&sortby=" . attr_url($sortby) . "&sortorder=" . attr_url($sortorder) . "&begin=" . attr_url($begin) . "&task=edit&noteid=" .
+                                        attr_url($myrow['id']) . "&$activity_string_html\" onclick=\"top.restoreSession()\">" .
                                         text($patient) . "</a></td><td width=5></td></tr>
                                         </table></td>
                                     <td style=\"border-bottom: 1px #000000 solid; border-right: 1px #000000 solid;\">
@@ -723,7 +723,7 @@ if (!empty($_REQUEST['go'])) { ?>
                                         </form>
                                         <div class='row oe-margin-t-10'>
                                             
-                                            <div class=\"col-xs-12 col-md-12 col-lg-12\"><a href=\"messages.php?showall=" . attr(urlencode($showall)) . "&sortby=" . attr(urlencode($sortby)) . "&sortorder=" . attr(urlencode($sortorder)) . "&begin=" . attr(urlencode($begin)) . "&task=addnew&$activity_string_html\" class=\"btn btn-default btn-add\" onclick=\"top.restoreSession()\">" .
+                                            <div class=\"col-xs-12 col-md-12 col-lg-12\"><a href=\"messages.php?showall=" . attr_url($showall) . "&sortby=" . attr_url($sortby) . "&sortorder=" . attr_url($sortorder) . "&begin=" . attr_url($begin) . "&task=addnew&$activity_string_html\" class=\"btn btn-default btn-add\" onclick=\"top.restoreSession()\">" .
                                             xlt('Add New') . "</a> &nbsp; <a href=\"javascript:confirmDeleteSelected()\" class=\"btn btn-default btn-delete\" onclick=\"top.restoreSession()\">" .
                                             xlt('Delete') . "</a>
                                             <div  class=\"text-right\">$prevlink &nbsp; " . text($end) . " " . xlt('of') . " " . text($total) . " &nbsp; $nextlink</div>
@@ -992,7 +992,7 @@ if (!empty($_REQUEST['go'])) { ?>
         };
         var PrintNote = function () {
             top.restoreSession();
-            window.open('../../patient_file/summary/pnotes_print.php?noteid=<?php echo attr(urlencode($noteid)); ?>', '_blank', 'resizable=1,scrollbars=1,width=600,height=500');
+            window.open('../../patient_file/summary/pnotes_print.php?noteid=' + <?php echo js_url($noteid); ?>, '_blank', 'resizable=1,scrollbars=1,width=600,height=500');
         };
 
         var SaveNote = function () {
@@ -1096,7 +1096,7 @@ if (!empty($_REQUEST['go'])) { ?>
             var url = '../../main/finder/multi_patients_finder.php'
             // for edit selected list
             if ($('#reply_to').val() !== '') {
-                url = url + '?patients=' + $('#reply_to').val() + '&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>';
+                url = url + '?patients=' + $('#reply_to').val() + '&csrf_token_form=<?php echo attr_url(collectCsrfToken()); ?>';
             }
             dlgopen(url, '_blank', 625, 400);
         }
diff --git a/interface/main/onotes/office_comments_full.php b/interface/main/onotes/office_comments_full.php
index 191a520a2..f45175e6d 100644
--- a/interface/main/onotes/office_comments_full.php
+++ b/interface/main/onotes/office_comments_full.php
@@ -156,13 +156,13 @@ if ($notes) {
 <tr><td>
 <?php
 if ($offset>($N-1)) {
-    echo "<a class='css_button' href=office_comments_full.php?active=".attr(urlencode($active))."&offset=".attr(urlencode($offset-$N))." onclick='top.restoreSession()'>".xlt('Previous')."</a>";
+    echo "<a class='css_button' href=office_comments_full.php?active=".attr_url($active)."&offset=".attr_url($offset-$N)." onclick='top.restoreSession()'>".xlt('Previous')."</a>";
 }
 ?>
 </td><td align=right>
 <?php
 if ($result_count == $N) {
-    echo "<a class='css_button' href=office_comments_full.php?active=".attr(urlencode($active))."&offset=".attr(urlencode($offset+$N))." onclick='top.restoreSession()'>".xlt('Next')."</a>";
+    echo "<a class='css_button' href=office_comments_full.php?active=".attr_url($active)."&offset=".attr_url($offset+$N)." onclick='top.restoreSession()'>".xlt('Next')."</a>";
 }
 ?>
 </td></tr>
diff --git a/library/edihistory/edih_997_error.php b/library/edihistory/edih_997_error.php
index b6b9296d8..1c05aec0b 100644
--- a/library/edihistory/edih_997_error.php
+++ b/library/edihistory/edih_997_error.php
@@ -287,7 +287,7 @@ function edih_997_err_report($err_array)
                 $clm01 = ($rtp == 'f837') ? $trn_ar[0][2] : $trn_ar[0][4]; // $trn_ar['CLM01'] : $trn_ar['BHT03'];
                 $svcdate = $trn_ar[0][1]; // ($rtp == 'f270') ? $trn_ar['ReqDate'] : $trn_ar['SvcDate'];
                 $btfn = $trn_ar[0][5]; // $trn_ar['FileName'];
-                $str_html .= text($pt_name) . " " . text($svcdate) . " <em>Trace</em> <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($btfn)) . "&ftype=" . attr(urlencode($rtp)) . "&pid=" . attr(urlencode($clm01)) . "&fmt=seg&csrf_token_form=" .attr(urlencode(collectCsrfToken())) . "'>" . text($clm01) . "</a> <br />".PHP_EOL;
+                $str_html .= text($pt_name) . " " . text($svcdate) . " <em>Trace</em> <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr_url($btfn) . "&ftype=" . attr_url($rtp) . "&pid=" . attr_url($clm01) . "&fmt=seg&csrf_token_form=" .attr_url(collectCsrfToken()) . "'>" . text($clm01) . "</a> <br />".PHP_EOL;
             } else {
                 $str_html .= "Unable to locate transaction  <em>Trace</em> " . text($trc) . " <br />".PHP_EOL;
             }
diff --git a/library/edihistory/edih_csv_data.php b/library/edihistory/edih_csv_data.php
index 566d3d823..c3caa0330 100644
--- a/library/edihistory/edih_csv_data.php
+++ b/library/edihistory/edih_csv_data.php
@@ -77,19 +77,19 @@ function edih_csv_process_html($data_ar, $err_only = false)
                 $typ = (isset($csvfile['RspType'])) ? $csvfile['RspType'] : '';
                 $rej = (isset($csvfile['RejCt'])) ? $csvfile['RejCt'] : '';
                 //
-                $dt_str .= ($fn1) ? "<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($fn1) . "</a>&nbsp;" : "";
+                $dt_str .= ($fn1) ? "<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($fn1) . "</a>&nbsp;" : "";
                 $dt_str .= ($dte) ? " &nbsp;" . text(substr($dte, 0, 4)) . "-" . text(substr($dte, 4, 2)) . "-" . text(substr($dte, 6, 2)) : "";
                 $dt_str .= ($clmct) ? " &nbsp;<em>Claims</em> " . text($clmct) : "";
                 if ($ft == 'f997' || $ft == 'ta1') {
                     $dt_str .= ($typ) ? " &nbsp;" . text($typ) : "";
                     $dt_str .= ($rej) ? " &nbsp;" . text($rej) : "";
-                    $dt_str .= ($trc) ? "&nbsp; <a class='" . attr($cls) . "' title='" . attr($trc) . "' href='edih_main.php?gtbl=file&trace=" . attr(urlencode($trc)) . "&ftype=" . attr(urlencode($ft)) . "&rsptype=" . attr(urlencode($typ)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'><em>trace</em></a>&nbsp;" : "";
+                    $dt_str .= ($trc) ? "&nbsp; <a class='" . attr($cls) . "' title='" . attr($trc) . "' href='edih_main.php?gtbl=file&trace=" . attr_url($trc) . "&ftype=" . attr_url($ft) . "&rsptype=" . attr_url($typ) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'><em>trace</em></a>&nbsp;" : "";
                 } elseif ($ft == 'f277') {
                     $dt_str .= (isset($csvfile['Accept'])) ? " &nbsp;<em>Accpt</em> " . text($csvfile['Accept']) : "";
                     $dt_str .= (isset($csvfile['Reject'])) ? " &nbsp;<em>Rej</em> " . text($csvfile['Reject']) : "";
                 } elseif ($ft == 'f835') {
                     $dt_str .= (isset($csvfile['Denied'])) ? " &nbsp;<em>Denied</em> " . text($csvfile['Denied']) : "";
-                    $dt_str .= ($trc) ? " &nbsp;<em>Chk</em> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn1)) . "&trace=" . attr(urlencode($trc)) . "&ftype=" . attr(urlencode($ft)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($trc) . "</a>&nbsp;" : "";
+                    $dt_str .= ($trc) ? " &nbsp;<em>Chk</em> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn1) . "&trace=" . attr_url($trc) . "&ftype=" . attr_url($ft) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($trc) . "</a>&nbsp;" : "";
                     $dt_str .= (isset($csvfile['Payer'])) ? " &nbsp;" . text($csvfile['Payer']) : "";
                 }
 
@@ -157,21 +157,21 @@ function edih_csv_process_html($data_ar, $err_only = false)
                     $dd_str .= ($sts) ? " &nbsp;" . text($sts) : "";
                     $dd_str .= ($ins) ? " &nbsp;" . text($ins) : "";
                     $dd_str .= ($clm) ? " &nbsp;" . text($clm) : "";
-                    $dd_str .= ($bht03) ? " &nbsp;<em>view</em> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&bht03=" . attr(urlencode($bht03)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp; <a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&bht03=" . attr(urlencode($bht03)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a>&nbsp;" : "";
-                    $dd_str .= ($pid) ? " &nbsp;<em>trace</em> <a class='sub' href='edih_main.php?gtbl=claim&ftype=" . attr(urlencode($ft)) . "&rsptype=f837&trace=" . attr(urlencode($pid)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($pid) . "</a>" : "";
-                    $dd_str .= ($auth && $auth == 'Rsp' || $auth == 'Reply') ?  "<a class='sub' href='edih_main.php?gtbl=claim&ftype=" . attr(urlencode($ft)) . "&rsptype=f278&trace=" . attr(urlencode($trc)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'><em>trace</em></a>" : "";
+                    $dd_str .= ($bht03) ? " &nbsp;<em>view</em> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&bht03=" . attr_url($bht03) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp; <a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&bht03=" . attr_url($bht03) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a>&nbsp;" : "";
+                    $dd_str .= ($pid) ? " &nbsp;<em>trace</em> <a class='sub' href='edih_main.php?gtbl=claim&ftype=" . attr_url($ft) . "&rsptype=f837&trace=" . attr_url($pid) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($pid) . "</a>" : "";
+                    $dd_str .= ($auth && $auth == 'Rsp' || $auth == 'Reply') ?  "<a class='sub' href='edih_main.php?gtbl=claim&ftype=" . attr_url($ft) . "&rsptype=f278&trace=" . attr_url($trc) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'><em>trace</em></a>" : "";
                 } elseif ($ft == 'f835') {
                     $dd_str .= ($clm) ? " &nbsp;<em>Claim ID</em> $ins" : "";
                     $dd_str .= ($ins) ? " &nbsp;<em>InsLevel</em> $ins" : "";
-                    $dd_str .= ($pid) ? " &nbsp;$pid <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&pid=" . attr(urlencode($pid)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&pid=" . attr(urlencode($pid)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a>" : "";
+                    $dd_str .= ($pid) ? " &nbsp;$pid <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&pid=" . attr_url($pid) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&pid=" . attr_url($pid) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a>" : "";
                 } elseif ($ft == 'f997') {
-                    $dd_str .= ($trc) ? " &nbsp;<a class='" . attr($cls) . "' title='" . attr($trc) . "' href='edih_main.php?gtbl=claim&ftype=" . attr(urlencode($ft)) . "&trace=" . attr(urlencode($trc)) . "&rsptype=" . attr(urlencode($typ)) . "&errseg=" . attr(urlencode($err)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'><em>trace</em></a>" : "";
+                    $dd_str .= ($trc) ? " &nbsp;<a class='" . attr($cls) . "' title='" . attr($trc) . "' href='edih_main.php?gtbl=claim&ftype=" . attr_url($ft) . "&trace=" . attr_url($trc) . "&rsptype=" . attr_url($typ) . "&errseg=" . attr_url($err) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'><em>trace</em></a>" : "";
                     $dd_str .= ($err) ? " &nbsp;" . text(substr($err, 0, 8)) : "";
                 } else {
-                    $dd_str .= ($pid) ? " &nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&pid=" . attr(urlencode($pid)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($pid) . "</a>" : "";
+                    $dd_str .= ($pid) ? " &nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&pid=" . attr_url($pid) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($pid) . "</a>" : "";
                 }
 
-                $dd_str .= ($fn1) ? " &nbsp;<a class='" . attr($cls) . "' title='" . attr($fn1) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn1)) . "&ftype=" . attr(urlencode($ft)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'><em>file</em></a>" : "";
+                $dd_str .= ($fn1) ? " &nbsp;<a class='" . attr($cls) . "' title='" . attr($fn1) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn1) . "&ftype=" . attr_url($ft) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'><em>file</em></a>" : "";
                 //
                 $clm_html .= "<dd class='" . attr($oe) . "'>$dd_str</dd>".PHP_EOL;
                 //
@@ -234,25 +234,25 @@ function edih_list_denied_claims($filetype, $filename, $trace = '')
             foreach ($row_ar as $row) {
                 $oe = ( $rwct % 2 ) ? 'codd' : 'ceven';
                 $rwct++;
-                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($row[5])) . "&ftype=" . attr(urlencode($ft)) . "&pid=" . attr(urlencode($row[2])) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($row[2]) . "</a></dt>".PHP_EOL;
+                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr_url($row[5]) . "&ftype=" . attr_url($ft) . "&pid=" . attr_url($row[2]) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($row[2]) . "</a></dt>".PHP_EOL;
             }
         } elseif ($ft == 'f277') {
             foreach ($row_ar as $row) {
                 $oe = ( $rwct % 2 ) ? 'codd' : 'ceven';
                 $rwct++;
-                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($row[5])) . "&ftype=" . attr(urlencode($ft)) . "&bht03=" . attr(urlencode($row[4])) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($row[4]) . "</a></dt>".PHP_EOL;
+                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr_url($row[5]) . "&ftype=" . attr_url($ft) . "&bht03=" . attr_url($row[4]) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($row[4]) . "</a></dt>".PHP_EOL;
             }
         } elseif ($ft == 'f271') {
             foreach ($row_ar as $row) {
                 $oe = ( $rwct % 2 ) ? 'codd' : 'ceven';
                 $rwct++;
-                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($row[5])) . "&ftype=" . attr(urlencode($ft)) . "&bht03=" . attr(urlencode($row[4])) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($row[4]) . "</a></dt>".PHP_EOL;
+                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&fname=" . attr_url($row[5]) . "&ftype=" . attr_url($ft) . "&bht03=" . attr_url($row[4]) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($row[4]) . "</a></dt>".PHP_EOL;
             }
         } elseif ($ft == 'f997') {
             foreach ($row_ar as $row) {
                 $oe = ( $rwct % 2 ) ? 'codd' : 'ceven';
                 $rwct++;
-                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&ftype=" . attr(urlencode($tp)) . "&trace=" . attr(urlencode($row[2])) . "&rsptype=" . attr(urlencode($row[6])) . "&err=" . attr(urlencode($row[7])) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($row[2]) . "</a></dt>".PHP_EOL;
+                $str_html .= "<dt class='" . attr($oe) . "'>" . text($row[0]) . " <a class='rpt' href='edih_main.php?gtbl=claim&ftype=" . attr_url($tp) . "&trace=" . attr_url($row[2]) . "&rsptype=" . attr_url($row[6]) . "&err=" . attr_url($row[7]) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($row[2]) . "</a></dt>".PHP_EOL;
             }
         }
 
@@ -321,8 +321,8 @@ function edih_claim_history($encounter)
                 //
                 $ch_html .= "<td>" . text($ch['PtName']) . "</td>".PHP_EOL;
                 $ch_html .= "<td>" . text($dt) . "</td>".PHP_EOL;
-                $ch_html .= "<td><a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&pid=" . attr(urlencode($ch['CLM01'])) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['CLM01']) . "</a></td>".PHP_EOL;
-                $ch_html .= "<td title='" . attr($ch['Control']) . "'><a  class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['FileName']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td><a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&pid=" . attr_url($ch['CLM01']) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['CLM01']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td title='" . attr($ch['Control']) . "'><a  class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['FileName']) . "</a></td>".PHP_EOL;
                 //
                 $ch_html .= "</tr>".PHP_EOL;
             }
@@ -349,8 +349,8 @@ function edih_claim_history($encounter)
                 //array('PtName', 'RspDate', 'Trace', 'Status', 'Control', 'FileName', 'RspType', 'err_seg');;
                 $ch_html .= "<tr class='ch997'>";
                 $ch_html .= "<td>Rsp Ack</td>".PHP_EOL;
-                $ch_html .= "<td><a class='rsp' target='_blank' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&trace=" . attr(urlencode($ch['Trace'])) . "&rsptype=" . attr(urlencode($ch['RspType'])) . "&errseg=" . attr(urlencode($ch['err_seg'])) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['Status']) . "</a></td>".PHP_EOL;
-                $ch_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['FileName']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td><a class='rsp' target='_blank' href='edih_main.php?gtbl=claim&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&trace=" . attr_url($ch['Trace']) . "&rsptype=" . attr_url($ch['RspType']) . "&errseg=" . attr_url($ch['err_seg']) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['Status']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['FileName']) . "</a></td>".PHP_EOL;
                 $ch_html .= "<td title='Response type/date'>" . text($ch['RspType']) . " " . text($ch['RspDate']) . "</td>".PHP_EOL;
                 $ch_html .= "</tr>".PHP_EOL;
             }
@@ -376,8 +376,8 @@ function edih_claim_history($encounter)
                 $ch_html .= "<tr class='ch277'>";
                 //
                 $ch_html .= "<td>Claim Status</td>".PHP_EOL;
-                $ch_html .= "<td><a class='rsp' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($ch['BHT03'])) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['Status']) . "</a></td>".PHP_EOL;
-                $ch_html .= "<td title='" . attr($ch['FileName']) . "'><a href='edih_main.php?gtbl=file&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['FileName']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td><a class='rsp' href='edih_main.php?gtbl=claim&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($ch['BHT03']) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['Status']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td title='" . attr($ch['FileName']) . "'><a href='edih_main.php?gtbl=file&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['FileName']) . "</a></td>".PHP_EOL;
                 $ch_html .= "<td title='Payer " . attr($ch['Payer']) . "'>" . text($ch['Trace']) . "</td>".PHP_EOL;
                 //
                 $ch_html .= "</tr>".PHP_EOL;
@@ -406,8 +406,8 @@ function edih_claim_history($encounter)
                 $ch_html .= "<tr class='ch835'>";
                 //
                 $ch_html .= "<td>" . text($ch['PtName']) . "</td>".PHP_EOL;
-                $ch_html .= "<td><a class='rsp' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&pid=" . attr(urlencode($ch['CLM01'])) . "&summary=no&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['Status']) . "</a></td>".PHP_EOL;
-                $ch_html .= "<td><a href='edih_main.php?gtbl=file&fname=" . attr(urlencode($ch['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&trace=" . attr(urlencode($ch['Trace'])) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($ch['Trace']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td><a class='rsp' href='edih_main.php?gtbl=claim&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&pid=" . attr_url($ch['CLM01']) . "&summary=no&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['Status']) . "</a></td>".PHP_EOL;
+                $ch_html .= "<td><a href='edih_main.php?gtbl=file&fname=" . attr_url($ch['FileName']) . "&ftype=" . attr_url($tp) . "&trace=" . attr_url($ch['Trace']) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($ch['Trace']) . "</a></td>".PHP_EOL;
                 $ch_html .= "<td title='" . attr($msg) . "'>" . text($ch['Payer']) . "</td>".PHP_EOL;
                 //
                 $ch_html .= "</tr>".PHP_EOL;
@@ -610,17 +610,17 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
                         $fn = $v;
-                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Control') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&icn=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&icn=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Trace') {
                         $trc = $v;
-                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&trace=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&rsptype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&trace=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&rsptype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Claim_ct') {
-                        $csv_html .= "<td>" . text($v) . " <a class='sub' href='edih_main.php?tracecheck=" . attr(urlencode($trc)) . "&ckprocessed=yes&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'><em>P?</em></a></td>".PHP_EOL;
+                        $csv_html .= "<td>" . text($v) . " <a class='sub' href='edih_main.php?tracecheck=" . attr_url($trc) . "&ckprocessed=yes&csrf_token_form=" . attr_url(collectCsrfToken()) . "'><em>P?</em></a></td>".PHP_EOL;
                     } elseif ($k == 'Denied') {
                         if ((int)$v > 0) {
-                            $csv_html .= "<td><a class='sub' href='edih_main.php?chkdenied=yes&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&trace=" . attr(urlencode($trc)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                            $csv_html .= "<td><a class='sub' href='edih_main.php?chkdenied=yes&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&trace=" . attr_url($trc) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                         } else {
                             $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                         }
@@ -644,12 +644,12 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) ."</td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
                         $fn = $v;
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Trace') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&trace=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&rsptype=" . attr(urlencode($rsp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&trace=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&rsptype=" . attr_url($rsp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'RejCt') {
                         if ((int)$v > 0) {
-                            $csv_html .= "<td><a class='rpt' href='edih_main.php?chkdenied=yes&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                            $csv_html .= "<td><a class='rpt' href='edih_main.php?chkdenied=yes&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                         } else {
                             $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                         }
@@ -672,12 +672,12 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'Date') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Control') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&icn=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&icn=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Reject') {
                         if ((int)$v > 0) {
-                            $csv_html .= "<td><a class='sub' href='edih_main.php?&chkdenied=yes&fname=" . attr(urlencode($val['FileName'])) . "&ftype=" . attr(urlencode($tp)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                            $csv_html .= "<td><a class='sub' href='edih_main.php?&chkdenied=yes&fname=" . attr_url($val['FileName']) . "&ftype=" . attr_url($tp) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                         } else {
                             $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                         }
@@ -701,11 +701,11 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                 $fn = $val['FileName'];
                 foreach ($val as $k => $v) {
                     if ($k == 'CLM01') {
-                        $csv_html .= "<td><a class='sub' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&pid=" . attr(urlencode($v)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='sub' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&pid=" . attr_url($v) . "&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'SvcDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
@@ -726,13 +726,13 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'SvcDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'CLM01') {
-                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&pid=" . attr(urlencode($pid)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&pid=" . attr(urlencode($pid)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&pid=" . attr_url($pid) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&pid=" . attr_url($pid) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } elseif ($k == 'Trace') {
-                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&trace=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&trace=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td title='" . attr($v) . "'>File <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td title='" . attr($v) . "'>File <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
@@ -754,13 +754,13 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'SvcDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'CLM01') {
-                        $csv_html .= "<td><a class='sub' href='edih_main.php?gtbl=claim&trace=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&rsptype=f837&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='sub' href='edih_main.php?gtbl=claim&trace=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&rsptype=f837&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'BHT03') {
-                        $csv_html .= "<td>" . text($v) . " <a class='rsp' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td>" . text($v) . " <a class='rsp' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td title='" . attr($v) . "'>File <a class='rsp' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td title='" . attr($v) . "'>File <a class='rsp' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
@@ -782,12 +782,12 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'ReqDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'CLM01') {
-                        $csv_html .= "<td><a class='sub' href='edih_main.php?gtbl=claim&trace=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&rsptype=f837&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='sub' href='edih_main.php?gtbl=claim&trace=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&rsptype=f837&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'BHT03') {
-                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
@@ -808,9 +808,9 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'ReqDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'BHT03') {
-                        $csv_html .= "<td> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td> <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
@@ -831,11 +831,11 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'RspDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'BHT03') {
-                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;".PHP_EOL;
-                        $csv_html .= "&nbsp;<a class='seg' target='_blank' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;".PHP_EOL;
+                        $csv_html .= "&nbsp;<a class='seg' target='_blank' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td title='" . attr($v) . "'> File <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td title='" . attr($v) . "'> File <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
@@ -856,11 +856,11 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'FileDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) . '-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'BHT03') {
-                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;".PHP_EOL;
-                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&bht03=" . attr(urlencode($v)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td>" . text($v) . " <a class='" . attr($cls) . "' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;".PHP_EOL;
+                        $csv_html .= "&nbsp;<a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&bht03=" . attr_url($v) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td title='" . attr($v) . "'> File <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=htm&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>H</a>&nbsp;";
-                        $csv_html .= "&nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>T</a></td>".PHP_EOL;
+                        $csv_html .= "<td title='" . attr($v) . "'> File <a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=htm&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>H</a>&nbsp;";
+                        $csv_html .= "&nbsp;<a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>T</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>$v</td>".PHP_EOL;
                     }
@@ -882,9 +882,9 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                     if ($k == 'RspDate') {
                         $csv_html .= "<td>" . text(substr($v, 0, 4)) .'-' . text(substr($v, 4, 2)) . '-' . text(substr($v, 6, 2)) . "</td>".PHP_EOL;
                     } elseif ($k == 'FileName') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'Trace') {
-                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr(urlencode($fn)) . "&ftype=" . attr(urlencode($tp)) . "&trace=" . attr(urlencode($v)) . "&rsptype=" . attr(urlencode($rsp)) . "&err=" . attr(urlencode($err)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='seg' href='edih_main.php?gtbl=claim&fname=" . attr_url($fn) . "&ftype=" . attr_url($tp) . "&trace=" . attr_url($v) . "&rsptype=" . attr_url($rsp) . "&err=" . attr_url($err) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } elseif ($k == 'err_seg') {
                         $csv_html .= "<td title='" . attr($v) . "'>" . text(substr($v, 0, 8)) . "...</td>".PHP_EOL;
                     } else {
@@ -902,7 +902,7 @@ function edih_csv_to_html($file_type, $csv_type, $period = '', $datestart = '',
                 $csv_html .= "<tr class='" . attr($bgc) . "'>".PHP_EOL;
                 foreach ($val as $k => $v) {
                     if ($k == 'FileName') {
-                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr(urlencode($v)) . "&ftype=" . attr(urlencode($tp)) . "&fmt=seg&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "'>" . text($v) . "</a></td>".PHP_EOL;
+                        $csv_html .= "<td><a class='" . attr($cls) . "' href='edih_main.php?gtbl=file&fname=" . attr_url($v) . "&ftype=" . attr_url($tp) . "&fmt=seg&csrf_token_form=" . attr_url(collectCsrfToken()) . "'>" . text($v) . "</a></td>".PHP_EOL;
                     } else {
                         $csv_html .= "<td>" . text($v) . "</td>".PHP_EOL;
                     }
-- 
2.11.4.GIT