Index: frontends/php/tr_logform.php
===================================================================
--- frontends/php/tr_logform.php	(revision 38887)
+++ frontends/php/tr_logform.php	(working copy)
@@ -26,7 +26,6 @@
 
 $page['title'] = _('Trigger form');
 $page['file'] = 'tr_logform.php';
-$page['scripts'] = array();
 $page['type'] = detect_page_type(PAGE_TYPE_HTML);
 
 define('ZBX_PAGE_NO_MENU', 1);
@@ -176,7 +175,7 @@
 		$sql = 'SELECT DISTINCT f.functionid, f.function, f.parameter, t.expression, '.
 								' t.description, t.priority, t.comments, t.url, t.status, t.type'.
 					' FROM functions f, triggers t, items i '.
-					' WHERE t.triggerid='.$_REQUEST['triggerid'].
+					' WHERE t.triggerid='.zbx_dbstr($_REQUEST['triggerid']).
 						' AND i.itemid=f.itemid '.
 						' AND f.triggerid = t.triggerid '.
 						' AND i.value_type IN ('.ITEM_VALUE_TYPE_LOG.' , '.ITEM_VALUE_TYPE_TEXT.', '.ITEM_VALUE_TYPE_STR.')';
@@ -258,7 +257,7 @@
 	$frmTRLog->addRow(_('Description'), new CTextBox('description', $description, 80));
 
 	$item = '';
-	$db_items = DBselect('SELECT DISTINCT * FROM items WHERE itemid='.$itemid);
+	$db_items = DBselect('SELECT DISTINCT * FROM items WHERE itemid='.zbx_dbstr($itemid));
 	while($db_item = DBfetch($db_items)){
 		if($db_item['templateid']){
 			$template_host = get_realhost_by_itemid($db_item['templateid']);
Index: frontends/php/api/classes/CAlert.php
===================================================================
--- frontends/php/api/classes/CAlert.php	(revision 38887)
+++ frontends/php/api/classes/CAlert.php	(working copy)
@@ -143,8 +143,8 @@
 
 		$sqlParts['from']['e'] = 'events e';
 		$sqlParts['where']['ae'] = 'a.eventid=e.eventid';
-		$sqlParts['where'][] = 'e.source='.$options['eventsource'];
-		$sqlParts['where'][] = 'e.object='.$options['eventobject'];
+		$sqlParts['where'][] = 'e.source='.zbx_dbstr($options['eventsource']);
+		$sqlParts['where'][] = 'e.object='.zbx_dbstr($options['eventobject']);
 
 		// groupids
 		if (!is_null($options['groupids'])) {
@@ -263,12 +263,12 @@
 
 		// time_from
 		if (!is_null($options['time_from'])) {
-			$sqlParts['where'][] = 'a.clock>'.$options['time_from'];
+			$sqlParts['where'][] = 'a.clock>'.zbx_dbstr($options['time_from']);
 		}
 
 		// time_till
 		if (!is_null($options['time_till'])) {
-			$sqlParts['where'][] = 'a.clock<'.$options['time_till'];
+			$sqlParts['where'][] = 'a.clock<'.zbx_dbstr($options['time_till']);
 		}
 
 		// limit
@@ -396,8 +396,8 @@
 						' AND a.eventid=e.eventid'.
 						' AND e.objectid=f.triggerid'.
 						' AND f.itemid=i.itemid'.
-						' AND e.object='.$options['eventobject'].
-						' AND e.source='.$options['eventsource']
+						' AND e.object='.zbx_dbstr($options['eventobject']).
+						' AND e.source='.zbx_dbstr($options['eventsource'])
 				);
 			}
 			// item and LLD rule events
@@ -408,8 +408,8 @@
 						' WHERE '.dbConditionInt('a.alertid', $alertIds).
 						' AND a.eventid=e.eventid'.
 						' AND e.objectid=i.itemid'.
-						' AND e.object='.$options['eventobject'].
-						' AND e.source='.$options['eventsource']
+						' AND e.object='.zbx_dbstr($options['eventobject']).
+						' AND e.source='.zbx_dbstr($options['eventsource'])
 				);
 			}
 
Index: frontends/php/api/classes/CTemplateScreen.php
===================================================================
--- frontends/php/api/classes/CTemplateScreen.php	(revision 38887)
+++ frontends/php/api/classes/CTemplateScreen.php	(working copy)
@@ -546,7 +546,7 @@
 				'SELECT src.itemid AS srcid,dest.itemid as destid'.
 						' FROM items dest,items src'.
 						' WHERE dest.key_=src.key_'.
-						' AND dest.hostid='.$templateId.
+						' AND dest.hostid='.zbx_dbstr($templateId).
 						' AND '.dbConditionInt('src.itemid', $resourceItemIds)
 			);
 			while ($dbItem = DBfetch($dbItems)) {
@@ -561,7 +561,7 @@
 						' WHERE dest.name=src.name'.
 						' AND destgi.graphid=dest.graphid'.
 						' AND destgi.itemid=desti.itemid'.
-						' AND desti.hostid='.$templateId.
+						' AND desti.hostid='.zbx_dbstr($templateId).
 						' AND '.dbConditionInt('src.graphid', $resourceGraphIds)
 			);
 			while ($dbItem = DBfetch($dbItems)) {
Index: frontends/php/api/classes/CGraphItem.php
===================================================================
--- frontends/php/api/classes/CGraphItem.php	(revision 38887)
+++ frontends/php/api/classes/CGraphItem.php	(working copy)
@@ -108,7 +108,7 @@
 
 		// type
 		if (!is_null($options['type'] )) {
-			$sqlParts['where'][] = 'gi.type='.$options['type'];
+			$sqlParts['where'][] = 'gi.type='.zbx_dbstr($options['type']);
 		}
 
 		// limit
Index: frontends/php/api/classes/CEvent.php
===================================================================
--- frontends/php/api/classes/CEvent.php	(revision 38887)
+++ frontends/php/api/classes/CEvent.php	(working copy)
@@ -285,12 +285,12 @@
 
 		// object
 		if (!is_null($options['object'])) {
-			$sqlParts['where']['o'] = 'e.object='.$options['object'];
+			$sqlParts['where']['o'] = 'e.object='.zbx_dbstr($options['object']);
 		}
 
 		// source
 		if (!is_null($options['source'])) {
-			$sqlParts['where'][] = 'e.source='.$options['source'];
+			$sqlParts['where'][] = 'e.source='.zbx_dbstr($options['source']);
 		}
 
 		// acknowledged
@@ -300,22 +300,22 @@
 
 		// time_from
 		if (!is_null($options['time_from'])) {
-			$sqlParts['where'][] = 'e.clock>='.$options['time_from'];
+			$sqlParts['where'][] = 'e.clock>='.zbx_dbstr($options['time_from']);
 		}
 
 		// time_till
 		if (!is_null($options['time_till'])) {
-			$sqlParts['where'][] = 'e.clock<='.$options['time_till'];
+			$sqlParts['where'][] = 'e.clock<='.zbx_dbstr($options['time_till']);
 		}
 
 		// eventid_from
 		if (!is_null($options['eventid_from'])) {
-			$sqlParts['where'][] = 'e.eventid>='.$options['eventid_from'];
+			$sqlParts['where'][] = 'e.eventid>='.zbx_dbstr($options['eventid_from']);
 		}
 
 		// eventid_till
 		if (!is_null($options['eventid_till'])) {
-			$sqlParts['where'][] = 'e.eventid<='.$options['eventid_till'];
+			$sqlParts['where'][] = 'e.eventid<='.zbx_dbstr($options['eventid_till']);
 		}
 
 		// value
@@ -501,8 +501,8 @@
 						' WHERE '.dbConditionInt('e.eventid', $eventIds).
 						' AND e.objectid=f.triggerid'.
 						' AND f.itemid=i.itemid'.
-						' AND e.object='.$options['object'].
-						' AND e.source='.$options['source']
+						' AND e.object='.zbx_dbstr($options['object']).
+						' AND e.source='.zbx_dbstr($options['source'])
 				);
 			}
 			// item and LLD rule events
@@ -512,8 +512,8 @@
 						' FROM events e,items i'.
 						' WHERE '.dbConditionInt('e.eventid', $eventIds).
 						' AND e.objectid=i.itemid'.
-						' AND e.object='.$options['object'].
-						' AND e.source='.$options['source']
+						' AND e.object='.zbx_dbstr($options['object']).
+						' AND e.source='.zbx_dbstr($options['source'])
 				);
 			}
 
Index: frontends/php/api/classes/CHistory.php
===================================================================
--- frontends/php/api/classes/CHistory.php	(revision 38887)
+++ frontends/php/api/classes/CHistory.php	(working copy)
@@ -147,13 +147,13 @@
 		// time_from
 		if (!is_null($options['time_from'])) {
 			$sqlParts['select']['clock'] = 'h.clock';
-			$sqlParts['where']['clock_from'] = 'h.clock>='.$options['time_from'];
+			$sqlParts['where']['clock_from'] = 'h.clock>='.zbx_dbstr($options['time_from']);
 		}
 
 		// time_till
 		if (!is_null($options['time_till'])) {
 			$sqlParts['select']['clock'] = 'h.clock';
-			$sqlParts['where']['clock_till'] = 'h.clock<='.$options['time_till'];
+			$sqlParts['where']['clock_till'] = 'h.clock<='.zbx_dbstr($options['time_till']);
 		}
 
 		// filter
Index: frontends/php/api/classes/CTrigger.php
===================================================================
--- frontends/php/api/classes/CTrigger.php	(revision 38887)
+++ frontends/php/api/classes/CTrigger.php	(working copy)
@@ -279,12 +279,12 @@
 
 		// lastChangeSince
 		if (!is_null($options['lastChangeSince'])) {
-			$sqlParts['where']['lastchangesince'] = 't.lastchange>'.$options['lastChangeSince'];
+			$sqlParts['where']['lastchangesince'] = 't.lastchange>'.zbx_dbstr($options['lastChangeSince']);
 		}
 
 		// lastChangeTill
 		if (!is_null($options['lastChangeTill'])) {
-			$sqlParts['where']['lastchangetill'] = 't.lastchange<'.$options['lastChangeTill'];
+			$sqlParts['where']['lastchangetill'] = 't.lastchange<'.zbx_dbstr($options['lastChangeTill']);
 		}
 
 		// withUnacknowledgedEvents
@@ -420,7 +420,7 @@
 
 		// min_severity
 		if (!is_null($options['min_severity'])) {
-			$sqlParts['where'][] = 't.priority>='.$options['min_severity'];
+			$sqlParts['where'][] = 't.priority>='.zbx_dbstr($options['min_severity']);
 		}
 
 		// limit
Index: frontends/php/api/classes/CTemplate.php
===================================================================
--- frontends/php/api/classes/CTemplate.php	(revision 38887)
+++ frontends/php/api/classes/CTemplate.php	(working copy)
@@ -527,7 +527,7 @@
 
 			foreach ($template['groups'] as $group) {
 				$hostgroupid = get_dbid('hosts_groups', 'hostgroupid');
-				$result = DBexecute("INSERT INTO hosts_groups (hostgroupid, hostid, groupid) VALUES ($hostgroupid, $templateid, {$group['groupid']})");
+				$result = DBexecute('INSERT INTO hosts_groups (hostgroupid,hostid,groupid) VALUES ('.zbx_dbstr($hostgroupid).','.zbx_dbstr($templateid).','.zbx_dbstr($group['groupid']).')');
 				if (!$result) {
 					self::exception(ZBX_API_ERROR_PARAMETERS, 'DBerror');
 				}
Index: frontends/php/api/classes/CUser.php
===================================================================
--- frontends/php/api/classes/CUser.php	(revision 38887)
+++ frontends/php/api/classes/CUser.php	(working copy)
@@ -431,7 +431,8 @@
 			$usrgrps = zbx_objectValues($user['usrgrps'], 'usrgrpid');
 			foreach ($usrgrps as $groupid) {
 				$usersGroupdId = get_dbid('users_groups', 'id');
-				$sql = 'INSERT INTO users_groups (id,usrgrpid,userid) VALUES ('.$usersGroupdId.','.$groupid.','.$userid.')';
+				$sql = 'INSERT INTO users_groups (id,usrgrpid,userid) VALUES ('.zbx_dbstr($usersGroupdId).','.zbx_dbstr($groupid).','.zbx_dbstr($userid).')';
+
 				if (!DBexecute($sql)) {
 					self::exception(ZBX_API_ERROR_PARAMETERS, 'DBerror');
 				}
@@ -440,8 +441,8 @@
 			foreach ($user['user_medias'] as $mediaData) {
 				$mediaid = get_dbid('media', 'mediaid');
 				$sql = 'INSERT INTO media (mediaid,userid,mediatypeid,sendto,active,severity,period)'.
-					' VALUES ('.$mediaid.','.$userid.','.$mediaData['mediatypeid'].','.
-					zbx_dbstr($mediaData['sendto']).','.$mediaData['active'].','.$mediaData['severity'].','.
+					' VALUES ('.zbx_dbstr($mediaid).','.zbx_dbstr($userid).','.zbx_dbstr($mediaData['mediatypeid']).','.
+					zbx_dbstr($mediaData['sendto']).','.zbx_dbstr($mediaData['active']).','.zbx_dbstr($mediaData['severity']).','.
 					zbx_dbstr($mediaData['period']).')';
 				if (!DBexecute($sql)) {
 					self::exception(ZBX_API_ERROR_PARAMETERS, 'DBerror');
@@ -504,7 +505,7 @@
 				DBexecute('DELETE FROM users_groups WHERE userid='.$user['userid'].' AND '.dbConditionInt('usrgrpid', $newUsrgrpids, true));
 
 				// getting the list of groups user is currently in
-				$dbGroupsUserIn = DBSelect('SELECT usrgrpid FROM users_groups WHERE userid='.$user['userid']);
+				$dbGroupsUserIn = DBSelect('SELECT usrgrpid FROM users_groups WHERE userid='.zbx_dbstr($user['userid']));
 				$groupsUserIn = array();
 				while ($grp = DBfetch($dbGroupsUserIn)) {
 					$groupsUserIn[$grp['usrgrpid']] = $grp['usrgrpid'];
@@ -522,7 +523,7 @@
 					}
 
 					$usersGroupdId = get_dbid('users_groups', 'id');
-					$sql = 'INSERT INTO users_groups (id,usrgrpid,userid) VALUES ('.$usersGroupdId.','.$groupid.','.$user['userid'].')';
+					$sql = 'INSERT INTO users_groups (id,usrgrpid,userid) VALUES ('.zbx_dbstr($usersGroupdId).','.zbx_dbstr($groupid).','.zbx_dbstr($user['userid']).')';
 
 					if (!DBexecute($sql)) {
 						self::exception(ZBX_API_ERROR_PARAMETERS, 'DBerror');
@@ -650,8 +651,8 @@
 				$mediaid = get_dbid('media', 'mediaid');
 
 				$sql = 'INSERT INTO media (mediaid,userid,mediatypeid,sendto,active,severity,period)'.
-						' VALUES ('.$mediaid.','.$user['userid'].','.$media['mediatypeid'].','.
-									zbx_dbstr($media['sendto']).','.$media['active'].','.$media['severity'].','.
+						' VALUES ('.zbx_dbstr($mediaid).','.zbx_dbstr($user['userid']).','.zbx_dbstr($media['mediatypeid']).','.
+									zbx_dbstr($media['sendto']).','.zbx_dbstr($media['active']).','.zbx_dbstr($media['severity']).','.
 									zbx_dbstr($media['period']).')';
 				if (!DBexecute($sql)) {
 					self::exception(ZBX_API_ERROR_PARAMETERS, 'DBerror');
@@ -750,12 +751,12 @@
 
 			$result = DBexecute(
 				'UPDATE media'.
-				' SET mediatypeid='.$media['mediatypeid'].','.
+				' SET mediatypeid='.zbx_dbstr($media['mediatypeid']).','.
 					' sendto='.zbx_dbstr($media['sendto']).','.
-					' active='.$media['active'].','.
-					' severity='.$media['severity'].','.
+					' active='.zbx_dbstr($media['active']).','.
+					' severity='.zbx_dbstr($media['severity']).','.
 					' period='.zbx_dbstr($media['period']).
-				' WHERE mediaid='.$media['mediaid']
+				' WHERE mediaid='.zbx_dbstr($media['mediaid'])
 			);
 			if (!$result) {
 				self::exception(ZBX_API_ERROR_PARAMETERS, _('Cannot update user media.'));
@@ -1034,13 +1035,13 @@
 			'SELECT u.userid,u.alias,u.name,u.surname,u.url,u.autologin,u.autologout,u.lang,u.refresh,u.type,'.
 			' u.theme,u.attempt_failed,u.attempt_ip,u.attempt_clock,u.rows_per_page'.
 			' FROM users u'.
-			' WHERE u.userid='.$userid
+			' WHERE u.userid='.zbx_dbstr($userid)
 		));
 
 		$userData['debug_mode'] = (bool) DBfetch(DBselect(
 			'SELECT ug.userid'.
 			' FROM usrgrp g,users_groups ug'.
-			' WHERE ug.userid='.$userid.
+			' WHERE ug.userid='.zbx_dbstr($userid).
 				' AND g.usrgrpid=ug.usrgrpid'.
 				' AND g.debug_mode='.GROUP_DEBUG_MODE_ENABLED
 		));
Index: frontends/php/api/classes/CImage.php
===================================================================
--- frontends/php/api/classes/CImage.php	(revision 38887)
+++ frontends/php/api/classes/CImage.php	(working copy)
@@ -267,7 +267,7 @@
 			$values = array(
 				'imageid' => $imageid,
 				'name' => zbx_dbstr($image['name']),
-				'imagetype' => $image['imagetype']
+				'imagetype' => zbx_dbstr($image['imagetype'])
 			);
 
 			switch ($DB['TYPE']) {
@@ -401,7 +401,7 @@
 						break;
 
 					case ZBX_DB_ORACLE:
-						$sql = 'SELECT i.image FROM images i WHERE i.imageid='.$image['imageid'].' FOR UPDATE';
+						$sql = 'SELECT i.image FROM images i WHERE i.imageid='.zbx_dbstr($image['imageid']).' FOR UPDATE';
 
 						if (!$stmt = oci_parse($DB['DB'], $sql)) {
 							$e = oci_error($DB['DB']);
@@ -423,7 +423,7 @@
 						break;
 
 					case ZBX_DB_DB2:
-						$stmt = db2_prepare($DB['DB'], 'UPDATE images SET image=? WHERE imageid='.$image['imageid']);
+						$stmt = db2_prepare($DB['DB'], 'UPDATE images SET image=? WHERE imageid='.zbx_dbstr($image['imageid']));
 
 						if (!$stmt) {
 							self::exception(ZBX_API_ERROR_PARAMETERS, db2_conn_errormsg($DB['DB']));
@@ -445,7 +445,7 @@
 			foreach ($values as $field => $value) {
 				$sqlUpd[] = $field.'='.$value;
 			}
-			$sql = 'UPDATE images SET '.implode(', ', $sqlUpd).' WHERE imageid='.$image['imageid'];
+			$sql = 'UPDATE images SET '.implode(', ', $sqlUpd).' WHERE imageid='.zbx_dbstr($image['imageid']);
 			$result = DBexecute($sql);
 
 			if (!$result) {
Index: frontends/php/api/classes/CMapElement.php
===================================================================
--- frontends/php/api/classes/CMapElement.php	(revision 38887)
+++ frontends/php/api/classes/CMapElement.php	(working copy)
@@ -162,7 +162,7 @@
 		$dbElements = DBselect(
 			'SELECT se.elementid,se.elementtype'.
 			' FROM sysmaps_elements se'.
-			' WHERE se.sysmapid='.$elementId.
+			' WHERE se.sysmapid='.zbx_dbstr($elementId).
 				' AND se.elementtype='.SYSMAP_ELEMENT_TYPE_MAP
 		);
 		while ($element = DBfetch($dbElements)) {
Index: frontends/php/api/classes/CTriggerPrototype.php
===================================================================
--- frontends/php/api/classes/CTriggerPrototype.php	(revision 38887)
+++ frontends/php/api/classes/CTriggerPrototype.php	(working copy)
@@ -384,7 +384,7 @@
 
 		// min_severity
 		if (!is_null($options['min_severity'])) {
-			$sqlParts['where'][] = 't.priority>='.$options['min_severity'];
+			$sqlParts['where'][] = 't.priority>='.zbx_dbstr($options['min_severity']);
 		}
 
 		// limit
Index: frontends/php/api/classes/CUserGroup.php
===================================================================
--- frontends/php/api/classes/CUserGroup.php	(revision 38887)
+++ frontends/php/api/classes/CUserGroup.php	(working copy)
@@ -117,7 +117,7 @@
 
 		// status
 		if (!is_null($options['status'])) {
-			$sqlParts['where'][] = 'g.users_status='.$options['status'];
+			$sqlParts['where'][] = 'g.users_status='.zbx_dbstr($options['status']);
 		}
 
 		// with_gui_access
Index: frontends/php/api/classes/CApplication.php
===================================================================
--- frontends/php/api/classes/CApplication.php	(revision 38887)
+++ frontends/php/api/classes/CApplication.php	(working copy)
@@ -558,7 +558,7 @@
 		DB::insert('items_applications', $appsInsert);
 
 		foreach ($itemids as $inum => $itemid) {
-			$dbChilds = DBselect('SELECT i.itemid,i.hostid FROM items i WHERE i.templateid='.$itemid);
+			$dbChilds = DBselect('SELECT i.itemid,i.hostid FROM items i WHERE i.templateid='.zbx_dbstr($itemid));
 			while ($child = DBfetch($dbChilds)) {
 				$dbApps = DBselect(
 					'SELECT a1.applicationid'.
Index: frontends/php/api/classes/managers/CHttpTestManager.php
===================================================================
--- frontends/php/api/classes/managers/CHttpTestManager.php	(revision 38887)
+++ frontends/php/api/classes/managers/CHttpTestManager.php	(working copy)
@@ -154,7 +154,7 @@
 			$dbCheckItems = DBselect(
 				'SELECT i.itemid,hi.type'.
 				' FROM items i,httptestitem hi'.
-				' WHERE hi.httptestid='.$httpTest['httptestid'].
+				' WHERE hi.httptestid='.zbx_dbstr($httpTest['httptestid']).
 					' AND hi.itemid=i.itemid'
 			);
 			while ($checkitem = DBfetch($dbCheckItems)) {
@@ -661,7 +661,7 @@
 				'SELECT i.itemid,i.key_'.
 					' FROM items i,httptestitem hti'.
 					' WHERE i.itemid=hti.itemid'.
-					' AND hti.httptestid='.$httpTest['templateid']
+					' AND hti.httptestid='.zbx_dbstr($httpTest['templateid'])
 			), 'key_');
 		}
 
@@ -755,7 +755,7 @@
 				' FROM items i,httpstepitem hsi,httpstep hs'.
 				' WHERE i.itemid=hsi.itemid'.
 					' AND hsi.httpstepid=hs.httpstepid'.
-					' AND hs.httptestid='.$httpTest['templateid']
+					' AND hs.httptestid='.zbx_dbstr($httpTest['templateid'])
 			), 'key_');
 		}
 
@@ -895,7 +895,7 @@
 			$dbStepItems = DBselect(
 				'SELECT i.itemid,i.key_,hi.type'.
 				' FROM items i,httpstepitem hi'.
-				' WHERE hi.httpstepid='.$webstep['httpstepid'].
+				' WHERE hi.httpstepid='.zbx_dbstr($webstep['httpstepid']).
 					' AND hi.itemid=i.itemid'
 			);
 			while ($stepitem = DBfetch($dbStepItems)) {
Index: frontends/php/actionconf.php
===================================================================
--- frontends/php/actionconf.php	(revision 38887)
+++ frontends/php/actionconf.php	(working copy)
@@ -311,7 +311,7 @@
 		' WHERE '.dbConditionInt('a.actionid', $_REQUEST['g_actionid'])
 	);
 	while ($row = DBfetch($goResult)) {
-		$res = DBexecute('UPDATE actions SET status='.$status.' WHERE actionid='.$row['actionid']);
+		$res = DBexecute('UPDATE actions SET status='.zbx_dbstr($status).' WHERE actionid='.zbx_dbstr($row['actionid']));
 		if ($res) {
 			$actionIds[] = $row['actionid'];
 		}
Index: frontends/php/chart2.php
===================================================================
--- frontends/php/chart2.php	(revision 38887)
+++ frontends/php/chart2.php	(working copy)
@@ -118,7 +118,7 @@
 $dbGraphItems = DBselect(
 	'SELECT gi.*'.
 	' FROM graphs_items gi'.
-	' WHERE gi.graphid='.$dbGraph['graphid'].
+	' WHERE gi.graphid='.zbx_dbstr($dbGraph['graphid']).
 	' ORDER BY gi.sortorder,gi.itemid DESC'
 );
 while ($dbGraphItem = DBfetch($dbGraphItems)) {
Index: frontends/php/chart3.php
===================================================================
--- frontends/php/chart3.php	(revision 38887)
+++ frontends/php/chart3.php	(working copy)
@@ -81,9 +81,9 @@
 		'SELECT i.itemid'.
 		' FROM httpstepitem hi,items i,httpstep hs'.
 		' WHERE i.itemid=hi.itemid'.
-			' AND hs.httptestid='.$httptestid.
+			' AND hs.httptestid='.zbx_dbstr($httptestid).
 			' AND hs.httpstepid=hi.httpstepid'.
-			' AND hi.type='.get_request('http_item_type', HTTPSTEP_ITEM_TYPE_TIME).
+			' AND hi.type='.zbx_dbstr(get_request('http_item_type', HTTPSTEP_ITEM_TYPE_TIME)).
 		' ORDER BY hs.no DESC'
 	);
 	while ($item = DBfetch($dbItems)) {
Index: frontends/php/httpconf.php
===================================================================
--- frontends/php/httpconf.php	(revision 38887)
+++ frontends/php/httpconf.php	(working copy)
@@ -295,7 +295,7 @@
 		}
 		if (delete_history_by_httptestid($id)) {
 			$goResult = true;
-			DBexecute('UPDATE httptest SET nextcheck=0 WHERE httptestid='.$id);
+			DBexecute('UPDATE httptest SET nextcheck=0 WHERE httptestid='.zbx_dbstr($id));
 			$host = DBfetch(DBselect(
 				'SELECT h.host FROM hosts h,httptest ht WHERE ht.hostid=h.hostid AND ht.httptestid='.zbx_dbstr($id)));
 
@@ -376,7 +376,7 @@
 		$data['http_password'] = $dbHttpTest['http_password'];
 		$data['http_proxy'] = $dbHttpTest['http_proxy'];
 		$data['templated'] = (bool) $dbHttpTest['templateid'];
-		$data['steps'] = DBfetchArray(DBselect('SELECT h.* FROM httpstep h WHERE h.httptestid='.$_REQUEST['httptestid'].' ORDER BY h.no'));
+		$data['steps'] = DBfetchArray(DBselect('SELECT h.* FROM httpstep h WHERE h.httptestid='.zbx_dbstr($_REQUEST['httptestid']).' ORDER BY h.no'));
 	}
 	else {
 		if (isset($_REQUEST['form_refresh'])) {
Index: frontends/php/applications.php
===================================================================
--- frontends/php/applications.php	(revision 38887)
+++ frontends/php/applications.php	(working copy)
@@ -26,7 +26,6 @@
 $page['title'] = _('Configuration of applications');
 $page['file'] = 'applications.php';
 $page['hist_arg'] = array('groupid', 'hostid');
-$page['scripts'] = array();
 
 require_once dirname(__FILE__).'/include/page_header.php';
 
@@ -191,8 +190,8 @@
 			'SELECT ia.itemid,i.hostid,i.key_'.
 			' FROM items_applications ia'.
 				' LEFT JOIN items i ON ia.itemid=i.itemid'.
-			' WHERE ia.applicationid='.$appid.
-				' AND i.hostid='.$_REQUEST['hostid'].
+			' WHERE ia.applicationid='.zbx_dbstr($appid).
+				' AND i.hostid='.zbx_dbstr($_REQUEST['hostid']).
 				' AND i.type<>'.ITEM_TYPE_HTTPTEST.
 				andDbNode('ia.applicationid')
 		);
Index: frontends/php/chart6.php
===================================================================
--- frontends/php/chart6.php	(revision 38887)
+++ frontends/php/chart6.php	(working copy)
@@ -101,7 +101,7 @@
 $result = DBselect(
 	'SELECT gi.*'.
 	' FROM graphs_items gi'.
-	' WHERE gi.graphid='.$dbGraph['graphid'].
+	' WHERE gi.graphid='.zbx_dbstr($dbGraph['graphid']).
 	' ORDER BY gi.sortorder,gi.itemid DESC'
 );
 while ($dbGraph = DBfetch($result)) {
Index: frontends/php/tr_comments.php
===================================================================
--- frontends/php/tr_comments.php	(revision 38887)
+++ frontends/php/tr_comments.php	(working copy)
@@ -63,7 +63,7 @@
 	$result = DBexecute(
 		'UPDATE triggers'.
 		' SET comments='.zbx_dbstr($_REQUEST['comments']).
-		' WHERE triggerid='.$_REQUEST['triggerid']
+		' WHERE triggerid='.zbx_dbstr($_REQUEST['triggerid'])
 	);
 	show_messages($result, _('Comment updated'), _('Cannot update comment'));
 
Index: frontends/php/scripts_exec.php
===================================================================
--- frontends/php/scripts_exec.php	(revision 38887)
+++ frontends/php/scripts_exec.php	(working copy)
@@ -44,7 +44,7 @@
 
 	$data = array(
 		'message' => '',
-		'info' => DBfetch(DBselect('SELECT s.name FROM scripts s WHERE s.scriptid='.$scriptid))
+		'info' => DBfetch(DBselect('SELECT s.name FROM scripts s WHERE s.scriptid='.zbx_dbstr($scriptid)))
 	);
 
 	$result = API::Script()->execute(array('hostid' => $hostid, 'scriptid' => $scriptid));
Index: frontends/php/users.php
===================================================================
--- frontends/php/users.php	(revision 38887)
+++ frontends/php/users.php	(working copy)
@@ -29,7 +29,6 @@
 $page['title'] = _('Configuration of users');
 $page['file'] = 'users.php';
 $page['hist_arg'] = array();
-$page['scripts'] = array();
 
 require_once dirname(__FILE__).'/include/page_header.php';
 
Index: frontends/php/tr_events.php
===================================================================
--- frontends/php/tr_events.php	(revision 38887)
+++ frontends/php/tr_events.php	(working copy)
@@ -30,7 +30,6 @@
 $page['title'] = _('Event details');
 $page['file'] = 'tr_events.php';
 $page['hist_arg'] = array('triggerid', 'eventid');
-$page['scripts'] = array();
 $page['type'] = detect_page_type(PAGE_TYPE_HTML);
 
 require_once dirname(__FILE__).'/include/page_header.php';
Index: frontends/php/srv_status.php
===================================================================
--- frontends/php/srv_status.php	(revision 38887)
+++ frontends/php/srv_status.php	(working copy)
@@ -25,7 +25,6 @@
 
 $page['title'] = _('IT services');
 $page['file'] = 'srv_status.php';
-$page['scripts'] = array();
 $page['hist_arg'] = array();
 
 define('ZBX_PAGE_DO_REFRESH', 1);
Index: frontends/php/adm.regexps.php
===================================================================
--- frontends/php/adm.regexps.php	(revision 38887)
+++ frontends/php/adm.regexps.php	(working copy)
@@ -84,7 +84,7 @@
  * Permissions
  */
 if (isset($_REQUEST['regexpid'])) {
-	$regExp = DBfetch(DBSelect('SELECT re.regexpid FROM regexps re WHERE re.regexpid='.get_request('regexpid')));
+	$regExp = DBfetch(DBSelect('SELECT re.regexpid FROM regexps re WHERE re.regexpid='.zbx_dbstr(get_request('regexpid'))));
 	if (empty($regExp)) {
 		access_deny();
 	}
@@ -221,7 +221,7 @@
 		$regExp = DBfetch(DBSelect(
 			'SELECT re.name,re.test_string'.
 			' FROM regexps re'.
-			' WHERE re.regexpid='.$_REQUEST['regexpid'].
+			' WHERE re.regexpid='.zbx_dbstr($_REQUEST['regexpid']).
 				andDbNode('re.regexpid')
 		));
 
@@ -231,7 +231,7 @@
 		$dbExpressions = DBselect(
 			'SELECT e.expressionid,e.expression,e.expression_type,e.exp_delimiter,e.case_sensitive'.
 			' FROM expressions e'.
-			' WHERE e.regexpid='.$_REQUEST['regexpid'].
+			' WHERE e.regexpid='.zbx_dbstr($_REQUEST['regexpid']).
 				andDbNode('e.expressionid').
 			' ORDER BY e.expression_type'
 		);
Index: frontends/php/discoveryconf.php
===================================================================
--- frontends/php/discoveryconf.php	(revision 38887)
+++ frontends/php/discoveryconf.php	(working copy)
@@ -26,7 +26,6 @@
 $page['title'] = _('Configuration of discovery');
 $page['file'] = 'discoveryconf.php';
 $page['hist_arg'] = array();
-$page['scripts'] = array();
 $page['type'] = detect_page_type();
 
 require_once dirname(__FILE__).'/include/page_header.php';
@@ -183,7 +182,7 @@
 
 	$goResult = false;
 	foreach ($_REQUEST['g_druleid'] as $drid) {
-		if (DBexecute('UPDATE drules SET status='.$status.' WHERE druleid='.$drid)) {
+		if (DBexecute('UPDATE drules SET status='.$status.' WHERE druleid='.zbx_dbstr($drid))) {
 			$rule_data = get_discovery_rule_by_druleid($drid);
 			add_audit(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_DISCOVERY_RULE, '['.$drid.'] '.$rule_data['name']);
 			$goResult = true;
Index: frontends/php/auditacts.php
===================================================================
--- frontends/php/auditacts.php	(revision 38887)
+++ frontends/php/auditacts.php	(working copy)
@@ -140,7 +140,7 @@
 		$firstAlert = DBfetch(DBselect(
 			'SELECT MIN(a.clock) AS clock'.
 			' FROM alerts a'.
-			' WHERE a.userid='.$user['userid']
+			' WHERE a.userid='.zbx_dbstr($user['userid'])
 		));
 	}
 }
Index: frontends/php/acknow.php
===================================================================
--- frontends/php/acknow.php	(revision 38887)
+++ frontends/php/acknow.php	(working copy)
@@ -193,7 +193,7 @@
 		'SELECT a.*,u.alias,u.name,u.surname'.
 		' FROM acknowledges a'.
 			' LEFT JOIN users u ON u.userid=a.userid'.
-		' WHERE a.eventid='.$_REQUEST['eventid']
+		' WHERE a.eventid='.zbx_dbstr($_REQUEST['eventid'])
 	);
 
 	if ($acknowledges) {
Index: frontends/php/httpdetails.php
===================================================================
--- frontends/php/httpdetails.php	(revision 38887)
+++ frontends/php/httpdetails.php	(working copy)
@@ -94,7 +94,7 @@
 	' FROM items i,httpstepitem hi,httpstep hs'.
 	' WHERE hi.itemid=i.itemid'.
 		' AND hi.httpstepid=hs.httpstepid'.
-		' AND hs.httptestid='.$httpTest['httptestid']
+		' AND hs.httptestid='.zbx_dbstr($httpTest['httptestid'])
 );
 $httpStepItems = array();
 $items = array();
@@ -134,7 +134,7 @@
 	_('Status')
 ));
 
-$db_httpsteps = DBselect('SELECT * FROM httpstep WHERE httptestid='.$httpTest['httptestid'].' ORDER BY no');
+$db_httpsteps = DBselect('SELECT * FROM httpstep WHERE httptestid='.zbx_dbstr($httpTest['httptestid']).' ORDER BY no');
 
 $totalTime = array(
 	'value' => 0,
Index: frontends/php/screenedit.php
===================================================================
--- frontends/php/screenedit.php	(revision 38887)
+++ frontends/php/screenedit.php	(working copy)
@@ -101,39 +101,39 @@
 		$fitem = DBfetch(DBselect(
 			'SELECT s.screenitemid,s.colspan,s.rowspan'.
 			' FROM screens_items s'.
-			' WHERE s.y='.$sw_pos[0].
-				' AND s.x='.$sw_pos[1].
-				' AND s.screenid='.$screen['screenid']
+			' WHERE s.y='.zbx_dbstr($sw_pos[0]).
+				' AND s.x='.zbx_dbstr($sw_pos[1]).
+				' AND s.screenid='.zbx_dbstr($screen['screenid'])
 		));
 
 		$sitem = DBfetch(DBselect(
 			'SELECT s.screenitemid,s.colspan,s.rowspan'.
 			' FROM screens_items s'.
-			' WHERE s.y='.$sw_pos[2].
-				' AND s.x='.$sw_pos[3].
-				' AND s.screenid='.$screen['screenid']
+			' WHERE s.y='.zbx_dbstr($sw_pos[2]).
+				' AND s.x='.zbx_dbstr($sw_pos[3]).
+				' AND s.screenid='.zbx_dbstr($screen['screenid'])
 		));
 
 		if ($fitem) {
 			DBexecute('UPDATE screens_items'.
-						' SET y='.$sw_pos[2].',x='.$sw_pos[3].
-						',colspan='.(isset($sitem['colspan']) ? $sitem['colspan'] : 1).
-						',rowspan='.(isset($sitem['rowspan']) ? $sitem['rowspan'] : 1).
-						' WHERE y='.$sw_pos[0].
-							' AND x='.$sw_pos[1].
-							' AND screenid='.$screen['screenid'].
-							' AND screenitemid='.$fitem['screenitemid']
+						' SET y='.zbx_dbstr($sw_pos[2]).',x='.zbx_dbstr($sw_pos[3]).
+						',colspan='.(isset($sitem['colspan']) ? zbx_dbstr($sitem['colspan']) : 1).
+						',rowspan='.(isset($sitem['rowspan']) ? zbx_dbstr($sitem['rowspan']) : 1).
+						' WHERE y='.zbx_dbstr($sw_pos[0]).
+							' AND x='.zbx_dbstr($sw_pos[1]).
+							' AND screenid='.zbx_dbstr($screen['screenid']).
+							' AND screenitemid='.zbx_dbstr($fitem['screenitemid'])
 			);
 		}
 		if ($sitem) {
 			DBexecute('UPDATE screens_items '.
-						' SET y='.$sw_pos[0].',x='.$sw_pos[1].
-						',colspan='.(isset($fitem['colspan']) ? $fitem['colspan'] : 1).
-						',rowspan='.(isset($fitem['rowspan']) ? $fitem['rowspan'] : 1).
-						' WHERE y='.$sw_pos[2].
-							' AND x='.$sw_pos[3].
-							' AND screenid='.$screen['screenid'].
-							' AND screenitemid='.$sitem['screenitemid']
+						' SET y='.zbx_dbstr($sw_pos[0]).',x='.zbx_dbstr($sw_pos[1]).
+						',colspan='.(isset($fitem['colspan']) ? zbx_dbstr($fitem['colspan']) : 1).
+						',rowspan='.(isset($fitem['rowspan']) ? zbx_dbstr($fitem['rowspan']) : 1).
+						' WHERE y='.zbx_dbstr($sw_pos[2]).
+							' AND x='.zbx_dbstr($sw_pos[3]).
+							' AND screenid='.zbx_dbstr($screen['screenid']).
+							' AND screenitemid='.zbx_dbstr($sitem['screenitemid'])
 			);
 		}
 		add_audit_details(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_SCREEN, $screen['screenid'], $screen['name'], 'Screen items switched');
@@ -208,20 +208,20 @@
 	unset($_REQUEST['x']);
 }
 elseif (isset($_REQUEST['add_row'])) {
-	DBexecute('UPDATE screens SET vsize=(vsize+1) WHERE screenid='.$screen['screenid']);
+	DBexecute('UPDATE screens SET vsize=(vsize+1) WHERE screenid='.zbx_dbstr($screen['screenid']));
 
 	$add_row = get_request('add_row', 0);
 	if ($screen['vsize'] > $add_row) {
-		DBexecute('UPDATE screens_items SET y=(y+1) WHERE screenid='.$screen['screenid'].' AND y>='.$add_row);
+		DBexecute('UPDATE screens_items SET y=(y+1) WHERE screenid='.zbx_dbstr($screen['screenid']).' AND y>='.zbx_dbstr($add_row));
 	}
 	add_audit_details(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_SCREEN, $screen['screenid'], $screen['name'], 'Row added');
 }
 elseif (isset($_REQUEST['add_col'])) {
-	DBexecute('UPDATE screens SET hsize=(hsize+1) WHERE screenid='.$screen['screenid']);
+	DBexecute('UPDATE screens SET hsize=(hsize+1) WHERE screenid='.zbx_dbstr($screen['screenid']));
 
 	$add_col = get_request('add_col', 0);
 	if ($screen['hsize'] > $add_col) {
-		DBexecute('UPDATE screens_items SET x=(x+1) WHERE screenid='.$screen['screenid'].' AND x>='.$add_col);
+		DBexecute('UPDATE screens_items SET x=(x+1) WHERE screenid='.zbx_dbstr($screen['screenid']).' AND x>='.zbx_dbstr($add_col));
 	}
 	add_audit_details(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_SCREEN, $screen['screenid'], $screen['name'], 'Column added');
 }
@@ -229,9 +229,9 @@
 	if ($screen['vsize'] > 1) {
 		$rmv_row = get_request('rmv_row', 0);
 
-		DBexecute('UPDATE screens SET vsize=(vsize-1) WHERE screenid='.$screen['screenid']);
-		DBexecute('DELETE FROM screens_items WHERE screenid='.$screen['screenid'].' AND y='.$rmv_row);
-		DBexecute('UPDATE screens_items SET y=(y-1) WHERE screenid='.$screen['screenid'].' AND y>'.$rmv_row);
+		DBexecute('UPDATE screens SET vsize=(vsize-1) WHERE screenid='.zbx_dbstr($screen['screenid']));
+		DBexecute('DELETE FROM screens_items WHERE screenid='.zbx_dbstr($screen['screenid']).' AND y='.zbx_dbstr($rmv_row));
+		DBexecute('UPDATE screens_items SET y=(y-1) WHERE screenid='.zbx_dbstr($screen['screenid']).' AND y>'.zbx_dbstr($rmv_row));
 
 		add_audit_details(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_SCREEN, $screen['screenid'], $screen['name'], 'Row deleted');
 	}
@@ -244,9 +244,9 @@
 	if ($screen['hsize'] > 1) {
 		$rmv_col = get_request('rmv_col', 0);
 
-		DBexecute('UPDATE screens SET hsize=(hsize-1) WHERE screenid='.$screen['screenid']);
-		DBexecute('DELETE FROM screens_items WHERE screenid='.$screen['screenid'].' AND x='.$rmv_col);
-		DBexecute('UPDATE screens_items SET x=(x-1) WHERE screenid='.$screen['screenid'].' AND x>'.$rmv_col);
+		DBexecute('UPDATE screens SET hsize=(hsize-1) WHERE screenid='.zbx_dbstr($screen['screenid']));
+		DBexecute('DELETE FROM screens_items WHERE screenid='.zbx_dbstr($screen['screenid']).' AND x='.zbx_dbstr($rmv_col));
+		DBexecute('UPDATE screens_items SET x=(x-1) WHERE screenid='.zbx_dbstr($screen['screenid']).' AND x>'.zbx_dbstr($rmv_col));
 
 		add_audit_details(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_SCREEN, $screen['screenid'], $screen['name'], 'Column deleted');
 	}
Index: frontends/php/adm.valuemapping.php
===================================================================
--- frontends/php/adm.valuemapping.php	(revision 38887)
+++ frontends/php/adm.valuemapping.php	(working copy)
@@ -43,7 +43,7 @@
  * Permissions
  */
 if (isset($_REQUEST['valuemapid'])) {
-	$dbValueMap = DBfetch(DBselect('SELECT v.name FROM valuemaps v WHERE v.valuemapid='.get_request('valuemapid')));
+	$dbValueMap = DBfetch(DBselect('SELECT v.name FROM valuemaps v WHERE v.valuemapid='.zbx_dbstr(get_request('valuemapid'))));
 	if (empty($dbValueMap)) {
 		access_deny();
 	}
@@ -91,7 +91,7 @@
 
 		$sql = 'SELECT v.name,v.valuemapid'.
 				' FROM valuemaps v'.
-				' WHERE v.valuemapid='.$_REQUEST['valuemapid'].
+				' WHERE v.valuemapid='.zbx_dbstr($_REQUEST['valuemapid']).
 					andDbNode('v.valuemapid');
 		if ($valueMapToDelete = DBfetch(DBselect($sql))) {
 			deleteValueMap($_REQUEST['valuemapid']);
@@ -163,7 +163,7 @@
 
 		if (empty($data['form_refresh'])) {
 			$data['mappings'] = DBfetchArray(DBselect(
-				'SELECT m.mappingid,m.value,m.newvalue FROM mappings m WHERE m.valuemapid='.$data['valuemapid']
+				'SELECT m.mappingid,m.value,m.newvalue FROM mappings m WHERE m.valuemapid='.zbx_dbstr($data['valuemapid'])
 			));
 		}
 		else {
@@ -172,7 +172,7 @@
 		}
 
 		$valueMapCount = DBfetch(DBselect(
-			'SELECT COUNT(i.itemid) AS cnt FROM items i WHERE i.valuemapid='.$data['valuemapid']
+			'SELECT COUNT(i.itemid) AS cnt FROM items i WHERE i.valuemapid='.zbx_dbstr($data['valuemapid'])
 		));
 
 		$data['confirmMessage'] = $valueMapCount['cnt']
Index: frontends/php/auditlogs.php
===================================================================
--- frontends/php/auditlogs.php	(revision 38887)
+++ frontends/php/auditlogs.php	(working copy)
@@ -113,10 +113,10 @@
 	$sqlWhere['alias'] = ' AND u.alias='.zbx_dbstr($data['alias']);
 }
 if ($data['action'] > -1) {
-	$sqlWhere['action'] = ' AND a.action='.$data['action'];
+	$sqlWhere['action'] = ' AND a.action='.zbx_dbstr($data['action']);
 }
 if ($data['resourcetype'] > -1) {
-	$sqlWhere['resourcetype'] = ' AND a.resourcetype='.$data['resourcetype'];
+	$sqlWhere['resourcetype'] = ' AND a.resourcetype='.zbx_dbstr($data['resourcetype']);
 }
 $sqlWhere['from'] = ' AND a.clock>'.$from;
 $sqlWhere['till'] = ' AND a.clock<'.$till;
Index: frontends/php/latest.php
===================================================================
--- frontends/php/latest.php	(revision 38887)
+++ frontends/php/latest.php	(working copy)
@@ -26,8 +26,6 @@
 $page['title'] = _('Latest data');
 $page['file'] = 'latest.php';
 $page['hist_arg'] = array('groupid','hostid','show','select','open','applicationid');
-$page['scripts'] = array();
-
 $page['type'] = detect_page_type(PAGE_TYPE_HTML);
 
 define('ZBX_PAGE_MAIN_HAT','hat_latest');
Index: frontends/php/include/db.inc.php
===================================================================
--- frontends/php/include/db.inc.php	(revision 38887)
+++ frontends/php/include/db.inc.php	(working copy)
@@ -134,8 +134,8 @@
 						'db2_attr_case' => DB2_CASE_LOWER,
 					);
 					db2_set_option($DB['DB'], $options, 1);
-					if (isset($DB['SCHEMA']) && ($DB['SCHEMA'] != '')) {
-						DBexecute("SET CURRENT SCHEMA='".$DB['SCHEMA']."'");
+					if (isset($DB['SCHEMA']) && $DB['SCHEMA'] != '') {
+						DBexecute('SET CURRENT SCHEMA='.zbx_dbstr($DB['SCHEMA']));
 					}
 				}
 
@@ -607,7 +607,7 @@
 
 	$result = false;
 
-	if (!isset($DB['DB']) || empty($DB['DB'])) {
+	if (!isset($DB['DB']) || empty($DB['DB']) || is_bool($cursor)) {
 		return $result;
 	}
 
Index: frontends/php/include/classes/class.chostsinfo.php
===================================================================
--- frontends/php/include/classes/class.chostsinfo.php	(revision 38887)
+++ frontends/php/include/classes/class.chostsinfo.php	(working copy)
@@ -54,7 +54,7 @@
 
 		if (remove_nodes_from_id($this->groupid) > 0) {
 			$cond_from = ',hosts_groups hg';
-			$cond_where = ' AND hg.hostid=h.hostid AND hg.groupid='.$this->groupid;
+			$cond_where = ' AND hg.hostid=h.hostid AND hg.groupid='.zbx_dbstr($this->groupid);
 		}
 		else {
 			$cond_from = '';
Index: frontends/php/include/classes/class.cfavorite.php
===================================================================
--- frontends/php/include/classes/class.cfavorite.php	(revision 38887)
+++ frontends/php/include/classes/class.cfavorite.php	(working copy)
@@ -91,7 +91,7 @@
 			'profileid' => get_dbid('profiles', 'profileid'),
 			'userid' => CWebUser::$data['userid'],
 			'idx' => zbx_dbstr($idx),
-			'value_id' => $favid,
+			'value_id' => zbx_dbstr($favid),
 			'type' => PROFILE_TYPE_ID
 		);
 		if (!is_null($favobj)) {
Index: frontends/php/include/classes/class.cchart.php
===================================================================
--- frontends/php/include/classes/class.cchart.php	(revision 38887)
+++ frontends/php/include/classes/class.cchart.php	(working copy)
@@ -226,18 +226,18 @@
 						'COUNT(*) AS count,AVG(value) AS avg,MIN(value) as min,'.
 						'MAX(value) AS max,MAX(clock) AS clock'.
 					' FROM history '.
-					' WHERE itemid='.$this->items[$i]['itemid'].
-						' AND clock>='.$from_time.
-						' AND clock<='.$to_time.
+					' WHERE itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND clock>='.zbx_dbstr($from_time).
+						' AND clock<='.zbx_dbstr($to_time).
 					' GROUP BY itemid,'.$calc_field
 					,
 					'SELECT itemid,'.$calc_field.' AS i,'.
 						'COUNT(*) AS count,AVG(value) AS avg,MIN(value) AS min,'.
 						'MAX(value) AS max,MAX(clock) AS clock'.
 					' FROM history_uint '.
-					' WHERE itemid='.$this->items[$i]['itemid'].
-						' AND clock>='.$from_time.
-						' AND clock<='.$to_time.
+					' WHERE itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND clock>='.zbx_dbstr($from_time).
+						' AND clock<='.zbx_dbstr($to_time).
 					' GROUP BY itemid,'.$calc_field
 				);
 			}
@@ -249,17 +249,17 @@
 						'MAX(value_max) AS max,MAX(clock) AS clock'.
 					' FROM trends'.
 					' WHERE itemid='.$this->items[$i]['itemid'].
-						' AND clock>='.$from_time.
-						' AND clock<='.$to_time.
+						' AND clock>='.zbx_dbstr($from_time).
+						' AND clock<='.zbx_dbstr($to_time).
 					' GROUP BY itemid,'.$calc_field
 					,
 					'SELECT itemid,'.$calc_field.' AS i,'.
 						'SUM(num) AS count,AVG(value_avg) AS avg,MIN(value_min) AS min,'.
 						'MAX(value_max) AS max,MAX(clock) AS clock'.
 					' FROM trends_uint '.
-					' WHERE itemid='.$this->items[$i]['itemid'].
-						' AND clock>='.$from_time.
-						' AND clock<='.$to_time.
+					' WHERE itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND clock>='.zbx_dbstr($from_time).
+						' AND clock<='.zbx_dbstr($to_time).
 					' GROUP BY itemid,'.$calc_field
 				);
 
@@ -439,7 +439,7 @@
 					' AND tr.status='.TRIGGER_STATUS_ENABLED.
 					' AND i.itemid=f.itemid'.
 					' AND h.hostid=i.hostid'.
-					' AND f.itemid='.$item['itemid'].
+					' AND f.itemid='.zbx_dbstr($item['itemid']).
 				' ORDER BY tr.priority'
 			);
 			while (($trigger = DBfetch($db_triggers)) && $cnt < $max) {
Index: frontends/php/include/classes/screens/CScreenTriggersOverview.php
===================================================================
--- frontends/php/include/classes/screens/CScreenTriggersOverview.php	(revision 38887)
+++ frontends/php/include/classes/screens/CScreenTriggersOverview.php	(working copy)
@@ -28,7 +28,7 @@
 	 */
 	public function get() {
 		$hostids = array();
-		$dbHostGroups = DBselect('SELECT DISTINCT hg.hostid FROM hosts_groups hg WHERE hg.groupid='.$this->screenitem['resourceid']);
+		$dbHostGroups = DBselect('SELECT DISTINCT hg.hostid FROM hosts_groups hg WHERE hg.groupid='.zbx_dbstr($this->screenitem['resourceid']));
 		while ($dbHostGroup = DBfetch($dbHostGroups)) {
 			$hostids[$dbHostGroup['hostid']] = $dbHostGroup['hostid'];
 		}
Index: frontends/php/include/classes/screens/CScreenDataOverview.php
===================================================================
--- frontends/php/include/classes/screens/CScreenDataOverview.php	(revision 38887)
+++ frontends/php/include/classes/screens/CScreenDataOverview.php	(working copy)
@@ -28,7 +28,7 @@
 	 */
 	public function get() {
 		$hostids = array();
-		$dbHostGroups = DBselect('SELECT DISTINCT hg.hostid FROM hosts_groups hg WHERE hg.groupid='.$this->screenitem['resourceid']);
+		$dbHostGroups = DBselect('SELECT DISTINCT hg.hostid FROM hosts_groups hg WHERE hg.groupid='.zbx_dbstr($this->screenitem['resourceid']));
 		while ($dbHostGroup = DBfetch($dbHostGroups)) {
 			$hostids[$dbHostGroup['hostid']] = $dbHostGroup['hostid'];
 		}
Index: frontends/php/include/classes/import/CImportReferencer.php
===================================================================
--- frontends/php/include/classes/import/CImportReferencer.php	(revision 38887)
+++ frontends/php/include/classes/import/CImportReferencer.php	(working copy)
@@ -651,7 +651,7 @@
 			foreach ($this->applications as $host => $applications) {
 				$hostId = $this->resolveHostOrTemplate($host);
 				if ($hostId) {
-					$sqlWhere[] = '(hostid='.$hostId.' AND '.dbConditionString('name', $applications).')';
+					$sqlWhere[] = '(hostid='.zbx_dbstr($hostId).' AND '.dbConditionString('name', $applications).')';
 				}
 			}
 
@@ -682,7 +682,7 @@
 			foreach ($this->items as $host => $keys) {
 				$hostId = $this->resolveHostOrTemplate($host);
 				if ($hostId) {
-					$sqlWhere[] = '(i.hostid='.$hostId.' AND '.dbConditionString('i.key_', $keys).')';
+					$sqlWhere[] = '(i.hostid='.zbx_dbstr($hostId).' AND '.dbConditionString('i.key_', $keys).')';
 				}
 			}
 
@@ -834,7 +834,7 @@
 			foreach ($this->macros as $host => $macros) {
 				$hostId = $this->resolveHostOrTemplate($host);
 				if ($hostId) {
-					$sqlWhere[] = '(hm.hostid='.$hostId.' AND '.dbConditionString('hm.macro', $macros).')';
+					$sqlWhere[] = '(hm.hostid='.zbx_dbstr($hostId).' AND '.dbConditionString('hm.macro', $macros).')';
 				}
 			}
 
@@ -882,7 +882,7 @@
 				foreach ($discoveryRule as $discoveryRuleKey => $hostPrototypes) {
 					$discoveryRuleId = $this->resolveItem($hostId, $discoveryRuleKey);
 					if ($hostId) {
-						$sqlWhere[] = '(hd.parent_itemid='.$discoveryRuleId.' AND '.dbConditionString('h.host', $hostPrototypes).')';
+						$sqlWhere[] = '(hd.parent_itemid='.zbx_dbstr($discoveryRuleId).' AND '.dbConditionString('h.host', $hostPrototypes).')';
 					}
 				}
 			}
Index: frontends/php/include/classes/class.cpie.php
===================================================================
--- frontends/php/include/classes/class.cpie.php	(revision 38887)
+++ frontends/php/include/classes/class.cpie.php	(working copy)
@@ -177,18 +177,18 @@
 						'AVG(h.value) AS avg,MIN(h.value) AS min,'.
 						'MAX(h.value) AS max,MAX(h.clock) AS clock'.
 					' FROM history h'.
-					' WHERE h.itemid='.$this->items[$i]['itemid'].
-						' AND h.clock>='.$from_time.
-						' AND h.clock<='.$to_time.
+					' WHERE h.itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND h.clock>='.zbx_dbstr($from_time).
+						' AND h.clock<='.zbx_dbstr($to_time).
 					' GROUP BY h.itemid'
 					,
 					'SELECT hu.itemid,'.
 						'AVG(hu.value) AS avg,MIN(hu.value) AS min,'.
 						'MAX(hu.value) AS max,MAX(hu.clock) AS clock'.
 					' FROM history_uint hu'.
-					' WHERE hu.itemid='.$this->items[$i]['itemid'].
-						' AND hu.clock>='.$from_time.
-						' AND hu.clock<='.$to_time.
+					' WHERE hu.itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND hu.clock>='.zbx_dbstr($from_time).
+						' AND hu.clock<='.zbx_dbstr($to_time).
 					' GROUP BY hu.itemid'
 				);
 			}
@@ -199,18 +199,18 @@
 						'AVG(t.value_avg) AS avg,MIN(t.value_min) AS min,'.
 						'MAX(t.value_max) AS max,MAX(t.clock) AS clock'.
 					' FROM trends t'.
-					' WHERE t.itemid='.$this->items[$i]['itemid'].
-						' AND t.clock>='.$from_time.
-						' AND t.clock<='.$to_time.
+					' WHERE t.itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND t.clock>='.zbx_dbstr($from_time).
+						' AND t.clock<='.zbx_dbstr($to_time).
 					' GROUP BY t.itemid'
 					,
 					'SELECT t.itemid,'.
 						'AVG(t.value_avg) AS avg,MIN(t.value_min) AS min,'.
 						'MAX(t.value_max) AS max,MAX(t.clock) AS clock'.
 					' FROM trends_uint t'.
-					' WHERE t.itemid='.$this->items[$i]['itemid'].
-						' AND t.clock>='.$from_time.
-						' AND t.clock<='.$to_time.
+					' WHERE t.itemid='.zbx_dbstr($this->items[$i]['itemid']).
+						' AND t.clock>='.zbx_dbstr($from_time).
+						' AND t.clock<='.zbx_dbstr($to_time).
 					' GROUP BY t.itemid'
 				);
 			}
Index: frontends/php/include/views/configuration.screen.constructor.edit.php
===================================================================
--- frontends/php/include/views/configuration.screen.constructor.edit.php	(revision 38887)
+++ frontends/php/include/views/configuration.screen.constructor.edit.php	(working copy)
@@ -415,7 +415,7 @@
 			'SELECT DISTINCT n.name AS node_name,s.screenid,s.name'.
 			' FROM screens s'.
 				' LEFT JOIN nodes n ON n.nodeid='.DBid2nodeid('s.screenid').
-			' WHERE s.screenid='.$resourceId
+			' WHERE s.screenid='.zbx_dbstr($resourceId)
 		);
 		while ($row = DBfetch($db_screens)) {
 			$screen = API::Screen()->get(array(
Index: frontends/php/include/maps.inc.php
===================================================================
--- frontends/php/include/maps.inc.php	(revision 38887)
+++ frontends/php/include/maps.inc.php	(working copy)
@@ -289,7 +289,7 @@
 			$res = DBselect('SELECT hi.ip,hi.dns,hi.useip,h.host,h.name,hi.type AS interfacetype'.
 					' FROM interface hi,hosts h'.
 					' WHERE hi.hostid=h.hostid'.
-						' AND hi.main=1 AND hi.hostid='.$selement['elementid']);
+						' AND hi.main=1 AND hi.hostid='.zbx_dbstr($selement['elementid']));
 
 			// process interface priorities
 			$tmpPriority = 0;
@@ -309,7 +309,7 @@
 					' WHERE h.hostid=hi.hostid'.
 						' AND hi.hostid=i.hostid'.
 						' AND i.itemid=f.itemid'.
-						' AND hi.main=1 AND f.triggerid='.$selement['elementid'].
+						' AND hi.main=1 AND f.triggerid='.zbx_dbstr($selement['elementid']).
 					' ORDER BY f.functionid');
 
 			// process interface priorities, build $hostsByFunctionId array
@@ -496,7 +496,7 @@
 			$db_mapselements = DBselect(
 				'SELECT DISTINCT se.elementtype,se.elementid'.
 				' FROM sysmaps_elements se'.
-				' WHERE se.sysmapid='.$db_element['elementid']
+				' WHERE se.sysmapid='.zbx_dbstr($db_element['elementid'])
 			);
 			while ($db_mapelement = DBfetch($db_mapselements)) {
 				get_map_elements($db_mapelement, $elements);
Index: frontends/php/include/hosts.inc.php
===================================================================
--- frontends/php/include/hosts.inc.php	(revision 38887)
+++ frontends/php/include/hosts.inc.php	(working copy)
@@ -484,7 +484,7 @@
 }
 
 function get_hostgroup_by_groupid($groupid) {
-	$groups = DBfetch(DBselect('SELECT g.* FROM groups g WHERE g.groupid='.$groupid));
+	$groups = DBfetch(DBselect('SELECT g.* FROM groups g WHERE g.groupid='.zbx_dbstr($groupid)));
 
 	if ($groups) {
 		return $groups;
@@ -526,7 +526,7 @@
 }
 
 function get_host_by_hostid($hostid, $no_error_message = 0) {
-	$row = DBfetch(DBselect('SELECT h.* FROM hosts h WHERE h.hostid='.$hostid));
+	$row = DBfetch(DBselect('SELECT h.* FROM hosts h WHERE h.hostid='.zbx_dbstr($hostid)));
 
 	if ($row) {
 		return $row;
@@ -578,7 +578,7 @@
 }
 
 function get_application_by_applicationid($applicationid, $no_error_message = 0) {
-	$row = DBfetch(DBselect('SELECT a.* FROM applications a WHERE a.applicationid='.$applicationid));
+	$row = DBfetch(DBselect('SELECT a.* FROM applications a WHERE a.applicationid='.zbx_dbstr($applicationid)));
 
 	if ($row) {
 		return $row;
@@ -794,7 +794,7 @@
 }
 
 function isTemplate($hostId) {
-	$dbHost = DBfetch(DBselect('SELECT h.status FROM hosts h WHERE h.hostid='.$hostId));
+	$dbHost = DBfetch(DBselect('SELECT h.status FROM hosts h WHERE h.hostid='.zbx_dbstr($hostId)));
 
 	return ($dbHost && $dbHost['status'] == HOST_STATUS_TEMPLATE);
 }
Index: frontends/php/include/users.inc.php
===================================================================
--- frontends/php/include/users.inc.php	(revision 38887)
+++ frontends/php/include/users.inc.php	(working copy)
@@ -137,12 +137,12 @@
  */
 function add_user_to_group($userId, $userGroupId) {
 	if (granted2move_user($userId, $userGroupId)) {
-		DBexecute('DELETE FROM users_groups WHERE userid='.$userId.' AND usrgrpid='.$userGroupId);
+		DBexecute('DELETE FROM users_groups WHERE userid='.zbx_dbstr($userId).' AND usrgrpid='.zbx_dbstr($userGroupId));
 
 		$usersGroupsId = get_dbid('users_groups', 'id');
 
 		return DBexecute(
-			'INSERT INTO users_groups (id,usrgrpid,userid) VALUES ('.$usersGroupsId.','.$userGroupId.','.$userId.')'
+			'INSERT INTO users_groups (id,usrgrpid,userid) VALUES ('.zbx_dbstr($usersGroupsId).','.zbx_dbstr($userGroupId).','.zbx_dbstr($userId).')'
 		);
 	}
 	else {
@@ -162,7 +162,7 @@
  */
 function remove_user_from_group($userId, $userGroupId) {
 	if (granted2move_user($userId, $userGroupId)) {
-		return DBexecute('DELETE FROM users_groups WHERE userid='.$userId.' AND usrgrpid='.$userGroupId);
+		return DBexecute('DELETE FROM users_groups WHERE userid='.zbx_dbstr($userId).' AND usrgrpid='.zbx_dbstr($userGroupId));
 	}
 	else {
 		error(_('User cannot change status of himself.'));
Index: frontends/php/include/events.inc.php
===================================================================
--- frontends/php/include/events.inc.php	(revision 38887)
+++ frontends/php/include/events.inc.php	(working copy)
@@ -99,7 +99,7 @@
 function get_tr_event_by_eventid($eventid) {
 	$sql = 'SELECT e.*,t.triggerid,t.description,t.expression,t.priority,t.status,t.type'.
 			' FROM events e,triggers t'.
-			' WHERE e.eventid='.$eventid.
+			' WHERE e.eventid='.zbx_dbstr($eventid).
 				' AND e.object='.EVENT_OBJECT_TRIGGER.
 				' AND t.triggerid=e.objectid';
 	return DBfetch(DBselect($sql));
@@ -164,10 +164,10 @@
 
 	$sql = 'SELECT e.*'.
 			' FROM events e'.
-			' WHERE e.objectid='.$currentEvent['objectid'].
-				' AND e.eventid>'.$currentEvent['eventid'].
-				' AND e.object='.$currentEvent['object'].
-				' AND e.source='.$currentEvent['source'].
+			' WHERE e.objectid='.zbx_dbstr($currentEvent['objectid']).
+				' AND e.eventid>'.zbx_dbstr($currentEvent['eventid']).
+				' AND e.object='.zbx_dbstr($currentEvent['object']).
+				' AND e.source='.zbx_dbstr($currentEvent['source']).
 			' ORDER BY e.object,e.objectid,e.eventid';
 	return DBfetch(DBselect($sql, 1));
 }
Index: frontends/php/include/images.inc.php
===================================================================
--- frontends/php/include/images.inc.php	(revision 38887)
+++ frontends/php/include/images.inc.php	(working copy)
@@ -36,7 +36,7 @@
 	static $images = array();
 
 	if (!isset($images[$imageid])) {
-		$row = DBfetch(DBselect('SELECT i.* FROM images i WHERE i.imageid='.$imageid));
+		$row = DBfetch(DBselect('SELECT i.* FROM images i WHERE i.imageid='.zbx_dbstr($imageid)));
 		$row['image'] = zbx_unescape_image($row['image']);
 		$images[$imageid] = $row;
 	}
Index: frontends/php/include/maintenances.inc.php
===================================================================
--- frontends/php/include/maintenances.inc.php	(revision 38887)
+++ frontends/php/include/maintenances.inc.php	(working copy)
@@ -23,7 +23,7 @@
 	return DBfetch(DBselect(
 			'SELECT m.*'.
 			' FROM maintenances m'.
-			' WHERE m.maintenanceid='.$maintenanceid.
+			' WHERE m.maintenanceid='.zbx_dbstr($maintenanceid).
 				andDbNode('m.maintenanceid')
 	));
 }
Index: frontends/php/include/discovery.inc.php
===================================================================
--- frontends/php/include/discovery.inc.php	(revision 38887)
+++ frontends/php/include/discovery.inc.php	(working copy)
@@ -172,7 +172,7 @@
 }
 
 function get_discovery_rule_by_druleid($druleid) {
-	return DBfetch(DBselect('SELECT d.* FROM drules d WHERE d.druleid='.$druleid));
+	return DBfetch(DBselect('SELECT d.* FROM drules d WHERE d.druleid='.zbx_dbstr($druleid)));
 }
 
 function delete_discovery_rule($druleid) {
@@ -182,7 +182,7 @@
 		'SELECT DISTINCT c.actionid'.
 		' FROM conditions c'.
 		' WHERE c.conditiontype='.CONDITION_TYPE_DRULE.
-			' AND c.value=\''.$druleid.'\''
+			' AND c.value='.zbx_dbstr($druleid)
 	);
 	while ($action = DBfetch($dbActions)) {
 		$actionids[] = $action['actionid'];
@@ -191,8 +191,8 @@
 	// disabling actions with deleted conditions
 	if (!empty($actionids)) {
 		DBexecute('UPDATE actions SET status='.ACTION_STATUS_DISABLED.' WHERE '.dbConditionInt('actionid', $actionids));
-		DBexecute('DELETE FROM conditions WHERE conditiontype='.CONDITION_TYPE_DRULE.' AND value=\''.$druleid.'\'');
+		DBexecute('DELETE FROM conditions WHERE conditiontype='.CONDITION_TYPE_DRULE.' AND value='.zbx_dbstr($druleid));
 	}
 
-	return DBexecute('DELETE FROM drules WHERE druleid='.$druleid);
+	return DBexecute('DELETE FROM drules WHERE druleid='.zbx_dbstr($druleid));
 }
Index: frontends/php/include/nodes.inc.php
===================================================================
--- frontends/php/include/nodes.inc.php	(revision 38887)
+++ frontends/php/include/nodes.inc.php	(working copy)
@@ -30,7 +30,7 @@
 		DBexecute(
 			'INSERT INTO profiles (profileid,userid,idx,value_id,type)'.
 			' VALUES ('.get_dbid('profiles', 'profileid').','.CWebUser::$data['userid'].','.
-				zbx_dbstr('web.nodes.selected').','.$nodeId.',4)');
+				zbx_dbstr('web.nodes.selected').','.zbx_dbstr($nodeId).',4)');
 	}
 
 	DBend();
@@ -287,7 +287,6 @@
 				error(_('Master node already exists.'));
 				return false;
 			}
-			$masterId = 'NULL';
 			break;
 
 		default:
@@ -295,13 +294,13 @@
 			return false;
 	}
 
-	if (DBfetch(DBselect('SELECT n.nodeid FROM nodes n WHERE n.nodeid='.$nodeId))) {
+	if (DBfetch(DBselect('SELECT n.nodeid FROM nodes n WHERE n.nodeid='.zbx_dbstr($nodeId)))) {
 		error(_('Node with same ID already exists.'));
 		return false;
 	}
 
 	$result = DBexecute('INSERT INTO nodes (nodeid,name,ip,port,nodetype,masterid)'.
-		' VALUES ('.$nodeId.','.zbx_dbstr($name).','.zbx_dbstr($ip).','.$port.','.$nodeType.','.$masterId.')');
+		' VALUES ('.zbx_dbstr($nodeId).','.zbx_dbstr($name).','.zbx_dbstr($ip).','.zbx_dbstr($port).','.zbx_dbstr($nodeType).','.($masterId ? zbx_dbstr($masterId) : 'NULL').')');
 
 	if ($result && $nodeType == ZBX_NODE_MASTER) {
 		DBexecute('UPDATE nodes SET masterid='.$nodeId.' WHERE nodeid='.$ZBX_LOCALNODEID);
@@ -320,14 +319,14 @@
 	}
 
 	return DBexecute(
-		'UPDATE nodes SET name='.zbx_dbstr($name).',ip='.zbx_dbstr($ip).',port='.$port.' WHERE nodeid='.$nodeId
+		'UPDATE nodes SET name='.zbx_dbstr($name).',ip='.zbx_dbstr($ip).',port='.zbx_dbstr($port).' WHERE nodeid='.zbx_dbstr($nodeId)
 	);
 }
 
 function delete_node($nodeId) {
 	$result = false;
 
-	$node = DBfetch(DBselect('SELECT n.nodeid,n.masterid FROM nodes n WHERE n.nodeid='.$nodeId));
+	$node = DBfetch(DBselect('SELECT n.nodeid,n.masterid FROM nodes n WHERE n.nodeid='.zbx_dbstr($nodeId)));
 	$nodeType = detect_node_type($node['nodeid'], $node['masterid']);
 
 	if ($nodeType == ZBX_NODE_LOCAL) {
@@ -335,8 +334,8 @@
 	}
 	else {
 		$result = (
-			DBexecute('UPDATE nodes SET masterid=NULL WHERE masterid='.$nodeId) &&
-			DBexecute('DELETE FROM nodes WHERE nodeid='.$nodeId)
+			DBexecute('UPDATE nodes SET masterid=NULL WHERE masterid='.zbx_dbstr($nodeId)) &&
+			DBexecute('DELETE FROM nodes WHERE nodeid='.zbx_dbstr($nodeId))
 		);
 
 		if ($nodeType != ZBX_NODE_MASTER) {
@@ -348,7 +347,7 @@
 }
 
 function get_node_by_nodeid($nodeId) {
-	return DBfetch(DBselect('SELECT n.* FROM nodes n WHERE n.nodeid='.$nodeId));
+	return DBfetch(DBselect('SELECT n.* FROM nodes n WHERE n.nodeid='.zbx_dbstr($nodeId)));
 }
 
 function get_node_path($nodeId, $result = '') {
Index: frontends/php/include/valuemap.inc.php
===================================================================
--- frontends/php/include/valuemap.inc.php	(revision 38887)
+++ frontends/php/include/valuemap.inc.php	(working copy)
@@ -62,7 +62,7 @@
 	unset($valueMap['valuemapid']);
 
 	// check existence
-	$sql = 'SELECT v.valuemapid FROM valuemaps v WHERE v.valuemapid='.$valueMapId.' '.andDbNode('v.valuemapid');
+	$sql = 'SELECT v.valuemapid FROM valuemaps v WHERE v.valuemapid='.zbx_dbstr($valueMapId).' '.andDbNode('v.valuemapid');
 	if (!DBfetch(DBselect($sql))) {
 		throw new Exception(_s('Value map with valuemapid "%1$s" does not exist.', $valueMapId));
 	}
@@ -233,7 +233,7 @@
 	$dbMappings = DBselect(
 		'SELECT m.mappingid,m.value,m.newvalue'.
 		' FROM mappings m'.
-		' WHERE m.valuemapid='.$valueMapId.
+		' WHERE m.valuemapid='.zbx_dbstr($valueMapId).
 			' '.andDbNode('m.mappingid')
 	);
 	while ($mapping = DBfetch($dbMappings)) {
@@ -266,7 +266,7 @@
 	$dbMappings = DBselect(
 		'SELECT m.newvalue'.
 		' FROM mappings m'.
-		' WHERE m.valuemapid='.$valueMapId.
+		' WHERE m.valuemapid='.zbx_dbstr($valueMapId).
 			' AND m.value='.zbx_dbstr($value).
 			' '.andDbNode('m.mappingid')
 	);
Index: frontends/php/include/httptest.inc.php
===================================================================
--- frontends/php/include/httptest.inc.php	(revision 38887)
+++ frontends/php/include/httptest.inc.php	(working copy)
@@ -77,7 +77,7 @@
 		' FROM items i,httpstepitem si,httpstep s'.
 		' WHERE i.itemid=si.itemid'.
 			' AND si.httpstepid=s.httpstepid'.
-			' AND s.httptestid='.$httptestid
+			' AND s.httptestid='.zbx_dbstr($httptestid)
 	);
 	while ($item_data = DBfetch($db_items)) {
 		if (!delete_history_by_itemid($item_data['itemid'])) {
@@ -89,11 +89,11 @@
 }
 
 function get_httptest_by_httptestid($httptestid) {
-	return DBfetch(DBselect('SELECT ht.* FROM httptest ht WHERE ht.httptestid='.$httptestid));
+	return DBfetch(DBselect('SELECT ht.* FROM httptest ht WHERE ht.httptestid='.zbx_dbstr($httptestid)));
 }
 
 function get_httpstep_by_no($httptestid, $no) {
-	return DBfetch(DBselect('SELECT hs.* FROM httpstep hs WHERE hs.httptestid='.$httptestid.' AND hs.no='.$no));
+	return DBfetch(DBselect('SELECT hs.* FROM httpstep hs WHERE hs.httptestid='.zbx_dbstr($httptestid).' AND hs.no='.zbx_dbstr($no)));
 }
 
 function get_httptests_by_hostid($hostids) {
Index: frontends/php/include/page_footer.php
===================================================================
--- frontends/php/include/page_footer.php	(revision 38887)
+++ frontends/php/include/page_footer.php	(working copy)
@@ -75,7 +75,7 @@
 		$post_script .= 'PageRefresh.init('.(CWebUser::$data['refresh'] * 1000).');'."\n";
 	}
 
-	if (in_array('flickerfreescreen.js', $page['scripts'])) {
+	if (isset($page['scripts']) && in_array('flickerfreescreen.js', $page['scripts'])) {
 		$post_script .= 'window.flickerfreeScreenShadow.timeout = '.SCREEN_REFRESH_TIMEOUT.' * 1000;'."\n";
 		$post_script .= 'window.flickerfreeScreenShadow.responsiveness = '.SCREEN_REFRESH_RESPONSIVENESS.' * 1000;'."\n";
 	}
Index: frontends/php/include/acknow.inc.php
===================================================================
--- frontends/php/include/acknow.inc.php	(revision 38887)
+++ frontends/php/include/acknow.inc.php	(working copy)
@@ -23,7 +23,7 @@
 	$dbEvents = DBfetch(DBselect(
 		'SELECT e.*'.
 		' FROM events e'.
-		' WHERE e.objectid='.$triggerId.
+		' WHERE e.objectid='.zbx_dbstr($triggerId).
 			' AND e.source='.EVENT_SOURCE_TRIGGERS.
 			' AND e.object='.EVENT_OBJECT_TRIGGER.
 		' ORDER BY e.objectid DESC,e.object DESC,e.eventid DESC',
Index: frontends/php/include/triggers.inc.php
===================================================================
--- frontends/php/include/triggers.inc.php	(revision 38887)
+++ frontends/php/include/triggers.inc.php	(working copy)
@@ -107,7 +107,7 @@
 function get_service_status_of_trigger($triggerid) {
 	$sql = 'SELECT t.triggerid,t.priority'.
 			' FROM triggers t'.
-			' WHERE t.triggerid='.$triggerid.
+			' WHERE t.triggerid='.zbx_dbstr($triggerid).
 				' AND t.status='.TRIGGER_STATUS_ENABLED.
 				' AND t.value='.TRIGGER_VALUE_TRUE;
 	$rows = DBfetch(DBselect($sql, 1));
@@ -264,7 +264,7 @@
 }
 
 function get_trigger_by_triggerid($triggerid) {
-	$db_trigger = DBfetch(DBselect('SELECT t.* FROM triggers t WHERE t.triggerid='.$triggerid));
+	$db_trigger = DBfetch(DBselect('SELECT t.* FROM triggers t WHERE t.triggerid='.zbx_dbstr($triggerid)));
 	if (!empty($db_trigger)) {
 		return $db_trigger;
 	}
@@ -289,7 +289,7 @@
 	return DBselect(
 		'SELECT DISTINCT t.*'.
 		' FROM triggers t,functions f,items i'.
-		' WHERE i.hostid='.$hostid.
+		' WHERE i.hostid='.zbx_dbstr($hostid).
 			' AND f.itemid=i.itemid'.
 			' AND f.triggerid=t.triggerid'
 	);
@@ -1077,8 +1077,8 @@
 				' FROM triggers t,functions f,items i'.
 				' WHERE t.triggerid=f.triggerid'.
 					' AND f.itemid=i.itemid'.
-					' AND t.templateid='.$val.
-					' AND i.hostid='.$hostid;
+					' AND t.templateid='.zbx_dbstr($val).
+					' AND i.hostid='.zbx_dbstr($hostid);
 		if ($db_new_dep = DBfetch(DBselect($sql))) {
 			$deps[$id] = $db_new_dep['triggerid'];
 		}
@@ -1296,7 +1296,7 @@
 			'SELECT DISTINCT i.itemid,i.name,i.key_,i.value_type'.
 			' FROM items i,functions f'.
 			' WHERE f.itemid=i.itemid'.
-				' AND f.triggerid='.$trigger['triggerid']
+				' AND f.triggerid='.zbx_dbstr($trigger['triggerid'])
 		);
 		while ($item = DBfetch($dbItems)) {
 			$triggerItems[] = array(
@@ -1319,7 +1319,7 @@
 		$dependencyTable->addRow(bold(_('Depends on').NAME_DELIMITER));
 
 		$isDependencyFound = false;
-		$dbDependencies = DBselect('SELECT td.* FROM trigger_depends td WHERE td.triggerid_down='.$triggerId);
+		$dbDependencies = DBselect('SELECT td.* FROM trigger_depends td WHERE td.triggerid_down='.zbx_dbstr($triggerId));
 		while ($dbDependency = DBfetch($dbDependencies)) {
 			$dependencyTable->addRow(SPACE.'-'.SPACE.CMacrosResolverHelper::resolveTriggerNameById($dbDependency['triggerid_up']));
 			$isDependencyFound = true;
@@ -1339,7 +1339,7 @@
 		$dependencyTable->addRow(bold(_('Dependent').NAME_DELIMITER));
 
 		$isDependencyFound = false;
-		$dbDependencies = DBselect('SELECT td.* FROM trigger_depends td WHERE td.triggerid_up='.$triggerId);
+		$dbDependencies = DBselect('SELECT td.* FROM trigger_depends td WHERE td.triggerid_up='.zbx_dbstr($triggerId));
 		while ($dbDependency = DBfetch($dbDependencies)) {
 			$dependencyTable->addRow(SPACE.'-'.SPACE.CMacrosResolverHelper::resolveTriggerNameById($dbDependency['triggerid_down']));
 			$isDependencyFound = true;
@@ -1377,10 +1377,10 @@
 	if ($period_start > 0 && $period_start <= time()) {
 		$sql = 'SELECT e.eventid,e.value'.
 				' FROM events e'.
-				' WHERE e.objectid='.$triggerid.
+				' WHERE e.objectid='.zbx_dbstr($triggerid).
 					' AND e.source='.EVENT_SOURCE_TRIGGERS.
 					' AND e.object='.EVENT_OBJECT_TRIGGER.
-					' AND e.clock<'.$period_start.
+					' AND e.clock<'.zbx_dbstr($period_start).
 				' ORDER BY e.eventid DESC';
 		if ($row = DBfetch(DBselect($sql, 1))) {
 			$start_value = $row['value'];
@@ -1390,14 +1390,14 @@
 
 	$sql = 'SELECT COUNT(e.eventid) AS cnt,MIN(e.clock) AS min_clock,MAX(e.clock) AS max_clock'.
 			' FROM events e'.
-			' WHERE e.objectid='.$triggerid.
+			' WHERE e.objectid='.zbx_dbstr($triggerid).
 				' AND e.source='.EVENT_SOURCE_TRIGGERS.
 				' AND e.object='.EVENT_OBJECT_TRIGGER;
 	if ($period_start != 0) {
-		$sql .= ' AND clock>='.$period_start;
+		$sql .= ' AND clock>='.zbx_dbstr($period_start);
 	}
 	if ($period_end != 0) {
-		$sql .= ' AND clock<='.$period_end;
+		$sql .= ' AND clock<='.zbx_dbstr($period_end);
 	}
 
 	$db_events = DBfetch(DBselect($sql));
@@ -1436,7 +1436,7 @@
 	$db_events = DBselect(
 		'SELECT e.eventid,e.clock,e.value'.
 		' FROM events e'.
-		' WHERE e.objectid='.$triggerid.
+		' WHERE e.objectid='.zbx_dbstr($triggerid).
 			' AND e.source='.EVENT_SOURCE_TRIGGERS.
 			' AND e.object='.EVENT_OBJECT_TRIGGER.
 			' AND e.clock BETWEEN '.$min.' AND '.$max.
Index: frontends/php/include/forms.inc.php
===================================================================
--- frontends/php/include/forms.inc.php	(revision 38887)
+++ frontends/php/include/forms.inc.php	(working copy)
@@ -64,7 +64,7 @@
 			$data['user_medias'] = array();
 			$dbMedia = DBselect('SELECT m.mediaid,m.mediatypeid,m.period,m.sendto,m.severity,m.active'.
 					' FROM media m'.
-					' WHERE m.userid='.$userid
+					' WHERE m.userid='.zbx_dbstr($userid)
 			);
 			while ($dbMedium = DBfetch($dbMedia)) {
 				$data['user_medias'][] = $dbMedium;
@@ -1206,7 +1206,7 @@
 		$data['db_applications'] = DBfetchArray(DBselect(
 			'SELECT DISTINCT a.applicationid,a.name'.
 			' FROM applications a'.
-			' WHERE a.hostid='.$data['hostid']
+			' WHERE a.hostid='.zbx_dbstr($data['hostid'])
 		));
 		order_result($data['db_applications'], 'name');
 
@@ -1219,7 +1219,7 @@
 		// valuemapid
 		if ($data['limited']) {
 			if (!empty($data['valuemapid'])) {
-				if ($map_data = DBfetch(DBselect('SELECT v.name FROM valuemaps v WHERE v.valuemapid='.$data['valuemapid']))) {
+				if ($map_data = DBfetch(DBselect('SELECT v.name FROM valuemaps v WHERE v.valuemapid='.zbx_dbstr($data['valuemapid'])))) {
 					$data['valuemaps'] = $map_data['name'];
 				}
 			}
@@ -1369,7 +1369,7 @@
 						' LEFT JOIN items i ON f.itemid=i.itemid'.
 						' LEFT JOIN hosts h ON i.hostid=h.hostid'.
 						' LEFT JOIN item_discovery id ON i.itemid=id.itemid'.
-					' WHERE t.triggerid='.$tmp_triggerid
+					' WHERE t.triggerid='.zbx_dbstr($tmp_triggerid)
 				));
 				if (bccomp($data['triggerid'], $tmp_triggerid) != 0) {
 					// parent trigger prototype link
@@ -1417,7 +1417,7 @@
 					'SELECT t.triggerid,t.description'.
 					' FROM triggers t,trigger_depends d'.
 					' WHERE t.triggerid=d.triggerid_up'.
-						' AND d.triggerid_down='.$data['triggerid']
+						' AND d.triggerid_down='.zbx_dbstr($data['triggerid'])
 				);
 				while ($trigger = DBfetch($db_triggers)) {
 					if (uint_in_array($trigger['triggerid'], $data['dependencies'])) {
Index: frontends/php/include/regexp.inc.php
===================================================================
--- frontends/php/include/regexp.inc.php	(revision 38887)
+++ frontends/php/include/regexp.inc.php	(working copy)
@@ -23,7 +23,7 @@
 	return DBfetch(DBselect(
 		'SELECT re.*'.
 		' FROM regexps re'.
-		' WHERE regexpid='.$regexpId.
+		' WHERE regexpid='.zbx_dbstr($regexpId).
 			andDbNode('re.regexpid')
 	));
 }
@@ -34,7 +34,7 @@
 	$dbExpressions = DBselect(
 		'SELECT e.expressionid,e.expression,e.expression_type,e.exp_delimiter,e.case_sensitive'.
 		' FROM expressions e'.
-		' WHERE regexpid='.$regexpId.
+		' WHERE regexpid='.zbx_dbstr($regexpId).
 			andDbNode('e.expressionid')
 	);
 	while ($expression = DBfetch($dbExpressions)) {
Index: frontends/php/include/actions.inc.php
===================================================================
--- frontends/php/include/actions.inc.php	(revision 38887)
+++ frontends/php/include/actions.inc.php	(working copy)
@@ -214,7 +214,7 @@
 					'SELECT dr.name,c.dcheckid,c.type,c.key_,c.ports'.
 					' FROM drules dr,dchecks c'.
 					' WHERE dr.druleid=c.druleid'.
-						' AND c.dcheckid='.$value
+						' AND c.dcheckid='.zbx_dbstr($value)
 			));
 			if ($row) {
 				$str_val = $row['name'].NAME_DELIMITER.discovery_check2str($row['type'], $row['key_'], $row['ports']);
@@ -474,7 +474,7 @@
 						$sql = 'SELECT a.def_shortdata,a.def_longdata '.
 								' FROM actions a,operations o '.
 								' WHERE a.actionid=o.actionid '.
-									' AND o.operationid='.$data['operationid'];
+									' AND o.operationid='.zbx_dbstr($data['operationid']);
 						if ($rows = DBfetch(DBselect($sql, 1))) {
 							$result[] = array(bold(_('Subject').NAME_DELIMITER), BR(), zbx_nl2br($rows['def_shortdata']));
 							$result[] = array(bold(_('Message').NAME_DELIMITER), BR(), zbx_nl2br($rows['def_longdata']));
@@ -971,7 +971,7 @@
 			' FROM events e,alerts a'.
 				' LEFT JOIN users u ON u.userid=a.userid'.
 				' LEFT JOIN media_type mt ON mt.mediatypeid=a.mediatypeid'.
-			' WHERE a.eventid='.$eventid.
+			' WHERE a.eventid='.zbx_dbstr($eventid).
 				(is_null($status)?'':' AND a.status='.$status).
 				' AND e.eventid=a.eventid'.
 				' AND a.alerttype IN ('.ALERT_TYPE_MESSAGE.','.ALERT_TYPE_COMMAND.')'.
Index: frontends/php/include/screens.inc.php
===================================================================
--- frontends/php/include/screens.inc.php	(revision 38887)
+++ frontends/php/include/screens.inc.php	(working copy)
@@ -57,7 +57,7 @@
 }
 
 function get_screen_by_screenid($screenid) {
-	$dbScreen = DBfetch(DBselect('SELECT s.* FROM screens s WHERE s.screenid='.$screenid));
+	$dbScreen = DBfetch(DBselect('SELECT s.* FROM screens s WHERE s.screenid='.zbx_dbstr($screenid)));
 
 	return empty($dbScreen) ? false : $dbScreen;
 }
@@ -70,7 +70,7 @@
 	$db_scr_items = DBselect(
 		'SELECT si.resourceid'.
 		' FROM screens_items si'.
-		' WHERE si.screenid='.$child_screenid.
+		' WHERE si.screenid='.zbx_dbstr($child_screenid).
 		' AND si.resourcetype='.SCREEN_RESOURCE_SCREEN
 	);
 	while ($scr_item = DBfetch($db_scr_items)) {
@@ -86,7 +86,7 @@
 	$db_slides = DBfetch(DBselect(
 		'SELECT MIN(s.step) AS min_step,MAX(s.step) AS max_step'.
 		' FROM slides s'.
-		' WHERE s.slideshowid='.$slideshowid
+		' WHERE s.slideshowid='.zbx_dbstr($slideshowid)
 	));
 	if (!$db_slides || is_null($db_slides['min_step'])) {
 		return false;
@@ -103,9 +103,9 @@
 	return DBfetch(DBselect(
 		'SELECT sl.*'.
 		' FROM slides sl,slideshows ss'.
-		' WHERE ss.slideshowid='.$slideshowid.
+		' WHERE ss.slideshowid='.zbx_dbstr($slideshowid).
 			' AND sl.slideshowid=ss.slideshowid'.
-			' AND sl.step='.$curr_step
+			' AND sl.step='.zbx_dbstr($curr_step)
 	));
 }
 
@@ -114,7 +114,7 @@
 
 	$sql = 'SELECT s.slideshowid'.
 			' FROM slideshows s'.
-			' WHERE s.slideshowid='.$slideshowid.
+			' WHERE s.slideshowid='.zbx_dbstr($slideshowid).
 				andDbNode('s.slideshowid', get_current_nodeid(null, $perm));
 	if (DBselect($sql)) {
 		$result = true;
@@ -123,7 +123,7 @@
 		$db_screens = DBselect(
 			'SELECT DISTINCT s.screenid'.
 			' FROM slides s'.
-			' WHERE s.slideshowid='.$slideshowid
+			' WHERE s.slideshowid='.zbx_dbstr($slideshowid)
 		);
 		while ($slide_data = DBfetch($db_screens)) {
 			$screenids[$slide_data['screenid']] = $slide_data['screenid'];
@@ -149,7 +149,7 @@
 }
 
 function get_slideshow_by_slideshowid($slideshowid) {
-	return DBfetch(DBselect('SELECT s.* FROM slideshows s WHERE s.slideshowid='.$slideshowid));
+	return DBfetch(DBselect('SELECT s.* FROM slideshows s WHERE s.slideshowid='.zbx_dbstr($slideshowid)));
 }
 
 function add_slideshow($name, $delay, $slides) {
@@ -185,7 +185,7 @@
 	$slideshowid = get_dbid('slideshows', 'slideshowid');
 	$result = DBexecute(
 		'INSERT INTO slideshows (slideshowid,name,delay)'.
-		' VALUES ('.$slideshowid.','.zbx_dbstr($name).','.$delay.')'
+		' VALUES ('.zbx_dbstr($slideshowid).','.zbx_dbstr($name).','.zbx_dbstr($delay).')'
 	);
 
 	// create slides
@@ -200,7 +200,7 @@
 
 		$result = DBexecute(
 			'INSERT INTO slides (slideid,slideshowid,screenid,step,delay)'.
-			' VALUES ('.$slideid.','.$slideshowid.','.$slide['screenid'].','.($i++).','.$slide['delay'].')'
+			' VALUES ('.zbx_dbstr($slideid).','.zbx_dbstr($slideshowid).','.zbx_dbstr($slide['screenid']).','.($i++).','.zbx_dbstr($slide['delay']).')'
 		);
 		if (!$result) {
 			return false;
@@ -236,7 +236,7 @@
 		'SELECT s.slideshowid'.
 		' FROM slideshows s'.
 		' WHERE s.name='.zbx_dbstr($name).
-			' AND s.slideshowid<>'.$slideshowid.
+			' AND s.slideshowid<>'.zbx_dbstr($slideshowid).
 			' '.andDbNode('s.slideshowid')
 	));
 	if (!empty($db_slideshow)) {
@@ -244,7 +244,7 @@
 		return false;
 	}
 
-	$db_slideshow = DBfetchArray(DBselect('SELECT * FROM slideshows WHERE slideshowid='.$slideshowid));
+	$db_slideshow = DBfetchArray(DBselect('SELECT * FROM slideshows WHERE slideshowid='.zbx_dbstr($slideshowid)));
 	$db_slideshow = $db_slideshow[0];
 	$changed = false;
 	$slideshow = array('name' => $name, 'delay' => $delay);
@@ -255,13 +255,13 @@
 		}
 	}
 	if ($changed) {
-		if (!$result = DBexecute('UPDATE slideshows SET name='.zbx_dbstr($name).',delay='.$delay.' WHERE slideshowid='.$slideshowid)) {
+		if (!$result = DBexecute('UPDATE slideshows SET name='.zbx_dbstr($name).',delay='.zbx_dbstr($delay).' WHERE slideshowid='.zbx_dbstr($slideshowid))) {
 			return false;
 		}
 	}
 
 	// get slides
-	$db_slides = DBfetchArrayAssoc(DBselect('SELECT s.* FROM slides s WHERE s.slideshowid='.$slideshowid), 'slideid');
+	$db_slides = DBfetchArrayAssoc(DBselect('SELECT s.* FROM slides s WHERE s.slideshowid='.zbx_dbstr($slideshowid)), 'slideid');
 
 	$slidesToDel = zbx_objectValues($db_slides, 'slideid');
 	$slidesToDel = zbx_toHash($slidesToDel);
@@ -271,7 +271,7 @@
 		if (isset($db_slides[$slide['slideid']])) {
 			// update slide
 			if ($db_slides[$slide['slideid']]['delay'] != $slide['delay'] || $db_slides[$slide['slideid']]['step'] != $step) {
-				$result = DBexecute('UPDATE slides SET  step='.$step.', delay='.$slide['delay'].' WHERE slideid='.$slide['slideid']);
+				$result = DBexecute('UPDATE slides SET step='.zbx_dbstr($step).', delay='.zbx_dbstr($slide['delay']).' WHERE slideid='.zbx_dbstr($slide['slideid']));
 			}
 			// do nothing with slide
 			else {
@@ -284,7 +284,7 @@
 			$slideid = get_dbid('slides', 'slideid');
 			$result = DBexecute(
 				'INSERT INTO slides (slideid,slideshowid,screenid,step,delay)'.
-				' VALUES ('.$slideid.','.$slideshowid.','.$slide['screenid'].','.$step.','.$slide['delay'].')'
+				' VALUES ('.zbx_dbstr($slideid).','.zbx_dbstr($slideshowid).','.zbx_dbstr($slide['screenid']).','.zbx_dbstr($step).','.zbx_dbstr($slide['delay']).')'
 			);
 		}
 		$step ++;
@@ -302,9 +302,9 @@
 }
 
 function delete_slideshow($slideshowid) {
-	$result = DBexecute('DELETE FROM slideshows where slideshowid='.$slideshowid);
-	$result &= DBexecute('DELETE FROM slides where slideshowid='.$slideshowid);
-	$result &= DBexecute('DELETE FROM profiles WHERE idx=\'web.favorite.screenids\' AND source=\'slideshowid\' AND value_id='.$slideshowid);
+	$result = DBexecute('DELETE FROM slideshows where slideshowid='.zbx_dbstr($slideshowid));
+	$result &= DBexecute('DELETE FROM slides where slideshowid='.zbx_dbstr($slideshowid));
+	$result &= DBexecute('DELETE FROM profiles WHERE idx=\'web.favorite.screenids\' AND source=\'slideshowid\' AND value_id='.zbx_dbstr($slideshowid));
 
 	return $result;
 }
@@ -314,14 +314,14 @@
 	if ($config == 0) {
 		$sql = 'SELECT si.screenitemid'.
 				' FROM screens_items si'.
-				' WHERE si.screenid='.$elid.
+				' WHERE si.screenid='.zbx_dbstr($elid).
 					' AND si.dynamic='.SCREEN_DYNAMIC_ITEM.
 					' '.andDbNode('si.screenitemid');
 	}
 	else {
 		$sql = 'SELECT si.screenitemid'.
 				' FROM slides s,screens_items si'.
-				' WHERE s.slideshowid='.$elid.
+				' WHERE s.slideshowid='.zbx_dbstr($elid).
 					' AND si.screenid=s.screenid'.
 					' AND si.dynamic='.SCREEN_DYNAMIC_ITEM.
 					' '.andDbNode('si.screenitemid');
Index: frontends/php/include/perm.inc.php
===================================================================
--- frontends/php/include/perm.inc.php	(revision 38887)
+++ frontends/php/include/perm.inc.php	(working copy)
@@ -46,7 +46,7 @@
 function check_perm2system($userid) {
 	$sql = 'SELECT g.usrgrpid'.
 			' FROM usrgrp g,users_groups ug'.
-			' WHERE ug.userid='.$userid.
+			' WHERE ug.userid='.zbx_dbstr($userid).
 				' AND g.usrgrpid=ug.usrgrpid'.
 				' AND g.users_status='.GROUP_STATUS_DISABLED;
 	if ($res = DBfetch(DBselect($sql, 1))) {
@@ -89,7 +89,7 @@
 
 	$sql = 'SELECT MAX(g.gui_access) AS gui_access'.
 			' FROM usrgrp g,users_groups ug'.
-			' WHERE ug.userid='.$userid.
+			' WHERE ug.userid='.zbx_dbstr($userid).
 				' AND g.usrgrpid=ug.usrgrpid';
 	$db_access = DBfetch(DBselect($sql));
 	if (!zbx_empty($db_access['gui_access'])) {
@@ -173,7 +173,7 @@
 					' LEFT JOIN rights r ON r.id=hg.groupid'.
 					' LEFT JOIN users_groups g ON r.groupid=g.usrgrpid'.
 					' LEFT JOIN nodes n ON '.DBid2nodeid('hg.groupid').'=n.nodeid'.
-				' WHERE g.userid='.$userId.
+				' WHERE g.userid='.zbx_dbstr($userId).
 					andDbNode('hg.groupid', $nodeId).
 				' GROUP BY n.nodeid,n.name,hg.groupid,hg.name,g.userid'.
 				' ORDER BY node_name,hg.name,permission';
@@ -522,7 +522,7 @@
 	if (!isset($userGroups[$userId])) {
 		$userGroups[$userId] = array();
 
-		$result = DBselect('SELECT usrgrpid FROM users_groups WHERE userid='.$userId);
+		$result = DBselect('SELECT usrgrpid FROM users_groups WHERE userid='.zbx_dbstr($userId));
 		while ($row = DBfetch($result)) {
 			$userGroups[$userId][] = $row['usrgrpid'];
 		}
Index: frontends/php/include/items.inc.php
===================================================================
--- frontends/php/include/items.inc.php	(revision 38887)
+++ frontends/php/include/items.inc.php	(working copy)
@@ -278,8 +278,9 @@
 	while ($item = DBfetch($db_items)) {
 		$old_status = $item['status'];
 		if ($status != $old_status) {
-			$result &= DBexecute('UPDATE items SET status='.$status.
-				' WHERE itemid='.$item['itemid']);
+			$result &= DBexecute(
+				'UPDATE items SET status='.zbx_dbstr($status).' WHERE itemid='.zbx_dbstr($item['itemid'])
+			);
 			if ($result) {
 				$host = get_host_by_hostid($item['hostid']);
 				$item_new = get_item_by_itemid($item['itemid']);
@@ -469,7 +470,7 @@
 }
 
 function get_item_by_itemid($itemid) {
-	$db_items = DBfetch(DBselect('SELECT i.* FROM items i WHERE i.itemid='.$itemid));
+	$db_items = DBfetch(DBselect('SELECT i.* FROM items i WHERE i.itemid='.zbx_dbstr($itemid)));
 	if ($db_items) {
 		return $db_items;
 	}
@@ -486,7 +487,7 @@
 			'i.valuemapid,i.delay_flex,i.params,i.ipmi_sensor,i.templateid,i.authtype,i.username,i.password,'.
 			'i.publickey,i.privatekey,i.flags,i.filter,i.description,i.inventory_link'.
 		' FROM items i'.
-		' WHERE i.itemid='.$itemid));
+		' WHERE i.itemid='.zbx_dbstr($itemid)));
 	if ($row) {
 		return $row;
 	}
@@ -519,7 +520,7 @@
 		$db_items = DBselect(
 			'SELECT src.*'.
 			' FROM items src,items dest'.
-			' WHERE dest.itemid='.$itemid.
+			' WHERE dest.itemid='.zbx_dbstr($itemid).
 				' AND src.key_=dest.key_'.
 				' AND '.dbConditionInt('src.hostid', $dest_hostids)
 		);
@@ -872,7 +873,7 @@
 		'SELECT a1.applicationid'.
 		' FROM applications a1,applications a2'.
 		' WHERE a1.name=a2.name'.
-			' AND a1.hostid='.$hostid.
+			' AND a1.hostid='.zbx_dbstr($hostid).
 			' AND '.dbConditionInt('a2.applicationid', $applications)
 	);
 	while ($app = DBfetch($db_apps)) {
@@ -1025,7 +1026,7 @@
 			'SELECT '.$function.'(value) AS value'.
 			' FROM '.$historyTables[$item['value_type']].
 			' WHERE clock>'.(time() - convertFunctionValue($param)).
-			' AND itemid='.$item['itemid'].
+			' AND itemid='.zbx_dbstr($item['itemid']).
 			' HAVING COUNT(*)>0' // necessary because DBselect() return 0 if empty data set, for graph templates
 		);
 		if ($row = DBfetch($result)) {
@@ -1057,9 +1058,9 @@
 
 	$sql = 'SELECT value'.
 			' FROM '.$table.
-			' WHERE itemid='.$db_item['itemid'].
-				' AND clock='.$clock.
-				' AND ns='.$ns;
+			' WHERE itemid='.zbx_dbstr($db_item['itemid']).
+				' AND clock='.zbx_dbstr($clock).
+				' AND ns='.zbx_dbstr($ns);
 	if (null != ($row = DBfetch(DBselect($sql, 1)))) {
 		$value = $row['value'];
 	}
@@ -1071,17 +1072,17 @@
 
 	$sql = 'SELECT DISTINCT clock'.
 			' FROM '.$table.
-			' WHERE itemid='.$db_item['itemid'].
-				' AND clock='.$clock.
-				' AND ns<'.$ns;
+			' WHERE itemid='.zbx_dbstr($db_item['itemid']).
+				' AND clock='.zbx_dbstr($clock).
+				' AND ns<'.zbx_dbstr($ns);
 	if (null != ($row = DBfetch(DBselect($sql)))) {
 		$max_clock = $row['clock'];
 	}
 	if ($max_clock == 0) {
 		$sql = 'SELECT MAX(clock) AS clock'.
 				' FROM '.$table.
-				' WHERE itemid='.$db_item['itemid'].
-					' AND clock<'.$clock;
+				' WHERE itemid='.zbx_dbstr($db_item['itemid']).
+					' AND clock<'.zbx_dbstr($clock);
 		if (null != ($row = DBfetch(DBselect($sql)))) {
 			$max_clock = $row['clock'];
 		}
@@ -1093,15 +1094,15 @@
 	if ($clock == $max_clock) {
 		$sql = 'SELECT value'.
 				' FROM '.$table.
-				' WHERE itemid='.$db_item['itemid'].
-					' AND clock='.$clock.
-					' AND ns<'.$ns;
+				' WHERE itemid='.zbx_dbstr($db_item['itemid']).
+					' AND clock='.zbx_dbstr($clock).
+					' AND ns<'.zbx_dbstr($ns);
 	}
 	else {
 		$sql = 'SELECT value'.
 				' FROM '.$table.
-				' WHERE itemid='.$db_item['itemid'].
-					' AND clock='.$max_clock.
+				' WHERE itemid='.zbx_dbstr($db_item['itemid']).
+					' AND clock='.zbx_dbstr($max_clock).
 				' ORDER BY itemid,clock desc,ns desc';
 	}
 
Index: frontends/php/include/services.inc.php
===================================================================
--- frontends/php/include/services.inc.php	(revision 38887)
+++ frontends/php/include/services.inc.php	(working copy)
@@ -43,7 +43,7 @@
 		$result = DBselect(
 			'SELECT s.status'.
 			' FROM services s,services_links l'.
-			' WHERE l.serviceupid='.$serviceid.
+			' WHERE l.serviceupid='.zbx_dbstr($serviceid).
 				' AND s.serviceid=l.servicedownid'.
 			' ORDER BY s.status'.$sort_order
 		);
@@ -78,7 +78,7 @@
 	$result = DBselect(
 		'SELECT sl.servicedownid'.
 		' FROM services_links sl'.
-		' WHERE sl.serviceupid='.$serviceid.
+		' WHERE sl.serviceupid='.zbx_dbstr($serviceid).
 			($soft ? '' : ' AND sl.soft=0')
 	);
 	while ($row = DBfetch($result)) {
@@ -355,7 +355,7 @@
 		'SELECT l.serviceupid,s.algorithm'.
 		' FROM services_links l,services s'.
 		' WHERE s.serviceid=l.serviceupid'.
-			' AND l.servicedownid='.$serviceid
+			' AND l.servicedownid='.zbx_dbstr($serviceid)
 	);
 	while ($row = DBfetch($result)) {
 		$serviceupid = $row['serviceupid'];
@@ -364,7 +364,7 @@
 		if ($algorithm == SERVICE_ALGORITHM_MAX || $algorithm == SERVICE_ALGORITHM_MIN) {
 			$status = get_service_status($serviceupid, $algorithm);
 			add_service_alarm($serviceupid, $status, time());
-			DBexecute('UPDATE services SET status='.$status.' WHERE serviceid='.$serviceupid);
+			DBexecute('UPDATE services SET status='.$status.' WHERE serviceid='.zbx_dbstr($serviceupid));
 		}
 		elseif ($algorithm != SERVICE_ALGORITHM_NONE) {
 			error(_('Unknown calculation algorithm of service status').SPACE.'['.$algorithm.']');
@@ -372,7 +372,7 @@
 		}
 	}
 
-	$result = DBselect('SELECT sl.serviceupid FROM services_links sl WHERE sl.servicedownid='.$serviceid);
+	$result = DBselect('SELECT sl.serviceupid FROM services_links sl WHERE sl.servicedownid='.zbx_dbstr($serviceid));
 	while ($row = DBfetch($result)) {
 		$serviceupid = $row['serviceupid'];
 		update_services_rec($serviceupid); // ATTENTION: recursion!!!
@@ -387,9 +387,9 @@
  * @param $status
  */
 function update_services($triggerid, $status) {
-	DBexecute('UPDATE services SET status='.$status.' WHERE triggerid='.$triggerid);
+	DBexecute('UPDATE services SET status='.$status.' WHERE triggerid='.zbx_dbstr($triggerid));
 
-	$result = DBselect('SELECT s.serviceid FROM services s WHERE s.triggerid='.$triggerid);
+	$result = DBselect('SELECT s.serviceid FROM services s WHERE s.triggerid='.zbx_dbstr($triggerid));
 	while ($row = DBfetch($result)) {
 		add_service_alarm($row['serviceid'], $status, time());
 		update_services_rec($row['serviceid']);
@@ -442,7 +442,7 @@
 	$result = DBselect(
 		'SELECT sa.servicealarmid,sa.value'.
 		' FROM service_alarms sa'.
-		' WHERE sa.serviceid='.$serviceid.
+		' WHERE sa.serviceid='.zbx_dbstr($serviceid).
 		' ORDER BY sa.servicealarmid DESC', 1
 	);
 	$row = DBfetch($result);
@@ -458,7 +458,7 @@
 	if (latest_service_alarm($serviceid, $status)) {
 		return true;
 	}
-	return DBexecute('INSERT INTO service_alarms (servicealarmid,serviceid,clock,value) VALUES ('.get_dbid('service_alarms', 'servicealarmid').','.$serviceid.','.$clock.','.$status.')');
+	return DBexecute('INSERT INTO service_alarms (servicealarmid,serviceid,clock,value) VALUES ('.get_dbid('service_alarms', 'servicealarmid').','.zbx_dbstr($serviceid).','.zbx_dbstr($clock).','.zbx_dbstr($status).')');
 }
 
 /**
Index: frontends/php/include/profiles.inc.php
===================================================================
--- frontends/php/include/profiles.inc.php	(revision 38887)
+++ frontends/php/include/profiles.inc.php	(working copy)
@@ -178,7 +178,7 @@
 			'profileid' => get_dbid('profiles', 'profileid'),
 			'userid' => self::$userDetails['userid'],
 			'idx' => zbx_dbstr($idx),
-			$value_type => ($value_type == 'value_str') ? zbx_dbstr($value) : $value,
+			$value_type => zbx_dbstr($value),
 			'type' => $type,
 			'idx2' => $idx2
 		);
@@ -197,11 +197,10 @@
 		}
 
 		$value_type = self::getFieldByType($type);
-		$value = ($value_type == 'value_str') ? zbx_dbstr($value) : $value;
 
 		return DBexecute(
 			'UPDATE profiles SET '.
-				$value_type.'='.$value.','.
+				$value_type.'='.zbx_dbstr($value).','.
 				' type='.$type.
 			' WHERE userid='.self::$userDetails['userid'].
 				' AND idx='.zbx_dbstr($idx).
@@ -276,7 +275,7 @@
 		}
 	}
 	if (isset($configs['alert_usrgrpid'])) {
-		if ($configs['alert_usrgrpid'] != 0 && !DBfetch(DBselect('SELECT u.usrgrpid FROM usrgrp u WHERE u.usrgrpid='.$configs['alert_usrgrpid']))) {
+		if ($configs['alert_usrgrpid'] != 0 && !DBfetch(DBselect('SELECT u.usrgrpid FROM usrgrp u WHERE u.usrgrpid='.zbx_dbstr($configs['alert_usrgrpid'])))) {
 			error(_('Incorrect user group.'));
 			return false;
 		}
Index: frontends/php/include/graphs.inc.php
===================================================================
--- frontends/php/include/graphs.inc.php	(revision 38887)
+++ frontends/php/include/graphs.inc.php	(working copy)
@@ -120,7 +120,7 @@
 	$dbGraphs = DBselect(
 		'SELECT MAX(g.graphtype) AS graphtype,MIN(gi.yaxisside) AS yaxissidel,MAX(gi.yaxisside) AS yaxissider,MAX(g.height) AS height'.
 		' FROM graphs g,graphs_items gi'.
-		' WHERE g.graphid='.$graphid.
+		' WHERE g.graphid='.zbx_dbstr($graphid).
 			' AND gi.graphid=g.graphid'
 	);
 	if ($graph = DBfetch($dbGraphs)) {
@@ -154,7 +154,7 @@
 		' FROM graphs g,graphs_items gi,items i'.
 		' WHERE g.graphid=gi.graphid'.
 			' AND gi.itemid=i.itemid'.
-			' AND i.hostid='.$hostid
+			' AND i.hostid='.zbx_dbstr($hostid)
 	);
 }
 
@@ -172,7 +172,7 @@
 		' FROM graphs_items gi,items i,hosts h'.
 		' WHERE h.hostid=i.hostid'.
 			' AND gi.itemid=i.itemid'.
-			' AND gi.graphid='.$graphid
+			' AND gi.graphid='.zbx_dbstr($graphid)
 	);
 }
 
@@ -187,7 +187,7 @@
 	$dbItems = DBselect(
 		'SELECT DISTINCT gi.itemid'.
 		' FROM graphs_items gi'.
-		' WHERE gi.graphid='.$graphid
+		' WHERE gi.graphid='.zbx_dbstr($graphid)
 	);
 	while ($item = DBfetch($dbItems)) {
 		$itemids[$item['itemid']] = $item['itemid'];
@@ -270,7 +270,7 @@
 		}
 
 		foreach ($itemIds as $itemId) {
-			$sqlUnions[] = 'SELECT MIN(ht.clock) AS c FROM '.$sqlFrom.' ht WHERE ht.itemid='.$itemId;
+			$sqlUnions[] = 'SELECT MIN(ht.clock) AS c FROM '.$sqlFrom.' ht WHERE ht.itemid='.zbx_dbstr($itemId);
 		}
 
 		$dbMin = DBfetch(DBselect(
@@ -285,7 +285,7 @@
 }
 
 function get_graph_by_graphid($graphid) {
-	$dbGraphs = DBselect('SELECT g.* FROM graphs g WHERE g.graphid='.$graphid);
+	$dbGraphs = DBselect('SELECT g.* FROM graphs g WHERE g.graphid='.zbx_dbstr($graphid));
 	$dbGraphs = DBfetch($dbGraphs);
 	if (!empty($dbGraphs)) {
 		return $dbGraphs;
@@ -312,8 +312,8 @@
 			'SELECT dest.itemid,src.key_'.
 			' FROM items dest,items src'.
 			' WHERE dest.key_=src.key_'.
-				' AND dest.hostid='.$dest_hostid.
-				' AND src.itemid='.$gitem['itemid']
+				' AND dest.hostid='.zbx_dbstr($dest_hostid).
+				' AND src.itemid='.zbx_dbstr($gitem['itemid'])
 		));
 
 		if ($dbItem) {
Index: frontends/php/popup.php
===================================================================
--- frontends/php/popup.php	(revision 38887)
+++ frontends/php/popup.php	(working copy)
@@ -110,7 +110,6 @@
 		break;
 }
 $page['file'] = 'popup.php';
-$page['scripts'] = array();
 
 define('ZBX_PAGE_NO_MENU', 1);
 
@@ -676,7 +675,7 @@
 	$table = new CTableInfo(_('No items defined.'));
 	$table->setHeader(array(_('Key'), _('Name')));
 
-	$result = DBselect('SELECT hi.* FROM help_items hi WHERE hi.itemtype='.$itemtype.' ORDER BY hi.key_');
+	$result = DBselect('SELECT hi.* FROM help_items hi WHERE hi.itemtype='.zbx_dbstr($itemtype).' ORDER BY hi.key_');
 	while ($row = DBfetch($result)) {
 		$action = get_window_opener($dstfrm, $dstfld1, html_entity_decode($row[$srcfld1])).(isset($srcfld2) ? get_window_opener($dstfrm, $dstfld2, $row[$srcfld2]) : '');
 		$name = new CSpan($row['key_'], 'link');
Index: frontends/php/adm.images.php
===================================================================
--- frontends/php/adm.images.php	(revision 38887)
+++ frontends/php/adm.images.php	(working copy)
@@ -43,7 +43,7 @@
  * Permissions
  */
 if (isset($_REQUEST['imageid'])) {
-	$dbImage = DBfetch(DBselect('SELECT i.imagetype,i.name FROM images i WHERE i.imageid='.get_request('imageid')));
+	$dbImage = DBfetch(DBselect('SELECT i.imagetype,i.name FROM images i WHERE i.imageid='.zbx_dbstr(get_request('imageid'))));
 	if (empty($dbImage)) {
 		access_deny();
 	}
Index: frontends/php/items.php
===================================================================
--- frontends/php/items.php	(revision 38887)
+++ frontends/php/items.php	(working copy)
@@ -855,7 +855,7 @@
 		$data['db_applications'] = DBfetchArray(DBselect(
 			'SELECT a.applicationid,a.name'.
 			' FROM applications a'.
-			' WHERE a.hostid='.$data['hostid'].
+			' WHERE a.hostid='.zbx_dbstr($data['hostid']).
 			' ORDER BY a.name'
 		));
 	}
Index: frontends/php/graphs.php
===================================================================
--- frontends/php/graphs.php	(revision 38887)
+++ frontends/php/graphs.php	(working copy)
@@ -27,7 +27,6 @@
 $page['title'] = isset($_REQUEST['parent_discoveryid']) ? _('Configuration of graph prototypes') : _('Configuration of graphs');
 $page['file'] = 'graphs.php';
 $page['hist_arg'] = array('hostid', 'parent_discoveryid');
-$page['scripts'] = array();
 
 require_once dirname(__FILE__).'/include/page_header.php';
 
Index: frontends/php/report2.php
===================================================================
--- frontends/php/report2.php	(revision 38887)
+++ frontends/php/report2.php	(working copy)
@@ -262,7 +262,7 @@
 
 		$sqlCondition = empty($_REQUEST['filter_hostid'])
 			? ' AND '.dbConditionInt('h.hostid', $templateIds)
-			: ' AND h.hostid='.$_REQUEST['filter_hostid'];
+			: ' AND h.hostid='.zbx_dbstr($_REQUEST['filter_hostid']);
 
 		$sql =
 			'SELECT DISTINCT t.triggerid,t.description,h.name'.
Index: frontends/php/report5.php
===================================================================
--- frontends/php/report5.php	(revision 38887)
+++ frontends/php/report5.php	(working copy)
@@ -24,7 +24,6 @@
 $page['title'] = _('Most busy triggers top 100');
 $page['file'] = 'report5.php';
 $page['hist_arg'] = array('period');
-$page['scripts'] = array();
 
 require_once dirname(__FILE__).'/include/page_header.php';
 
Index: frontends/php/maps.php
===================================================================
--- frontends/php/maps.php	(revision 38887)
+++ frontends/php/maps.php	(working copy)
@@ -25,7 +25,6 @@
 $page['title'] = _('Network maps');
 $page['file'] = 'maps.php';
 $page['hist_arg'] = array('sysmapid');
-$page['scripts'] = array();
 $page['type'] = detect_page_type(PAGE_TYPE_HTML);
 
 if ($page['type'] == PAGE_TYPE_HTML) {
Index: frontends/php/slideconf.php
===================================================================
--- frontends/php/slideconf.php	(revision 38887)
+++ frontends/php/slideconf.php	(working copy)
@@ -165,7 +165,7 @@
 		$data['delay'] = $dbSlideshow['delay'];
 
 		// get slides
-		$db_slides = DBselect('SELECT s.* FROM slides s WHERE s.slideshowid='.$data['slideshowid'].' ORDER BY s.step');
+		$db_slides = DBselect('SELECT s.* FROM slides s WHERE s.slideshowid='.zbx_dbstr($data['slideshowid']).' ORDER BY s.step');
 		while ($slide = DBfetch($db_slides)) {
 			$data['slides'][$slide['step']] = array(
 				'slideid' => $slide['slideid'],
Index: frontends/php/usergrps.php
===================================================================
--- frontends/php/usergrps.php	(revision 38887)
+++ frontends/php/usergrps.php	(working copy)
@@ -29,7 +29,6 @@
 $page['title'] = _('Configuration of user groups');
 $page['file'] = 'usergrps.php';
 $page['hist_arg'] = array('config');
-$page['scripts'] = array();
 
 require_once dirname(__FILE__).'/include/page_header.php';
 
@@ -365,7 +364,7 @@
 			'SELECT DISTINCT u.userid '.
 			' FROM users u,users_groups ug '.
 			' WHERE u.userid=ug.userid '.
-				' AND ug.usrgrpid='.$data['usrgrpid']
+				' AND ug.usrgrpid='.zbx_dbstr($data['usrgrpid'])
 		);
 		while ($dbUser = DBfetch($dbUsers)) {
 			$data['group_users'][$dbUser['userid']] = $dbUser['userid'];
@@ -379,7 +378,7 @@
 			' FROM groups g'.
 				' LEFT JOIN rights r ON r.id=g.groupid'.
 				' LEFT JOIN nodes n ON n.nodeid='.DBid2nodeid('g.groupid').
-			' WHERE r.groupid='.$data['usrgrpid']
+			' WHERE r.groupid='.zbx_dbstr($data['usrgrpid'])
 		);
 		while ($dbRight = DBfetch($dbRights)) {
 			if (!empty($dbRight['nodename'])) {
@@ -412,7 +411,7 @@
 		$sqlFrom = ',users_groups g';
 		$sqlWhere =
 			' WHERE '.dbConditionInt('u.userid', $data['group_users']).
-				' OR (u.userid=g.userid AND g.usrgrpid='.$data['selected_usrgrp'].andDbNode('u.userid').')';
+				' OR (u.userid=g.userid AND g.usrgrpid='.zbx_dbstr($data['selected_usrgrp']).andDbNode('u.userid').')';
 	}
 	else {
 		$sqlFrom = '';
Index: frontends/php/adm.other.php
===================================================================
--- frontends/php/adm.other.php	(revision 38887)
+++ frontends/php/adm.other.php	(working copy)
@@ -81,7 +81,7 @@
 				$val = _('None');
 			}
 			else {
-				$val = DBfetch(DBselect('SELECT u.name FROM usrgrp u WHERE u.usrgrpid='.$val));
+				$val = DBfetch(DBselect('SELECT u.name FROM usrgrp u WHERE u.usrgrpid='.zbx_dbstr($val)));
 				$val = $val['name'];
 			}
 
Index: frontends/php/proxies.php
===================================================================
--- frontends/php/proxies.php	(revision 38887)
+++ frontends/php/proxies.php	(working copy)
@@ -154,7 +154,7 @@
 		$dbHosts = DBselect(
 			'SELECT h.hostid,h.status'.
 			' FROM hosts h'.
-			' WHERE h.proxy_hostid='.$hostId.
+			' WHERE h.proxy_hostid='.zbx_dbstr($hostId).
 				andDbNode('h.hostid')
 		);
 		while ($dbHost = DBfetch($dbHosts)) {
