From 5d9bfd601be34fa223624df786c66068b334c775 Mon Sep 17 00:00:00 2001
From: Kentaro Ohkouchi <nanasess@fsm.ne.jp>
Date: Thu, 24 Mar 2022 15:21:38 +0900
Subject: [PATCH] =?UTF-8?q?=E6=95=B0=E5=80=A4=E9=A0=85=E7=9B=AE=E3=81=AB?=
 =?UTF-8?q?=E3=82=A8=E3=82=B9=E3=82=B1=E3=83=BC=E3=83=97=E5=87=A6=E7=90=86?=
 =?UTF-8?q?=E3=82=92=E4=BB=98=E4=B8=8E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

エスケープ漏れがあった場合でも、デフォルトフィルターによってサニタイ
ズされるため実害は無いが、保険のためエスケープ処理を追加
---
 .../Smarty/templates/admin/basis/delivery.tpl |  8 +--
 data/Smarty/templates/admin/basis/holiday.tpl | 10 ++--
 data/Smarty/templates/admin/basis/kiyaku.tpl  | 10 ++--
 data/Smarty/templates/admin/basis/payment.tpl | 10 ++--
 data/Smarty/templates/admin/basis/tax.tpl     |  4 +-
 .../templates/admin/contents/csv_sql.tpl      |  4 +-
 .../templates/admin/contents/file_manager.tpl |  2 +-
 .../templates/admin/contents/recommend.tpl    |  4 +-
 .../admin/contents/recommend_search.tpl       |  2 +-
 data/Smarty/templates/admin/customer/edit.tpl |  4 +-
 data/Smarty/templates/admin/design/index.tpl  | 56 +++++++++----------
 .../templates/admin/design/main_edit.tpl      |  2 +-
 data/Smarty/templates/admin/order/edit.tpl    |  2 +-
 data/Smarty/templates/admin/order/index.tpl   |  8 +--
 .../templates/admin/order/product_select.tpl  |  4 +-
 data/Smarty/templates/admin/order/status.tpl  |  4 +-
 .../templates/admin/ownersstore/plugin.tpl    | 14 ++---
 .../admin/ownersstore/products_list.tpl       |  4 +-
 .../templates/admin/products/category.tpl     |  8 +--
 .../admin/products/category_tree_fork.tpl     |  2 +-
 .../Smarty/templates/admin/products/class.tpl | 10 ++--
 .../admin/products/classcategory.tpl          | 10 ++--
 .../templates/admin/products/complete.tpl     |  2 +-
 .../Smarty/templates/admin/products/index.tpl |  8 +--
 .../Smarty/templates/admin/products/maker.tpl | 10 ++--
 .../templates/admin/products/product_rank.tpl |  6 +-
 .../admin/products/product_rank_tree_fork.tpl |  2 +-
 .../templates/admin/products/review.tpl       |  4 +-
 data/Smarty/templates/admin/system/index.tpl  |  8 +--
 .../templates/default/mypage/delivery.tpl     |  4 +-
 .../templates/default/products/detail.tpl     |  4 +-
 .../templates/default/products/list.tpl       |  2 +-
 .../templates/default/shopping/confirm.tpl    |  2 +-
 .../templates/default/shopping/deliv.tpl      |  6 +-
 .../templates/default/shopping/multiple.tpl   |  2 +-
 .../default/shopping/nonmember_input.tpl      |  2 +-
 .../templates/default/shopping/payment.tpl    |  2 +-
 .../templates/mobile/mypage/history.tpl       |  2 +-
 data/Smarty/templates/mobile/mypage/index.tpl |  2 +-
 .../templates/mobile/products/detail.tpl      |  6 +-
 .../mobile/products/select_find1.tpl          |  2 +-
 .../mobile/products/select_find2.tpl          |  2 +-
 .../templates/mobile/products/select_item.tpl |  4 +-
 .../templates/mobile/shopping/confirm.tpl     |  4 +-
 .../templates/mobile/shopping/deliv.tpl       | 14 ++---
 .../templates/mobile/shopping/multiple.tpl    |  2 +-
 .../templates/mobile/shopping/payment.tpl     |  4 +-
 .../mobile/shopping/select_deliv.tpl          |  4 +-
 .../templates/sphone/frontparts/bloc/news.tpl |  2 +-
 .../templates/sphone/mypage/delivery.tpl      |  4 +-
 .../templates/sphone/mypage/history.tpl       |  2 +-
 .../templates/sphone/products/detail.tpl      |  6 +-
 .../templates/sphone/shopping/confirm.tpl     |  2 +-
 .../templates/sphone/shopping/deliv.tpl       |  4 +-
 .../templates/sphone/shopping/multiple.tpl    |  2 +-
 .../sphone/shopping/nonmember_input.tpl       |  2 +-
 .../templates/sphone/shopping/payment.tpl     |  2 +-
 57 files changed, 159 insertions(+), 159 deletions(-)

diff --git a/data/Smarty/templates/admin/basis/delivery.tpl b/data/Smarty/templates/admin/basis/delivery.tpl
index 0a2962dc85..5bcbf53215 100644
--- a/data/Smarty/templates/admin/basis/delivery.tpl
+++ b/data/Smarty/templates/admin/basis/delivery.tpl
@@ -50,16 +50,16 @@
                 <tr>
                     <td><!--{$arrDelivList[cnt].name|h}--></td>
                     <td><!--{$arrDelivList[cnt].service_name|h}--></td>
-                    <td align="center"><a href="?" onclick="eccube.changeAction('./delivery_input.php'); eccube.setModeAndSubmit('pre_edit', 'deliv_id', <!--{$arrDelivList[cnt].deliv_id}-->); return false;">
+                    <td align="center"><a href="?" onclick="eccube.changeAction('./delivery_input.php'); eccube.setModeAndSubmit('pre_edit', 'deliv_id', <!--{$arrDelivList[cnt].deliv_id|h}-->); return false;">
                         編集</a></td>
-                    <td align="center"><a href="?" onclick="eccube.setModeAndSubmit('delete', 'deliv_id', <!--{$arrDelivList[cnt].deliv_id}-->); return false;">
+                    <td align="center"><a href="?" onclick="eccube.setModeAndSubmit('delete', 'deliv_id', <!--{$arrDelivList[cnt].deliv_id|h}-->); return false;">
                         削除</a></td>
                     <td align="center">
                     <!--{if $smarty.section.cnt.iteration != 1}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('up','deliv_id', '<!--{$arrDelivList[cnt].deliv_id}-->'); return false;">上へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('up','deliv_id', '<!--{$arrDelivList[cnt].deliv_id|h}-->'); return false;">上へ</a>
                     <!--{/if}-->
                     <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('down','deliv_id', '<!--{$arrDelivList[cnt].deliv_id}-->'); return false;">下へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('down','deliv_id', '<!--{$arrDelivList[cnt].deliv_id|h}-->'); return false;">下へ</a>
                     <!--{/if}-->
                     </td>
                 </tr>
diff --git a/data/Smarty/templates/admin/basis/holiday.tpl b/data/Smarty/templates/admin/basis/holiday.tpl
index 37809e8994..4dbd6b3c0f 100644
--- a/data/Smarty/templates/admin/basis/holiday.tpl
+++ b/data/Smarty/templates/admin/basis/holiday.tpl
@@ -25,7 +25,7 @@
 <form name="form1" id="form1" method="post" action="?">
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="edit" />
-    <input type="hidden" name="holiday_id" value="<!--{$tpl_holiday_id}-->" />
+    <input type="hidden" name="holiday_id" value="<!--{$tpl_holiday_id|h}-->" />
     <div id="basis" class="contents-main">
 
         <table class="form">
@@ -85,7 +85,7 @@
                 <td><!--{$arrHoliday[cnt].month|h}-->月<!--{$arrHoliday[cnt].day|h}-->日</td>
                 <td class="center">
                     <!--{if $tpl_holiday_id != $arrHoliday[cnt].holiday_id}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id}-->); return false;">編集</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id|h}-->); return false;">編集</a>
                     <!--{else}-->
                     編集中
                     <!--{/if}-->
@@ -94,15 +94,15 @@
                     <!--{if $arrClassCatCount[$class_id] > 0}-->
                     -
                     <!--{else}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('delete', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id}-->); return false;">削除</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('delete', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id|h}-->); return false;">削除</a>
                     <!--{/if}-->
                 </td>
                 <td class="center">
                     <!--{if $smarty.section.cnt.iteration != 1}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('up', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id}-->); return false;">上へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('up', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id|h}-->); return false;">上へ</a>
                     <!--{/if}-->
                     <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('down', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id}-->); return false;">下へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('down', 'holiday_id', <!--{$arrHoliday[cnt].holiday_id|h}-->); return false;">下へ</a>
                     <!--{/if}-->
                 </td>
             </tr>
diff --git a/data/Smarty/templates/admin/basis/kiyaku.tpl b/data/Smarty/templates/admin/basis/kiyaku.tpl
index 527dd7ce32..153cd686d1 100644
--- a/data/Smarty/templates/admin/basis/kiyaku.tpl
+++ b/data/Smarty/templates/admin/basis/kiyaku.tpl
@@ -25,7 +25,7 @@
 <form name="form1" id="form1" method="post" action="?">
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="edit" />
-    <input type="hidden" name="kiyaku_id" value="<!--{$tpl_kiyaku_id}-->" />
+    <input type="hidden" name="kiyaku_id" value="<!--{$tpl_kiyaku_id|h}-->" />
     <div id="basis" class="contents-main">
         <table class="form">
             <tr>
@@ -69,7 +69,7 @@
                     <td><!--{* 規格名 *}--><!--{$arrKiyaku[cnt].kiyaku_title|h}--></td>
                     <td align="center">
                         <!--{if $tpl_kiyaku_id != $arrKiyaku[cnt].kiyaku_id}-->
-                        <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id}-->); return false;">編集</a>
+                        <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id|h}-->); return false;">編集</a>
                         <!--{else}-->
                         編集中
                         <!--{/if}-->
@@ -78,15 +78,15 @@
                         <!--{if $arrClassCatCount[$class_id] > 0}-->
                         -
                         <!--{else}-->
-                        <a href="?" onclick="eccube.setModeAndSubmit('delete', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id}-->); return false;">削除</a>
+                        <a href="?" onclick="eccube.setModeAndSubmit('delete', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id|h}-->); return false;">削除</a>
                         <!--{/if}-->
                     </td>
                     <td align="center">
                         <!--{if $smarty.section.cnt.iteration != 1}-->
-                        <a href="?" onclick="eccube.setModeAndSubmit('up', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id}-->); return false;">上へ</a>
+                        <a href="?" onclick="eccube.setModeAndSubmit('up', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id|h}-->); return false;">上へ</a>
                         <!--{/if}-->
                         <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                        <a href="?" onclick="eccube.setModeAndSubmit('down', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id}-->); return false;">下へ</a>
+                        <a href="?" onclick="eccube.setModeAndSubmit('down', 'kiyaku_id', <!--{$arrKiyaku[cnt].kiyaku_id|h}-->); return false;">下へ</a>
                         <!--{/if}-->
                     </td>
                 </tr>
diff --git a/data/Smarty/templates/admin/basis/payment.tpl b/data/Smarty/templates/admin/basis/payment.tpl
index 83afc8b35f..0579bb00da 100644
--- a/data/Smarty/templates/admin/basis/payment.tpl
+++ b/data/Smarty/templates/admin/basis/payment.tpl
@@ -25,7 +25,7 @@
 <form name="form1" id="form1" method="post" action="?">
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="edit" />
-    <input type="hidden" name="payment_id" value="<!--{$tpl_payment_id}-->" />
+    <input type="hidden" name="payment_id" value="<!--{$tpl_payment_id|h}-->" />
     <div id="basis" class="contents-main">
         <div class="btn">
             <ul>
@@ -62,14 +62,14 @@
                 <td class="center">
                     <!--{if $arrPaymentListFree[cnt].rule_max > 0}--><!--{$arrPaymentListFree[cnt].rule_max|n2s|h}--><!--{else}-->0<!--{/if}-->円
                     <!--{if $arrPaymentListFree[cnt].upper_rule > 0}-->～<!--{$arrPaymentListFree[cnt].upper_rule|n2s|h}-->円<!--{elseif $arrPaymentListFree[cnt].upper_rule == "0"}--><!--{else}-->～無制限<!--{/if}--></td>
-                <td class="center"><!--{if $arrPaymentListFree[cnt].fix != 1}--><a href="?" onclick="eccube.changeAction('./payment_input.php'); eccube.setModeAndSubmit('pre_edit', 'payment_id', <!--{$arrPaymentListFree[cnt].payment_id}-->); return false;">編集</a><!--{else}-->-<!--{/if}--></td>
-                <td class="center"><!--{if $arrPaymentListFree[cnt].fix != 1}--><a href="?" onclick="eccube.setModeAndSubmit('delete', 'payment_id', <!--{$arrPaymentListFree[cnt].payment_id}-->); return false;">削除</a><!--{else}-->-<!--{/if}--></td>
+                <td class="center"><!--{if $arrPaymentListFree[cnt].fix != 1}--><a href="?" onclick="eccube.changeAction('./payment_input.php'); eccube.setModeAndSubmit('pre_edit', 'payment_id', <!--{$arrPaymentListFree[cnt].payment_id|h}-->); return false;">編集</a><!--{else}-->-<!--{/if}--></td>
+                <td class="center"><!--{if $arrPaymentListFree[cnt].fix != 1}--><a href="?" onclick="eccube.setModeAndSubmit('delete', 'payment_id', <!--{$arrPaymentListFree[cnt].payment_id|h}-->); return false;">削除</a><!--{else}-->-<!--{/if}--></td>
                 <td class="center">
                 <!--{if $smarty.section.cnt.iteration != 1}-->
-                <a href="?" onclick="eccube.setModeAndSubmit('up','payment_id', <!--{$arrPaymentListFree[cnt].payment_id}-->); return false;">上へ</a>
+                <a href="?" onclick="eccube.setModeAndSubmit('up','payment_id', <!--{$arrPaymentListFree[cnt].payment_id|h}-->); return false;">上へ</a>
                 <!--{/if}-->
                 <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                <a href="?" onclick="eccube.setModeAndSubmit('down','payment_id', <!--{$arrPaymentListFree[cnt].payment_id}-->); return false;">下へ</a>
+                <a href="?" onclick="eccube.setModeAndSubmit('down','payment_id', <!--{$arrPaymentListFree[cnt].payment_id|h}-->); return false;">下へ</a>
                 <!--{/if}-->
                 </td>
             </tr>
diff --git a/data/Smarty/templates/admin/basis/tax.tpl b/data/Smarty/templates/admin/basis/tax.tpl
index f8b9b74a25..7c1c7868ca 100644
--- a/data/Smarty/templates/admin/basis/tax.tpl
+++ b/data/Smarty/templates/admin/basis/tax.tpl
@@ -126,7 +126,7 @@
             </td>
             <td class="center">
             <!--{if $tpl_tax_rule_id != $arrTaxrule[cnt].tax_rule_id}-->
-                <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'tax_rule_id', '<!--{$arrTaxrule[cnt].tax_rule_id}-->'); return false;">編集</a>
+                <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'tax_rule_id', '<!--{$arrTaxrule[cnt].tax_rule_id|h}-->'); return false;">編集</a>
             <!--{else}-->
                 編集中
             <!--{/if}-->
@@ -135,7 +135,7 @@
             <!--{if $arrTaxrule[cnt].tax_rule_id == 0}-->
                 -
             <!--{else}-->
-                <a href="?" onclick="eccube.setModeAndSubmit('delete', 'tax_rule_id', '<!--{$arrTaxrule[cnt].tax_rule_id}-->'); return false;">削除</a>
+                <a href="?" onclick="eccube.setModeAndSubmit('delete', 'tax_rule_id', '<!--{$arrTaxrule[cnt].tax_rule_id|h}-->'); return false;">削除</a>
             <!--{/if}-->
             </td>
         </tr>
diff --git a/data/Smarty/templates/admin/contents/csv_sql.tpl b/data/Smarty/templates/admin/contents/csv_sql.tpl
index ff1ad85274..aaf5c0687f 100644
--- a/data/Smarty/templates/admin/contents/csv_sql.tpl
+++ b/data/Smarty/templates/admin/contents/csv_sql.tpl
@@ -58,8 +58,8 @@ function fnTargetSelf(){
                         </td>
                         <td>
                             <div class="btn">
-                                <a class="btn-normal" href="javascript:;" name='csv' onclick="fnTargetSelf(); eccube.fnFormModeSubmit('form1','csv_output','csv_output_id',<!--{$item.sql_id}-->); return false;"><span>CSV出力</span></a>
-                                <a class="btn-normal" href="javascript:;" name='del' onclick="fnTargetSelf(); eccube.fnFormModeSubmit('form1','delete','sql_id',<!--{$item.sql_id}-->); return false;"><span>削除</span></a>
+                                <a class="btn-normal" href="javascript:;" name='csv' onclick="fnTargetSelf(); eccube.fnFormModeSubmit('form1','csv_output','csv_output_id',<!--{$item.sql_id|h}-->); return false;"><span>CSV出力</span></a>
+                                <a class="btn-normal" href="javascript:;" name='del' onclick="fnTargetSelf(); eccube.fnFormModeSubmit('form1','delete','sql_id',<!--{$item.sql_id|h}-->); return false;"><span>削除</span></a>
                             </div>
                         </td>
                     </tr>
diff --git a/data/Smarty/templates/admin/contents/file_manager.tpl b/data/Smarty/templates/admin/contents/file_manager.tpl
index 941ef68b57..a8c28d40b0 100644
--- a/data/Smarty/templates/admin/contents/file_manager.tpl
+++ b/data/Smarty/templates/admin/contents/file_manager.tpl
@@ -114,7 +114,7 @@
                         </td>
                         <!--{if $arrFileList[cnt].is_dir}-->
                             <td class="center">
-                                <a href="javascript:;" onclick="eccube.setValue('tree_select_file', '<!--{$arrFileList[cnt].file_path}-->', 'form1'); eccube.fileManager.selectFile('<!--{$id}-->', '#808080');eccube.setModeAndSubmit('move','',''); return false;">表示</a>
+                                <a href="javascript:;" onclick="eccube.setValue('tree_select_file', '<!--{$arrFileList[cnt].file_path}-->', 'form1'); eccube.fileManager.selectFile('<!--{$id|h}-->', '#808080');eccube.setModeAndSubmit('move','',''); return false;">表示</a>
                             </td>
                         <!--{else}-->
                             <td class="center">
diff --git a/data/Smarty/templates/admin/contents/recommend.tpl b/data/Smarty/templates/admin/contents/recommend.tpl
index df74e53e5b..926344723a 100644
--- a/data/Smarty/templates/admin/contents/recommend.tpl
+++ b/data/Smarty/templates/admin/contents/recommend.tpl
@@ -161,10 +161,10 @@ function lfnSortItem(mode,data,form){
                 <td>
                     <!--{* 移動 *}-->
                     <!--{if $smarty.section.cnt.iteration != 1 && $arrItems[$smarty.section.cnt.iteration].best_id}-->
-                        <a href="?" onclick="lfnSortItem('up',<!--{$arrItems[$smarty.section.cnt.iteration].best_id}-->,'form<!--{$smarty.section.cnt.iteration-1}-->'); return false;">上へ</a><br />&nbsp;
+                        <a href="?" onclick="lfnSortItem('up',<!--{$arrItems[$smarty.section.cnt.iteration].best_id|h}-->,'form<!--{$smarty.section.cnt.iteration-1}-->'); return false;">上へ</a><br />&nbsp;
                     <!--{/if}-->
                     <!--{if $smarty.section.cnt.iteration != $tpl_disp_max && $arrItems[$smarty.section.cnt.iteration].best_id}-->
-                        <a href="?" onclick="lfnSortItem('down',<!--{$arrItems[$smarty.section.cnt.iteration].best_id}-->,'form<!--{$smarty.section.cnt.iteration+1}-->'); return false;">下へ</a>
+                        <a href="?" onclick="lfnSortItem('down',<!--{$arrItems[$smarty.section.cnt.iteration].best_id|h}-->,'form<!--{$smarty.section.cnt.iteration+1}-->'); return false;">下へ</a>
                     <!--{/if}-->
                 </td>
             </tr>
diff --git a/data/Smarty/templates/admin/contents/recommend_search.tpl b/data/Smarty/templates/admin/contents/recommend_search.tpl
index a6db223b16..ee5d27dae6 100644
--- a/data/Smarty/templates/admin/contents/recommend_search.tpl
+++ b/data/Smarty/templates/admin/contents/recommend_search.tpl
@@ -114,7 +114,7 @@ function func_submit( id ){
                 <!--{/if}-->
             </td>
             <td><!--{$arr.name|h}--></td>
-            <td class="center"><a href="" onclick="return func_submit(<!--{$arr.product_id}-->)">決定</a></td>
+            <td class="center"><a href="" onclick="return func_submit(<!--{$arr.product_id|h}-->)">決定</a></td>
         </tr>
         <!--▲商品<!--{$smarty.foreach.loop.iteration}-->-->
         <!--{/foreach}-->
diff --git a/data/Smarty/templates/admin/customer/edit.tpl b/data/Smarty/templates/admin/customer/edit.tpl
index 4a65558aac..9cb9090842 100644
--- a/data/Smarty/templates/admin/customer/edit.tpl
+++ b/data/Smarty/templates/admin/customer/edit.tpl
@@ -268,7 +268,7 @@
 
         <input type="hidden" name="order_id" value="" />
         <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno}-->" />
-        <input type="hidden" name="edit_customer_id" value="<!--{$edit_customer_id}-->" />
+        <input type="hidden" name="edit_customer_id" value="<!--{$edit_customer_id|h}-->" />
 
         <h2>購入履歴一覧</h2>
         <!--{if $tpl_linemax > 0}-->
@@ -288,7 +288,7 @@
                 <!--{section name=cnt loop=$arrPurchaseHistory}-->
                     <tr>
                         <td><!--{$arrPurchaseHistory[cnt].create_date|sfDispDBDate}--></td>
-                        <td class="center"><a href="../order/edit.php?order_id=<!--{$arrPurchaseHistory[cnt].order_id}-->" ><!--{$arrPurchaseHistory[cnt].order_id}--></a></td>
+                        <td class="center"><a href="../order/edit.php?order_id=<!--{$arrPurchaseHistory[cnt].order_id|h}-->" ><!--{$arrPurchaseHistory[cnt].order_id|h}--></a></td>
                         <td class="center"><!--{$arrPurchaseHistory[cnt].payment_total|n2s}-->円</td>
                         <td class="center"><!--{if $arrPurchaseHistory[cnt].status eq 5}--><!--{$arrPurchaseHistory[cnt].commit_date|sfDispDBDate}--><!--{else}-->未発送<!--{/if}--></td>
                         <!--{assign var=payment_id value="`$arrPurchaseHistory[cnt].payment_id`"}-->
diff --git a/data/Smarty/templates/admin/design/index.tpl b/data/Smarty/templates/admin/design/index.tpl
index 70af05f572..9fe0415e29 100644
--- a/data/Smarty/templates/admin/design/index.tpl
+++ b/data/Smarty/templates/admin/design/index.tpl
@@ -50,8 +50,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_HEAD]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -73,8 +73,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_HEAD_TOP]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -94,8 +94,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_HEADER_INTERNAL]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -114,8 +114,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_TOP]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -136,8 +136,8 @@ function fnTargetSelf(){
                                 <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_MAIN_HEAD]}-->
                                     <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                         <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                         <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                         <!--{$item.name}-->
                                         <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -161,8 +161,8 @@ function fnTargetSelf(){
                                 <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_MAIN_FOOT]}-->
                                     <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                         <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                         <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                         <!--{$item.name}-->
                                         <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -181,8 +181,8 @@ function fnTargetSelf(){
                                 <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_LEFT]}-->
                                     <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                         <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                         <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                         <!--{$item.name}-->
                                         <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -199,8 +199,8 @@ function fnTargetSelf(){
                                 <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_MAIN_HEAD]}-->
                                     <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                         <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                         <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                         <!--{$item.name}-->
                                         <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -217,8 +217,8 @@ function fnTargetSelf(){
                                 <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_RIGHT]}-->
                                     <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                         <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                         <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                         <!--{$item.name}-->
                                         <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -242,8 +242,8 @@ function fnTargetSelf(){
                                 <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_MAIN_FOOT]}-->
                                     <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                         <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                        <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                        <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                         <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                         <!--{$item.name}-->
                                         <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -263,8 +263,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_BOTTOM]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -286,8 +286,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_FOOTER_BOTTOM]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -315,8 +315,8 @@ function fnTargetSelf(){
                             <!--{if $item.target_id == $arrTarget[$smarty.const.TARGET_ID_UNUSED]}-->
                                 <div class="sort<!--{if !$firstflg}--> first<!--{/if}-->">
                                     <input type="hidden" class="name" name="name_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.name}-->" />
-                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id}-->" />
-                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id}-->" />
+                                    <input type="hidden" class="id" name="id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_id|h}-->" />
+                                    <input type="hidden" class="target-id" name="target_id_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.target_id|h}-->" />
                                     <input type="hidden" class="top" name="top_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="<!--{$item.bloc_row}-->" />
                                     <!--{$item.name}-->
                                     <label class="anywherecheck">(<input type="checkbox" class="anywhere" name="anywhere_<!--{$smarty.foreach.bloc_loop.iteration}-->" value="1" <!--{if $item.anywhere == 1}-->checked="checked"<!--{/if}--> />全ページ)</label>
@@ -358,11 +358,11 @@ function fnTargetSelf(){
                     <!--{$item.page_name}-->
                 </td>
                 <td class="center">
-                    <a href="?page_id=<!--{$item.page_id}-->&amp;device_type_id=<!--{$item.device_type_id}-->" >編集</a>
+                    <a href="?page_id=<!--{$item.page_id|h}-->&amp;device_type_id=<!--{$item.device_type_id|h}-->" >編集</a>
                 </td>
                 <td class="center">
                     <!--{if $item.filename|strlen >= 1}-->
-                        <a href="main_edit.php?page_id=<!--{$item.page_id}-->&amp;device_type_id=<!--{$item.device_type_id}-->">編集</a>
+                        <a href="main_edit.php?page_id=<!--{$item.page_id|h}-->&amp;device_type_id=<!--{$item.device_type_id|h}-->">編集</a>
                     <!--{/if}-->
                 </td>
                 <td class="center">
diff --git a/data/Smarty/templates/admin/design/main_edit.tpl b/data/Smarty/templates/admin/design/main_edit.tpl
index 48fedd2fe6..6c6f99829d 100644
--- a/data/Smarty/templates/admin/design/main_edit.tpl
+++ b/data/Smarty/templates/admin/design/main_edit.tpl
@@ -160,7 +160,7 @@ function fnTargetSelf(){
                 </td>
                 <td class="center">
                     <!--{if $item.filename|strlen >= 1}-->
-                        <a href="?page_id=<!--{$item.page_id}-->&amp;device_type_id=<!--{$item.device_type_id}-->">編集</a>
+                        <a href="?page_id=<!--{$item.page_id|h}-->&amp;device_type_id=<!--{$item.device_type_id|h}-->">編集</a>
                     <!--{/if}-->
                 </td>
                 <td class="center">
diff --git a/data/Smarty/templates/admin/order/edit.tpl b/data/Smarty/templates/admin/order/edit.tpl
index 5b3d515ffb..2e90499cbb 100644
--- a/data/Smarty/templates/admin/order/edit.tpl
+++ b/data/Smarty/templates/admin/order/edit.tpl
@@ -404,7 +404,7 @@
                         <!--{if $tpl_shipping_quantity <= 1}-->
                             <a class="btn-normal" href="javascript:;" name="change" onclick="eccube.openWindow('<!--{$smarty.const.ROOT_URLPATH}--><!--{$smarty.const.ADMIN_DIR}-->order/product_select.php?no=<!--{$product_index}-->&amp;order_id=<!--{$arrForm.order_id.value|h}-->&amp;shipping_id=<!--{$top_shipping_id}-->', 'search', '615', '500', {menubar:'no'}); return false;">変更</a>
                             <!--{if !empty($arrForm.quantity.value) && count($arrForm.quantity.value) > 1}-->
-                                <a class="btn-normal" href="javascript:;" name="delete" onclick="eccube.setValue('delete_no', <!--{$product_index}-->, 'form1'); eccube.setValue('select_shipping_id', '<!--{$top_shipping_id}-->', 'form1'); eccube.setModeAndSubmit('delete_product','anchor_key','order_products'); return false;">削除</a>
+                                <a class="btn-normal" href="javascript:;" name="delete" onclick="eccube.setValue('delete_no', <!--{$product_index}-->, 'form1'); eccube.setValue('select_shipping_id', '<!--{$top_shipping_id|h}-->', 'form1'); eccube.setModeAndSubmit('delete_product','anchor_key','order_products'); return false;">削除</a>
                             <!--{/if}-->
                         <!--{/if}-->
                     <input type="hidden" name="product_type_id[<!--{$product_index}-->]" value="<!--{$arrForm.product_type_id.value[$product_index]|h}-->" id="product_type_id_<!--{$product_index}-->" />
diff --git a/data/Smarty/templates/admin/order/index.tpl b/data/Smarty/templates/admin/order/index.tpl
index 4dd2e41915..e2b590480b 100644
--- a/data/Smarty/templates/admin/order/index.tpl
+++ b/data/Smarty/templates/admin/order/index.tpl
@@ -388,17 +388,17 @@
                                 <td class="center"><!--{$arrResults[cnt].commit_date|sfDispDBDate|default:"未発送"}--></td>
                                 <td class="center"><!--{$arrORDERSTATUS[$status]}--></td>
                                 <td class="center">
-                                    <input type="checkbox" name="pdf_order_id[]" value="<!--{$arrResults[cnt].order_id}-->" id="pdf_order_id_<!--{$arrResults[cnt].order_id}-->"/><label for="pdf_order_id_<!--{$arrResults[cnt].order_id}-->">一括出力</label><br />
-                                    <a href="./" onClick="eccube.openWindow('pdf.php?order_id=<!--{$arrResults[cnt].order_id}-->','pdf_input','620','650'); return false;"><span class="icon_class">個別出力</span></a>
+                                    <input type="checkbox" name="pdf_order_id[]" value="<!--{$arrResults[cnt].order_id|h}-->" id="pdf_order_id_<!--{$arrResults[cnt].order_id|h}-->"/><label for="pdf_order_id_<!--{$arrResults[cnt].order_id|h}-->">一括出力</label><br />
+                                    <a href="./" onClick="eccube.openWindow('pdf.php?order_id=<!--{$arrResults[cnt].order_id|h}-->','pdf_input','620','650'); return false;"><span class="icon_class">個別出力</span></a>
                                 </td>
                                 <td class="center"><a href="?" onclick="eccube.changeAction('<!--{$smarty.const.ADMIN_ORDER_EDIT_URLPATH}-->'); eccube.setModeAndSubmit('pre_edit', 'order_id', '<!--{$arrResults[cnt].order_id}-->'); return false;"><span class="icon_edit">編集</span></a></td>
                                 <td class="center">
                                     <!--{if $arrResults[cnt].order_email|strlen >= 1}-->
-                                        <input type="checkbox" name="mail_order_id[]" value="<!--{$arrResults[cnt].order_id}-->" id="mail_order_id_<!--{$arrResults[cnt].order_id}-->"/><label for="mail_order_id_<!--{$arrResults[cnt].order_id}-->">一括通知</label><br />
+                                        <input type="checkbox" name="mail_order_id[]" value="<!--{$arrResults[cnt].order_id|h}-->" id="mail_order_id_<!--{$arrResults[cnt].order_id|h}-->"/><label for="mail_order_id_<!--{$arrResults[cnt].order_id|h}-->">一括通知</label><br />
                                         <a href="?" onclick="eccube.changeAction('<!--{$smarty.const.ADMIN_ORDER_MAIL_URLPATH}-->'); eccube.setModeAndSubmit('pre_edit', 'order_id', '<!--{$arrResults[cnt].order_id}-->'); return false;"><span class="icon_mail">個別通知</span></a>
                                     <!--{/if}-->
                                 </td>
-                                <td class="center"><a href="?" onclick="eccube.setModeAndSubmit('delete', 'order_id', <!--{$arrResults[cnt].order_id}-->); return false;"><span class="icon_delete">削除</span></a></td>
+                                <td class="center"><a href="?" onclick="eccube.setModeAndSubmit('delete', 'order_id', <!--{$arrResults[cnt].order_id|h}-->); return false;"><span class="icon_delete">削除</span></a></td>
                             </tr>
                         <!--{/section}-->
                     <!--{/if}-->
diff --git a/data/Smarty/templates/admin/order/product_select.tpl b/data/Smarty/templates/admin/order/product_select.tpl
index e75837a8f6..c5482aecbe 100644
--- a/data/Smarty/templates/admin/order/product_select.tpl
+++ b/data/Smarty/templates/admin/order/product_select.tpl
@@ -120,7 +120,7 @@
     <input name="mode" type="hidden" value="search" />
     <input name="anchor_key" type="hidden" value="" />
     <input name="search_pageno" type="hidden" value="" />
-    <input name="shipping_id" type="hidden" value="<!--{$shipping_id}-->" />
+    <input name="shipping_id" type="hidden" value="<!--{$shipping_id|h}-->" />
     <input name="no" type="hidden" value="<!--{$tpl_no|h}-->" />
     <table class="form">
         <col width="20%" />
@@ -230,7 +230,7 @@
                             <input type="hidden" name="product_type" id="product_type<!--{$id|h}-->" value="<!--{$tpl_product_type[$id]}-->" />
                         </form>
                     </td>
-                    <td class="center"><a href="javascript:;" onclick="return func_submit('<!--{$arrProducts[cnt].product_id}-->', '<!--{$tpl_class_name1[$id]}-->', '<!--{$tpl_class_name2[$id]}-->'); return false;">決定</a></td>
+                    <td class="center"><a href="javascript:;" onclick="return func_submit('<!--{$arrProducts[cnt].product_id|h}-->', '<!--{$tpl_class_name1[$id]}-->', '<!--{$tpl_class_name2[$id]}-->'); return false;">決定</a></td>
                 </tr>
                 <!--▲商品<!--{$smarty.section.cnt.iteration}-->-->
         <!--{sectionelse}-->
diff --git a/data/Smarty/templates/admin/order/status.tpl b/data/Smarty/templates/admin/order/status.tpl
index 8060ceba05..a0c0c7e096 100644
--- a/data/Smarty/templates/admin/order/status.tpl
+++ b/data/Smarty/templates/admin/order/status.tpl
@@ -88,9 +88,9 @@
                 <!--{section name=cnt loop=$arrStatus}-->
                 <!--{assign var=status value="`$arrStatus[cnt].status`"}-->
                 <tr style="background:<!--{$arrORDERSTATUS_COLOR[$status]}-->;">
-                    <td class="center"><input type="checkbox" name="move[]" value="<!--{$arrStatus[cnt].order_id}-->" ></td>
+                    <td class="center"><input type="checkbox" name="move[]" value="<!--{$arrStatus[cnt].order_id|h}-->" ></td>
                     <td class="center"><!--{$arrORDERSTATUS[$status]}--></td>
-                    <td class="center"><a href="#" onclick="eccube.openWindow('./disp.php?order_id=<!--{$arrStatus[cnt].order_id}-->','order_disp','800','900',{resizable:'no',focus:false}); return false;" ><!--{$arrStatus[cnt].order_id}--></a></td>
+                    <td class="center"><a href="#" onclick="eccube.openWindow('./disp.php?order_id=<!--{$arrStatus[cnt].order_id|h}-->','order_disp','800','900',{resizable:'no',focus:false}); return false;" ><!--{$arrStatus[cnt].order_id|h}--></a></td>
                     <td class="center"><!--{$arrStatus[cnt].create_date|sfDispDBDate}--></td>
                     <td><!--{$arrStatus[cnt].order_name01|h}--> <!--{$arrStatus[cnt].order_name02|h}--></td>
                     <!--{assign var=payment_id value="`$arrStatus[cnt].payment_id`"}-->
diff --git a/data/Smarty/templates/admin/ownersstore/plugin.tpl b/data/Smarty/templates/admin/ownersstore/plugin.tpl
index 4dd9c0aa29..9d0662639f 100644
--- a/data/Smarty/templates/admin/ownersstore/plugin.tpl
+++ b/data/Smarty/templates/admin/ownersstore/plugin.tpl
@@ -189,25 +189,25 @@
                                 <span class="attention"><!--{$arrErr[$plugin.plugin_code]}--></span>
                                 <!-- 設定 -->
                                     <!--{if $plugin.config_flg == true && $plugin.status != $smarty.const.PLUGIN_STATUS_UPLOADED}-->
-                                        <a href="?" onclick="eccube.openWindow('../load_plugin_config.php?plugin_id=<!--{$plugin.plugin_id}-->', 'load', 615, 400);return false;">プラグイン設定</a>&nbsp;|&nbsp;
+                                        <a href="?" onclick="eccube.openWindow('../load_plugin_config.php?plugin_id=<!--{$plugin.plugin_id|h}-->', 'load', 615, 400);return false;">プラグイン設定</a>&nbsp;|&nbsp;
                                     <!--{else}-->
                                         <span>プラグイン設定&nbsp;|&nbsp;</span>
                                     <!--{/if}-->
                                 <!-- アップデート -->
-                                    <a class="update_link" href="javascript:;" name="<!--{$plugin.plugin_id}-->">アップデート</a>&nbsp;|&nbsp;
+                                    <a class="update_link" href="javascript:;" name="<!--{$plugin.plugin_id|h}-->">アップデート</a>&nbsp;|&nbsp;
                                 <!-- 削除 -->
-                                    <a  href="javascript:;" name="uninstall" onclick="uninstall(<!--{$plugin.plugin_id}-->, '<!--{$plugin.plugin_code}-->'); return false;">削除</a>&nbsp;|&nbsp;
+                                    <a  href="javascript:;" name="uninstall" onclick="uninstall(<!--{$plugin.plugin_id|h}-->, '<!--{$plugin.plugin_code}-->'); return false;">削除</a>&nbsp;|&nbsp;
                                 <!-- 有効/無効 -->
                                     <!--{if $plugin.enable == $smarty.const.PLUGIN_ENABLE_TRUE}-->
-                                        <label><input id="plugin_enable" type="checkbox" name="disable" value="<!--{$plugin.plugin_id}-->" checked="checked" />有効</label><br/>
+                                        <label><input id="plugin_enable" type="checkbox" name="disable" value="<!--{$plugin.plugin_id|h}-->" checked="checked" />有効</label><br/>
                                     <!--{else}-->
-                                        <label><input id="plugin_enable" type="checkbox" name="enable" value="<!--{$plugin.plugin_id}-->" />有効にする</label><br/>
+                                        <label><input id="plugin_enable" type="checkbox" name="enable" value="<!--{$plugin.plugin_id|h}-->" />有効にする</label><br/>
                                     <!--{/if}-->
 
                                     <!-- アップデートリンク押下時に表示する. -->
                                     <div id="plugin_update_<!--{$plugin.plugin_id}-->" style="display: none">
                                         <input id="update_file_<!--{$plugin.plugin_id}-->" name="<!--{$plugin.plugin_code}-->" type="file" style="<!--{$arrErr[$key]|sfGetErrorColor}-->" class="box30" size="30" <!--{if $arrErr[$key]}-->style="background-color:<!--{$smarty.const.ERR_COLOR|h}-->"<!--{/if}--> />
-                                        <a class="btn-action" href="javascript:;" onclick="update(<!--{$plugin.plugin_id}-->, '<!--{$plugin.plugin_code}-->'); return false;"><span class="btn-next">アップデート</span></a>
+                                        <a class="btn-action" href="javascript:;" onclick="update(<!--{$plugin.plugin_id|h}-->, '<!--{$plugin.plugin_code}-->'); return false;"><span class="btn-next">アップデート</span></a>
                                     </div>
                             </div>
                     </td>
@@ -215,7 +215,7 @@
                     <td class="center">
                         <span class="attention"><!--{$arrErr.priority[$plugin.plugin_id]}--></span>
                         <input type="text" class="center" name="priority_<!--{$plugin.plugin_code}-->" value="<!--{$plugin.priority|h}-->" size="1" />
-                        <a class="btn-action" href="javascript:;" onclick="update_priority(<!--{$plugin.plugin_id}-->, '<!--{$plugin.plugin_code}-->'); return false;"><span class="btn-next">変更</span></a><br/>
+                        <a class="btn-action" href="javascript:;" onclick="update_priority(<!--{$plugin.plugin_id|h}-->, '<!--{$plugin.plugin_code}-->'); return false;"><span class="btn-next">変更</span></a><br/>
                         <span><!--{$plugin.priority_message}--></span>
                     </td>
                 </tr>
diff --git a/data/Smarty/templates/admin/ownersstore/products_list.tpl b/data/Smarty/templates/admin/ownersstore/products_list.tpl
index 106bb132ae..a20be48f02 100644
--- a/data/Smarty/templates/admin/ownersstore/products_list.tpl
+++ b/data/Smarty/templates/admin/ownersstore/products_list.tpl
@@ -73,13 +73,13 @@
                     <!--{* インストール済みなら設定ボタン表示 *}-->
                     <!--{if $product.installed_flg}-->
                         <span class="icon_confirm">
-                        <a href="#" onclick="eccube.openWindow('../load_module_config.php?module_id=<!--{$product.product_id}-->', 'load', 615, 400);return false;">
+                        <a href="#" onclick="eccube.openWindow('../load_module_config.php?module_id=<!--{$product.product_id|h}-->', 'load', 615, 400);return false;">
                             設定</a>
                         </span>
                     <!--{else}-->
                         <div id='ownersstore_settings<!--{$product.product_id|h}-->' style="display:none">
                         <span class="icon_confirm">
-                        <a href="#" onclick="eccube.openWindow('../load_module_config.php?module_id=<!--{$product.product_id}-->', 'load', 615, 400);return false;">
+                        <a href="#" onclick="eccube.openWindow('../load_module_config.php?module_id=<!--{$product.product_id|h}-->', 'load', 615, 400);return false;">
                             設定</a>
                         </span>
                         </div>
diff --git a/data/Smarty/templates/admin/products/category.tpl b/data/Smarty/templates/admin/products/category.tpl
index 9764752642..de5fe6d1f5 100644
--- a/data/Smarty/templates/admin/products/category.tpl
+++ b/data/Smarty/templates/admin/products/category.tpl
@@ -93,21 +93,21 @@
                     </td>
                     <td class="center">
                         <!--{if $arrForm.category_id != $arrList[cnt].category_id}-->
-                        <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'category_id', <!--{$arrList[cnt].category_id}-->); return false;">編集</a>
+                        <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'category_id', <!--{$arrList[cnt].category_id|h}-->); return false;">編集</a>
                         <!--{else}-->
                         編集中
                         <!--{/if}-->
                     </td>
                     <td class="center">
-                        <a href="?" onclick="eccube.setModeAndSubmit('delete', 'category_id', <!--{$arrList[cnt].category_id}-->); return false;">削除</a>
+                        <a href="?" onclick="eccube.setModeAndSubmit('delete', 'category_id', <!--{$arrList[cnt].category_id|h}-->); return false;">削除</a>
                     </td>
                     <td class="center">
                     <!--{* 移動 *}-->
                     <!--{if $smarty.section.cnt.iteration != 1}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('up','category_id', <!--{$arrList[cnt].category_id}-->); return false;">上へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('up','category_id', <!--{$arrList[cnt].category_id|h}-->); return false;">上へ</a>
                     <!--{/if}-->
                     <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('down','category_id', <!--{$arrList[cnt].category_id}-->); return false;">下へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('down','category_id', <!--{$arrList[cnt].category_id|h}-->); return false;">下へ</a>
                     <!--{/if}-->
                     </td>
 
diff --git a/data/Smarty/templates/admin/products/category_tree_fork.tpl b/data/Smarty/templates/admin/products/category_tree_fork.tpl
index 995f098bb8..d629d4efe5 100644
--- a/data/Smarty/templates/admin/products/category_tree_fork.tpl
+++ b/data/Smarty/templates/admin/products/category_tree_fork.tpl
@@ -26,7 +26,7 @@
             <!--{* カテゴリ名表示 *}-->
             <!--{assign var=disp_name value="`$child.category_id`.`$child.category_name`"}-->
             <!--{if $child.level != $smarty.const.LEVEL_MAX}-->
-                <a href="?" onclick="eccube.setModeAndSubmit('tree', 'parent_category_id', <!--{$child.category_id}-->); return false;">
+                <a href="?" onclick="eccube.setModeAndSubmit('tree', 'parent_category_id', <!--{$child.category_id|h}-->); return false;">
                 <!--{if $arrForm.parent_category_id == $child.category_id}-->
                     <img src="<!--{$TPL_URLPATH}-->img/contents/folder_open.gif" alt="フォルダ" />
                 <!--{else}-->
diff --git a/data/Smarty/templates/admin/products/class.tpl b/data/Smarty/templates/admin/products/class.tpl
index e82dfc4455..6c2e39412f 100644
--- a/data/Smarty/templates/admin/products/class.tpl
+++ b/data/Smarty/templates/admin/products/class.tpl
@@ -63,10 +63,10 @@
                 <tr style="background:<!--{if $tpl_class_id != $arrClass[cnt].class_id}-->#ffffff<!--{else}--><!--{$smarty.const.SELECT_RGB}--><!--{/if}-->;">
                     <!--{assign var=class_id value=$arrClass[cnt].class_id}-->
                     <td><!--{* 規格名 *}--><!--{$arrClass[cnt].name|h}--> (<!--{$arrClassCatCount[$class_id]|default:0}-->)</td>
-                    <td align="center"><a href="javascript:;" onclick="eccube.moveClassCatPage(<!--{$arrClass[cnt].class_id}-->); return false;">分類登録</a></td>
+                    <td align="center"><a href="javascript:;" onclick="eccube.moveClassCatPage(<!--{$arrClass[cnt].class_id|h}-->); return false;">分類登録</a></td>
                     <td align="center">
                         <!--{if $tpl_class_id != $arrClass[cnt].class_id}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'class_id', <!--{$arrClass[cnt].class_id}-->); return false;">編集</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'class_id', <!--{$arrClass[cnt].class_id|h}-->); return false;">編集</a>
                         <!--{else}-->
                             編集中
                         <!--{/if}-->
@@ -75,15 +75,15 @@
                         <!--{if $arrClassCatCount[$class_id] > 0}-->
                             -
                         <!--{else}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('delete', 'class_id', <!--{$arrClass[cnt].class_id}-->); return false;">削除</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('delete', 'class_id', <!--{$arrClass[cnt].class_id|h}-->); return false;">削除</a>
                         <!--{/if}-->
                     </td>
                     <td align="center">
                         <!--{if $smarty.section.cnt.iteration != 1}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('up', 'class_id', <!--{$arrClass[cnt].class_id}-->); return false;">上へ</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('up', 'class_id', <!--{$arrClass[cnt].class_id|h}-->); return false;">上へ</a>
                         <!--{/if}-->
                         <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('down', 'class_id', <!--{$arrClass[cnt].class_id}-->); return false;">下へ</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('down', 'class_id', <!--{$arrClass[cnt].class_id|h}-->); return false;">下へ</a>
                         <!--{/if}-->
                     </td>
                 </tr>
diff --git a/data/Smarty/templates/admin/products/classcategory.tpl b/data/Smarty/templates/admin/products/classcategory.tpl
index b94377aa6d..819675b0f3 100644
--- a/data/Smarty/templates/admin/products/classcategory.tpl
+++ b/data/Smarty/templates/admin/products/classcategory.tpl
@@ -25,7 +25,7 @@
 <form name="form1" id="form1" method="post" action="">
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="edit" />
-    <input type="hidden" name="classcategory_id" value="<!--{$tpl_classcategory_id}-->" />
+    <input type="hidden" name="classcategory_id" value="<!--{$tpl_classcategory_id|h}-->" />
     <!--{foreach key=key item=item from=$arrHidden}-->
         <input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
     <!--{/foreach}-->
@@ -69,20 +69,20 @@
                     <td><!--{* 規格名 *}--><!--{$arrClassCat[cnt].name|h}--></td>
                     <td align="center" >
                         <!--{if $tpl_classcategory_id != $arrClassCat[cnt].classcategory_id}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('pre_edit','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id}-->); return false;">編集</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('pre_edit','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id|h}-->); return false;">編集</a>
                         <!--{else}-->
                             編集中
                         <!--{/if}-->
                     </td>
                     <td align="center">
-                        <a href="?" onclick="if(window.confirm('分類名を削除すると、その分類を利用している商品規格が無効になります。\n整合性の問題を把握し、バックアップを行ってから削除することを推奨致します。')){ eccube.setModeAndSubmit('delete','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id}-->); } return false;">削除</a>
+                        <a href="?" onclick="if(window.confirm('分類名を削除すると、その分類を利用している商品規格が無効になります。\n整合性の問題を把握し、バックアップを行ってから削除することを推奨致します。')){ eccube.setModeAndSubmit('delete','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id|h}-->); } return false;">削除</a>
                     </td>
                     <td align="center">
                         <!--{if $smarty.section.cnt.iteration != 1}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('up','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id}-->); return false;">上へ</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('up','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id|h}-->); return false;">上へ</a>
                         <!--{/if}-->
                         <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('down','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id}-->); return false;">下へ</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('down','classcategory_id', <!--{$arrClassCat[cnt].classcategory_id|h}-->); return false;">下へ</a>
                         <!--{/if}-->
                     </td>
                 </tr>
diff --git a/data/Smarty/templates/admin/products/complete.tpl b/data/Smarty/templates/admin/products/complete.tpl
index a62f6be971..b8f8e46348 100644
--- a/data/Smarty/templates/admin/products/complete.tpl
+++ b/data/Smarty/templates/admin/products/complete.tpl
@@ -48,7 +48,7 @@
                 <li><a class="btn-action" href="javascript:;" onclick="eccube.changeAction('<!--{$smarty.const.ADMIN_PRODUCTS_URLPATH}-->'); eccube.setModeAndSubmit('search','',''); return false;"><span class="btn-prev">検索結果へ戻る</span></a></li>
                 <li><a class="btn-action" href="./product.php"><span class="btn-next">続けて登録を行う</span></a></li>
                 <!--{if $smarty.const.OPTION_CLASS_REGIST == 1}-->
-                <li><a class="btn-action" href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'product_id', '<!--{$arrForm.product_id}-->'); return false;"><span class="btn-next">この商品の規格を登録する</span></a></li>
+                <li><a class="btn-action" href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'product_id', '<!--{$arrForm.product_id|h}-->'); return false;"><span class="btn-next">この商品の規格を登録する</span></a></li>
                 <!--{/if}-->
             </ul>
         </div>
diff --git a/data/Smarty/templates/admin/products/index.tpl b/data/Smarty/templates/admin/products/index.tpl
index c57da99d53..aed4efcd8f 100644
--- a/data/Smarty/templates/admin/products/index.tpl
+++ b/data/Smarty/templates/admin/products/index.tpl
@@ -267,13 +267,13 @@ function lfnDispChange(){
                             <!--{* 表示 *}-->
                             <!--{assign var=key value=$arrProducts[cnt].status}-->
                             <td class="menu" rowspan="2"><!--{$arrDISP[$key]}--></td>
-                            <td class="menu" rowspan="2"><span class="icon_edit"><a href="javascript:;" onclick="eccube.changeAction('./product.php'); eccube.setModeAndSubmit('pre_edit', 'product_id', <!--{$arrProducts[cnt].product_id}-->); return false;" >編集</a></span></td>
+                            <td class="menu" rowspan="2"><span class="icon_edit"><a href="javascript:;" onclick="eccube.changeAction('./product.php'); eccube.setModeAndSubmit('pre_edit', 'product_id', <!--{$arrProducts[cnt].product_id|h}-->); return false;" >編集</a></span></td>
                             <td class="menu" rowspan="2"><span class="icon_confirm"><a href="<!--{$smarty.const.HTTP_URL}-->products/detail.php?product_id=<!--{$arrProducts[cnt].product_id}-->&amp;admin=on" target="_blank">確認</a></span></td>
                             <!--{if $smarty.const.OPTION_CLASS_REGIST == 1}-->
-                            <td class="menu" rowspan="2"><span class="icon_class"><a href="javascript:;" onclick="eccube.changeAction('./product_class.php'); eccube.setModeAndSubmit('pre_edit', 'product_id', <!--{$arrProducts[cnt].product_id}-->); return false;" >規格</a></span></td>
+                            <td class="menu" rowspan="2"><span class="icon_class"><a href="javascript:;" onclick="eccube.changeAction('./product_class.php'); eccube.setModeAndSubmit('pre_edit', 'product_id', <!--{$arrProducts[cnt].product_id|h}-->); return false;" >規格</a></span></td>
                             <!--{/if}-->
-                            <td class="menu" rowspan="2"><span class="icon_delete"><a href="javascript:;" onclick="eccube.setValue('category_id', '<!--{$arrProducts[cnt].category_id}-->'); eccube.setModeAndSubmit('delete', 'product_id', <!--{$arrProducts[cnt].product_id}-->); return false;">削除</a></span></td>
-                            <td class="menu" rowspan="2"><span class="icon_copy"><a href="javascript:;" onclick="eccube.changeAction('./product.php'); eccube.setModeAndSubmit('copy', 'product_id', <!--{$arrProducts[cnt].product_id}-->); return false;" >複製</a></span></td>
+                            <td class="menu" rowspan="2"><span class="icon_delete"><a href="javascript:;" onclick="eccube.setValue('category_id', '<!--{$arrProducts[cnt].category_id|h}-->'); eccube.setModeAndSubmit('delete', 'product_id', <!--{$arrProducts[cnt].product_id|h}-->); return false;">削除</a></span></td>
+                            <td class="menu" rowspan="2"><span class="icon_copy"><a href="javascript:;" onclick="eccube.changeAction('./product.php'); eccube.setModeAndSubmit('copy', 'product_id', <!--{$arrProducts[cnt].product_id|h}-->); return false;" >複製</a></span></td>
                         </tr>
                         <tr style="background:<!--{$arrPRODUCTSTATUS_COLOR[$status]}-->;">
                             <td>
diff --git a/data/Smarty/templates/admin/products/maker.tpl b/data/Smarty/templates/admin/products/maker.tpl
index e8b0022537..996743b33d 100644
--- a/data/Smarty/templates/admin/products/maker.tpl
+++ b/data/Smarty/templates/admin/products/maker.tpl
@@ -25,7 +25,7 @@
 <form name="form1" id="form1" method="post" action="?">
     <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
     <input type="hidden" name="mode" value="edit" />
-    <input type="hidden" name="maker_id" value="<!--{$tpl_maker_id}-->" />
+    <input type="hidden" name="maker_id" value="<!--{$tpl_maker_id|h}-->" />
     <div id="products" class="contents-main">
 
         <table class="form">
@@ -66,7 +66,7 @@
                 <td><!--{$arrMaker[cnt].name|h}--></td>
                 <td class="center">
                     <!--{if $tpl_maker_id != $arrMaker[cnt].maker_id}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'maker_id', <!--{$arrMaker[cnt].maker_id}-->); return false;">編集</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('pre_edit', 'maker_id', <!--{$arrMaker[cnt].maker_id|h}-->); return false;">編集</a>
                     <!--{else}-->
                     編集中
                     <!--{/if}-->
@@ -75,15 +75,15 @@
                     <!--{if $arrClassCatCount[$class_id] > 0}-->
                     -
                     <!--{else}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('delete', 'maker_id', <!--{$arrMaker[cnt].maker_id}-->); return false;">削除</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('delete', 'maker_id', <!--{$arrMaker[cnt].maker_id|h}-->); return false;">削除</a>
                     <!--{/if}-->
                 </td>
                 <td class="center">
                     <!--{if $smarty.section.cnt.iteration != 1}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('up', 'maker_id', <!--{$arrMaker[cnt].maker_id}-->); return false;">上へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('up', 'maker_id', <!--{$arrMaker[cnt].maker_id|h}-->); return false;">上へ</a>
                     <!--{/if}-->
                     <!--{if $smarty.section.cnt.iteration != $smarty.section.cnt.last}-->
-                    <a href="?" onclick="eccube.setModeAndSubmit('down', 'maker_id', <!--{$arrMaker[cnt].maker_id}-->); return false;">下へ</a>
+                    <a href="?" onclick="eccube.setModeAndSubmit('down', 'maker_id', <!--{$arrMaker[cnt].maker_id|h}-->); return false;">下へ</a>
                     <!--{/if}-->
                 </td>
             </tr>
diff --git a/data/Smarty/templates/admin/products/product_rank.tpl b/data/Smarty/templates/admin/products/product_rank.tpl
index 83bfdd8093..aad530c02a 100644
--- a/data/Smarty/templates/admin/products/product_rank.tpl
+++ b/data/Smarty/templates/admin/products/product_rank.tpl
@@ -97,13 +97,13 @@
                             <td align="center">
                             <!--{* 移動 *}-->
                             <!--{if !(count($arrProductsList) == 1 && $rank == 1)}-->
-                            <input type="text" name="pos-<!--{$arrProductsList[cnt].product_id}-->" size="3" class="box3" />番目へ<a href="?" onclick="eccube.setModeAndSubmit('move','product_id', '<!--{$arrProductsList[cnt].product_id}-->'); return false;">移動</a><br />
+                            <input type="text" name="pos-<!--{$arrProductsList[cnt].product_id|h}-->" size="3" class="box3" />番目へ<a href="?" onclick="eccube.setModeAndSubmit('move','product_id', '<!--{$arrProductsList[cnt].product_id|h}-->'); return false;">移動</a><br />
                             <!--{/if}-->
                             <!--{if !($smarty.section.cnt.first && $tpl_disppage eq 1)}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('up','product_id', '<!--{$arrProductsList[cnt].product_id}-->'); return false;">上へ</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('up','product_id', '<!--{$arrProductsList[cnt].product_id|h}-->'); return false;">上へ</a>
                             <!--{/if}-->
                             <!--{if !($smarty.section.cnt.last && $tpl_disppage eq $tpl_pagemax)}-->
-                            <a href="?" onclick="eccube.setModeAndSubmit('down','product_id', '<!--{$arrProductsList[cnt].product_id}-->'); return false;">下へ</a>
+                            <a href="?" onclick="eccube.setModeAndSubmit('down','product_id', '<!--{$arrProductsList[cnt].product_id|h}-->'); return false;">下へ</a>
                             <!--{/if}-->
                             </td>
                         </tr>
diff --git a/data/Smarty/templates/admin/products/product_rank_tree_fork.tpl b/data/Smarty/templates/admin/products/product_rank_tree_fork.tpl
index 034aa21ebe..9a0877192b 100644
--- a/data/Smarty/templates/admin/products/product_rank_tree_fork.tpl
+++ b/data/Smarty/templates/admin/products/product_rank_tree_fork.tpl
@@ -26,7 +26,7 @@
             <!--{* カテゴリ名表示 *}-->
             <!--{assign var=disp_name value="`$child.category_id`.`$child.category_name`"}-->
             <!--{if $child.level != $smarty.const.LEVEL_MAX}-->
-                <a href="?" onclick="eccube.setModeAndSubmit('tree', 'parent_category_id', <!--{$child.category_id}-->); return false;">
+                <a href="?" onclick="eccube.setModeAndSubmit('tree', 'parent_category_id', <!--{$child.category_id|h}-->); return false;">
                 <!--{if $arrForm.parent_category_id == $child.category_id}-->
                     <img src="<!--{$TPL_URLPATH}-->img/contents/folder_open.gif" alt="フォルダ" />
                 <!--{else}-->
diff --git a/data/Smarty/templates/admin/products/review.tpl b/data/Smarty/templates/admin/products/review.tpl
index 3251b298d3..425bf749f3 100644
--- a/data/Smarty/templates/admin/products/review.tpl
+++ b/data/Smarty/templates/admin/products/review.tpl
@@ -154,8 +154,8 @@
                             <!--{assign var=key value="`$arrReview[cnt].recommend_level`"}-->
                             <td><!--{$arrRECOMMEND[$key]|h}--></td>
                             <td class="menu"><!--{if $arrReview[cnt].status eq 1}-->表示<!--{elseif $arrReview[cnt].status eq 2}-->非表示<!--{/if}--></td>
-                            <td class="menu"><a href="javascript:;" onclick="eccube.changeAction('./review_edit.php'); eccube.setModeAndSubmit('','review_id','<!--{$arrReview[cnt].review_id}-->'); return false;">編集</a></td>
-                            <td class="menu"><a href="javascript:;" onclick="eccube.setModeAndSubmit('delete','review_id','<!--{$arrReview[cnt].review_id}-->'); return false;">削除</a></td>
+                            <td class="menu"><a href="javascript:;" onclick="eccube.changeAction('./review_edit.php'); eccube.setModeAndSubmit('','review_id','<!--{$arrReview[cnt].review_id|h}-->'); return false;">編集</a></td>
+                            <td class="menu"><a href="javascript:;" onclick="eccube.setModeAndSubmit('delete','review_id','<!--{$arrReview[cnt].review_id|h}-->'); return false;">削除</a></td>
                         </tr>
                     <!--{/section}-->
                 </table>
diff --git a/data/Smarty/templates/admin/system/index.tpl b/data/Smarty/templates/admin/system/index.tpl
index 9379b858de..609697fd8d 100644
--- a/data/Smarty/templates/admin/system/index.tpl
+++ b/data/Smarty/templates/admin/system/index.tpl
@@ -58,13 +58,13 @@
                 <td><!--{$list_data[data].name|h}--></td>
                 <td><!--{$list_data[data].department|h}--></td>
                 <!--{assign var="work" value=$list_data[data].work}--><td><!--{$arrWORK[$work]|h}--></td>
-                <td align="center"><a href="#" onclick="eccube.openWindow('./input.php?id=<!--{$list_data[data].member_id}-->&amp;pageno=<!--{$tpl_disppage}-->','member_edit','620','450'); return false;">編集</a></td>
-                <td align="center"><!--{if $workmax > 1}--><a href="#" onclick="eccube.deleteMember(<!--{$list_data[data].member_id}-->,<!--{$tpl_disppage}-->,<!--{if $list_data[data].authority==0}--><!--{$tpl_last_admin}--><!--{else}-->false<!--{/if}-->); return false;">削除</a>
+                <td align="center"><a href="#" onclick="eccube.openWindow('./input.php?id=<!--{$list_data[data].member_id|h}-->&amp;pageno=<!--{$tpl_disppage}-->','member_edit','620','450'); return false;">編集</a></td>
+                <td align="center"><!--{if $workmax > 1}--><a href="#" onclick="eccube.deleteMember(<!--{$list_data[data].member_id|h}-->,<!--{$tpl_disppage}-->,<!--{if $list_data[data].authority==0}--><!--{$tpl_last_admin}--><!--{else}-->false<!--{/if}-->); return false;">削除</a>
                 <!--{else}-->-<!--{/if}--></td>
                 <td align="center">
                 <!--{$tpl_nomove}-->
-                <!--{if !($smarty.section.data.first && $tpl_disppage eq 1)}--><a href="./rank.php?id=<!--{$list_data[data].member_id}-->&amp;move=up&amp;pageno=<!--{$tpl_disppage}-->">上へ</a><!--{/if}-->
-                <!--{if !($smarty.section.data.last && $tpl_disppage eq $tpl_pagemax)}--><a href="./rank.php?id=<!--{$list_data[data].member_id}-->&amp;move=down&amp;pageno=<!--{$tpl_disppage}-->">下へ</a><!--{/if}-->
+                <!--{if !($smarty.section.data.first && $tpl_disppage eq 1)}--><a href="./rank.php?id=<!--{$list_data[data].member_id|h}-->&amp;move=up&amp;pageno=<!--{$tpl_disppage}-->">上へ</a><!--{/if}-->
+                <!--{if !($smarty.section.data.last && $tpl_disppage eq $tpl_pagemax)}--><a href="./rank.php?id=<!--{$list_data[data].member_id|h}-->&amp;move=down&amp;pageno=<!--{$tpl_disppage}-->">下へ</a><!--{/if}-->
                 </td>
             </tr>
             <!--▲メンバー<!--{$smarty.section.data.iteration}-->-->
diff --git a/data/Smarty/templates/default/mypage/delivery.tpl b/data/Smarty/templates/default/mypage/delivery.tpl
index f9fd9505b6..4b834f99e4 100644
--- a/data/Smarty/templates/default/mypage/delivery.tpl
+++ b/data/Smarty/templates/default/mypage/delivery.tpl
@@ -70,10 +70,10 @@
                                 <!--{$arrOtherDeliv[cnt].company_name|h}-->&nbsp;<!--{$arrOtherDeliv[cnt].name01|h}-->&nbsp;<!--{$arrOtherDeliv[cnt].name02|h}-->
                             </td>
                             <td class="alignC">
-                                <a href="./delivery_addr.php" onclick="eccube.openWindow('./delivery_addr.php?other_deliv_id=<!--{$arrOtherDeliv[cnt].other_deliv_id}-->','deliv_disp','600','640'); return false;">変更</a>
+                                <a href="./delivery_addr.php" onclick="eccube.openWindow('./delivery_addr.php?other_deliv_id=<!--{$arrOtherDeliv[cnt].other_deliv_id|h}-->','deliv_disp','600','640'); return false;">変更</a>
                             </td>
                             <td class="alignC">
-                                <a href="#" onclick="eccube.setModeAndSubmit('delete','other_deliv_id','<!--{$arrOtherDeliv[cnt].other_deliv_id}-->'); return false;">削除</a>
+                                <a href="#" onclick="eccube.setModeAndSubmit('delete','other_deliv_id','<!--{$arrOtherDeliv[cnt].other_deliv_id|h}-->'); return false;">削除</a>
                             </td>
                         </tr>
                     <!--{/section}-->
diff --git a/data/Smarty/templates/default/products/detail.tpl b/data/Smarty/templates/default/products/detail.tpl
index 8f71d5cc9b..29c516c9b1 100644
--- a/data/Smarty/templates/default/products/detail.tpl
+++ b/data/Smarty/templates/default/products/detail.tpl
@@ -182,8 +182,8 @@
                 <!--▼買い物カゴ-->
                 <div class="cart_area clearfix">
                     <input type="hidden" name="mode" value="cart" />
-                    <input type="hidden" name="product_id" value="<!--{$tpl_product_id}-->" />
-                    <input type="hidden" name="product_class_id" value="<!--{$tpl_product_class_id}-->" id="product_class_id" />
+                    <input type="hidden" name="product_id" value="<!--{$tpl_product_id|h}-->" />
+                    <input type="hidden" name="product_class_id" value="<!--{$tpl_product_class_id|h}-->" id="product_class_id" />
                     <input type="hidden" name="favorite_product_id" value="" />
 
                     <!--{if $tpl_stock_find}-->
diff --git a/data/Smarty/templates/default/products/list.tpl b/data/Smarty/templates/default/products/list.tpl
index 4f17e165a9..79300d2b6f 100644
--- a/data/Smarty/templates/default/products/list.tpl
+++ b/data/Smarty/templates/default/products/list.tpl
@@ -239,7 +239,7 @@
                                 <div class="cartin_btn">
                                     <!--★カゴに入れる★-->
                                     <div id="cartbtn_default_<!--{$id}-->">
-                                        <input type="image" id="cart<!--{$id}-->" src="<!--{$TPL_URLPATH}-->img/button/btn_cartin.jpg" alt="カゴに入れる" onclick="fnInCart(this.form); return false;" class="hover_change_image" />
+                                        <input type="image" id="cart<!--{$id|h}-->" src="<!--{$TPL_URLPATH}-->img/button/btn_cartin.jpg" alt="カゴに入れる" onclick="fnInCart(this.form); return false;" class="hover_change_image" />
                                     </div>
                                     <div class="attention" id="cartbtn_dynamic_<!--{$id}-->"></div>
                                 </div>
diff --git a/data/Smarty/templates/default/shopping/confirm.tpl b/data/Smarty/templates/default/shopping/confirm.tpl
index 609c2e2527..edc5ae10d5 100644
--- a/data/Smarty/templates/default/shopping/confirm.tpl
+++ b/data/Smarty/templates/default/shopping/confirm.tpl
@@ -45,7 +45,7 @@
         <form name="form1" id="form1" method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
             <input type="hidden" name="mode" value="confirm" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
 
             <div class="btn_area">
                 <ul>
diff --git a/data/Smarty/templates/default/shopping/deliv.tpl b/data/Smarty/templates/default/shopping/deliv.tpl
index eaad3811a7..b3bc5fb7b9 100644
--- a/data/Smarty/templates/default/shopping/deliv.tpl
+++ b/data/Smarty/templates/default/shopping/deliv.tpl
@@ -56,7 +56,7 @@
         <form name="form1" id="form1" method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
             <input type="hidden" name="mode" value="customer_addr" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
             <input type="hidden" name="other_deliv_id" value="" />
             <!--{if $arrErr.deli != ""}-->
                 <p class="attention"><!--{$arrErr.deli}--></p>
@@ -80,7 +80,7 @@
                             <!--{if $smarty.section.cnt.first}-->
                                 <input type="radio" name="deliv_check" id="chk_id_<!--{$smarty.section.cnt.iteration}-->" value="-1" <!--{if $arrForm.deliv_check.value == "" || $arrForm.deliv_check.value == -1}--> checked="checked"<!--{/if}--> />
                             <!--{else}-->
-                                <input type="radio" name="deliv_check" id="chk_id_<!--{$smarty.section.cnt.iteration}-->" value="<!--{$arrAddr[cnt].other_deliv_id}-->"<!--{if $arrForm.deliv_check.value == $arrAddr[cnt].other_deliv_id}--> checked="checked"<!--{/if}--> />
+                                <input type="radio" name="deliv_check" id="chk_id_<!--{$smarty.section.cnt.iteration}-->" value="<!--{$arrAddr[cnt].other_deliv_id|h}-->"<!--{if $arrForm.deliv_check.value == $arrAddr[cnt].other_deliv_id|h}--> checked="checked"<!--{/if}--> />
                             <!--{/if}-->
                         </td>
                         <td class="alignC">
@@ -110,7 +110,7 @@
                         </td>
                         <td class="alignC">
                             <!--{if !$smarty.section.cnt.first}-->
-                                <a href="?" onclick="eccube.setModeAndSubmit('delete', 'other_deliv_id', '<!--{$arrAddr[cnt].other_deliv_id}-->'); return false">削除</a>
+                                <a href="?" onclick="eccube.setModeAndSubmit('delete', 'other_deliv_id', '<!--{$arrAddr[cnt].other_deliv_id|h}-->'); return false">削除</a>
                                 <!--{else}-->
                                     -
                                 <!--{/if}-->
diff --git a/data/Smarty/templates/default/shopping/multiple.tpl b/data/Smarty/templates/default/shopping/multiple.tpl
index cb7f55870a..48f62c67a1 100644
--- a/data/Smarty/templates/default/shopping/multiple.tpl
+++ b/data/Smarty/templates/default/shopping/multiple.tpl
@@ -41,7 +41,7 @@
         <!--{/if}-->
         <form name="form1" id="form1" method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
             <input type="hidden" name="line_of_num" value="<!--{$arrForm.line_of_num.value}-->" />
             <input type="hidden" name="mode" value="confirm" />
             <table summary="商品情報">
diff --git a/data/Smarty/templates/default/shopping/nonmember_input.tpl b/data/Smarty/templates/default/shopping/nonmember_input.tpl
index bc61bde2f3..06372d5f18 100644
--- a/data/Smarty/templates/default/shopping/nonmember_input.tpl
+++ b/data/Smarty/templates/default/shopping/nonmember_input.tpl
@@ -39,7 +39,7 @@
         <form name="form1" id="form1" method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
             <input type="hidden" name="mode" value="nonmember_confirm" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
             <table summary=" ">
             <!--{include file="`$smarty.const.TEMPLATE_REALDIR`frontparts/form_personal_input.tpl" flgFields=2 emailMobile=false prefix="order_"}-->
                 <tr>
diff --git a/data/Smarty/templates/default/shopping/payment.tpl b/data/Smarty/templates/default/shopping/payment.tpl
index a605704e79..f32612490e 100644
--- a/data/Smarty/templates/default/shopping/payment.tpl
+++ b/data/Smarty/templates/default/shopping/payment.tpl
@@ -127,7 +127,7 @@
         <form name="form1" id="form1" method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
             <input type="hidden" name="mode" value="confirm" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
 
             <!--{assign var=key value="deliv_id"}-->
             <!--{if $is_single_deliv}-->
diff --git a/data/Smarty/templates/mobile/mypage/history.tpl b/data/Smarty/templates/mobile/mypage/history.tpl
index cdd36d83a8..1b309857af 100644
--- a/data/Smarty/templates/mobile/mypage/history.tpl
+++ b/data/Smarty/templates/mobile/mypage/history.tpl
@@ -29,7 +29,7 @@
 
     <form action="order.php" method="post">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
-        <input type="hidden" name="order_id" value="<!--{$tpl_arrOrderData.order_id}-->">
+        <input type="hidden" name="order_id" value="<!--{$tpl_arrOrderData.order_id|h}-->">
         <input type="submit" name="submit" value="再注文">
     </form>
 
diff --git a/data/Smarty/templates/mobile/mypage/index.tpl b/data/Smarty/templates/mobile/mypage/index.tpl
index b8301feb7c..515fcbd404 100644
--- a/data/Smarty/templates/mobile/mypage/index.tpl
+++ b/data/Smarty/templates/mobile/mypage/index.tpl
@@ -63,7 +63,7 @@
                 <!--{/if}-->
             <!--{/if}-->
 
-            <div align="right"><a href="./history.php?order_id=<!--{$arrOrder[cnt].order_id}-->">→詳細を見る</a></div><br>
+            <div align="right"><a href="./history.php?order_id=<!--{$arrOrder[cnt].order_id|h}-->">→詳細を見る</a></div><br>
         <!--{/section}-->
         <hr>
     <!--{else}-->
diff --git a/data/Smarty/templates/mobile/products/detail.tpl b/data/Smarty/templates/mobile/products/detail.tpl
index bc91216848..ad7fb27bec 100644
--- a/data/Smarty/templates/mobile/products/detail.tpl
+++ b/data/Smarty/templates/mobile/products/detail.tpl
@@ -39,7 +39,7 @@
             <!--{if ($smarty.get.image == "" || $smarty.get.image == "main_image")}-->
                 [1]
             <!--{else}-->
-                [<a href="?product_id=<!--{$smarty.get.product_id}-->&amp;image=main_image">1</a>]
+                [<a href="?product_id=<!--{$smarty.get.product_id|h}-->&amp;image=main_image">1</a>]
             <!--{/if}-->
 
             <!--{assign var=num value="2"}-->
@@ -49,7 +49,7 @@
                     <!--{if $key == $smarty.get.image}-->
                         [<!--{$num}-->]
                     <!--{else}-->
-                        [<a href="?product_id=<!--{$smarty.get.product_id}-->&amp;image=<!--{$key}-->"><!--{$num}--></a>]
+                        [<a href="?product_id=<!--{$smarty.get.product_id|h}-->&amp;image=<!--{$key}-->"><!--{$num}--></a>]
                     <!--{/if}-->
                     <!--{assign var=num value="`$num+1`"}-->
                 <!--{/if}-->
@@ -144,7 +144,7 @@
         <input type="hidden" name="mode" value="select">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
 
-        <input type="hidden" name="product_id" value="<!--{$tpl_product_id}-->">
+        <input type="hidden" name="product_id" value="<!--{$tpl_product_id|h}-->">
         <!--{if $tpl_stock_find}-->
             <!--★商品を選ぶ★-->
             <center><input type="submit" name="select" id="cart" value="この商品を選ぶ"></center>
diff --git a/data/Smarty/templates/mobile/products/select_find1.tpl b/data/Smarty/templates/mobile/products/select_find1.tpl
index 97f40b3fd4..6a0dcdc882 100644
--- a/data/Smarty/templates/mobile/products/select_find1.tpl
+++ b/data/Smarty/templates/mobile/products/select_find1.tpl
@@ -37,7 +37,7 @@
             <!--{html_options options=$arrClassCat1 selected=$arrForm.classcategory_id1.value}-->
         </select><br>
         <input type="hidden" name="mode" value="select2">
-        <input type="hidden" name="product_id" value="<!--{$tpl_product_id}-->">
+        <input type="hidden" name="product_id" value="<!--{$tpl_product_id|h}-->">
         <center><input type="submit" name="submit" value="次へ"></center>
     </form>
 <!--{/strip}-->
diff --git a/data/Smarty/templates/mobile/products/select_find2.tpl b/data/Smarty/templates/mobile/products/select_find2.tpl
index 9b9f639c21..f11b4f8fe2 100644
--- a/data/Smarty/templates/mobile/products/select_find2.tpl
+++ b/data/Smarty/templates/mobile/products/select_find2.tpl
@@ -38,7 +38,7 @@
         </select><br>
         <input type="hidden" name="mode" value="selectItem">
         <input type="hidden" name="classcategory_id1" value="<!--{$arrForm.classcategory_id1.value|h}-->">
-        <input type="hidden" name="product_id" value="<!--{$tpl_product_id}-->">
+        <input type="hidden" name="product_id" value="<!--{$tpl_product_id|h}-->">
         <center><input type="submit" name="submit" value="次へ"></center>
     </form>
 <!--{/strip}-->
diff --git a/data/Smarty/templates/mobile/products/select_item.tpl b/data/Smarty/templates/mobile/products/select_item.tpl
index 2587f7fa65..8828236c46 100644
--- a/data/Smarty/templates/mobile/products/select_item.tpl
+++ b/data/Smarty/templates/mobile/products/select_item.tpl
@@ -41,8 +41,8 @@
         <input type="hidden" name="mode" value="cart">
         <input type="hidden" name="classcategory_id1" value="<!--{$arrForm.classcategory_id1.value|h}-->">
         <input type="hidden" name="classcategory_id2" value="<!--{$arrForm.classcategory_id2.value|h}-->">
-        <input type="hidden" name="product_id" value="<!--{$tpl_product_id}-->">
-        <input type="hidden" name="product_class_id" value="<!--{$tpl_product_class_id}-->">
+        <input type="hidden" name="product_id" value="<!--{$tpl_product_id|h}-->">
+        <input type="hidden" name="product_class_id" value="<!--{$tpl_product_class_id|h}-->">
         <input type="hidden" name="product_type" value="<!--{$tpl_product_type}-->">
         <center><input type="submit" name="submit" value="カゴに入れる"></center>
     </form>
diff --git a/data/Smarty/templates/mobile/shopping/confirm.tpl b/data/Smarty/templates/mobile/shopping/confirm.tpl
index 0b1cf7d464..de8289e5eb 100644
--- a/data/Smarty/templates/mobile/shopping/confirm.tpl
+++ b/data/Smarty/templates/mobile/shopping/confirm.tpl
@@ -26,7 +26,7 @@
     <form method="post" action="<!--{$smarty.const.MOBILE_SHOPPING_CONFIRM_URLPATH}-->">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
         <input type="hidden" name="mode" value="confirm">
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
 
         下記のご注文内容に間違いはございませんか？<br>
 
@@ -149,7 +149,7 @@
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
         <input type="hidden" name="mode" value="select_deliv">
         <input type="hidden" name="deliv_id" value="<!--{$arrForm.deliv_id|h}-->">
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
         <center><input type="submit" value="戻る"></center>
     </form>
 <!--{/strip}-->
diff --git a/data/Smarty/templates/mobile/shopping/deliv.tpl b/data/Smarty/templates/mobile/shopping/deliv.tpl
index 5064adf3fb..49e4392dc5 100644
--- a/data/Smarty/templates/mobile/shopping/deliv.tpl
+++ b/data/Smarty/templates/mobile/shopping/deliv.tpl
@@ -30,15 +30,15 @@
         <!--{section name=cnt loop=$arrAddr}-->
         <form method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
             <input type="hidden" name="deli" value="<!--{$smarty.section.cnt.iteration}-->">
             <input type="hidden" name="mode" value="customer_addr">
             <!--{if $smarty.section.cnt.first}-->
                 <input type="hidden" name="other_deliv_id" value="">
                 <input type="hidden" name="deliv_check" value="-1">
             <!--{else}-->
-                <input type="hidden" name="other_deliv_id" value="<!--{$arrAddr[cnt].other_deliv_id}-->">
-                <input type="hidden" name="deliv_check" value="<!--{$arrAddr[cnt].other_deliv_id}-->">
+                <input type="hidden" name="other_deliv_id" value="<!--{$arrAddr[cnt].other_deliv_id|h}-->">
+                <input type="hidden" name="deliv_check" value="<!--{$arrAddr[cnt].other_deliv_id|h}-->">
                 <br>
             <!--{/if}-->
 
@@ -62,15 +62,15 @@
             <form method="get" action="<!--{$smarty.const.ROOT_URLPATH}-->mypage/delivery_addr.php">
                 <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
                 <input type="hidden" name="page" value="<!--{$smarty.server.SCRIPT_NAME|h}-->">
-                <input type="hidden" name="other_deliv_id" value="<!--{$arrAddr[cnt].other_deliv_id}-->">
+                <input type="hidden" name="other_deliv_id" value="<!--{$arrAddr[cnt].other_deliv_id|h}-->">
                 <center><input type="submit" value="お届け先情報変更"></center>
             </form>
 
             <form method="post" action="?">
                 <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
-                <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+                <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
                 <input type="hidden" name="mode" value="delete">
-                <input type="hidden" name="other_deliv_id" value="<!--{$arrAddr[cnt].other_deliv_id}-->">
+                <input type="hidden" name="other_deliv_id" value="<!--{$arrAddr[cnt].other_deliv_id|h}-->">
                 <center><input type="submit" value="お届け先を削除"></center>
             </form>
         <!--{/if}-->
@@ -91,7 +91,7 @@
         ■お届け先を複数指定する<br>
         <form method="post" action="?">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
             <input type="hidden" name="mode" value="multiple">
             <center><input type="submit" value="複数お届け先"></center>
         </form>
diff --git a/data/Smarty/templates/mobile/shopping/multiple.tpl b/data/Smarty/templates/mobile/shopping/multiple.tpl
index 903f7b3bed..4843e222f5 100644
--- a/data/Smarty/templates/mobile/shopping/multiple.tpl
+++ b/data/Smarty/templates/mobile/shopping/multiple.tpl
@@ -27,7 +27,7 @@
 
     <form method="post" action="?">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
         <input type="hidden" name="line_of_num" value="<!--{$arrForm.line_of_num.value}-->">
         <input type="hidden" name="mode" value="confirm">
         <!--{section name=line loop=$arrForm.line_of_num.value}-->
diff --git a/data/Smarty/templates/mobile/shopping/payment.tpl b/data/Smarty/templates/mobile/shopping/payment.tpl
index 122a2b1362..4c4ec3b910 100644
--- a/data/Smarty/templates/mobile/shopping/payment.tpl
+++ b/data/Smarty/templates/mobile/shopping/payment.tpl
@@ -26,7 +26,7 @@
     <form method="post" action="<!--{$smarty.const.MOBILE_SHOPPING_PAYMENT_URLPATH}-->">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
         <input type="hidden" name="mode" value="confirm">
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
         <!--{assign var=key value="deliv_id"}-->
         <input type="hidden" name="<!--{$key}-->" value="<!--{$arrForm[$key].value|h}-->">
         ■お支払方法 <font color="#FF0000">*</font><br>
@@ -35,7 +35,7 @@
             <font color="#FF0000"><!--{$arrErr[$key]}--></font>
         <!--{/if}-->
         <!--{section name=cnt loop=$arrPayment}-->
-            <input type="radio" name="<!--{$key}-->" value="<!--{$arrPayment[cnt].payment_id}-->" <!--{$arrPayment[cnt].payment_id|sfGetChecked:$arrForm[$key].value}-->>
+            <input type="radio" name="<!--{$key}-->" value="<!--{$arrPayment[cnt].payment_id|h}-->" <!--{$arrPayment[cnt].payment_id|sfGetChecked:$arrForm[$key].value}-->>
             <!--{$arrPayment[cnt].payment_method|h}-->
             <br>
         <!--{/section}-->
diff --git a/data/Smarty/templates/mobile/shopping/select_deliv.tpl b/data/Smarty/templates/mobile/shopping/select_deliv.tpl
index 644c8787f8..d6c9c196a8 100644
--- a/data/Smarty/templates/mobile/shopping/select_deliv.tpl
+++ b/data/Smarty/templates/mobile/shopping/select_deliv.tpl
@@ -26,14 +26,14 @@
     <form method="post" action="<!--{$smarty.const.MOBILE_SHOPPING_PAYMENT_URLPATH}-->">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
         <input type="hidden" name="mode" value="select_deliv">
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->">
         ■配送方法 <font color="#FF0000">*</font><br>
         <!--{assign var=key value="deliv_id"}-->
         <!--{if $arrErr[$key] != ""}-->
             <font color="#FF0000"><!--{$arrErr[$key]}--></font>
         <!--{/if}-->
         <!--{section name=cnt loop=$arrDeliv}-->
-            <input type="radio" name="<!--{$key}-->" value="<!--{$arrDeliv[cnt].deliv_id}-->" <!--{$arrDeliv[cnt].deliv_id|sfGetChecked:$arrForm[$key].value}-->>
+            <input type="radio" name="<!--{$key}-->" value="<!--{$arrDeliv[cnt].deliv_id|h}-->" <!--{$arrDeliv[cnt].deliv_id|sfGetChecked:$arrForm[$key].value}-->>
             <!--{$arrDeliv[cnt].name|h}-->
             <br>
         <!--{/section}-->
diff --git a/data/Smarty/templates/sphone/frontparts/bloc/news.tpl b/data/Smarty/templates/sphone/frontparts/bloc/news.tpl
index 028efa162d..fe43711dda 100644
--- a/data/Smarty/templates/sphone/frontparts/bloc/news.tpl
+++ b/data/Smarty/templates/sphone/frontparts/bloc/news.tpl
@@ -26,7 +26,7 @@
     <ul class="newslist">
         <!--{section name=data loop=$arrNews max=3}-->
             <li>
-                <a id="windowcolumn<!--{$smarty.section.data.index}-->" href="javascript:getNewsDetail(<!--{$arrNews[data].news_id}-->);">
+                <a id="windowcolumn<!--{$smarty.section.data.index}-->" href="javascript:getNewsDetail(<!--{$arrNews[data].news_id|h}-->);">
                 <span class="news_title"><!--{$arrNews[data].news_title|h}--></span></a><br />
                 <span class="news_date"><!--{$arrNews[data].cast_news_date|date_format:"%Y年 %m月 %d日"}--></span>
             </li>
diff --git a/data/Smarty/templates/sphone/mypage/delivery.tpl b/data/Smarty/templates/sphone/mypage/delivery.tpl
index 7dba98eed3..6b98efea0d 100644
--- a/data/Smarty/templates/sphone/mypage/delivery.tpl
+++ b/data/Smarty/templates/sphone/mypage/delivery.tpl
@@ -63,8 +63,8 @@
                                 <span class="name01"><!--{$arrOtherDeliv[cnt].name01|h}--></span>&nbsp;<span class="name02"><!--{$arrOtherDeliv[cnt].name02|h}--></span></p>
 
                             <ul class="edit">
-                                <li><a href="#" onClick="eccube.openWindow('./delivery_addr.php?other_deliv_id=<!--{$arrOtherDeliv[cnt].other_deliv_id}-->','deliv_disp','600','640'); return false;" class="b_edit deliv_edit" rel="external">編集</a></li>
-                                <li><a href="#" onClick="eccube.setModeAndSubmit('delete','other_deliv_id','<!--{$arrOtherDeliv[cnt].other_deliv_id}-->'); return false;" class="deliv_delete" rel="external"><img src="<!--{$TPL_URLPATH}-->img/button/btn_delete.png" class="pointer" width="21" height="20" alt="削除" /></a></li>
+                                <li><a href="#" onClick="eccube.openWindow('./delivery_addr.php?other_deliv_id=<!--{$arrOtherDeliv[cnt].other_deliv_id|h}-->','deliv_disp','600','640'); return false;" class="b_edit deliv_edit" rel="external">編集</a></li>
+                                <li><a href="#" onClick="eccube.setModeAndSubmit('delete','other_deliv_id','<!--{$arrOtherDeliv[cnt].other_deliv_id|h}-->'); return false;" class="deliv_delete" rel="external"><img src="<!--{$TPL_URLPATH}-->img/button/btn_delete.png" class="pointer" width="21" height="20" alt="削除" /></a></li>
                             </ul>
                         </div>
                         <!--▲お届け先-->
diff --git a/data/Smarty/templates/sphone/mypage/history.tpl b/data/Smarty/templates/sphone/mypage/history.tpl
index 5c39ac6684..b92d7d5ce8 100644
--- a/data/Smarty/templates/sphone/mypage/history.tpl
+++ b/data/Smarty/templates/sphone/mypage/history.tpl
@@ -38,7 +38,7 @@
 
             <form action="order.php" method="post">
                 <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
-                <input type="hidden" name="order_id" value="<!--{$tpl_arrOrderData.order_id}-->">
+                <input type="hidden" name="order_id" value="<!--{$tpl_arrOrderData.order_id|h}-->">
                 <input class="btn_reorder btn data-role-none" type="submit" name="submit" value="再注文">
             </form>
         </div>
diff --git a/data/Smarty/templates/sphone/products/detail.tpl b/data/Smarty/templates/sphone/products/detail.tpl
index 84c092da51..24422a14e2 100644
--- a/data/Smarty/templates/sphone/products/detail.tpl
+++ b/data/Smarty/templates/sphone/products/detail.tpl
@@ -239,8 +239,8 @@
 
                 <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
                 <input type="hidden" name="mode" value="cart" />
-                <input type="hidden" name="product_id" value="<!--{$tpl_product_id}-->" />
-                <input type="hidden" name="product_class_id" value="<!--{$tpl_product_class_id}-->" id="product_class_id" />
+                <input type="hidden" name="product_id" value="<!--{$tpl_product_id|h}-->" />
+                <input type="hidden" name="product_class_id" value="<!--{$tpl_product_class_id|h}-->" id="product_class_id" />
                 <input type="hidden" name="favorite_product_id" value="" />
 
                 <!--▼買い物カゴ-->
@@ -375,7 +375,7 @@
             <div class="review_btn">
                 <!--{if is_array($arrReview) && count($arrReview) < $smarty.const.REVIEW_REGIST_MAX}-->
                     <!--★新規コメントを書き込む★-->
-                    <a href="./review.php?product_id=<!--{$arrProduct.product_id}-->" target="_blank" class="btn_sub">新規コメントを書き込む</a>
+                    <a href="./review.php?product_id=<!--{$arrProduct.product_id|h}-->" target="_blank" class="btn_sub">新規コメントを書き込む</a>
                 <!--{/if}-->
             </div>
             </div>
diff --git a/data/Smarty/templates/sphone/shopping/confirm.tpl b/data/Smarty/templates/sphone/shopping/confirm.tpl
index a19a165eac..1e6943c1a2 100644
--- a/data/Smarty/templates/sphone/shopping/confirm.tpl
+++ b/data/Smarty/templates/sphone/shopping/confirm.tpl
@@ -84,7 +84,7 @@
     <form name="form1" id="form1" method="post" action="<!--{$smarty.const.ROOT_URLPATH}-->shopping/confirm.php">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
         <input type="hidden" name="mode" value="confirm" />
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
 
         <h3 class="subtitle">ご注文内容</h3>
 
diff --git a/data/Smarty/templates/sphone/shopping/deliv.tpl b/data/Smarty/templates/sphone/shopping/deliv.tpl
index 450c8f379e..eff140a84d 100644
--- a/data/Smarty/templates/sphone/shopping/deliv.tpl
+++ b/data/Smarty/templates/sphone/shopping/deliv.tpl
@@ -35,7 +35,7 @@
         <form name="form1" id="form1" method="post" action="<!--{$smarty.const.ROOT_URLPATH}-->shopping/deliv.php">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
             <input type="hidden" name="mode" value="customer_addr" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
             <input type="hidden" name="other_deliv_id" value="" />
             <!--{if $arrErr.deli != ""}-->
                 <p class="attention"><!--{$arrErr.deli}--></p>
@@ -65,7 +65,7 @@
                         <!--{else}-->
                             <dt>
                                 <p>
-                                    <input type="radio" name="deliv_check" id="chk_id_<!--{$smarty.section.cnt.iteration}-->" value="<!--{$arrAddr[cnt].other_deliv_id}-->"<!--{if $arrForm.deliv_check.value == $arrAddr[cnt].other_deliv_id}--> checked="checked"<!--{/if}--> class="data-role-none" />
+                                    <input type="radio" name="deliv_check" id="chk_id_<!--{$smarty.section.cnt.iteration}-->" value="<!--{$arrAddr[cnt].other_deliv_id|h}-->"<!--{if $arrForm.deliv_check.value == $arrAddr[cnt].other_deliv_id|h}--> checked="checked"<!--{/if}--> class="data-role-none" />
                                     <label for="chk_id_<!--{$smarty.section.cnt.iteration}-->">追加登録住所</label>
                                 </p>
                                 <ul class="edit">
diff --git a/data/Smarty/templates/sphone/shopping/multiple.tpl b/data/Smarty/templates/sphone/shopping/multiple.tpl
index c1ea6656c7..d2455452a6 100644
--- a/data/Smarty/templates/sphone/shopping/multiple.tpl
+++ b/data/Smarty/templates/sphone/shopping/multiple.tpl
@@ -42,7 +42,7 @@
     <div class="form_area">
         <form name="form1" id="form1" method="post" action="<!--{$smarty.const.ROOT_URLPATH}-->shopping/multiple.php">
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
-            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+            <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
             <input type="hidden" name="line_of_num" value="<!--{$arrForm.line_of_num.value}-->" />
             <input type="hidden" name="mode" value="confirm" />
 
diff --git a/data/Smarty/templates/sphone/shopping/nonmember_input.tpl b/data/Smarty/templates/sphone/shopping/nonmember_input.tpl
index ac386d9e1f..84366059e6 100644
--- a/data/Smarty/templates/sphone/shopping/nonmember_input.tpl
+++ b/data/Smarty/templates/sphone/shopping/nonmember_input.tpl
@@ -49,7 +49,7 @@
     <form name="form1" id="form1" method="post" action="?">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
         <input type="hidden" name="mode" value="nonmember_confirm" />
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
 
         <dl class="form_entry">
             <dt>お名前&nbsp;<span class="attention">※</span></dt>
diff --git a/data/Smarty/templates/sphone/shopping/payment.tpl b/data/Smarty/templates/sphone/shopping/payment.tpl
index 051abede63..af54cf2ebb 100644
--- a/data/Smarty/templates/sphone/shopping/payment.tpl
+++ b/data/Smarty/templates/sphone/shopping/payment.tpl
@@ -120,7 +120,7 @@
     <form name="form1" id="form1" method="post" action="<!--{$smarty.const.ROOT_URLPATH}-->shopping/payment.php">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
         <input type="hidden" name="mode" value="confirm" />
-        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->" />
+        <input type="hidden" name="uniqid" value="<!--{$tpl_uniqid|h}-->" />
 
         <!--★インフォメーション★-->
         <div class="information end">