Changeset 1316529

Timestamp:

12/26/2015 02:44:05 PM (10 years ago)

Author:

digontoahsan

Message:

Changes for ADVPS version 2.5.0

Location:

advanced-post-slider/trunk

Files:

• advanced-post-slider.php (modified) (7 diffs)
• advps-admin.php (modified) (16 diffs)
• js/advps.script.js (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• templates/template-one.php (modified) (32 diffs)
• templates/template-three.php (modified) (34 diffs)
• templates/template-two.php (modified) (27 diffs)

advanced-post-slider/trunk/advanced-post-slider.php

@@ -4 +4 @@
     Plugin URI: www.wpcue.com
     Description: A multipurpose responsive slideshow plugin powered with three built-in design template, lots of easy customizable options and many more to explore.
-    Version: 2.4.0
+    Version: 2.5.0
     Author: digontoahsan
     Author URI: www.wpcue.com
@@ -76 +76 @@
             update_option('advps-update-notification','show');
         }
-        update_option('advps-curr-version','2.4.0');
+        update_option('advps-curr-version','2.5.0');
     }
     add_action( 'plugins_loaded', 'advps_update_db' );
@@ -108 +108 @@
     
     function advpsUpdateLabel(){
-        $nonce = $_POST['checkReq'];
-        $fname = $_POST['f_name'];
-        $fvalue = trim($_POST['f_value']);
+        $nonce = sanitize_text_field(  $_POST['checkReq'] );
+        $fname = sanitize_text_field( $_POST['f_name'] );
+        $fvalue = trim( sanitize_text_field( $_POST['f_value']) );
         if(! defined( 'ABSPATH' ) || !wp_verify_nonce( $nonce, 'advpsauthrequst' )){
             echo "Unauthorized request.";
@@ -124 +124 @@
 
     function chkCaetegory(){
-        $nonce = $_POST['checkReq'];
-        $posttype = $_POST['post_type'];
+        $nonce = sanitize_text_field( $_POST['checkReq'] );
+        $posttype = sanitize_text_field( $_POST['post_type'] );
         if(! defined( 'ABSPATH' ) || !wp_verify_nonce( $nonce, 'advpsauthrequst' )){
             echo "Unauthorized request.";
@@ -155 +155 @@
     }
     function advpsUpdateOpt(){
-        $nonce = $_POST['checkReq'];
+        $nonce = sanitize_text_field( $_POST['checkReq'] );
         $optdata = $_POST['optdata'];
         
@@ -200 +200 @@
     }
     function advpsListPost(){
-        $nonce = $_POST['checkReq'];
-        $ptype = $_POST['ptype'];
-        $pmax = $_POST['pmax'];
-        $porderBy = $_POST['porderBy'];
-        $porder = $_POST['porder'];
-        $plist = explode(',',$_POST['plist']);
+        $nonce = sanitize_text_field( $_POST['checkReq'] );
+        $ptype = sanitize_text_field( $_POST['ptype'] );
+        $pmax = sanitize_text_field( $_POST['pmax'] );
+        $porderBy = sanitize_text_field( $_POST['porderBy'] );
+        $porder = sanitize_text_field( $_POST['porder'] );
+        $plist = explode(',', sanitize_text_field( $_POST['plist'] ) ) ;
         
         if(! defined( 'ABSPATH' ) || !wp_verify_nonce( $nonce, 'advpsauthrequst' )){
@@ -230 +230 @@
     }
     function advpsUpdateSmethod(){
-        $nonce = $_POST['checkReq'];
-        $selnam = $_POST['selnam'];
-        $selval = $_POST['selval'];
+        $nonce = sanitize_text_field( $_POST['checkReq'] );
+        $selnam = sanitize_text_field( $_POST['selnam'] );
+        $selval = sanitize_text_field( $_POST['selval'] );
         
         if(! defined( 'ABSPATH' ) || !wp_verify_nonce( $nonce, 'advpsauthrequst' )){

advanced-post-slider/trunk/advps-admin.php

@@ -8 +8 @@
     
     if(isset($_GET['tab'])){
-        $currTab = $_GET['tab'];
+        $currTab = sanitize_text_field( $_GET['tab'] );
     }
     else
@@ -18 +18 @@
     }
     if(isset($_POST['optset-id'])){
+        $optset_id = intval( $_POST['optset-id'] );
+        
         if ( !isset($_POST['advps_wpnonce']) || !wp_verify_nonce($_POST['advps_wpnonce'],'advps-checkauthnonce') )
         {
@@ -25 +27 @@
         
         if(isset($_POST['del-optset'])){
-        $q_del = $wpdb->prepare("delete from ".$wpdb->prefix."advps_optionset where id = %d",$_POST['optset-id']);
-            
+            $q_del = $wpdb->prepare("delete from ".$wpdb->prefix."advps_optionset where id = %d",$optset_id);           
             if($wpdb->query($q_del)){
-                delete_option('optset'.$_POST['optset-id']);
+                delete_option('optset'.$optset_id);
                 $stsMgs =  "Deleted successfully.";
             }
         }
         elseif(isset($_POST['dup-optset'])){
-            
-            $q_sel = $wpdb->prepare( "select * from ".$wpdb->prefix."advps_optionset where id = %d",$_POST['optset-id'] );
+            $nextopt_id = intval( $_POST['nextoptid'] );
+            
+            $q_sel = $wpdb->prepare( "select * from ".$wpdb->prefix."advps_optionset where id = %d",$optset_id );
             $res = $wpdb->get_results($q_sel);
             
@@ -40 +42 @@
             
             if($wpdb->query($q_add)){
-                update_option('advpssmethod'.$_POST['nextoptid'],get_option('advpssmethod'.$_POST['optset-id']));
+                update_option('advpssmethod'.$nextopt_id,get_option('advpssmethod'.$optset_id ));
                 $stsMgs =  "Duplicated successfully.";
             }
@@ -55 +57 @@
             }
             
-            $all_field = $_POST;
+            //$all_field = $_POST;
+            $nextopt_id = intval( $_POST['nextoptid'] );
             $tem_list = array('one','two','three');
             $template = sanitize_text_field($_POST['template']);
@@ -83 +86 @@
             }
             if($wpdb->query($q_add)){
-                update_option('advpssmethod'.$_POST['nextoptid'],'plist');
+                update_option('advpssmethod'.$nextopt_id,'plist');
                 $stsMgs =  "Added successfully.";
             }
@@ -100 +103 @@
             
             $thumb_name = sanitize_text_field($_POST['advps_thumb_name']);
-            $width = sanitize_text_field($_POST['advps_thumb_width']);
-            $height = sanitize_text_field($_POST['advps_thumb_height']);
+            $width = intval($_POST['advps_thumb_width']);
+            $height = intval($_POST['advps_thumb_height']);
             $crop = sanitize_text_field($_POST['advps_crop']);
     
@@ -118 +121 @@
         }
         
-        $thumb_id = sanitize_text_field($_POST['thumb_id']);
+        $thumb_id = intval($_POST['thumb_id']);
         $thumb_name = sanitize_text_field($_POST['advps_thumb_name']);
-        $width = sanitize_text_field($_POST['advps_thumb_width']);
-        $height = sanitize_text_field($_POST['advps_thumb_height']);
+        $width = intval($_POST['advps_thumb_width']);
+        $height = intval($_POST['advps_thumb_height']);
         $crop = sanitize_text_field($_POST['advps_crop']);
             
@@ -152 +155 @@
             }
             if($(this).hasClass('closed')){
-                $(this).css('background-image','url(<?php echo advps_url?>images/up.png)');
+                $(this).css('background-image','url(<?php echo esc_url( advps_url );?>images/up.png)');
                 $(this).removeClass('closed');
             }
             else
             {
-                $(this).css('background-image','url(<?php echo advps_url?>images/down.png)');
+                $(this).css('background-image','url(<?php echo esc_url( advps_url );?>images/down.png)');
                 $(this).addClass('closed');
             }
@@ -190 +193 @@
 .advps-legend {
     background-color:#6E6E6E;
- background-image:url(<?php echo advps_url?>images/up.png);
+ background-image:url(<?php echo esc_url( advps_url );?>images/up.png);
     background-repeat:no-repeat;
     background-position: 96px 6px;
@@ -225 +228 @@
 }
 .postbox .down {
- background-image:url(<?php echo advps_url?>images/downb.png);
+ background-image:url(<?php echo esc_url( advps_url );?>images/downb.png);
     background-repeat:no-repeat;
     background-position: 4px 10px;
 }
 .postbox .up {
- background-image:url(<?php echo advps_url?>images/upb.png);
+ background-image:url(<?php echo esc_url( advps_url );?>images/upb.png);
     background-repeat:no-repeat;
     background-position: 4px 10px;
@@ -254 +257 @@
   <?php if($stsMgs != ''){?>
   <div id="message" class="updated below-h2">
-    <p><?php echo $stsMgs;?></p>
+    <p><?php echo esc_html( $stsMgs );?></p>
   </div>
   <?php }?>
@@ -266 +269 @@
         }elseif($currTab == 'thumb'){?>
   <div class="advps-col-right">
-    <h2>Advanced post slider <?php echo get_option('advps-curr-version');?></h2>
+    <h2>Advanced post slider <?php echo esc_html( get_option('advps-curr-version') );?></h2>
     <ul>
       <li><a href="http://www.wpcue.com/wordpress-plugins/advanced-post-slider/" target="_blank">Plugin Homepage</a></li>
@@ -291 +294 @@
             <form method="post">
               <th scope="row">Name&nbsp;
-                <input type="text" name="advps_thumb_name" value="<?php echo $thmb->thumb_name;?>" style="width:140px" /></th>
+                <input type="text" name="advps_thumb_name" value="<?php echo esc_attr( $thmb->thumb_name );?>" style="width:140px" /></th>
               <td>Width&nbsp;
-                <input type="text" name="advps_thumb_width" value="<?php echo $thmb->width;?>" style="width:80px;" onkeypress="return onlyNum(event);" />
+                <input type="text" name="advps_thumb_width" value="<?php echo esc_attr( $thmb->width );?>" style="width:80px;" onkeypress="return onlyNum(event);" />
                 px&nbsp;&nbsp;&nbsp;Height&nbsp;
-                <input type="text" name="advps_thumb_height" value="<?php echo $thmb->height;?>" style="width:80px;" onkeypress="return onlyNum(event);" />
+                <input type="text" name="advps_thumb_height" value="<?php echo esc_attr( $thmb->height );?>" style="width:80px;" onkeypress="return onlyNum(event);" />
                 px <span style="margin-left:20px;">Crop&nbsp;
                 <select name="advps_crop">
@@ -304 +307 @@
                 <input type="submit" value="Save" class="button-secondary" name="update_thumb" />
                 </span></td>
-              <input type="hidden" value="<?php echo $thmb->id;?>" name="thumb_id" />
+              <input type="hidden" value="<?php echo esc_attr( $thmb->id );?>" name="thumb_id" />
               <?php wp_nonce_field('advps-checkauthnonce','advps_wpnonce'); ?>
             </form>
@@ -348 +351 @@
   <?php }?>
 </div>
-<meta name="wpversion" content="<?php echo $wp_version;?>" />
+<meta name="wpversion" content="<?php echo esc_attr( $wp_version );?>" />

advanced-post-slider/trunk/js/advps.script.js

@@ -198 +198 @@
     }
 }
+function duplicateOptSet(id){
+    jQuery("#frmOptDel"+id).removeAttr("onsubmit");
+    jQuery("#frmOptDel"+id).submit();
+}
 function pagerAttr(v){
     alert(v);

advanced-post-slider/trunk/readme.txt

@@ -2 +2 @@
 Contributors: digontoahsan
 Donate link: 
-Tags: post slider, content slider, slider, slideshow, wordpress content slider, content, wordpress slideshow, images, logo scroller, testimonial scroller, banner rotator, recent post slider, bxslider, image slider, sidebar slideshow, posts, post, image, image slideshow, responsive slideshow, responsive slider, carousel slider, ticker, responsive carousel slider, responsive carousel, showcase, news slider, thumbnail, thumbnail slider, featured thumbnail
+Tags: post slider, wordpress content slider, wordpress slideshow, logo scroller, testimonial scroller, banner rotator, recent post slider, image slider, image slideshow, responsive slider, responsive carousel slider, news slider
 Requires at least: 3.0.1
 Tested up to: 4.4
-Stable tag: 2.4.0
+Stable tag: 2.5.0
 License: GPLv2
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -149 +149 @@
 * Security fix.
 
+= 2.5.0 =
+* Important security fix and data cleaning. Upgrade is highly recommended.
+* Duplicating option set not working issue resolved.
+
 == Upgrade Notice ==

advanced-post-slider/trunk/templates/template-one.php

@@ -4 +4 @@
 
 <div class="advps-col-right">
-  <h2>Advanced post slider <?php echo get_option('advps-curr-version');?></h2>
+  <h2>Advanced post slider <?php echo esc_html( get_option('advps-curr-version') );?></h2>
   <ul>
     <li><a href="http://www.wpcue.com/wordpress-plugins/advanced-post-slider/" target="_blank">Plugin Homepage</a></li>
@@ -38 +38 @@
       <div class="handlediv down" title="Click to toggle"> <br>
       </div>
-      <h3 style="cursor:pointer; text-align:center" class="advps-expand <?php if(isset($_POST['advps_submit']) && $_POST['advps_submit'] == 'Add new slideshow' && $_POST['nextoptid'] == $dset->id){echo 'advps-highlight';}?>" id="lbltxt<?php echo $dset->id;?>">
-        <?php if(get_option('optset'.$dset->id)){echo get_option('optset'.$dset->id);}else{echo 'Slider '.$dset->id;}?>
+      <h3 style="cursor:pointer; text-align:center" class="advps-expand <?php if(isset($_POST['advps_submit']) && $_POST['advps_submit'] == 'Add new slideshow' && $_POST['nextoptid'] == intval( $dset->id )){echo 'advps-highlight';}?>" id="lbltxt<?php echo intval(intval( $dset->id ));?>">
+        <?php if(get_option('optset'.intval(intval( $dset->id )))){echo esc_html( get_option('optset'.intval(intval( $dset->id ))) );}else{echo 'Slider '.intval(intval( $dset->id ));}?>
       </h3>
       <div class="inside">
@@ -47 +47 @@
             <tr>
               <th scope="row">Label</th>
-              <td><input type="text" style="width:px;" value="<?php if(get_option('optset'.$dset->id)){echo get_option('optset'.$dset->id);}else{echo 'Slider '.$dset->id;}?>" name="optset<?php echo $dset->id;?>" class="advps-optset-label" onchange="advpsUpdateLabel(this.name,this.value,<?php echo $dset->id;?>)" />
-                <span id="lbludtSts<?php echo $dset->id;?>" style="padding-left:10px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+              <td><input type="text" style="width:px;" value="<?php if(get_option('optset'.intval ( $dset->id ))){echo esc_attr( get_option('optset'.intval ( $dset->id )) );}else{echo 'Slider '.intval ( $dset->id );}?>" name="optset<?php echo intval ( $dset->id );?>" class="advps-optset-label" onchange="advpsUpdateLabel(this.name,this.value,<?php echo intval ( $dset->id );?>)" />
+                <span id="lbludtSts<?php echo intval ( $dset->id );?>" style="padding-left:10px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
             </tr>
             <tr>
               <th scope="row">Usage</th>
-              <td><input style="width:200px; font-size:12px; text-align:center;" type="text" value='[advps-slideshow optset="<?php echo $dset->id;?>"]' readonly="readonly"  /></td>
+              <td><input style="width:200px; font-size:12px; text-align:center;" type="text" value='[advps-slideshow optset="<?php echo intval ( $dset->id );?>"]' readonly="readonly"  /></td>
             </tr>
           </table>
@@ -58 +58 @@
         <fieldset>
           <legend class="advps-legend advpssm" style="width:80px; background-position:79px 6px;"><strong>Select Post</strong></legend>
-          <div id="advps-sel<?php echo $dset->id;?>">
+          <div id="advps-sel<?php echo intval ( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Select post using</th>
-                <td><select name="advpssmethod<?php echo $dset->id?>" onchange="updateSm(this,<?php echo $dset->id;?>);">
-                    <option value="plist" <?php if(get_option('advpssmethod'.$dset->id) == 'plist'){echo 'selected="selected"';}?>>Post list</option>
-                    <option value="query" <?php if(get_option('advpssmethod'.$dset->id) == 'query'){echo 'selected="selected"';}?>>Query</option>
+                <td><select name="advpssmethod<?php echo intval ( $dset->id )?>" onchange="updateSm(this,<?php echo intval ( $dset->id );?>);">
+                    <option value="plist" <?php if(get_option('advpssmethod'.intval ( $dset->id )) == 'plist'){echo 'selected="selected"';}?>>Post list</option>
+                    <option value="query" <?php if(get_option('advpssmethod'.intval ( $dset->id )) == 'query'){echo 'selected="selected"';}?>>Query</option>
                   </select>
-                  <span id="smudtsts<?php echo $dset->id;?>" style="padding-left:10px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+                  <span id="smudtsts<?php echo intval ( $dset->id );?>" style="padding-left:10px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
               </tr>
             </table>
-            <form method="post" onsubmit="return false" id="plist<?php echo $dset->id;?>">
-              <table class="form-table <?php if(get_option('advpssmethod'.$dset->id) == 'query'){echo 'advps-hide';}?>">
+            <form method="post" onsubmit="return false" id="plist<?php echo intval ( $dset->id );?>">
+              <table class="form-table <?php if(get_option('advpssmethod'.intval ( $dset->id )) == 'query'){echo 'advps-hide';}?>">
                 <tr>
                   <th scope="row">Listing option</th>
@@ -79 +79 @@
                               foreach ($customPostTypes  as $post_type ) {
                           ?>
-                      <option value="<?php echo $post_type;?>" <?php if($plist['advps_post_stypes'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
+                      <option value="<?php echo esc_attr( $post_type );?>" <?php if($plist['advps_post_stypes'] == $post_type){echo 'selected="selected"';}?>><?php echo esc_html( $post_type );?></option>
                       <?php     
                               }
@@ -85 +85 @@
                     </select>
                     <span style="padding-left:10px;">
-                    <input type="text" name="advps_plistmax" value="<?php echo $plist['advps_plistmax'];?>" style="width:40px;" onkeypress="return onlyNum(event);" title="Max number of post to list" />
+                    <input type="text" name="advps_plistmax" value="<?php echo esc_attr( $plist['advps_plistmax'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" title="Max number of post to list" />
                     </span> <span style="padding-left:10px;">
                     <select name="advps_plistorder_by" title="Order by">
@@ -103 +103 @@
                     </select>
                     </span> <span style="padding-left:10px;">
-                    <button class="button-secondary" value="" onclick="listPost(<?php echo $dset->id;?>)">List</button>
-                    </span> <span class="ajx-loaderp" style="padding-left:12px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+                    <button class="button-secondary" value="" onclick="listPost(<?php echo intval ( $dset->id );?>)">List</button>
+                    </span> <span class="ajx-loaderp" style="padding-left:12px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
                 </tr>
                 <tr>
                   <th scope="row">Select post from list</th>
-                  <td><select name="advps_plist[]" multiple="multiple" style="min-height:250px; min-width:300px;" id="advps-plist-field<?php echo $dset->id;?>">
+                  <td><select name="advps_plist[]" multiple="multiple" style="min-height:250px; min-width:300px;" id="advps-plist-field<?php echo intval( $dset->id );?>">
                       <?php 
                         $lpargs = array(
-                                'post_type'      => ($plist['advps_post_stypes']) ? $plist['advps_post_stypes'] : 'post',
-                                'posts_per_page' => ($plist['advps_plistmax']) ? $plist['advps_plistmax'] : 99,
-                                'orderby'        => ($plist['advps_plistorder_by']) ? $plist['advps_plistorder_by'] : 'date',
-                                'order'          => ($plist['advps_plistorder']) ? $plist['advps_plistorder'] : 'DESC'
+                                'post_type'      => ($plist['advps_post_stypes']) ? esc_html( $plist['advps_post_stypes'] ) : 'post',
+                                'posts_per_page' => ($plist['advps_plistmax']) ? esc_html( $plist['advps_plistmax'] ) : 99,
+                                'orderby'        => ($plist['advps_plistorder_by']) ? esc_html( $plist['advps_plistorder_by'] ) : 'date',
+                                'order'          => ($plist['advps_plistorder']) ? esc_html( $plist['advps_plistorder'] ) : 'DESC'
                         );
                         $pl_query = new WP_Query($lpargs); while ($pl_query->have_posts()) : $pl_query->the_post();?>
@@ -126 +126 @@
                 <tr>
                   <th scope="row">&nbsp;</th>
-                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('plist<?php echo $dset->id;?>')" />
-                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('plist<?php echo intval( $dset->id );?>')" />
+                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
                 </tr>
               </table>
               <input type="hidden" name="opt_field" value="plist" />
-              <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+              <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
             </form>
-            <form method="post" onsubmit="return false" id="query<?php echo $dset->id;?>">
-              <table class="form-table <?php if(!get_option('advpssmethod'.$dset->id) || get_option('advpssmethod'.$dset->id) == 'plist'){echo 'advps-hide';}?>">
+            <form method="post" onsubmit="return false" id="query<?php echo intval( $dset->id );?>">
+              <table class="form-table <?php if(!get_option('advpssmethod'.intval( $dset->id )) || get_option('advpssmethod'.intval( $dset->id )) == 'plist'){echo 'advps-hide';}?>">
                 <tr>
                   <th scope="row">Post Type</th>
-                  <td><select name="advps_post_types" onchange="advpsCheckCat(this.value,<?php echo $dset->id;?>)">
+                  <td><select name="advps_post_types" onchange="advpsCheckCat(this.value,<?php echo intval( $dset->id );?>)">
                       <option value="post" <?php if($query['advps_post_types'] == 'post'){echo 'selected="selected"';}?>>post</option>
                       <option value="page" <?php if($query['advps_post_types'] == 'page'){echo 'selected="selected"';}?>>page</option>
@@ -143 +143 @@
                               foreach ($customPostTypes  as $post_type ) {
                           ?>
-                      <option value="<?php echo $post_type;?>" <?php if($query['advps_post_types'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
+                      <option value="<?php echo esc_attr( $post_type );?>" <?php if($query['advps_post_types'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
                       <?php     
                               }
@@ -149 +149 @@
                     </select></td>
                 </tr>
-                <tr id="advps-cat-field<?php echo $dset->id;?>">
+                <tr id="advps-cat-field<?php echo intval( $dset->id );?>">
                   <?php  
-                    $posttypeobj = get_post_type_object($query['advps_post_types']);
+                    $posttypeobj = get_post_type_object( esc_html( $query['advps_post_types']) );
                     if($query['advps_post_types'] != "page" && ($query['advps_post_types'] == 'post' || in_array('category',$posttypeobj->taxonomies))){
                 ?>
@@ -160 +160 @@
                         foreach($catList as $scat){
                       ?>
-                      <option value="<?php echo $scat->term_id;?>" <?php if(isset($query['advps_category']) && in_array($scat->term_id,$query['advps_category'])){echo 'selected="selected"';}?>><?php echo $scat->name;?></option>
+                      <option value="<?php echo esc_attr( $scat->term_id );?>" <?php if(isset($query['advps_category']) && in_array($scat->term_id,$query['advps_category'])){echo 'selected="selected"';}?>><?php echo esc_html( $scat->name );?></option>
                       <?php }?>
                     </select>
@@ -168 +168 @@
                 <tr>
                   <th scope="row">Max. Number of post</th>
-                  <td><input type="text" name="advps_maxpost" value="<?php echo $query['advps_maxpost'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                  <td><input type="text" name="advps_maxpost" value="<?php echo esc_attr( $query['advps_maxpost'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
                 </tr>
                 <tr>
                   <th scope="row">Offset (optional)</th>
-                  <td><input type="text" name="advps_offset" value="<?php echo $query['advps_offset'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                  <td><input type="text" name="advps_offset" value="<?php echo esc_attr( $query['advps_offset'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
                 </tr>
                 <tr>
                   <th scope="row">Exclude (optional)</th>
-                  <td><input type="text" name="advps_exclude" value="<?php echo $query['advps_exclude'];?>" style="width:100px;" />
+                  <td><input type="text" name="advps_exclude" value="<?php echo esc_attr( $query['advps_exclude'] );?>" style="width:100px;" />
                     <span style="padding-left:10px; font-size:10px; font-style:italic;">[ Ex. 1,5,10 Comma separated post IDs that need to exclude from slideshow ]</span></td>
                 </tr>
@@ -201 +201 @@
                 <tr>
                   <th scope="row">&nbsp;</th>
-                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('query<?php echo $dset->id;?>')" />
-                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('query<?php echo intval( $dset->id );?>')" />
+                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
                 </tr>
               </table>
               <input type="hidden" name="opt_field" value="query" />
-              <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+              <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
             </form>
           </div>
@@ -212 +212 @@
         <fieldset>
           <legend class="advps-legend" style="width:50px; background-position:49px 6px;"><strong>Slider</strong></legend>
-          <form method="post" id="slider<?php echo $dset->id;?>" onsubmit="return false">
+          <form method="post" id="slider<?php echo intval( $dset->id );?>" onsubmit="return false">
             <table class="form-table">
               <tr>
                 <th scope="row">Slider Type</th>
-                <td><select name="advps_slider_type" onchange="sliderType(this.value,<?php echo $dset->id;?>);">
+                <td><select name="advps_slider_type" onchange="sliderType(this.value,<?php echo intval( $dset->id );?>);">
                     <option value="standard" <?php if($slider['advps_slider_type'] == 'standard'){echo 'selected="selected"';}?>>Standard</option>
                     <option value="carousel" <?php if($slider['advps_slider_type'] == 'carousel'){echo 'selected="selected"';}?>>Carousel</option>
@@ -240 +240 @@
               <tr>
                 <th scope="row">Speed</th>
-                <td><input type="text" name="advps_speed" value="<?php echo $slider['advps_speed'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_speed" value="<?php echo esc_attr( $slider['advps_speed'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
@@ -251 +251 @@
               <tr>
                 <th scope="row">Pause</th>
-                <td><input type="text" name="advps_timeout" value="<?php echo $slider['advps_timeout'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_timeout" value="<?php echo esc_attr( $slider['advps_timeout'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
                 <th scope="row">Slide margin</th>
-                <td><input type="text" name="advps_sldmargin" value="<?php echo $slider['advps_sldmargin'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_sldmargin" value="<?php echo esc_attr( $slider['advps_sldmargin'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
@@ -266 +266 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('slider<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('slider<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="slider" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:121px; background-position:120px 6px;"><strong>Carousel & Ticker</strong></legend>
-          <form method="post" onsubmit="return false" id="caro_ticker<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="caro_ticker<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Number of slide</th>
-                <td><input type="text" name="advps_caro_slds" value="<?php if(isset($caro_ticker['advps_caro_slds'])){echo $caro_ticker['advps_caro_slds'];}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_caro_slds" value="<?php if(isset($caro_ticker['advps_caro_slds'])){echo esc_attr( $caro_ticker['advps_caro_slds'] );}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   <span style="padding-left:20px; font-size:10px; font-style:italic;">[ N.B. For slider type Carousel or Ticker. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Slide width</th>
-                <td><input type="text" name="advps_caro_sldwidth" value="<?php if(isset($caro_ticker['advps_caro_sldwidth'])){echo $caro_ticker['advps_caro_sldwidth'];}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_caro_sldwidth" value="<?php if(isset($caro_ticker['advps_caro_sldwidth'])){echo esc_attr( $caro_ticker['advps_caro_sldwidth'] );}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   <span style="padding-left:20px; font-size:10px; font-style:italic;">[ N.B. For slider type Carousel or Ticker. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('caro_ticker<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('caro_ticker<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="caro_ticker" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:155px; background-position:154px 6px;"><strong>Container & Thumbnail</strong></legend>
-          <form method="post" onsubmit="return false" id="container<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="container<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -314 +314 @@
                         foreach($_wp_additional_image_sizes as $tkey => $tval){
                         ?>
-                    <option value="<?php echo $tkey;?>" <?php if($container['advps_thumbnail'] == $tkey){echo 'selected="selected"';}?>><?php echo $tkey;?></option>
+                    <option value="<?php echo esc_attr( $tkey );?>" <?php if($container['advps_thumbnail'] == $tkey){echo 'selected="selected"';}?>><?php echo esc_html( $tkey );?></option>
                     <?php
                         }
@@ -322 +322 @@
               <tr>
                 <th scope="row">Default image url</th>
-                <td><input type="text" name="advps_default_image" value="<?php if(isset($container['advps_default_image'])){ echo $container['advps_default_image'];}?>" style="width:250px;" />
+                <td><input type="text" name="advps_default_image" value="<?php if(isset($container['advps_default_image'])){ echo esc_url( $container['advps_default_image'] );}?>" style="width:250px;" />
                   <span style="padding-left:10px; font-size:10px; font-style:italic;"> [ N.B. If any post doesn't have featured image then default image will be shown.]</span></td>
               </tr>
               <tr>
                 <th scope="row">Slide Container Width</th>
-                <td><input type="text" name="advps_sld_width" value="<?php echo $container['advps_sld_width'];?>" style="width:45px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_sld_width" value="<?php echo esc_attr( $container['advps_sld_width'] );?>" style="width:45px;" onkeypress="return onlyNum(event);" />
                   &nbsp;px</td>
               </tr>
@@ -339 +339 @@
               <tr>
                 <th scope="row">Background Color</th>
-                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bgcolor" value="<?php echo $container['advps_bgcolor'];?>" style="width:100px;" />
+                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bgcolor" value="<?php echo esc_attr( $container['advps_bgcolor'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -345 +345 @@
                 <th scope="row">Border</th>
                 <td><span style="vertical-align:top">
-                  <input type="text" name="advps_border_size" value="<?php echo $container['advps_border_size'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_border_size" value="<?php echo esc_attr( $container['advps_border_size'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px &nbsp;&nbsp;
                   <select name="advps_border_type">
@@ -356 +356 @@
                   </select>
                   &nbsp;&nbsp;</span>
-                  <input class="advps-color-picker" type="text" name="advps_border_color" id="advpscolor<?php echo ++$flg?>" value="<?php echo $container['advps_border_color'];?>" style="width:100px;" />
+                  <input class="advps-color-picker" type="text" name="advps_border_color" id="advpscolor<?php echo ++$flg?>" value="<?php echo esc_attr( $container['advps_border_color'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -369 +369 @@
                 <th scope="row">Box Shadow</th>
                 <td><span style="vertical-align:top">
-                  <input type="text" name="advps_bxshad1" value="<?php echo $container['advps_bxshad1'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad1" value="<?php echo esc_attr( $container['advps_bxshad1'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px &nbsp;&nbsp;
-                  <input type="text" name="advps_bxshad2" value="<?php echo $container['advps_bxshad2'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad2" value="<?php echo esc_attr( $container['advps_bxshad2'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px&nbsp;&nbsp;
-                  <input type="text" name="advps_bxshad3" value="<?php echo $container['advps_bxshad3'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad3" value="<?php echo esc_attr( $container['advps_bxshad3'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px&nbsp;&nbsp;</span>
-                  <input class="advps-color-picker" type="text" name="advps_bxshadcolor" value="<?php echo $container['advps_bxshadcolor'];?>" style="width:100px;" id="advpscolor<?php echo ++$flg?>" />
+                  <input class="advps-color-picker" type="text" name="advps_bxshadcolor" value="<?php echo esc_attr( $container['advps_bxshadcolor'] );?>" style="width:100px;" id="advpscolor<?php echo ++$flg?>" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -387 +387 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('container<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('container<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="container" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:102px; background-position:101px 6px;"><strong>Title & Excerpt</strong></legend>
-          <form method="post" onsubmit="return false" id="content<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="content<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Overlay size</th>
                 <td>Width&nbsp;
-                  <input type="text" name="advps_overlay_width" value="<?php echo $content['advps_overlay_width'];?>" style="width:80px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_overlay_width" value="<?php echo esc_attr( $content['advps_overlay_width'] );?>" style="width:80px;" onkeypress="return onlyNum(event);" />
                   %&nbsp;&nbsp;&nbsp;Height&nbsp;
-                  <input type="text" name="advps_overlay_height" value="<?php echo $content['advps_overlay_height'];?>" style="width:80px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_overlay_height" value="<?php echo esc_attr( $content['advps_overlay_height'] );?>" style="width:80px;" onkeypress="return onlyNum(event);" />
                   %</td>
               </tr>
               <tr>
                 <th scope="row">Overlay color</th>
-                <td><input type="text" name="advps_overlay_color" value="<?php echo $content['advps_overlay_color'];?>" style="width:100px;" class="advps-color-picker" id="advpscolor<?php echo ++$flg?>" />
+                <td><input type="text" name="advps_overlay_color" value="<?php echo esc_attr( $content['advps_overlay_color'] );?>" style="width:100px;" class="advps-color-picker" id="advpscolor<?php echo ++$flg?>" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Overlay opacity</th>
-                <td><input type="text" name="advps_overlay_opacity" value="<?php echo $content['advps_overlay_opacity'];?>" style="width:50px;" />
+                <td><input type="text" name="advps_overlay_opacity" value="<?php echo esc_attr( $content['advps_overlay_opacity'] );?>" style="width:50px;" />
                   &nbsp;<span style="padding-left:10px; font-size:10px; font-style:italic;">[ 0 - 1 ]</span></td>
               </tr>
@@ -435 +435 @@
               <tr>
                 <th scope="row">Text opacity</th>
-                <td><input type="text" name="advps_text_opacity" value="<?php echo $content['advps_text_opacity'];?>" style="width:50px;" />
+                <td><input type="text" name="advps_text_opacity" value="<?php echo esc_attr( $content['advps_text_opacity'] );?>" style="width:50px;" />
                   &nbsp;<span style="padding-left:10px; font-size:10px; font-style:italic;">[ 0 - 1 ]</span></td>
               </tr>
@@ -457 +457 @@
               <tr>
                 <th scope="row">Title font Color</th>
-                <td><input type="text" name="advps_titleFcolor" value="<?php echo $content['advps_titleFcolor'];?>" style="width:100px;" class="advps-color-picker" id="advpscolor<?php echo ++$flg?>" />
+                <td><input type="text" name="advps_titleFcolor" value="<?php echo esc_attr( $content['advps_titleFcolor'] );?>" style="width:100px;" class="advps-color-picker" id="advpscolor<?php echo ++$flg?>" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Title hover Color</th>
-                <td><input type="text" name="advps_titleHcolor" value="<?php echo $content['advps_titleHcolor'];?>" style="width:100px;" class="advps-color-picker" id="advpscolor<?php echo ++$flg?>" />
+                <td><input type="text" name="advps_titleHcolor" value="<?php echo esc_attr( $content['advps_titleHcolor'] );?>" style="width:100px;" class="advps-color-picker" id="advpscolor<?php echo ++$flg?>" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Title font size</th>
-                <td><input type="text" name="advps_titleFsizeL" value="<?php if(isset($content['advps_titleFsizeL'])){ echo $content['advps_titleFsizeL'];}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize1" value="<?php if(isset($content['advps_titleFsize1'])){ echo $content['advps_titleFsize1'];}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize2" value="<?php if(isset($content['advps_titleFsize2'])){echo $content['advps_titleFsize2'];}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize3" value="<?php if(isset($content['advps_titleFsize3'])){echo $content['advps_titleFsize3'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize4" value="<?php if(isset($content['advps_titleFsize4'])){echo $content['advps_titleFsize4'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize5" value="<?php if(isset($content['advps_titleFsize5'])){echo $content['advps_titleFsize5'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_titleFsizeL" value="<?php if(isset($content['advps_titleFsizeL'])){ echo esc_attr( $content['advps_titleFsizeL'] );}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize1" value="<?php if(isset($content['advps_titleFsize1'])){ echo esc_attr( $content['advps_titleFsize1'] );}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize2" value="<?php if(isset($content['advps_titleFsize2'])){echo esc_attr( $content['advps_titleFsize2'] );}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize3" value="<?php if(isset($content['advps_titleFsize3'])){echo esc_attr( $content['advps_titleFsize3'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize4" value="<?php if(isset($content['advps_titleFsize4'])){echo esc_attr( $content['advps_titleFsize4'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize5" value="<?php if(isset($content['advps_titleFsize5'])){echo esc_attr( $content['advps_titleFsize5'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. Different sizes for different media screen width. Hover the field to know which field is for which width. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Title line height</th>
-                <td><input type="text" name="advps_titleLheightL" value="<?php if(isset($content['advps_titleLheightL'])){ echo $content['advps_titleLheightL'];}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight1" value="<?php if(isset($content['advps_titleLheight1'])){ echo $content['advps_titleLheight1'];}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight2" value="<?php if(isset($content['advps_titleLheight2'])){echo $content['advps_titleLheight2'];}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight3" value="<?php if(isset($content['advps_titleLheight3'])){echo $content['advps_titleLheight3'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight4" value="<?php if(isset($content['advps_titleLheight4'])){echo $content['advps_titleLheight4'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight5" value="<?php if(isset($content['advps_titleLheight5'])){echo $content['advps_titleLheight5'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_titleLheightL" value="<?php if(isset($content['advps_titleLheightL'])){ echo esc_attr( $content['advps_titleLheightL'] );}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight1" value="<?php if(isset($content['advps_titleLheight1'])){ echo esc_attr( $content['advps_titleLheight1'] );}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight2" value="<?php if(isset($content['advps_titleLheight2'])){echo esc_attr( $content['advps_titleLheight2'] );}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight3" value="<?php if(isset($content['advps_titleLheight3'])){echo esc_attr( $content['advps_titleLheight3'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight4" value="<?php if(isset($content['advps_titleLheight4'])){echo esc_attr( $content['advps_titleLheight4'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight5" value="<?php if(isset($content['advps_titleLheight5'])){echo esc_attr( $content['advps_titleLheight5'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. Each for different media screen width. Hover the field to know which field is for which width. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Excerpt font color</th>
-                <td><input class="advps-color-picker" type="text" name="advps_excptFcolor" value="<?php echo $content['advps_excptFcolor'];?>" style="width:100px;" id="advpscolor<?php echo ++$flg?>" />
+                <td><input class="advps-color-picker" type="text" name="advps_excptFcolor" value="<?php echo esc_attr( $content['advps_excptFcolor'] );?>" style="width:100px;" id="advpscolor<?php echo ++$flg?>" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Excerpt font size</th>
-                <td><input type="text" name="advps_excptFsizeL" value="<?php if(isset($content['advps_excptFsizeL'])){ echo $content['advps_excptFsizeL'];}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize1" value="<?php if(isset($content['advps_excptFsize1'])){ echo $content['advps_excptFsize1'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize2" value="<?php if(isset($content['advps_excptFsize2'])){echo $content['advps_excptFsize2'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize3" value="<?php if(isset($content['advps_excptFsize3'])){echo $content['advps_excptFsize3'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize4" value="<?php if(isset($content['advps_excptFsize4'])){echo $content['advps_excptFsize4'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize5" value="<?php if(isset($content['advps_excptFsize5'])){echo $content['advps_excptFsize5'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_excptFsizeL" value="<?php if(isset($content['advps_excptFsizeL'])){ echo esc_attr( $content['advps_excptFsizeL'] );}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize1" value="<?php if(isset($content['advps_excptFsize1'])){ echo esc_attr( $content['advps_excptFsize1'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize2" value="<?php if(isset($content['advps_excptFsize2'])){echo esc_attr( $content['advps_excptFsize2'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize3" value="<?php if(isset($content['advps_excptFsize3'])){echo esc_attr( $content['advps_excptFsize3'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize4" value="<?php if(isset($content['advps_excptFsize4'])){echo esc_attr( $content['advps_excptFsize4'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize5" value="<?php if(isset($content['advps_excptFsize5'])){echo esc_attr( $content['advps_excptFsize5'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; </td>
               </tr>
               <tr>
                 <th scope="row">Excerpt line height</th>
-                <td><input type="text" name="advps_excptLheightL" value="<?php if(isset($content['advps_excptLheightL'])){ echo $content['advps_excptLheightL'];}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight1" value="<?php if(isset($content['advps_excptLheight1'])){ echo $content['advps_excptLheight1'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight2" value="<?php if(isset($content['advps_excptLheight2'])){echo $content['advps_excptLheight2'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight3" value="<?php if(isset($content['advps_excptLheight3'])){echo $content['advps_excptLheight3'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight4" value="<?php if(isset($content['advps_excptLheight4'])){echo $content['advps_excptLheight4'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight5" value="<?php if(isset($content['advps_excptLheight5'])){echo $content['advps_excptLheight5'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_excptLheightL" value="<?php if(isset($content['advps_excptLheightL'])){ echo esc_attr( $content['advps_excptLheightL'] );}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight1" value="<?php if(isset($content['advps_excptLheight1'])){ echo esc_attr( $content['advps_excptLheight1'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight2" value="<?php if(isset($content['advps_excptLheight2'])){echo esc_attr( $content['advps_excptLheight2'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight3" value="<?php if(isset($content['advps_excptLheight3'])){echo esc_attr( $content['advps_excptLheight3'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight4" value="<?php if(isset($content['advps_excptLheight4'])){echo esc_attr( $content['advps_excptLheight4'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight5" value="<?php if(isset($content['advps_excptLheight5'])){echo esc_attr( $content['advps_excptLheight5'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; </td>
               </tr>
               <tr>
                 <th scope="row">Excerpt length</th>
-                <td><input type="text" name="advps_excerptlen" value="<?php echo $content['advps_excerptlen'];?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_excerptlen" value="<?php echo esc_attr( $content['advps_excerptlen'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   &nbsp;words</td>
               </tr>
@@ -592 +592 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('content<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('content<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="content" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:79px; background-position:78px 6px;"><strong>Navigation</strong></legend>
-          <form method="post" onsubmit="return false" id="navigation<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="navigation<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -617 +617 @@
                   <span style="padding:0px 5px 0px 10px;">Bullet</span>
                   <input type="radio" name="advps_pager_type" value="bullet" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'bullet'){echo 'checked="checked"';}?>>
-                  <span id="advps-pthumb-lvl<?php echo $dset->id;?>" style="padding:0px 5px 0px 10px;" class="<?php if($slider['advps_slider_type'] != 'standard'){echo 'advps-fade';}?>">Thumbnail</span>
-                  <input id="advps-pthumb<?php echo $dset->id;?>" <?php if($slider['advps_slider_type'] != 'standard'){echo 'disabled="disabled"';}?> type="radio" name="advps_pager_type" value="thumb" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'thumb'){echo 'checked="checked"';}?>></td>
+                  <span id="advps-pthumb-lvl<?php echo intval( $dset->id );?>" style="padding:0px 5px 0px 10px;" class="<?php if($slider['advps_slider_type'] != 'standard'){echo 'advps-fade';}?>">Thumbnail</span>
+                  <input id="advps-pthumb<?php echo intval( $dset->id );?>" <?php if($slider['advps_slider_type'] != 'standard'){echo 'disabled="disabled"';}?> type="radio" name="advps_pager_type" value="thumb" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'thumb'){echo 'checked="checked"';}?>></td>
               </tr>
               <tr>
                 <th scope="row">Thumbnail Width</th>
-                <td><input type="text" name="advps_pthumb_width" value="<?php echo $navigation['advps_pthumb_width'];?>" style="width:50px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_pthumb_width" value="<?php echo esc_attr( $navigation['advps_pthumb_width'] );?>" style="width:50px;" onkeypress="return onlyNum(event);" />
                   &nbsp;% <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. For pager type thumbnail. ]</span></td>
               </tr>
@@ -635 +635 @@
               <tr>
                 <th scope="row">Pager position from bottom</th>
-                <td><input type="text" name="advps_pager_bottom" value="<?php echo $navigation['advps_pager_bottom'];?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
+                <td><input type="text" name="advps_pager_bottom" value="<?php echo esc_attr( $navigation['advps_pager_bottom'] );?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
                   &nbsp;px</td>
               </tr>
@@ -656 +656 @@
               <tr>
                 <th scope="row">Play/Pause position from bottom</th>
-                <td><input type="text" name="advps_ppause_bottom" value="<?php echo $navigation['advps_ppause_bottom'];?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
+                <td><input type="text" name="advps_ppause_bottom" value="<?php echo esc_attr( $navigation['advps_ppause_bottom'] );?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
                   &nbsp;px</td>
               </tr>
@@ -668 +668 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('navigation<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('navigation<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="navigation" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <!-- </form>-->
-        <form method="post" id="frmOptDel<?php echo $dset->id;?>" onsubmit="return false">
-          <input type="hidden" value="<?php echo $dset->id;?>" name="optset-id" />
-          <input type="hidden" value="<?php echo $tcount[0]->Auto_increment;?>" name="nextoptid" />
+        <form method="post" id="frmOptDel<?php echo intval( $dset->id );?>" onsubmit="return false">
+          <input type="hidden" value="<?php echo intval( $dset->id );?>" name="optset-id" />
+          <input type="hidden" value="<?php echo intval( $tcount[0]->Auto_increment );?>" name="nextoptid" />
           <p>
-            <input type="submit" name="del-optset" value="Delete" class="button-secondary" onclick="deleteOptSet(<?php echo $dset->id;?>)" style="width:12%;" />
+            <input type="submit" name="del-optset" value="Delete" class="button-secondary" onclick="deleteOptSet(<?php echo intval( $dset->id );?>)" style="width:12%;" />
             <span style="margin-left:5px;">
-            <input type="submit" name="dup-optset" value="Duplicate" class="button-secondary" onclick="duplicateOptSet(<?php echo $dset->id;?>)" style="width:12%;" />
+            <input type="submit" name="dup-optset" value="Duplicate" class="button-secondary" onclick="duplicateOptSet(<?php echo intval( $dset->id );?>)" style="width:12%;" />
             </span> </p>
           <?php wp_nonce_field('advps-checkauthnonce','advps_wpnonce'); ?>
@@ -697 +697 @@
   <form method="post">
     <input type="hidden" name="template" value="one" />
-    <input type="hidden" name="nextoptid" id="nextoptid" value="<?php echo $tcount[0]->Auto_increment;?>" />
+    <input type="hidden" name="nextoptid" id="nextoptid" value="<?php echo intval( $tcount[0]->Auto_increment );?>" />
     <?php wp_nonce_field('advps-checkauthnonce','advps_wpnonce'); ?>
     <input type="submit" name="advps_submit" value="Add new slideshow" class="button-primary" style="font-weight:bold" />

advanced-post-slider/trunk/templates/template-three.php

@@ -4 +4 @@
 
 <div class="advps-col-right">
-  <h2>Advanced post slider <?php echo get_option('advps-curr-version');?></h2>
+  <h2>Advanced post slider <?php echo esc_html( get_option('advps-curr-version') );?></h2>
   <ul>
     <li><a href="http://www.wpcue.com/wordpress-plugins/advanced-post-slider/" target="_blank">Plugin Homepage</a></li>
@@ -42 +42 @@
       <div class="handlediv down" title="Click to toggle"> <br>
       </div>
-      <h3 style="cursor:pointer; text-align:center" class="advps-expand <?php if(isset($_POST['advps_submit']) && $_POST['advps_submit'] == 'Add new slideshow' && $_POST['nextoptid'] == $dset->id){echo 'advps-highlight';}?>" id="lbltxt<?php echo $dset->id;?>">
-        <?php if(get_option('optset'.$dset->id)){echo get_option('optset'.$dset->id);}else{echo 'Slider '.$dset->id;}?>
+      <h3 style="cursor:pointer; text-align:center" class="advps-expand <?php if(isset($_POST['advps_submit']) && $_POST['advps_submit'] == 'Add new slideshow' && $_POST['nextoptid'] == intval( $dset->id )){echo 'advps-highlight';}?>" id="lbltxt<?php echo intval( $dset->id );?>">
+        <?php if(get_option('optset'.intval( $dset->id ))){echo esc_html( get_option('optset'.intval( $dset->id )) );}else{echo 'Slider '.intval( $dset->id );}?>
       </h3>
       <div class="inside">
@@ -51 +51 @@
             <tr>
               <th scope="row">Label</th>
-              <td><input type="text" style="width:px;" value="<?php if(get_option('optset'.$dset->id)){echo get_option('optset'.$dset->id);}else{echo 'Slider '.$dset->id;}?>" name="optset<?php echo $dset->id;?>" class="advps-optset-label" onchange="advpsUpdateLabel(this.name,this.value,<?php echo $dset->id;?>)" />
-                <span id="lbludtSts<?php echo $dset->id;?>" style="padding-left:10px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+              <td><input type="text" style="width:px;" value="<?php if(get_option('optset'.intval( $dset->id ))){echo esc_attr( get_option('optset'.intval( $dset->id )) );}else{echo 'Slider '.intval( $dset->id );}?>" name="optset<?php echo intval( $dset->id );?>" class="advps-optset-label" onchange="advpsUpdateLabel(this.name,this.value,<?php echo intval( $dset->id );?>)" />
+                <span id="lbludtSts<?php echo intval( $dset->id );?>" style="padding-left:10px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
             </tr>
             <tr>
               <th scope="row">Usage</th>
-              <td><input style="width:200px; font-size:12px; text-align:center;" type="text" value='[advps-slideshow optset="<?php echo $dset->id;?>"]' readonly="readonly"  /></td>
+              <td><input style="width:200px; font-size:12px; text-align:center;" type="text" value='[advps-slideshow optset="<?php echo intval( $dset->id );?>"]' readonly="readonly"  /></td>
             </tr>
           </table>
@@ -62 +62 @@
         <fieldset>
           <legend class="advps-legend" style="width:80px; background-position:79px 6px;"><strong>Select Post</strong></legend>
-          <div id="advps-sel<?php echo $dset->id;?>">
+          <div id="advps-sel<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Select post using</th>
-                <td><select name="advpssmethod<?php echo $dset->id?>" onchange="updateSm(this,<?php echo $dset->id;?>);">
-                    <option value="plist" <?php if(get_option('advpssmethod'.$dset->id) == 'plist'){echo 'selected="selected"';}?>>Post list</option>
-                    <option value="query" <?php if(get_option('advpssmethod'.$dset->id) == 'query'){echo 'selected="selected"';}?>>Query</option>
-                  </select>
-                  <span id="smudtsts<?php echo $dset->id;?>" style="padding-left:10px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+                <td><select name="advpssmethod<?php echo intval( $dset->id )?>" onchange="updateSm(this,<?php echo intval( $dset->id );?>);">
+                    <option value="plist" <?php if(get_option('advpssmethod'.intval( $dset->id )) == 'plist'){echo 'selected="selected"';}?>>Post list</option>
+                    <option value="query" <?php if(get_option('advpssmethod'.intval( $dset->id )) == 'query'){echo 'selected="selected"';}?>>Query</option>
+                  </select>
+                  <span id="smudtsts<?php echo intval( $dset->id );?>" style="padding-left:10px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
               </tr>
             </table>
-            <form method="post" onsubmit="return false" id="plist<?php echo $dset->id;?>">
-              <table class="form-table <?php if(get_option('advpssmethod'.$dset->id) == 'query'){echo 'advps-hide';}?>">
+            <form method="post" onsubmit="return false" id="plist<?php echo intval( $dset->id );?>">
+              <table class="form-table <?php if(get_option('advpssmethod'.intval( $dset->id )) == 'query'){echo 'advps-hide';}?>">
                 <tr>
                   <th scope="row">Listing option</th>
@@ -89 +89 @@
                     </select>
                     <span style="padding-left:10px;">
-                    <input type="text" name="advps_plistmax" value="<?php echo $plist['advps_plistmax'];?>" style="width:40px;" onkeypress="return onlyNum(event);" title="Max number of post to list" />
+                    <input type="text" name="advps_plistmax" value="<?php echo esc_attr( $plist['advps_plistmax'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" title="Max number of post to list" />
                     </span> <span style="padding-left:10px;">
                     <select name="advps_plistorder_by" title="Order by">
@@ -107 +107 @@
                     </select>
                     </span> <span style="padding-left:10px;">
-                    <button class="button-secondary" value="" onclick="listPost(<?php echo $dset->id;?>)">List</button>
-                    </span> <span class="ajx-loaderp" style="padding-left:12px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+                    <button class="button-secondary" value="" onclick="listPost(<?php echo intval( $dset->id );?>)">List</button>
+                    </span> <span class="ajx-loaderp" style="padding-left:12px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
                 </tr>
                 <tr>
                   <th scope="row">Select post from list</th>
-                  <td><select name="advps_plist[]" multiple="multiple" style="min-height:250px; min-width:300px;" id="advps-plist-field<?php echo $dset->id;?>">
+                  <td><select name="advps_plist[]" multiple="multiple" style="min-height:250px; min-width:300px;" id="advps-plist-field<?php echo intval( $dset->id );?>">
                       <?php 
                         $lpargs = array(
-                                'post_type'      => ($plist['advps_post_stypes']) ? $plist['advps_post_stypes'] : 'post',
-                                'posts_per_page' => ($plist['advps_plistmax']) ? $plist['advps_plistmax'] : 99,
-                                'orderby'        => ($plist['advps_plistorder_by']) ? $plist['advps_plistorder_by'] : 'date',
-                                'order'          => ($plist['advps_plistorder']) ? $plist['advps_plistorder'] : 'DESC'
+                                'post_type'      => ($plist['advps_post_stypes']) ? esc_html( $plist['advps_post_stypes'] ) : 'post',
+                                'posts_per_page' => ($plist['advps_plistmax']) ? esc_html( $plist['advps_plistmax'] ) : 99,
+                                'orderby'        => ($plist['advps_plistorder_by']) ? esc_html( $plist['advps_plistorder_by'] ) : 'date',
+                                'order'          => ($plist['advps_plistorder']) ? esc_html( $plist['advps_plistorder'] ) : 'DESC'
                         );
                         $pl_query = new WP_Query($lpargs); while ($pl_query->have_posts()) : $pl_query->the_post();?>
@@ -130 +130 @@
                 <tr>
                   <th scope="row">&nbsp;</th>
-                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('plist<?php echo $dset->id;?>')" />
-                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('plist<?php echo intval( $dset->id );?>')" />
+                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
                 </tr>
               </table>
               <input type="hidden" name="opt_field" value="plist" />
-              <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+              <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
             </form>
-            <form method="post" onsubmit="return false" id="query<?php echo $dset->id;?>">
-              <table class="form-table <?php if(!get_option('advpssmethod'.$dset->id) || get_option('advpssmethod'.$dset->id) == 'plist'){echo 'advps-hide';}?>">
+            <form method="post" onsubmit="return false" id="query<?php echo intval( $dset->id );?>">
+              <table class="form-table <?php if(!get_option('advpssmethod'.intval( $dset->id )) || get_option('advpssmethod'.intval( $dset->id )) == 'plist'){echo 'advps-hide';}?>">
                 <tr>
                   <th scope="row">Post Type</th>
-                  <td><select name="advps_post_types" onchange="advpsCheckCat(this.value,<?php echo $dset->id;?>)">
+                  <td><select name="advps_post_types" onchange="advpsCheckCat(this.value,<?php echo intval( $dset->id );?>)">
                       <option value="post" <?php if($query['advps_post_types'] == 'post'){echo 'selected="selected"';}?>>post</option>
                       <option value="page" <?php if($query['advps_post_types'] == 'page'){echo 'selected="selected"';}?>>page</option>
@@ -147 +147 @@
                               foreach ($customPostTypes  as $post_type ) {
                           ?>
-                      <option value="<?php echo $post_type;?>" <?php if($query['advps_post_types'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
+                      <option value="<?php echo esc_attr( $post_type );?>" <?php if($query['advps_post_types'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
                       <?php     
                               }
@@ -153 +153 @@
                     </select></td>
                 </tr>
-                <tr id="advps-cat-field<?php echo $dset->id;?>">
+                <tr id="advps-cat-field<?php echo intval( $dset->id );?>">
                   <?php  
-                    $posttypeobj = get_post_type_object($query['advps_post_types']);
+                    $posttypeobj = get_post_type_object( esc_html( $query['advps_post_types']) );
                     if($query['advps_post_types'] != "page" && ($query['advps_post_types'] == 'post' || in_array('category',$posttypeobj->taxonomies))){
                 ?>
@@ -164 +164 @@
                         foreach($catList as $scat){
                       ?>
-                      <option value="<?php echo $scat->term_id;?>" <?php if(isset($query['advps_category']) && in_array($scat->term_id,$query['advps_category'])){echo 'selected="selected"';}?>><?php echo $scat->name;?></option>
+                      <option value="<?php echo $scat->term_id;?>" <?php if(isset($query['advps_category']) && in_array($scat->term_id,$query['advps_category'])){echo 'selected="selected"';}?>><?php echo esc_html( $scat->name );?></option>
                       <?php }?>
                     </select>
@@ -172 +172 @@
                 <tr>
                   <th scope="row">Max. Number of post</th>
-                  <td><input type="text" name="advps_maxpost" value="<?php echo $query['advps_maxpost'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                  <td><input type="text" name="advps_maxpost" value="<?php echo esc_attr( $query['advps_maxpost'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
                 </tr>
                 <tr>
                   <th scope="row">Offset (optional)</th>
-                  <td><input type="text" name="advps_offset" value="<?php echo $query['advps_offset'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                  <td><input type="text" name="advps_offset" value="<?php echo esc_attr( $query['advps_offset'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
                 </tr>
                 <tr>
                   <th scope="row">Exclude (optional)</th>
-                  <td><input type="text" name="advps_exclude" value="<?php echo $query['advps_exclude'];?>" style="width:100px;" />
+                  <td><input type="text" name="advps_exclude" value="<?php echo esc_attr( $query['advps_exclude'] );?>" style="width:100px;" />
                     <span style="padding-left:10px; font-size:10px; font-style:italic;">[ Ex. 1,5,10 Comma separated post IDs that need to exclude from slideshow ]</span></td>
                 </tr>
@@ -205 +205 @@
                 <tr>
                   <th scope="row">&nbsp;</th>
-                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('query<?php echo $dset->id;?>')" />
-                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('query<?php echo intval( $dset->id );?>')" />
+                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
                 </tr>
               </table>
               <input type="hidden" name="opt_field" value="query" />
-              <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+              <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
             </form>
           </div>
@@ -216 +216 @@
         <fieldset>
           <legend class="advps-legend" style="width:50px; background-position:49px 6px;"><strong>Slider</strong></legend>
-          <form method="post" id="slider<?php echo $dset->id;?>" onsubmit="return false">
+          <form method="post" id="slider<?php echo intval( $dset->id );?>" onsubmit="return false">
             <table class="form-table">
               <tr>
                 <th scope="row">Slider Type</th>
-                <td><select name="advps_slider_type" onchange="sliderType(this.value,<?php echo $dset->id;?>);">
+                <td><select name="advps_slider_type" onchange="sliderType(this.value,<?php echo intval( $dset->id );?>);">
                     <option value="standard" <?php if($slider['advps_slider_type'] == 'standard'){echo 'selected="selected"';}?>>Standard</option>
                     <option value="carousel" <?php if($slider['advps_slider_type'] == 'carousel'){echo 'selected="selected"';}?>>Carousel</option>
@@ -244 +244 @@
               <tr>
                 <th scope="row">Speed</th>
-                <td><input type="text" name="advps_speed" value="<?php echo $slider['advps_speed'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_speed" value="<?php echo esc_attr( $slider['advps_speed'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
@@ -255 +255 @@
               <tr>
                 <th scope="row">Pause</th>
-                <td><input type="text" name="advps_timeout" value="<?php echo $slider['advps_timeout'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_timeout" value="<?php echo esc_attr( $slider['advps_timeout'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
                 <th scope="row">Slide margin</th>
-                <td><input type="text" name="advps_sldmargin" value="<?php echo $slider['advps_sldmargin'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_sldmargin" value="<?php echo esc_attr( $slider['advps_sldmargin'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
@@ -270 +270 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('slider<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('slider<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="slider" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:121px; background-position:120px 6px;"><strong>Carousel & Ticker</strong></legend>
-          <form method="post" onsubmit="return false" id="caro_ticker<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="caro_ticker<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Number of slide</th>
-                <td><input type="text" name="advps_caro_slds" value="<?php if(isset($caro_ticker['advps_caro_slds'])){echo $caro_ticker['advps_caro_slds'];}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_caro_slds" value="<?php if(isset($caro_ticker['advps_caro_slds'])){echo esc_attr( $caro_ticker['advps_caro_slds'] );}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   <span style="padding-left:20px; font-size:10px; font-style:italic;">[ N.B. For slider type Carousel or Ticker. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Slide width</th>
-                <td><input type="text" name="advps_caro_sldwidth" value="<?php if(isset($caro_ticker['advps_caro_sldwidth'])){echo $caro_ticker['advps_caro_sldwidth'];}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_caro_sldwidth" value="<?php if(isset($caro_ticker['advps_caro_sldwidth'])){echo esc_attr( $caro_ticker['advps_caro_sldwidth'] );}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   <span style="padding-left:20px; font-size:10px; font-style:italic;">[ N.B. For slider type Carousel or Ticker. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('caro_ticker<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('caro_ticker<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="caro_ticker" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:155px; background-position:154px 6px;"><strong>Container & Thumbnail</strong></legend>
-          <form method="post" onsubmit="return false" id="container<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="container<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -318 +318 @@
                         foreach($_wp_additional_image_sizes as $tkey => $tval){
                         ?>
-                    <option value="<?php echo $tkey;?>" <?php if($container['advps_thumbnail'] == $tkey){echo 'selected="selected"';}?>><?php echo $tkey;?></option>
+                    <option value="<?php echo esc_attr( $tkey );?>" <?php if($container['advps_thumbnail'] == $tkey){echo 'selected="selected"';}?>><?php echo esc_html( $tkey );?></option>
                     <?php
                         }
@@ -331 +331 @@
               <tr>
                 <th scope="row">Slide Container Width</th>
-                <td><input type="text" name="advps_sld_width" value="<?php echo $container['advps_sld_width'];?>" style="width:45px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_sld_width" value="<?php echo esc_attr( $container['advps_sld_width'] );?>" style="width:45px;" onkeypress="return onlyNum(event);" />
                   &nbsp;px </td>
               </tr>
@@ -343 +343 @@
               <tr>
                 <th scope="row">Padding</th>
-                <td><input type="text" name="advps_contpad1" value="<?php echo $container['advps_contpad1'];?>" style="width:40px; height:25px;" />
+                <td><input type="text" name="advps_contpad1" value="<?php echo esc_attr( $container['advps_contpad1'] );?>" style="width:40px; height:25px;" />
                   <select name="advps_padu1" style="vertical-align:top; width:46px; height:25px;">
                     <option value="vw" <?php if(isset($container['advps_padu1']) && $container['advps_padu1'] == 'vw'){echo 'selected="selected"';}?>>vw</option>
@@ -352 +352 @@
                     <option value="pt" <?php if(isset($container['advps_padu1']) && $container['advps_padu1'] == 'pt'){echo 'selected="selected"';}?>>pt</option>
                   </select>
-                  <input type="text" name="advps_contpad2" value="<?php echo $container['advps_contpad2'];?>" style="width:40px; height:25px;" />
+                  <input type="text" name="advps_contpad2" value="<?php echo esc_attr( $container['advps_contpad2'] );?>" style="width:40px; height:25px;" />
                   <select name="advps_padu2" style="vertical-align:top;width:46px; height:25px;">
                     <option value="vw" <?php if(isset($container['advps_padu2']) && $container['advps_padu2'] == 'vw'){echo 'selected="selected"';}?>>vw</option>
@@ -361 +361 @@
                     <option value="pt" <?php if(isset($container['advps_padu2']) && $container['advps_padu2'] == 'pt'){echo 'selected="selected"';}?>>pt</option>
                   </select>
-                  <input type="text" name="advps_contpad3" value="<?php echo $container['advps_contpad3'];?>" style="width:40px; height:25px;" />
+                  <input type="text" name="advps_contpad3" value="<?php echo esc_attr( $container['advps_contpad3'] );?>" style="width:40px; height:25px;" />
                   <select name="advps_padu3" style="vertical-align:top;width:46px; height:25px;">
                     <option value="vw" <?php if(isset($container['advps_padu3']) && $container['advps_padu3'] == 'vw'){echo 'selected="selected"';}?>>vw</option>
@@ -370 +370 @@
                     <option value="pt" <?php if(isset($container['advps_padu3']) && $container['advps_padu3'] == 'pt'){echo 'selected="selected"';}?>>pt</option>
                   </select>
-                  <input type="text" name="advps_contpad4" value="<?php echo $container['advps_contpad4'];?>" style="width:40px; height:25px;" />
+                  <input type="text" name="advps_contpad4" value="<?php echo esc_attr( $container['advps_contpad4'] );?>" style="width:40px; height:25px;" />
                   <select name="advps_padu4" style="vertical-align:top;width:46px; height:25px;">
                     <option value="vw" <?php if(isset($container['advps_padu4']) && $container['advps_padu4'] == 'vw'){echo 'selected="selected"';}?>>vw</option>
@@ -382 +382 @@
               <tr>
                 <th scope="row">Background Color</th>
-                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bgcolor" value="<?php echo $container['advps_bgcolor'];?>" style="width:100px;" />
+                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bgcolor" value="<?php echo esc_attr( $container['advps_bgcolor'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -388 +388 @@
                 <th scope="row">Border</th>
                 <td><span style="vertical-align:top">
-                  <input type="text" name="advps_border_size" value="<?php echo $container['advps_border_size'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_border_size" value="<?php echo esc_attr( $container['advps_border_size'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px &nbsp;&nbsp;
                   <select name="advps_border_type">
@@ -399 +399 @@
                   </select>
                   &nbsp;&nbsp;</span>
-                  <input class="advps-color-picker" type="text" name="advps_border_color" id="advpscolor<?php echo ++$flg?>" value="<?php echo $container['advps_border_color'];?>" style="width:100px;" />
+                  <input class="advps-color-picker" type="text" name="advps_border_color" id="advpscolor<?php echo ++$flg?>" value="<?php echo esc_attr( $container['advps_border_color'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -412 +412 @@
                 <th scope="row">Box Shadow</th>
                 <td><span style="vertical-align:top">
-                  <input type="text" name="advps_bxshad1" value="<?php echo $container['advps_bxshad1'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad1" value="<?php echo esc_attr( $container['advps_bxshad1'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px &nbsp;&nbsp;
-                  <input type="text" name="advps_bxshad2" value="<?php echo $container['advps_bxshad2'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad2" value="<?php echo esc_attr( $container['advps_bxshad2'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px&nbsp;&nbsp;
-                  <input type="text" name="advps_bxshad3" value="<?php echo $container['advps_bxshad3'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad3" value="<?php echo esc_attr( $container['advps_bxshad3'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px&nbsp;&nbsp;</span>
-                  <input class="advps-color-picker" type="text" name="advps_bxshadcolor" value="<?php echo $container['advps_bxshadcolor'];?>" style="width:100px;" id="advpscolor<?php echo ++$flg?>" />
+                  <input class="advps-color-picker" type="text" name="advps_bxshadcolor" value="<?php echo esc_attr( $container['advps_bxshadcolor'] );?>" style="width:100px;" id="advpscolor<?php echo ++$flg?>" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -430 +430 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('container<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('container<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="container" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:66px; background-position:65px 6px;"><strong>Content</strong></legend>
-          <form method="post" onsubmit="return false" id="content<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="content<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -454 +454 @@
               <tr>
                 <th scope="row">Content width</th>
-                <td><input type="text" name="advps_cont_width" value="<?php echo $content['advps_cont_width'];?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_cont_width" value="<?php echo esc_attr( $content['advps_cont_width'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   px</td>
               </tr>
@@ -468 +468 @@
               <tr>
                 <th scope="row">Title font Color</th>
-                <td><input id="advpscolor<?php echo ++$flg?>" type="text" name="advps_titleFcolor" value="<?php echo $content['advps_titleFcolor'];?>" style="width:100px;" class="advps-color-picker" />
+                <td><input id="advpscolor<?php echo ++$flg?>" type="text" name="advps_titleFcolor" value="<?php echo esc_attr( $content['advps_titleFcolor'] );?>" style="width:100px;" class="advps-color-picker" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Title hover Color</th>
-                <td><input id="advpscolor<?php echo ++$flg?>" type="text" name="advps_titleHcolor" value="<?php echo $content['advps_titleHcolor'];?>" style="width:100px;" class="advps-color-picker" />
+                <td><input id="advpscolor<?php echo ++$flg?>" type="text" name="advps_titleHcolor" value="<?php echo esc_attr( $content['advps_titleHcolor'] );?>" style="width:100px;" class="advps-color-picker" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Title font size</th>
-                <td><input type="text" name="advps_titleFsizeL" value="<?php if(isset($content['advps_titleFsizeL'])){ echo $content['advps_titleFsizeL'];}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize1" value="<?php if(isset($content['advps_titleFsize1'])){ echo $content['advps_titleFsize1'];}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize2" value="<?php if(isset($content['advps_titleFsize2'])){echo $content['advps_titleFsize2'];}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize3" value="<?php if(isset($content['advps_titleFsize3'])){echo $content['advps_titleFsize3'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize4" value="<?php if(isset($content['advps_titleFsize4'])){echo $content['advps_titleFsize4'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleFsize5" value="<?php if(isset($content['advps_titleFsize5'])){echo $content['advps_titleFsize5'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_titleFsizeL" value="<?php if(isset($content['advps_titleFsizeL'])){ echo esc_attr( $content['advps_titleFsizeL'] );}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize1" value="<?php if(isset($content['advps_titleFsize1'])){ echo esc_attr( $content['advps_titleFsize1'] );}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize2" value="<?php if(isset($content['advps_titleFsize2'])){echo esc_attr( $content['advps_titleFsize2'] );}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize3" value="<?php if(isset($content['advps_titleFsize3'])){echo esc_attr( $content['advps_titleFsize3'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize4" value="<?php if(isset($content['advps_titleFsize4'])){echo esc_attr( $content['advps_titleFsize4'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleFsize5" value="<?php if(isset($content['advps_titleFsize5'])){echo esc_attr( $content['advps_titleFsize5'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. Different sizes for different media screen width. Hover the field to know which field is for which width. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Title line height</th>
-                <td><input type="text" name="advps_titleLheightL" value="<?php if(isset($content['advps_titleLheightL'])){ echo $content['advps_titleLheightL'];}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight1" value="<?php if(isset($content['advps_titleLheight1'])){ echo $content['advps_titleLheight1'];}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight2" value="<?php if(isset($content['advps_titleLheight2'])){echo $content['advps_titleLheight2'];}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight3" value="<?php if(isset($content['advps_titleLheight3'])){echo $content['advps_titleLheight3'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight4" value="<?php if(isset($content['advps_titleLheight4'])){echo $content['advps_titleLheight4'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_titleLheight5" value="<?php if(isset($content['advps_titleLheight5'])){echo $content['advps_titleLheight5'];}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_titleLheightL" value="<?php if(isset($content['advps_titleLheightL'])){ echo esc_attr( $content['advps_titleLheightL'] );}else{echo 20;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight1" value="<?php if(isset($content['advps_titleLheight1'])){ echo esc_attr( $content['advps_titleLheight1'] );}else{echo 18;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight2" value="<?php if(isset($content['advps_titleLheight2'])){echo esc_attr( $content['advps_titleLheight2'] );}else{echo 16;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight3" value="<?php if(isset($content['advps_titleLheight3'])){echo esc_attr( $content['advps_titleLheight3'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight4" value="<?php if(isset($content['advps_titleLheight4'])){echo esc_attr( $content['advps_titleLheight4'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_titleLheight5" value="<?php if(isset($content['advps_titleLheight5'])){echo esc_attr( $content['advps_titleLheight5'] );}else{echo 15;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. Each for different media screen width. Hover the field to know which field is for which width. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Excerpt/Content font color</th>
-                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_excptFcolor" value="<?php echo $content['advps_excptFcolor'];?>" style="width:100px;" />
+                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_excptFcolor" value="<?php echo esc_attr( $content['advps_excptFcolor'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
               <tr>
                 <th scope="row">Excerpt/Content font size</th>
-                <td><input type="text" name="advps_excptFsizeL" value="<?php if(isset($content['advps_excptFsizeL'])){ echo $content['advps_excptFsizeL'];}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize1" value="<?php if(isset($content['advps_excptFsize1'])){ echo $content['advps_excptFsize1'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize2" value="<?php if(isset($content['advps_excptFsize2'])){echo $content['advps_excptFsize2'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize3" value="<?php if(isset($content['advps_excptFsize3'])){echo $content['advps_excptFsize3'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize4" value="<?php if(isset($content['advps_excptFsize4'])){echo $content['advps_excptFsize4'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptFsize5" value="<?php if(isset($content['advps_excptFsize5'])){echo $content['advps_excptFsize5'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_excptFsizeL" value="<?php if(isset($content['advps_excptFsizeL'])){ echo esc_attr( $content['advps_excptFsizeL'] );}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize1" value="<?php if(isset($content['advps_excptFsize1'])){ echo esc_attr( $content['advps_excptFsize1'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize2" value="<?php if(isset($content['advps_excptFsize2'])){echo esc_attr( $content['advps_excptFsize2'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize3" value="<?php if(isset($content['advps_excptFsize3'])){echo esc_attr( $content['advps_excptFsize3'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize4" value="<?php if(isset($content['advps_excptFsize4'])){echo esc_attr( $content['advps_excptFsize4'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptFsize5" value="<?php if(isset($content['advps_excptFsize5'])){echo esc_attr( $content['advps_excptFsize5'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; </td>
               </tr>
               <tr>
                 <th scope="row">Excerpt line height</th>
-                <td><input type="text" name="advps_excptLheightL" value="<?php if(isset($content['advps_excptLheightL'])){ echo $content['advps_excptLheightL'];}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight1" value="<?php if(isset($content['advps_excptLheight1'])){ echo $content['advps_excptLheight1'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight2" value="<?php if(isset($content['advps_excptLheight2'])){echo $content['advps_excptLheight2'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight3" value="<?php if(isset($content['advps_excptLheight3'])){echo $content['advps_excptLheight3'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight4" value="<?php if(isset($content['advps_excptLheight4'])){echo $content['advps_excptLheight4'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
-                  &nbsp;px&nbsp;&nbsp;
-                  <input type="text" name="advps_excptLheight5" value="<?php if(isset($content['advps_excptLheight5'])){echo $content['advps_excptLheight5'];}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
+                <td><input type="text" name="advps_excptLheightL" value="<?php if(isset($content['advps_excptLheightL'])){ echo esc_attr( $content['advps_excptLheightL'] );}else{echo 14;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For desktop, laptop and larger width device." />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight1" value="<?php if(isset($content['advps_excptLheight1'])){ echo esc_attr( $content['advps_excptLheight1'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 1024" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight2" value="<?php if(isset($content['advps_excptLheight2'])){echo esc_attr( $content['advps_excptLheight2'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 768" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight3" value="<?php if(isset($content['advps_excptLheight3'])){echo esc_attr( $content['advps_excptLheight3'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 650" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight4" value="<?php if(isset($content['advps_excptLheight4'])){echo esc_attr( $content['advps_excptLheight4'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 480" />
+                  &nbsp;px&nbsp;&nbsp;
+                  <input type="text" name="advps_excptLheight5" value="<?php if(isset($content['advps_excptLheight5'])){echo esc_attr( $content['advps_excptLheight5'] );}else{echo 12;}?>" style="width:40px;" onkeypress="return onlyNum(event);" title="For media screen smaller than 320" />
                   &nbsp;px&nbsp;&nbsp; </td>
               </tr>
               <tr>
                 <th scope="row">Excerpt length</th>
-                <td><input type="text" name="advps_excerptlen" value="<?php echo $content['advps_excerptlen'];?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_excerptlen" value="<?php echo esc_attr( $content['advps_excerptlen'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   &nbsp;words</td>
               </tr>
@@ -596 +596 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('content<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('content<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="content" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:79px; background-position:78px 6px;"><strong>Navigation</strong></legend>
-          <form method="post" onsubmit="return false" id="navigation<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="navigation<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -621 +621 @@
                   <span style="padding:0px 5px 0px 10px;">Bullet</span>
                   <input type="radio" name="advps_pager_type" value="bullet" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'bullet'){echo 'checked="checked"';}?>>
-                  <span id="advps-pthumb-lvl<?php echo $dset->id;?>" style="padding:0px 5px 0px 10px;" class="<?php if($slider['advps_slider_type'] != 'standard'){echo 'advps-fade';}?>">Thumbnail</span>
-                  <input id="advps-pthumb<?php echo $dset->id;?>" <?php if($slider['advps_slider_type'] != 'standard'){echo 'disabled="disabled"';}?> type="radio" name="advps_pager_type" value="thumb" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'thumb'){echo 'checked="checked"';}?>></td>
+                  <span id="advps-pthumb-lvl<?php echo intval( $dset->id );?>" style="padding:0px 5px 0px 10px;" class="<?php if($slider['advps_slider_type'] != 'standard'){echo 'advps-fade';}?>">Thumbnail</span>
+                  <input id="advps-pthumb<?php echo intval( $dset->id );?>" <?php if($slider['advps_slider_type'] != 'standard'){echo 'disabled="disabled"';}?> type="radio" name="advps_pager_type" value="thumb" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'thumb'){echo 'checked="checked"';}?>></td>
               </tr>
               <tr>
                 <th scope="row">Thumbnail Width</th>
-                <td><input type="text" name="advps_pthumb_width" value="<?php echo $navigation['advps_pthumb_width'];?>" style="width:50px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_pthumb_width" value="<?php echo esc_attr( $navigation['advps_pthumb_width'] );?>" style="width:50px;" onkeypress="return onlyNum(event);" />
                   &nbsp;% <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. For pager type thumbnail. ]</span></td>
               </tr>
@@ -639 +639 @@
               <tr>
                 <th scope="row">Pager position from bottom</th>
-                <td><input type="text" name="advps_pager_bottom" value="<?php echo $navigation['advps_pager_bottom'];?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
+                <td><input type="text" name="advps_pager_bottom" value="<?php echo esc_attr( $navigation['advps_pager_bottom'] );?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
                   &nbsp;px</td>
               </tr>
@@ -672 +672 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('navigation<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('navigation<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="navigation" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
-        <form method="post" id="frmOptDel<?php echo $dset->id;?>" onsubmit="return false">
-          <input type="hidden" value="<?php echo $dset->id;?>" name="optset-id" />
-          <input type="hidden" value="<?php echo $tcount[0]->Auto_increment;?>" name="nextoptid" />
+        <form method="post" id="frmOptDel<?php echo intval( $dset->id );?>" onsubmit="return false">
+          <input type="hidden" value="<?php echo intval( $dset->id );?>" name="optset-id" />
+          <input type="hidden" value="<?php echo intval( $tcount[0]->Auto_increment );?>" name="nextoptid" />
           <p>
-            <input type="submit" name="del-optset" value="Delete" class="button-secondary" onclick="deleteOptSet(<?php echo $dset->id;?>)" style="width:12%;" />
+            <input type="submit" name="del-optset" value="Delete" class="button-secondary" onclick="deleteOptSet(<?php echo intval( $dset->id );?>)" style="width:12%;" />
             <span style="margin-left:5px;">
-            <input type="submit" name="dup-optset" value="Duplicate" class="button-secondary" onclick="duplicateOptSet(<?php echo $dset->id;?>)" style="width:12%;" />
+            <input type="submit" name="dup-optset" value="Duplicate" class="button-secondary" onclick="duplicateOptSet(<?php echo intval( $dset->id );?>)" style="width:12%;" />
             </span> </p>
           <?php wp_nonce_field('advps-checkauthnonce','advps_wpnonce'); ?>
@@ -700 +700 @@
 <div style="position:relative; float:left; width:72%">
   <form method="post">
-    <input type="hidden" name="nextoptid" value="<?php echo $tcount[0]->Auto_increment;?>" />
+    <input type="hidden" name="nextoptid" value="<?php echo intval( $tcount[0]->Auto_increment );?>" />
     <input type="hidden" name="template" value="three" />
     <?php wp_nonce_field('advps-checkauthnonce','advps_wpnonce'); ?>

advanced-post-slider/trunk/templates/template-two.php

@@ -3 +3 @@
 ?>
 <div class="advps-col-right">
-  <h2>Advanced post slider <?php echo get_option('advps-curr-version');?></h2>
+  <h2>Advanced post slider <?php echo esc_html( get_option('advps-curr-version') );?></h2>
   <ul>
     <li><a href="http://www.wpcue.com/wordpress-plugins/advanced-post-slider/" target="_blank">Plugin Homepage</a></li>
@@ -37 +37 @@
       <div class="handlediv down" title="Click to toggle"> <br>
       </div>
-      <h3 style="cursor:pointer; text-align:center" class="advps-expand <?php if(isset($_POST['advps_submit']) && $_POST['advps_submit'] == 'Add new slideshow' && $_POST['nextoptid'] == $dset->id){echo 'advps-highlight';}?>" id="lbltxt<?php echo $dset->id;?>">
-        <?php if(get_option('optset'.$dset->id)){echo get_option('optset'.$dset->id);}else{echo 'Slider '.$dset->id;}?>
+      <h3 style="cursor:pointer; text-align:center" class="advps-expand <?php if(isset($_POST['advps_submit']) && $_POST['advps_submit'] == 'Add new slideshow' && $_POST['nextoptid'] == intval( $dset->id )){echo 'advps-highlight';}?>" id="lbltxt<?php echo intval( $dset->id );?>">
+        <?php if(get_option('optset'.intval( $dset->id ))){echo esc_html( get_option('optset'.intval( $dset->id )) );}else{echo 'Slider '.intval( $dset->id );}?>
       </h3>
       <div class="inside">
@@ -46 +46 @@
             <tr>
               <th scope="row">Label</th>
-              <td><input type="text" style="" value="<?php if(get_option('optset'.$dset->id)){echo get_option('optset'.$dset->id);}else{echo 'Slider '.$dset->id;}?>" name="optset<?php echo $dset->id;?>" class="advps-optset-label" onchange="advpsUpdateLabel(this.name,this.value,<?php echo $dset->id;?>)" />
-                <span id="lbludtSts<?php echo $dset->id;?>" style="padding-left:10px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+              <td><input type="text" style="" value="<?php if(get_option('optset'.intval( $dset->id ))){echo esc_attr( get_option('optset'.intval( $dset->id )) );}else{echo 'Slider '.intval( $dset->id );}?>" name="optset<?php echo intval( $dset->id );?>" class="advps-optset-label" onchange="advpsUpdateLabel(this.name,this.value,<?php echo intval( $dset->id );?>)" />
+                <span id="lbludtSts<?php echo intval( $dset->id );?>" style="padding-left:10px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
             </tr>
             <tr>
               <th scope="row">Usage</th>
-              <td><input style="width:200px; font-size:12px; text-align:center;" type="text" value='[advps-slideshow optset="<?php echo $dset->id;?>"]' readonly="readonly"  /></td>
+              <td><input style="width:200px; font-size:12px; text-align:center;" type="text" value='[advps-slideshow optset="<?php echo intval( $dset->id );?>"]' readonly="readonly"  /></td>
             </tr>
           </table>
@@ -57 +57 @@
         <fieldset>
           <legend class="advps-legend advpssm" style="width:80px; background-position:79px 6px;"><strong>Select Post</strong></legend>
-          <div id="advps-sel<?php echo $dset->id;?>">
+          <div id="advps-sel<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Select post using</th>
-                <td><select name="advpssmethod<?php echo $dset->id?>" onchange="updateSm(this,<?php echo $dset->id;?>);">
-                    <option value="plist" <?php if(get_option('advpssmethod'.$dset->id) == 'plist'){echo 'selected="selected"';}?>>Post list</option>
-                    <option value="query" <?php if(get_option('advpssmethod'.$dset->id) == 'query'){echo 'selected="selected"';}?>>Query</option>
-                  </select><span id="smudtsts<?php echo $dset->id;?>" style="padding-left:10px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+                <td><select name="advpssmethod<?php echo intval( $dset->id )?>" onchange="updateSm(this,<?php echo intval( $dset->id );?>);">
+                    <option value="plist" <?php if(get_option('advpssmethod'.intval( $dset->id )) == 'plist'){echo 'selected="selected"';}?>>Post list</option>
+                    <option value="query" <?php if(get_option('advpssmethod'.intval( $dset->id )) == 'query'){echo 'selected="selected"';}?>>Query</option>
+                  </select><span id="smudtsts<?php echo intval( $dset->id );?>" style="padding-left:10px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
               </tr>
             </table>
-            <form method="post" onsubmit="return false" id="plist<?php echo $dset->id;?>">
-              <table class="form-table <?php if(get_option('advpssmethod'.$dset->id) == 'query'){echo 'advps-hide';}?>">
+            <form method="post" onsubmit="return false" id="plist<?php echo intval( $dset->id );?>">
+              <table class="form-table <?php if(get_option('advpssmethod'.intval( $dset->id )) == 'query'){echo 'advps-hide';}?>">
                 <tr>
                   <th scope="row">Listing option</th>
@@ -83 +83 @@
                     </select>
                     <span style="padding-left:10px;">
-                    <input type="text" name="advps_plistmax" value="<?php echo $plist['advps_plistmax'];?>" style="width:40px;" onkeypress="return onlyNum(event);" title="Max number of post to list" />
+                    <input type="text" name="advps_plistmax" value="<?php echo esc_attr( $plist['advps_plistmax'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" title="Max number of post to list" />
                     </span> <span style="padding-left:10px;">
                     <select name="advps_plistorder_by" title="Order by">
@@ -101 +101 @@
                     </select>
                     </span> <span style="padding-left:10px;">
-                    <button class="button-secondary" value="" onclick="listPost(<?php echo $dset->id;?>)">List</button>
-                    </span> <span class="ajx-loaderp" style="padding-left:12px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span></td>
+                    <button class="button-secondary" value="" onclick="listPost(<?php echo intval( $dset->id );?>)">List</button>
+                    </span> <span class="ajx-loaderp" style="padding-left:12px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span></td>
                 </tr>
                 <tr>
                   <th scope="row">Select post from list</th>
-                  <td><select name="advps_plist[]" multiple="multiple" style="min-height:250px; min-width:300px;" id="advps-plist-field<?php echo $dset->id;?>">
+                  <td><select name="advps_plist[]" multiple="multiple" style="min-height:250px; min-width:300px;" id="advps-plist-field<?php echo intval( $dset->id );?>">
                       <?php 
                         $lpargs = array(
-                                'post_type'      => ($plist['advps_post_stypes']) ? $plist['advps_post_stypes'] : 'post',
-                                'posts_per_page' => ($plist['advps_plistmax']) ? $plist['advps_plistmax'] : 99,
-                                'orderby'        => ($plist['advps_plistorder_by']) ? $plist['advps_plistorder_by'] : 'date',
-                                'order'          => ($plist['advps_plistorder']) ? $plist['advps_plistorder'] : 'DESC'
+                                'post_type'      => ($plist['advps_post_stypes']) ? esc_html( $plist['advps_post_stypes'] ) : 'post',
+                                'posts_per_page' => ($plist['advps_plistmax']) ? esc_html( $plist['advps_plistmax'] ) : 99,
+                                'orderby'        => ($plist['advps_plistorder_by']) ? esc_html( $plist['advps_plistorder_by'] ) : 'date',
+                                'order'          => ($plist['advps_plistorder']) ? esc_html( $plist['advps_plistorder'] ) : 'DESC'
                         );
                         $pl_query = new WP_Query($lpargs); while ($pl_query->have_posts()) : $pl_query->the_post();?>
@@ -124 +124 @@
                 <tr>
                   <th scope="row">&nbsp;</th>
-                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('plist<?php echo $dset->id;?>')" />
-                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('plist<?php echo intval( $dset->id );?>')" />
+                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
                 </tr>
               </table>
               <input type="hidden" name="opt_field" value="plist" />
-              <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+              <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
             </form>
-            <form method="post" onsubmit="return false" id="query<?php echo $dset->id;?>">
-              <table class="form-table <?php if(!get_option('advpssmethod'.$dset->id) || get_option('advpssmethod'.$dset->id) == 'plist'){echo 'advps-hide';}?>">
+            <form method="post" onsubmit="return false" id="query<?php echo intval( $dset->id );?>">
+              <table class="form-table <?php if(!get_option('advpssmethod'.intval( $dset->id )) || get_option('advpssmethod'.intval( $dset->id )) == 'plist'){echo 'advps-hide';}?>">
                 <tr>
                   <th scope="row">Post Type</th>
-                  <td><select name="advps_post_types" onchange="advpsCheckCat(this.value,<?php echo $dset->id;?>)">
+                  <td><select name="advps_post_types" onchange="advpsCheckCat(this.value,<?php echo intval( $dset->id );?>)">
                       <option value="post" <?php if($query['advps_post_types'] == 'post'){echo 'selected="selected"';}?>>post</option>
                       <option value="page" <?php if($query['advps_post_types'] == 'page'){echo 'selected="selected"';}?>>page</option>
@@ -141 +141 @@
                               foreach ($customPostTypes  as $post_type ) {
                           ?>
-                      <option value="<?php echo $post_type;?>" <?php if($query['advps_post_types'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
+                      <option value="<?php echo esc_attr( $post_type );?>" <?php if($query['advps_post_types'] == $post_type){echo 'selected="selected"';}?>><?php echo $post_type;?></option>
                       <?php     
                               }
@@ -147 +147 @@
                     </select></td>
                 </tr>
-                <tr id="advps-cat-field<?php echo $dset->id;?>">
+                <tr id="advps-cat-field<?php echo intval( $dset->id );?>">
                   <?php
-                    $posttypeobj = get_post_type_object($query['advps_post_types']);  
+                    $posttypeobj = get_post_type_object( esc_html( $query['advps_post_types']) );  
                     if($query['advps_post_types'] != "page" && ($query['advps_post_types'] == 'post' || in_array('category',$posttypeobj->taxonomies))){
                 ?>
@@ -158 +158 @@
                         foreach($catList as $scat){
                       ?>
-                      <option value="<?php echo $scat->term_id;?>" <?php if(isset($query['advps_category']) && in_array($scat->term_id,$query['advps_category'])){echo 'selected="selected"';}?>><?php echo $scat->name;?></option>
+                      <option value="<?php echo esc_attr( $scat->term_id );?>" <?php if(isset($query['advps_category']) && in_array($scat->term_id,$query['advps_category'])){echo 'selected="selected"';}?>><?php echo esc_html( $scat->name );?></option>
                       <?php }?>
                     </select>
@@ -166 +166 @@
                 <tr>
                   <th scope="row">Max. Number of post</th>
-                  <td><input type="text" name="advps_maxpost" value="<?php echo $query['advps_maxpost'];?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                  <td><input type="text" name="advps_maxpost" value="<?php echo esc_attr( $query['advps_maxpost'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                     <span style="padding-left:10px; font-size:10px; font-style:italic;">[ * Maximum Slides]</span></td>
                 </tr>
                 <tr>
                   <th scope="row">Offset (optional)</th>
-                  <td><input type="text" name="advps_offset" value="<?php echo $query['advps_offset'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                  <td><input type="text" name="advps_offset" value="<?php echo esc_attr( $query['advps_offset'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
                 </tr>
                 <tr>
                   <th scope="row">Exclude (optional)</th>
-                  <td><input type="text" name="advps_exclude" value="<?php echo $query['advps_exclude'];?>" style="width:100px;" />
+                  <td><input type="text" name="advps_exclude" value="<?php echo esc_attr( $query['advps_exclude'] );?>" style="width:100px;" />
                     <span style="padding-left:10px; font-size:10px; font-style:italic;">[ Ex. 1,5,10 Comma separated post IDs that need to exclude from slideshow ]</span></td>
                 </tr>
@@ -200 +200 @@
                 <tr>
                   <th scope="row">&nbsp;</th>
-                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('query<?php echo $dset->id;?>')" />
-                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                  <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('query<?php echo intval( $dset->id );?>')" />
+                    <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
                 </tr>
               </table>
               <input type="hidden" name="opt_field" value="query" />
-              <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+              <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
             </form>
           </div>
@@ -211 +211 @@
         <fieldset>
           <legend class="advps-legend" style="width:50px; background-position:49px 6px;"><strong>Slider</strong></legend>
-          <form method="post" id="slider<?php echo $dset->id;?>" onsubmit="return false">
+          <form method="post" id="slider<?php echo intval( $dset->id );?>" onsubmit="return false">
             <table class="form-table">
               <tr>
                 <th scope="row">Slider Type</th>
-                <td><select name="advps_slider_type" onchange="sliderType(this.value,<?php echo $dset->id;?>);">
+                <td><select name="advps_slider_type" onchange="sliderType(this.value,<?php echo intval( $dset->id );?>);">
                     <option value="standard" <?php if($slider['advps_slider_type'] == 'standard'){echo 'selected="selected"';}?>>Standard</option>
                     <option value="carousel" <?php if($slider['advps_slider_type'] == 'carousel'){echo 'selected="selected"';}?>>Carousel</option>
@@ -239 +239 @@
               <tr>
                 <th scope="row">Speed</th>
-                <td><input type="text" name="advps_speed" value="<?php echo $slider['advps_speed'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_speed" value="<?php echo esc_attr( $slider['advps_speed'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
@@ -250 +250 @@
               <tr>
                 <th scope="row">Pause</th>
-                <td><input type="text" name="advps_timeout" value="<?php echo $slider['advps_timeout'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_timeout" value="<?php echo esc_attr( $slider['advps_timeout'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
                 <th scope="row">Slide margin</th>
-                <td><input type="text" name="advps_sldmargin" value="<?php echo $slider['advps_sldmargin'];?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
+                <td><input type="text" name="advps_sldmargin" value="<?php echo esc_attr( $slider['advps_sldmargin'] );?>" style="width:60px;" onkeypress="return onlyNum(event);" /></td>
               </tr>
               <tr>
@@ -266 +266 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('slider<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('slider<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="slider" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:121px; background-position:120px 6px;"><strong>Carousel & Ticker</strong></legend>
-          <form method="post" onsubmit="return false" id="caro_ticker<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="caro_ticker<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
                 <th scope="row">Number of slide</th>
-                <td><input type="text" name="advps_caro_slds" value="<?php if(isset($caro_ticker['advps_caro_slds'])){echo $caro_ticker['advps_caro_slds'];}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_caro_slds" value="<?php if(isset($caro_ticker['advps_caro_slds'])){echo esc_attr( $caro_ticker['advps_caro_slds'] );}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   <span style="padding-left:20px; font-size:10px; font-style:italic;">[ N.B. For slider type Carousel or Ticker. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">Slide width</th>
-                <td><input type="text" name="advps_caro_sldwidth" value="<?php if(isset($caro_ticker['advps_caro_sldwidth'])){echo $caro_ticker['advps_caro_sldwidth'];}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_caro_sldwidth" value="<?php if(isset($caro_ticker['advps_caro_sldwidth'])){echo esc_attr( $caro_ticker['advps_caro_sldwidth'] );}?>" style="width:60px;" onkeypress="return onlyNum(event);" />
                   <span style="padding-left:20px; font-size:10px; font-style:italic;">[ N.B. For slider type Carousel or Ticker. ]</span></td>
               </tr>
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('caro_ticker<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('caro_ticker<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="caro_ticker" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:158px; background-position:157px 6px;"><strong>Container & Thumbnail</strong></legend>
-          <form method="post" onsubmit="return false" id="container<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="container<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -314 +314 @@
                         foreach($_wp_additional_image_sizes as $tkey => $tval){
                         ?>
-                    <option value="<?php echo $tkey;?>" <?php if($container['advps_thumbnail'] == $tkey){echo 'selected="selected"';}?>><?php echo $tkey;?></option>
+                    <option value="<?php echo esc_attr( $tkey );?>" <?php if($container['advps_thumbnail'] == $tkey){echo 'selected="selected"';}?>><?php echo esc_html( $tkey );?></option>
                     <?php
                         }
@@ -322 +322 @@
               <tr>
                 <th scope="row">Default image url</th>
-                <td><input type="text" name="advps_default_image" value="<?php if(isset($container['advps_default_image'])){ echo $container['advps_default_image'];}?>" style="width:250px;" />
+                <td><input type="text" name="advps_default_image" value="<?php if(isset($container['advps_default_image'])){ echo esc_url( $container['advps_default_image'] );}?>" style="width:250px;" />
                   <span style="padding-left:10px; font-size:10px; font-style:italic;"> [ N.B. If any post doesn't have featured image then default image will be shown.]</span></td>
               </tr>
               <tr>
                 <th scope="row">Slide Container Width</th>
-                <td><input type="text" name="advps_sld_width" value="<?php echo $container['advps_sld_width'];?>" style="width:45px;" onkeypress="return onlyNum(event);" />
+                <td><input type="text" name="advps_sld_width" value="<?php echo esc_attr( $container['advps_sld_width'] );?>" style="width:45px;" onkeypress="return onlyNum(event);" />
                   &nbsp;px</td>
               </tr>
@@ -339 +339 @@
               <tr>
                 <th scope="row">Background Color</th>
-                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bgcolor" value="<?php echo $container['advps_bgcolor'];?>" style="width:100px;" />
+                <td><input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bgcolor" value="<?php echo esc_attr( $container['advps_bgcolor'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -345 +345 @@
                 <th scope="row">Border</th>
                 <td><span style="vertical-align:top">
-                  <input type="text" name="advps_border_size" value="<?php echo $container['advps_border_size'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_border_size" value="<?php echo esc_attr( $container['advps_border_size'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px &nbsp;&nbsp;
                   <select name="advps_border_type">
@@ -356 +356 @@
                   </select>
                   &nbsp;&nbsp;</span>
-                  <input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_border_color" value="<?php echo $container['advps_border_color'];?>" style="width:100px;" />
+                  <input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_border_color" value="<?php echo esc_attr( $container['advps_border_color'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -369 +369 @@
                 <th scope="row">Box Shadow</th>
                 <td><span style="vertical-align:top">
-                  <input type="text" name="advps_bxshad1" value="<?php echo $container['advps_bxshad1'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad1" value="<?php echo esc_attr( $container['advps_bxshad1'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px &nbsp;&nbsp;
-                  <input type="text" name="advps_bxshad2" value="<?php echo $container['advps_bxshad2'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad2" value="<?php echo esc_attr( $container['advps_bxshad2'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px&nbsp;&nbsp;
-                  <input type="text" name="advps_bxshad3" value="<?php echo $container['advps_bxshad3'];?>" style="width:40px;" onkeypress="return onlyNum(event);" />
+                  <input type="text" name="advps_bxshad3" value="<?php echo esc_attr( $container['advps_bxshad3'] );?>" style="width:40px;" onkeypress="return onlyNum(event);" />
                   px&nbsp;&nbsp;</span>
-                  <input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bxshadcolor" value="<?php echo $container['advps_bxshadcolor'];?>" style="width:100px;" />
+                  <input id="advpscolor<?php echo ++$flg?>" class="advps-color-picker" type="text" name="advps_bxshadcolor" value="<?php echo esc_attr( $container['advps_bxshadcolor'] );?>" style="width:100px;" />
                   <div class="advpsfarb" style="padding-left:22%"></div></td>
               </tr>
@@ -435 +435 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('container<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('container<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="container" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
         <fieldset>
           <legend class="advps-legend" style="width:79px; background-position:78px 6px;"><strong>Navigation</strong></legend>
-          <form method="post" onsubmit="return false" id="navigation<?php echo $dset->id;?>">
+          <form method="post" onsubmit="return false" id="navigation<?php echo intval( $dset->id );?>">
             <table class="form-table">
               <tr>
@@ -460 +460 @@
                   <span style="padding:0px 5px 0px 10px;">Bullet</span>
                   <input type="radio" name="advps_pager_type" value="bullet" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'bullet'){echo 'checked="checked"';}?>>
-                  <span id="advps-pthumb-lvl<?php echo $dset->id;?>" style="padding:0px 5px 0px 10px;" class="<?php if($slider['advps_slider_type'] != 'standard'){echo 'advps-fade';}?>">Thumbnail</span>
-                  <input id="advps-pthumb<?php echo $dset->id;?>" <?php if($slider['advps_slider_type'] != 'standard'){echo 'disabled="disabled"';}?> type="radio" name="advps_pager_type" value="thumb" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'thumb'){echo 'checked="checked"';}?>></td>
+                  <span id="advps-pthumb-lvl<?php echo intval( $dset->id );?>" style="padding:0px 5px 0px 10px;" class="<?php if($slider['advps_slider_type'] != 'standard'){echo 'advps-fade';}?>">Thumbnail</span>
+                  <input id="advps-pthumb<?php echo intval( $dset->id );?>" <?php if($slider['advps_slider_type'] != 'standard'){echo 'disabled="disabled"';}?> type="radio" name="advps_pager_type" value="thumb" <?php if(isset($navigation['advps_pager_type']) && $navigation['advps_pager_type'] == 'thumb'){echo 'checked="checked"';}?>></td>
               </tr>
               <tr>
                 <th scope="row">Thumbnail Width</th>
                 <td>
-                  <input type="text" name="advps_pthumb_width" value="<?php echo $navigation['advps_pthumb_width'];?>" style="width:50px;" onkeypress="return onlyNum(event);" />&nbsp;%                  
+                  <input type="text" name="advps_pthumb_width" value="<?php echo esc_attr( $navigation['advps_pthumb_width'] );?>" style="width:50px;" onkeypress="return onlyNum(event);" />&nbsp;%                  
                   <span style="padding-left:10px; font-size:10px; font-style:italic;">[ N.B. For pager type thumbnail. ]</span></td>
               </tr>
@@ -479 +479 @@
               <tr>
                 <th scope="row">Pager position from bottom</th>
-                <td><input type="text" name="advps_pager_bottom" value="<?php echo $navigation['advps_pager_bottom'];?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
+                <td><input type="text" name="advps_pager_bottom" value="<?php echo esc_attr( $navigation['advps_pager_bottom'] );?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
                   &nbsp;px</td>
               </tr>
@@ -500 +500 @@
               <tr>
                 <th scope="row">Play/Pause position from bottom</th>
-                <td><input type="text" name="advps_ppause_bottom" value="<?php echo $navigation['advps_ppause_bottom'];?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
+                <td><input type="text" name="advps_ppause_bottom" value="<?php echo esc_attr( $navigation['advps_ppause_bottom'] );?>" style="width:50px;" onkeypress="return NumNdNeg(event);" />
                   &nbsp;px</td>
               </tr>
@@ -512 +512 @@
               <tr>
                 <th scope="row">&nbsp;</th>
-                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('navigation<?php echo $dset->id;?>')" />
-                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo advps_url;?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
+                <td><input type="submit" name="advps_submit" value="Save changes" class="button-primary" onclick="updateOptionSet('navigation<?php echo intval( $dset->id );?>')" />
+                  <span class="ajx-loader" style="padding-left:15px; display:none;"><img src="<?php echo esc_url( advps_url );?>/images/ajax-loader.gif" /></span><span class="ajx-sts"></span></td>
               </tr>
             </table>
             <input type="hidden" name="opt_field" value="navigation" />
-            <input type="hidden" value="<?php echo $dset->id;?>" name="opt_id" />
+            <input type="hidden" value="<?php echo intval( $dset->id );?>" name="opt_id" />
           </form>
         </fieldset>
-        <form method="post" id="frmOptDel<?php echo $dset->id;?>" onsubmit="return false">
-          <input type="hidden" value="<?php echo $dset->id;?>" name="optset-id" />
+        <form method="post" id="frmOptDel<?php echo intval( $dset->id );?>" onsubmit="return false">
+          <input type="hidden" value="<?php echo intval( $dset->id );?>" name="optset-id" />
           <input type="hidden" value="<?php echo $tcount[0]->Auto_increment;?>" name="nextoptid" />
           <p>
-            <input type="submit" name="del-optset" value="Delete" class="button-secondary" onclick="deleteOptSet(<?php echo $dset->id;?>)" style="width:12%;" />
-            <span style="margin-left:5px;"><input type="submit" name="dup-optset" value="Duplicate" class="button-secondary" onclick="duplicateOptSet(<?php echo $dset->id;?>)" style="width:12%;" /></span>
+            <input type="submit" name="del-optset" value="Delete" class="button-secondary" onclick="deleteOptSet(<?php echo intval( $dset->id );?>)" style="width:12%;" />
+            <span style="margin-left:5px;"><input type="submit" name="dup-optset" value="Duplicate" class="button-secondary" onclick="duplicateOptSet(<?php echo intval( $dset->id );?>)" style="width:12%;" /></span>
           </p>
           <?php wp_nonce_field('advps-checkauthnonce','advps_wpnonce'); ?>