diff --git a/public/templates/mmcFE/admin/user/default.tpl b/public/templates/mmcFE/admin/user/default.tpl
index 83dbf92d..f8957d83 100644
--- a/public/templates/mmcFE/admin/user/default.tpl
+++ b/public/templates/mmcFE/admin/user/default.tpl
@@ -26,7 +26,7 @@
 <form action="{$smarty.server.PHP_SELF}" method="POST" id='query'>
   <input type="hidden" name="page" value="{$smarty.request.page}">
   <input type="hidden" name="action" value="{$smarty.request.action}">
-  <input type="text" class="pin" name="query" value="{$smarty.request.query|default:"%"}">
+  <input type="text" class="pin" name="query" value="{$smarty.request.query|default:"%"|escape}">
   <input type="submit" class="submit small" value="Query">
 </form>
 {include file="global/block_footer.tpl"}
diff --git a/public/templates/mmcFE/statistics/round/block_stats.tpl b/public/templates/mmcFE/statistics/round/block_stats.tpl
index dbd37bae..4857bc7e 100644
--- a/public/templates/mmcFE/statistics/round/block_stats.tpl
+++ b/public/templates/mmcFE/statistics/round/block_stats.tpl
@@ -61,9 +61,9 @@
   </table></td>
   <td class="right">
   <form action="{$smarty.server.PHP_SELF}" method="POST" id='search'>
-  <input type="hidden" name="page" value="{$smarty.request.page}">
-  <input type="hidden" name="action" value="{$smarty.request.action}">
-  <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"}">
+  <input type="hidden" name="page" value="{$smarty.request.page|escape}">
+  <input type="hidden" name="action" value="{$smarty.request.action|escape}">
+  <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"|escape}">
   <input type="submit" class="submit small" value="Search">
 </form></td></tr>
 </tbody></table>
diff --git a/public/templates/mmcFE/statistics/round/pplns_block_stats.tpl b/public/templates/mmcFE/statistics/round/pplns_block_stats.tpl
index f23facb3..86f3baca 100644
--- a/public/templates/mmcFE/statistics/round/pplns_block_stats.tpl
+++ b/public/templates/mmcFE/statistics/round/pplns_block_stats.tpl
@@ -2,9 +2,9 @@
 <br>
 <center>
   <form action="{$smarty.server.PHP_SELF}" method="POST" id='search'>
-  <input type="hidden" name="page" value="{$smarty.request.page}">
-  <input type="hidden" name="action" value="{$smarty.request.action}">
-  <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"}">
+  <input type="hidden" name="page" value="{$smarty.request.page|escape}">
+  <input type="hidden" name="action" value="{$smarty.request.action|escape}">
+  <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"|escape}">
   <input type="submit" class="submit small" value="Search">
 </form>
 </center> 
diff --git a/public/templates/mpos/admin/user/default.tpl b/public/templates/mpos/admin/user/default.tpl
index f9d3eec3..0d69bd63 100644
--- a/public/templates/mpos/admin/user/default.tpl
+++ b/public/templates/mpos/admin/user/default.tpl
@@ -100,7 +100,7 @@
     <form action="{$smarty.server.PHP_SELF}" method="POST" id='query'>
       <input type="hidden" name="page" value="{$smarty.request.page|escape}">
       <input type="hidden" name="action" value="{$smarty.request.action|escape}">
-      <input type="text" class="pin" name="query" value="{$smarty.request.query|default:"%"}">
+      <input type="text" class="pin" name="query" value="{$smarty.request.query|default:"%"|escape}">
       <input type="submit" value="Query" class="alt_btn">
     </form>
     </div>
diff --git a/public/templates/mpos/statistics/round/block_stats.tpl b/public/templates/mpos/statistics/round/block_stats.tpl
index c4c4c0d8..aafcb856 100644
--- a/public/templates/mpos/statistics/round/block_stats.tpl
+++ b/public/templates/mpos/statistics/round/block_stats.tpl
@@ -44,9 +44,9 @@
   <footer>
     <div class="submit_link">
       <form action="{$smarty.server.PHP_SELF}" method="POST" id='search'>
-        <input type="hidden" name="page" value="{$smarty.request.page}">
-        <input type="hidden" name="action" value="{$smarty.request.action}">
-        <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"}">
+        <input type="hidden" name="page" value="{$smarty.request.page|escape}">
+        <input type="hidden" name="action" value="{$smarty.request.action|escape}">
+        <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"|escape}">
         <input type="submit" value="Search" class="alt_btn">
       </form>
     </div>
diff --git a/public/templates/mpos/statistics/round/pplns_block_stats.tpl b/public/templates/mpos/statistics/round/pplns_block_stats.tpl
index d330b7fe..63b6e5ae 100644
--- a/public/templates/mpos/statistics/round/pplns_block_stats.tpl
+++ b/public/templates/mpos/statistics/round/pplns_block_stats.tpl
@@ -85,9 +85,9 @@
   <footer>
     <div class="submit_link">
       <form action="{$smarty.server.PHP_SELF}" method="POST" id='search'>
-        <input type="hidden" name="page" value="{$smarty.request.page}">
-        <input type="hidden" name="action" value="{$smarty.request.action}">
-        <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"}">
+        <input type="hidden" name="page" value="{$smarty.request.page|escape}">
+        <input type="hidden" name="action" value="{$smarty.request.action|escape}">
+        <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"|escape}">
         <input type="submit" value="Search" class="alt_btn">
       </form>
     </div>
diff --git a/public/templates/mpos/statistics/round/pplns_block_stats_small.tpl b/public/templates/mpos/statistics/round/pplns_block_stats_small.tpl
index 0a55b816..07fa4c73 100644
--- a/public/templates/mpos/statistics/round/pplns_block_stats_small.tpl
+++ b/public/templates/mpos/statistics/round/pplns_block_stats_small.tpl
@@ -74,9 +74,9 @@
   <footer>
     <div class="submit_link">
       <form action="{$smarty.server.PHP_SELF}" method="POST" id='search'>
-        <input type="hidden" name="page" value="{$smarty.request.page}">
-        <input type="hidden" name="action" value="{$smarty.request.action}">
-        <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"}">
+        <input type="hidden" name="page" value="{$smarty.request.page|escape}">
+        <input type="hidden" name="action" value="{$smarty.request.action|escape}">
+        <input type="text" class="pin" name="search" value="{$smarty.request.height|default:"%"|escape}">
         <input type="submit" value="Search" class="alt_btn">
       </form>
     </div>