diff --git a/app/conferences_active/conference_interactive_inc.php b/app/conferences_active/conference_interactive_inc.php
index c06282127a..c74faca9d8 100644
--- a/app/conferences_active/conference_interactive_inc.php
+++ b/app/conferences_active/conference_interactive_inc.php
@@ -17,23 +17,27 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 	James Rose <james.o.rose@gmail.com>
 */
-include "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
-if (permission_exists('conference_interactive_view')) {
-	//access granted
-}
-else {
-	echo "access denied";
-	exit;
-}
+
+//includes
+	include "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (permission_exists('conference_interactive_view')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -107,7 +111,7 @@ else {
 		echo "<table width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
 		echo "<tr>\n";
 		echo "	<td>";
-		echo "		<strong style='color: #000;'>".$text['label-members'].": ".$member_count."</strong>\n";
+		echo "		<strong style='color: #000;'>".$text['label-members'].": ".escape($member_count)."</strong>\n";
 		echo "	</td>\n";
 		echo "<td align='right'>\n";
 
@@ -128,9 +132,9 @@ else {
 		}
 		if (permission_exists('conference_interactive_mute')) {
 			$action_mute_all = ($mute_all == "true") ? 'unmute' : 'mute';
-			echo "	<input type='button' class='btn' title=\"".$text['label-mute-all-alt']."\" onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".$conference_name."&data=".$action_mute_all."+non_moderator');\" value='".$text['label-'.$action_mute_all.'-all']."'>\n";
+			echo "	<input type='button' class='btn' title=\"".$text['label-mute-all-alt']."\" onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".escape($conference_name)."&data=".$action_mute_all."+non_moderator');\" value='".$text['label-'.$action_mute_all.'-all']."'>\n";
 		}
-		echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".$conference_name."&data=kick+all');\" value='".$text['label-end-conference']."'>\n";
+		echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".escape($conference_name)."&data=kick+all');\" value='".$text['label-end-conference']."'>\n";
 
 		echo "</td>\n";
 		echo "</tr>\n";
@@ -165,11 +169,11 @@ else {
 				$caller_id_name = $row->caller_id_name;
 				$caller_id_name = urldecode($caller_id_name);
 				$caller_id_number = $row->caller_id_number;
-	
+
 				//format seconds
 				$join_time_formatted = sprintf('%02d:%02d:%02d', ($join_time/3600), ($join_time/60%60), $join_time%60);
 				$last_talking_formatted = sprintf('%02d:%02d:%02d', ($last_talking/3600), ($last_talking/60%60), $last_talking%60);
-	
+
 				if (strlen($record_path) == 0) {
 					if (permission_exists('conference_interactive_mute')) {
 						$action_mute = ($flag_can_speak == "true") ? 'mute' : 'unmute';
@@ -179,8 +183,8 @@ else {
 					echo "<tr>\n";
 					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title." style='padding: 4px 6px;'><img src='resources/images/".(($is_moderator == "true") ? 'moderator' : 'participant').".png' style='width: 16px; height: 16px; border: none;' title=\"".$text['label-'.(($is_moderator == "true") ? 'moderator' : 'participant')]."\"></td>\n";
 					$talking_icon = ($flag_talking == "true") ? "<img src='resources/images/talking.png' style='width: 16px; height: 16px; border: none; margin: -2px 10px -2px 15px;' align='absmiddle' title=\"".$text['label-talking']."\">" : null;
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".$caller_id_name.$talking_icon."</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".$caller_id_number."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".escape($caller_id_name).$talking_icon."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".escape($caller_id_number)."</td>\n";
 					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title." style='padding-top: 5px;'>";
 					echo 	($flag_can_hear == "true") ? "<img src='resources/images/hear.png' style='width: 16px; height: 16px; border: none; margin: 0px 4px -2px 0px;' align='absmiddle' title=\"".$text['label-hear']."\">" : null;
 					echo 	($flag_can_speak == "true") ? "<img src='resources/images/speak.png' style='width: 16px; height: 16px; border: none; margin: 0px 6px -2px 0px;' align='absmiddle' title=\"".$text['label-speak']."\">" : null;
@@ -188,36 +192,36 @@ else {
 						echo ($flag_has_video == "true") ? "<img src='resources/images/video.png' style='width: 16px; height: 16px; border: none; margin: 0px 4px -2px 0px;' align='absmiddle' title=\"".$text['label-video']."\">" : null;
 					}
 					echo "</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".$join_time_formatted."</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".$last_talking_formatted."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".escape($join_time_formatted)."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".escape($last_talking_formatted)."</td>\n";
 					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick." ".$td_title.">".$text['label-'.(($flag_has_floor == "true") ? 'yes' : 'no')]."</td>\n";
 					echo "<td valign='top' class='".$row_style[$c]."' style='text-align: right; padding: 1px 2px; white-space: nowrap;'>\n";
 					//energy
 						if (permission_exists('conference_interactive_energy')) {
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=up&cmd=conference&name=".$conference_name."&data=energy&id=".$id."');\" value='+".$text['label-energy']."'>\n";
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=down&cmd=conference&name=".$conference_name."&data=energy&id=".$id."');\" value='-".$text['label-energy']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=up&cmd=conference&name=".escape($conference_name)."&data=energy&id=".escape($id)."');\" value='+".$text['label-energy']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=down&cmd=conference&name=".escape($conference_name)."&data=energy&id=".escape($id)."');\" value='-".$text['label-energy']."'>\n";
 						}
 					//volume
 						if (permission_exists('conference_interactive_volume')) {
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=up&cmd=conference&name=".$conference_name."&data=volume_in&id=".$id."');\" value='+".$text['label-volume']."'>\n";
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=down&cmd=conference&name=".$conference_name."&data=volume_in&id=".$id."');\" value='-".$text['label-volume']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=up&cmd=conference&name=".escape($conference_name)."&data=volume_in&id=".escape($id)."');\" value='+".$text['label-volume']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=down&cmd=conference&name=".escape($conference_name)."&data=volume_in&id=".escape($id)."');\" value='-".$text['label-volume']."'>\n";
 						}
 						if (permission_exists('conference_interactive_gain')) {
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=up&cmd=conference&name=".$conference_name."&data=volume_out&id=".$id."');\" value='+".$text['label-gain']."'>\n";
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=down&cmd=conference&name=".$conference_name."&data=volume_out&id=".$id."');\" value='-".$text['label-gain']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=up&cmd=conference&name=".escape($conference_name)."&data=volume_out&id=".escape($id)."');\" value='+".$text['label-gain']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?direction=down&cmd=conference&name=".escape($conference_name)."&data=volume_out&id=".escape($id)."');\" value='-".$text['label-gain']."'>\n";
 						}
 					//mute and unmute
 						if (permission_exists('conference_interactive_mute')) {
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".$conference_name."&data=".$action_mute."&id=".$id."');\" value='".$text['label-'.$action_mute]."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".escape($conference_name)."&data=".$action_mute."&id=".escape($id)."');\" value='".$text['label-'.$action_mute]."'>\n";
 						}
 					//deaf and undeaf
 						if (permission_exists('conference_interactive_deaf')) {
 							$action_deaf = ($flag_can_hear == "true") ? 'deaf' : 'undeaf';
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".$conference_name."&data=".$action_deaf."&id=".$id."');\" value='".$text['label-'.$action_deaf]."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".escape($conference_name)."&data=".$action_deaf."&id=".escape($id)."');\" value='".$text['label-'.$action_deaf]."'>\n";
 						}
 					//kick someone from the conference
 						if (permission_exists('conference_interactive_kick')) {
-							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".$conference_name."&data=kick&id=".$id."&uuid=".$uuid."');\" value='".$text['label-kick']."'>\n";
+							echo "	<input type='button' class='btn' onclick=\"send_cmd('conference_exec.php?cmd=conference&name=".escape($conference_name)."&data=kick&id=".escape($id)."&uuid=".escape($uuid)."');\" value='".$text['label-kick']."'>\n";
 						}
 					echo "</td>\n";
 					echo "</tr>\n";
@@ -228,4 +232,5 @@ else {
 		echo "</table>\n";
 		echo "<br /><br />";
 	}
-?>
\ No newline at end of file
+
+?>