diff -urN punbb-1.3.1/admin/categories.php punbb-1.3.2/admin/categories.php
--- punbb-1.3.1/admin/categories.php	2008-10-30 09:58:26.000000000 +0000
+++ punbb-1.3.2/admin/categories.php	2008-12-01 07:57:37.000000000 +0000
@@ -214,7 +214,7 @@
 		if (isset($cat_name[$cur_cat['id']]) && isset($cat_order[$cur_cat['id']]))
 		{
 			if ($cat_name[$cur_cat['id']] == '')
-				message($lang_admin_categories['Must enter category']);
+				message($lang_admin_categories['Must name category']);
 
 			if ($cat_order[$cur_cat['id']] < 0)
 				message($lang_admin_categories['Must be integer']);
diff -urN punbb-1.3.1/admin/db_update.php punbb-1.3.2/admin/db_update.php
--- punbb-1.3.1/admin/db_update.php	2008-11-26 14:40:11.000000000 +0000
+++ punbb-1.3.2/admin/db_update.php	2008-12-08 15:02:16.000000000 +0000
@@ -10,7 +10,7 @@
  */
 
 
-define('UPDATE_TO', '1.3.1');
+define('UPDATE_TO', '1.3.2');
 define('UPDATE_TO_DB_REVISION', 3);
 
 // The number of items to process per pageview (lower this if the update script times out during UTF-8 conversion)
diff -urN punbb-1.3.1/admin/forums.php punbb-1.3.2/admin/forums.php
--- punbb-1.3.1/admin/forums.php	2008-11-26 15:10:28.000000000 +0000
+++ punbb-1.3.2/admin/forums.php	2008-11-28 15:50:06.000000000 +0000
@@ -177,7 +177,6 @@
 		</form>
 	</div>
 
-</div>
 <?php
 
 		($hook = get_hook('afo_del_forum_end')) ? eval($hook) : null;
diff -urN punbb-1.3.1/admin/install.php punbb-1.3.2/admin/install.php
--- punbb-1.3.1/admin/install.php	2008-11-26 14:40:11.000000000 +0000
+++ punbb-1.3.2/admin/install.php	2008-12-08 15:02:16.000000000 +0000
@@ -10,7 +10,7 @@
  */
 
 
-define('FORUM_VERSION', '1.3.1');
+define('FORUM_VERSION', '1.3.2');
 define('FORUM_DB_REVISION', 3);
 define('MIN_PHP_VERSION', '4.3.0');
 define('MIN_MYSQL_VERSION', '4.1.2');
diff -urN punbb-1.3.1/admin/settings.php punbb-1.3.2/admin/settings.php
--- punbb-1.3.1/admin/settings.php	2008-11-26 13:42:47.000000000 +0000
+++ punbb-1.3.2/admin/settings.php	2008-12-04 17:00:41.000000000 +0000
@@ -214,7 +214,7 @@
 		{
 			$query = array(
 				'UPDATE'	=> 'config',
-				'SET'		=> 'conf_value='.$input,
+				'SET'		=> 'conf_value='.intval($input),
 				'WHERE'		=> 'conf_name=\'p_'.$forum_db->escape($key).'\''
 			);
 
diff -urN punbb-1.3.1/admin/users.php punbb-1.3.2/admin/users.php
--- punbb-1.3.1/admin/users.php	2008-11-26 12:38:16.000000000 +0000
+++ punbb-1.3.2/admin/users.php	2008-12-04 16:48:51.000000000 +0000
@@ -817,6 +817,14 @@
 	$form = $_POST['form'];
 	$form['username'] = $_POST['username'];
 
+	//Check up for order_by and direction values
+	$order_by = isset($_POST['order_by']) ? forum_trim($_POST['order_by']) : null;
+	$direction = isset($_POST['direction']) ? forum_trim($_POST['direction']) : null;
+	if ($order_by == null || $direction == null)
+		message($lang_common['Bad request']);
+	if (!in_array($order_by, array('username', 'email', 'num_posts', 'num_posts', 'registered')) || !in_array($direction, array('ASC', 'DESC')))
+		message($lang_common['Bad request']);
+
 	($hook = get_hook('aus_find_user_selected')) ? eval($hook) : null;
 
 	// forum_trim() all elements in $form
@@ -829,8 +837,6 @@
 	$last_post_before = forum_trim($_POST['last_post_before']);
 	$registered_after = forum_trim($_POST['registered_after']);
 	$registered_before = forum_trim($_POST['registered_before']);
-	$order_by = $_POST['order_by'];
-	$direction = $_POST['direction'];
 	$user_group = $_POST['user_group'];
 
 	if ((!empty($posts_greater) || !empty($posts_less)) && !ctype_digit($posts_greater.$posts_less))
@@ -891,7 +897,7 @@
 			)
 		),
 		'WHERE'		=> 'u.id>1 AND '.implode(' AND ', $conditions),
-		'ORDER BY'	=> $forum_db->escape($order_by).' '.$forum_db->escape($direction)
+		'ORDER BY'	=> $order_by.' '.$direction
 	);
 
 	($hook = get_hook('aus_find_user_qr_find_users')) ? eval($hook) : null;
diff -urN punbb-1.3.1/header.php punbb-1.3.2/header.php
--- punbb-1.3.1/header.php	2008-11-26 13:31:37.000000000 +0000
+++ punbb-1.3.2/header.php	2008-12-08 11:53:13.000000000 +0000
@@ -247,7 +247,7 @@
 		if ($forum_updates['fail'])
 			$alert_items['update_fail'] = '<p><strong>'.$lang_common['Updates'].'</strong> '.$lang_common['Updates failed'].'</p>';
 		else if (isset($forum_updates['version']) && isset($forum_updates['hotfix']))
-			$alert_items['update_version_hotfix'] = '<p><strong>'.$lang_common['Updates'].'</strong> '.sprintf($lang_common['Updates version n hf'], $forum_updates['version']).'</p>';
+			$alert_items['update_version_hotfix'] = '<p><strong>'.$lang_common['Updates'].'</strong> '.sprintf($lang_common['Updates version n hf'], $forum_updates['version'], forum_link($forum_url['admin_extensions_hotfixes'])).'</p>';
 		else if (isset($forum_updates['version']))
 			$alert_items['update_version'] = '<p><strong>'.$lang_common['Updates'].'</strong> '.sprintf($lang_common['Updates version'], $forum_updates['version']).'</p>';
 		else if (isset($forum_updates['hotfix']))
diff -urN punbb-1.3.1/include/essentials.php punbb-1.3.2/include/essentials.php
--- punbb-1.3.1/include/essentials.php	2008-11-26 14:40:11.000000000 +0000
+++ punbb-1.3.2/include/essentials.php	2008-12-08 15:02:16.000000000 +0000
@@ -15,7 +15,7 @@
 	exit('The constant FORUM_ROOT must be defined and point to a valid PunBB installation root directory.');
 
 // Define the version and database revision that this code was written for
-define('FORUM_VERSION', '1.3.1');
+define('FORUM_VERSION', '1.3.2');
 define('FORUM_DB_REVISION', 3);
 
 // Load the functions script
diff -urN punbb-1.3.1/include/functions.php punbb-1.3.2/include/functions.php
--- punbb-1.3.1/include/functions.php	2008-11-26 13:31:37.000000000 +0000
+++ punbb-1.3.2/include/functions.php	2008-12-04 16:49:51.000000000 +0000
@@ -448,7 +448,7 @@
 		else
 		{
 			$links['search'] = '<li id="navsearch"'.((FORUM_PAGE == 'search') ? ' class="isactive"' : '').'><a href="'.forum_link($forum_url['search']).'">'.$lang_common['Search'].'</a></li>';
-			$links['profile'] = '<li id="navprofile"'.((FORUM_PAGE == 'editprofile' || FORUM_PAGE == 'viewprofile') ? ' class="isactive"' : '').'><a href="'.forum_link($forum_url['user'], $forum_user['id']).'">'.$lang_common['Profile'].'</a></li>';
+			$links['profile'] = '<li id="navprofile"'.((substr(FORUM_PAGE, 0, 7) == 'profile') ? ' class="isactive"' : '').'><a href="'.forum_link($forum_url['user'], $forum_user['id']).'">'.$lang_common['Profile'].'</a></li>';
 			$links['logout'] = '<li id="navlogout"><a href="'.forum_link($forum_url['logout'], array($forum_user['id'], generate_form_token('logout'.$forum_user['id']))).'">'.$lang_common['Logout'].'</a></li>';
 			$links['admin'] = '<li id="navadmin"'.((substr(FORUM_PAGE, 0, 5) == 'admin') ? ' class="isactive"' : '').'><a href="'.forum_link($forum_url['admin_index']).'">'.$lang_common['Admin'].'</a></li>';
 		}
diff -urN punbb-1.3.1/include/parser.php punbb-1.3.2/include/parser.php
--- punbb-1.3.1/include/parser.php	2008-11-21 12:36:01.000000000 +0000
+++ punbb-1.3.2/include/parser.php	2008-12-08 13:47:34.000000000 +0000
@@ -681,8 +681,8 @@
 
 	if (strpos($text, '[quote') !== false)
 	{
+		$text = preg_replace('#\[quote=(&quot;|"|\'|)(.*?)\\1\]#e', '"</p><div class=\"quotebox\"><cite>".str_replace(array(\'[\', \'\\"\'), array(\'&#91;\', \'"\'), \'$2\')." ".$lang_common[\'wrote\'].":</cite><blockquote><p>"', $text);
 		$text = preg_replace('#\[quote\]\s*#', '</p><div class="quotebox"><blockquote><p>', $text);
-		$text = preg_replace('#\[quote=(&quot;|"|\'|)(.*?)\\1\]#se', '"</p><div class=\"quotebox\"><cite>".str_replace(array(\'[\', \'\\"\'), array(\'&#91;\', \'"\'), \'$2\')." ".$lang_common[\'wrote\'].":</cite><blockquote><p>"', $text);
 		$text = preg_replace('#\s*\[\/quote\]#S', '</p></blockquote></div><p>', $text);
 	}
 
@@ -752,7 +752,7 @@
 {
 	$text = ' '.$text;
 
-	$text = preg_replace('#(?<=[\s\]\)])(<)?(\[)?(\()?([\'"]?)(https?|ftp|news){1}://([\w\-]+\.([\w\-]+\.)*[\w]+(:[0-9]+)?(/[^\s\[]*[^\s.,?!\[;:-])?)\4(?(3)(\)))(?(2)(\]))(?(1)(>))(?![^\s]*\[/(?:url|img)\])#ie', 'stripslashes(\'$1$2$3$4\').handle_url_tag(\'$5://$6\', \'$5://$6\', true).stripslashes(\'$4$10$11$12\')', $text);
+	$text = preg_replace('#(?<=[\s\]\)])(<)?(\[)?(\()?([\'"]?)(https?|ftp|news){1}://([\w\-]+\.([\w\-]+\.)*[\w]+(:[0-9]+)?(/[^\s\[]*[^\s.,?!\[;:-]?)?)\4(?(3)(\)))(?(2)(\]))(?(1)(>))(?![^\s]*\[/(?:url|img)\])#ie', 'stripslashes(\'$1$2$3$4\').handle_url_tag(\'$5://$6\', \'$5://$6\', true).stripslashes(\'$4$10$11$12\')', $text);
 	$text = preg_replace('#(?<=[\s\]\)])(<)?(\[)?(\()?([\'"]?)(www|ftp)\.(([\w\-]+\.)*[\w]+(:[0-9]+)?(/[^\s\[]*[^\s.,?!\[;:-])?)\4(?(3)(\)))(?(2)(\]))(?(1)(>))(?![^\s]*\[/(?:url|img)\])#ie', 'stripslashes(\'$1$2$3$4\').handle_url_tag(\'$5.$6\', \'$5.$6\', true).stripslashes(\'$4$10$11$12\')', $text);
 
 	return substr($text, 1);
diff -urN punbb-1.3.1/lang/English/common.php punbb-1.3.2/lang/English/common.php
--- punbb-1.3.1/lang/English/common.php	2008-11-26 13:31:37.000000000 +0000
+++ punbb-1.3.2/lang/English/common.php	2008-12-08 11:53:13.000000000 +0000
@@ -135,7 +135,7 @@
 'Maintenance alert'			=>	'<strong>WARNING! Maintenance mode enabled.</strong> This board is currently in maintenance mode. <em>DO NOT</em> logout, if you do you will not be able to login again.',
 'Updates'					=>	'PunBB updates:',
 'Updates failed'			=>	'The latest attempt at checking for updates against the punbb.informer.com updates service failed. This probably just means that the service is temporarily overloaded or out of order. However, if this alert does not disappear within a day or two, you should disable the automatic check for updates and check for updates manually in the future.',
-'Updates version n hf'		=>	'A newer version of PunBB, version %s, is available for download at <a href="http://punbb.informer.com/">punbb.informer.com</a>. Furthermore, one or more hotfixes are available for install on the strong>Extensions</strong> » <strong>Manage hotfixes</strong> tab of the admin interface.',
+'Updates version n hf'		=>	'A newer version of PunBB, version %s, is available for download at <a href="http://punbb.informer.com/">punbb.informer.com</a>. Furthermore, one or more hotfixes are available for install on the <a href="%s">Manage hotfixes</a> tab of the admin interface.',
 'Updates version'			=>	'A newer version of PunBB, version %s, is available for download at <a href="http://punbb.informer.com/">punbb.informer.com</a>.',
 'Updates hf'				=>	'One or more hotfixes are available for install on the <a href="%s">Manage hotfixes</a> tab of the admin interface.',
 'Database mismatch'			=>	'Database version mismatch',
diff -urN punbb-1.3.1/lang/English/login.php punbb-1.3.2/lang/English/login.php
--- punbb-1.3.1/lang/English/login.php	2008-11-26 12:46:21.000000000 +0000
+++ punbb-1.3.2/lang/English/login.php	2008-12-08 08:12:44.000000000 +0000
@@ -1,6 +1,6 @@
 <?php
 
-// Language definitions used in delete.php
+// Language definitions used in login.php
 $lang_login = array(
 
 // Miscellaneous
diff -urN punbb-1.3.1/login.php punbb-1.3.2/login.php
--- punbb-1.3.1/login.php	2008-11-08 17:53:23.000000000 +0000
+++ punbb-1.3.2/login.php	2008-12-04 16:42:00.000000000 +0000
@@ -427,7 +427,7 @@
 				<div class="sf-set set<?php echo ++$forum_page['item_count'] ?>">
 					<div class="sf-box text required">
 						<label for="fld<?php echo ++$forum_page['fld_count'] ?>"><span><?php echo $lang_login['Password'] ?> <em><?php echo $lang_common['Required'] ?></em></span></label><br />
-						<span class="fld-input"><input type="password" id="fld<?php echo $forum_page['fld_count'] ?>" name="req_password" value="<?php echo isset($_POST['req_password']) ? ($_POST['req_password']) : '' ?>" size="35" /></span>
+						<span class="fld-input"><input type="password" id="fld<?php echo $forum_page['fld_count'] ?>" name="req_password" value="<?php echo isset($_POST['req_password']) ? forum_htmlencode($_POST['req_password']) : '' ?>" size="35" /></span>
 					</div>
 				</div>
 <?php ($hook = get_hook('li_login_pre_remember_me_checkbox')) ? eval($hook) : null; ?>
diff -urN punbb-1.3.1/style/Oxygen/Oxygen.css punbb-1.3.2/style/Oxygen/Oxygen.css
--- punbb-1.3.1/style/Oxygen/Oxygen.css	2008-11-26 13:51:24.000000000 +0000
+++ punbb-1.3.2/style/Oxygen/Oxygen.css	2008-12-08 14:50:43.000000000 +0000
@@ -786,7 +786,10 @@
 	padding: 0.5em 0;
 	white-space: nowrap;
 	font-weight: normal;
-	text-transform: capitalize;
+	}
+
+.brd .item-summary strong:first-letter {
+	text-transform: uppercase;
 	}
 
 .brd .item-summary .subject-title {
