diff --git a/profiles/openatrium/modules/contrib/ucreate/ucreate.module b/profiles/openatrium/modules/contrib/ucreate/ucreate.module
index 9ca8317..9ab4714 100644
--- a/profiles/openatrium/modules/contrib/ucreate/ucreate.module
+++ b/profiles/openatrium/modules/contrib/ucreate/ucreate.module
@@ -140,7 +140,7 @@ function ucreate_user_form() {
       // Exclude 'anonymous user'
       if ($rid !== 1) {
         $form['roles'][$rid] = array(
-          '#title' => $role,
+          '#title' => check_plain($role),
           '#type' => 'checkbox',
           '#default_value' => in_array($rid, $default_roles, TRUE) || $rid === 2,
           '#disabled' => $rid === 2 ? TRUE : FALSE,
@@ -180,7 +180,7 @@ function ucreate_user_form() {
 function ucreate_validate_name($element, &$form_state) {
   if ($account = user_load(array('name' => $element['#value']))) {
     $name = user_access('access user profiles') ? l($account->name, 'user/'. $account->uid) : $account->name;
-    form_set_error('name', t('User !name already exists.', array('!name' => $name)));
+    form_set_error('name', t('User @name already exists.', array('@name' => $name)));
   }
   else if ($error = user_validate_name($element['#value'])) {
     form_set_error('name', $error);
@@ -198,6 +198,7 @@ function ucreate_validate_mail($element, &$form_state) {
     form_set_error('mail', t('User with this e-mail address already exists.'));
   }
   else if ($error = user_validate_mail($element['#value'])) {
+    // We trust user_validate_mail to reurn a valid, non-malicious string.
     form_set_error('mail', $error);
   }
 }
@@ -238,10 +239,10 @@ function ucreate_block_form($form, $user, $op) {
       ),
     );
     if ($op == 'block') {
-      $message = t('Are you sure you would like to suspend !user\'s account?', array('!user' => theme('username', $account)));
+      $message = t("Are you sure you would like to suspend !user's account?", array('!user' => theme('username', $account)));
     }
     else if ($op == 'activate') {
-      $message = t('Are you sure you would like to activate !user\'s account?', array('!user' => theme('username', $account)));
+      $message = t("Are you sure you would like to activate !user's account?", array('!user' => theme('username', $account)));
     }
     $form = confirm_form($form, $message, $path, '');
     return $form;
@@ -300,7 +301,7 @@ function ucreate_user_create($edit) {
 
   // Notify user if successful.
   if ($account->uid) {
-    drupal_set_message(t('You have created an account for !name. The username and password have been sent along with log in instructions to the e-mail address !email.', array('!name' => $edit['name'], '!email' => l($edit['mail'], 'mailto:'. $edit['mail']))));
+    drupal_set_message(t('You have created an account for @name. The username and password have been sent along with log in instructions to the e-mail address @email.', array('@name' => $edit['name'], '!email' => l($edit['mail'], 'mailto:'. $edit['mail']))));
 
     $params['subject'] = t('[!site_name] We have created an account for you', array('!site_name' => variable_get('site_name', 'Drupal')));
     $variables = array(