diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc
index 2944f43..17bd219 100644
--- a/core/includes/bootstrap.inc
+++ b/core/includes/bootstrap.inc
@@ -210,7 +210,8 @@ const LANGUAGE_RTL = 1;
 define('REQUEST_TIME', (int) $_SERVER['REQUEST_TIME']);
 
 /**
- * Flag for drupal_set_title(); text is not sanitized, so run drupal_htmlspecialchars().
+ * Flag for drupal_set_title(); text is not sanitized, so run
+ * drupal_htmlspecialchars().
  */
 const DRUPAL_HTMLSPECIALCHARS = 0;
 
@@ -1563,8 +1564,8 @@ function t($string, array $args = array(), array $options = array()) {
  *   the key:
  *   - !variable: Inserted as is. Use this for text that has already been
  *     sanitized.
- *   - @variable: Escaped to HTML using drupal_htmlspecialchars(). Use this for anything
- *     displayed on a page on the site.
+ *   - @variable: Escaped to HTML using drupal_htmlspecialchars(). Use this for
+ *     anything displayed on a page on the site.
  *   - %variable: Escaped as a placeholder for user-submitted content using
  *     drupal_placeholder(), which shows up as <em>emphasized</em> text.
  *
@@ -1702,7 +1703,8 @@ function watchdog_exception($type, Exception $exception, $message = NULL, $varia
 
    // Use a default value if $message is not set.
    if (empty($message)) {
-     // The exception message is run through drupal_htmlspecialchars() by _drupal_decode_exception().
+     // The exception message is run through drupal_htmlspecialchars() by
+     // _drupal_decode_exception().
      $message = '%type: !message in %function (line %line of %file).';
    }
    // $variables must be an array so that we can add the exception information.
@@ -1873,10 +1875,10 @@ function drupal_get_title() {
  *   Optional string value to assign to the page title; or if set to NULL
  *   (default), leaves the current title unchanged.
  * @param $output
- *   Optional flag - normally should be left as DRUPAL_HTMLSPECIALCHARS. Only set to
- *   PASS_THROUGH if you have already removed any possibly dangerous code
- *   from $title using a function like drupal_htmlspecialchars() or filter_xss(). With this
- *   flag the string will be passed through unchanged.
+ *   Optional flag - normally should be left as DRUPAL_HTMLSPECIALCHARS. Only
+ *   set to PASS_THROUGH if you have already removed any possibly dangerous code
+ *   from $title using a function like drupal_htmlspecialchars() or
+ *   filter_xss(). With this flag the string will be passed through unchanged.
  *
  * @return
  *   The updated title of the current page.
diff --git a/core/includes/common.inc b/core/includes/common.inc
index 833f591..eae1074 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -1245,8 +1245,8 @@ function flood_is_allowed($name, $threshold, $window = 3600, $identifier = NULL)
  * @return
  *   A plain-text URI stripped of dangerous protocols. As with all plain-text
  *   strings, this return value must not be output to an HTML page without
- *   drupal_htmlspecialchars() being called on it. However, it can be passed to functions
- *   expecting plain-text strings.
+ *   drupal_htmlspecialchars() being called on it. However, it can be passed to
+ *   functions expecting plain-text strings.
  *
  * @see check_url()
  */
@@ -2229,15 +2229,16 @@ function drupal_http_header_attributes(array $attributes = array()) {
  * If a value is itself an array, then its elements are concatenated to a single
  * space-delimited string (for example, a class attribute with multiple values).
  *
- * Attribute values are sanitized by running them through drupal_htmlspecialchars().
+ * Attribute values are sanitized by running them through
+ * drupal_htmlspecialchars().
  * Attribute names are not automatically sanitized. When using user-supplied
  * attribute names, it is strongly recommended to allow only white-listed names,
  * since certain attributes carry security risks and can be abused.
  *
  * Examples of security aspects when using drupal_attributes:
  * @code
- *   // By running the value in the following statement through drupal_htmlspecialchars,
- *   // the malicious script is neutralized.
+ *   // By running the value in the following statement through
+ *   // drupal_htmlspecialchars,the malicious script is neutralized.
  *   drupal_attributes(array('title' => t('<script>steal_cookie();</script>')));
  *
  *   // The statement below demonstrates dangerous use of drupal_attributes, and
@@ -2280,8 +2281,8 @@ function drupal_attributes(array $attributes = array()) {
  *   The internal path or external URL being linked to, such as "node/34" or
  *   "http://example.com/foo". After the url() function is called to construct
  *   the URL from $path and $options, the resulting URL is passed through
- *   drupal_htmlspecialchars() before it is inserted into the HTML anchor tag, to ensure
- *   well-formed HTML. See url() for more information and notes.
+ *   drupal_htmlspecialchars() before it is inserted into the HTML anchor tag,
+ *   to ensure well-formed HTML. See url() for more information and notes.
  * @param array $options
  *   An associative array of additional options, with the following elements:
  *   - 'attributes': An associative array of HTML attributes to apply to the
@@ -6868,7 +6869,8 @@ function drupal_install_schema($module) {
  * @return
  *   An array of arrays with the following key/value pairs:
  *    - success: a boolean indicating whether the query succeeded.
- *    - query: the SQL query(s) executed, passed through drupal_htmlspecialchars().
+ *    - query: the SQL query(s) executed, passed through
+ *      drupal_htmlspecialchars().
  */
 function drupal_uninstall_schema($module) {
   $schema = drupal_get_schema_unprocessed($module);
diff --git a/core/includes/form.inc b/core/includes/form.inc
index 28ba35a..a483d05 100644
--- a/core/includes/form.inc
+++ b/core/includes/form.inc
@@ -4126,9 +4126,9 @@ function element_validate_number($element, &$form_state) {
  * Note: if the batch 'title', 'init_message', 'progress_message', or
  * 'error_message' could contain any user input, it is the responsibility of
  * the code calling batch_set() to sanitize them first with a function like
- * drupal_htmlspecialchars() or filter_xss(). Furthermore, if the batch operation
- * returns any user input in the 'results' or 'message' keys of $context,
- * it must also sanitize them first.
+ * drupal_htmlspecialchars() or filter_xss(). Furthermore, if the batch
+ * operation returns any user input in the 'results' or 'message' keys of
+ * $context, it must also sanitize them first.
  *
  * Sample batch operations:
  * @code
diff --git a/core/includes/menu.inc b/core/includes/menu.inc
index 895b098..77cd117 100644
--- a/core/includes/menu.inc
+++ b/core/includes/menu.inc
@@ -658,8 +658,8 @@ function _menu_check_access(&$item, $map) {
  * @return
  *   No return value.
  *   $item['title'] is localized according to $item['title_callback'].
- *   If an item's callback is drupal_htmlspecialchars(), $item['options']['html'] becomes
- *   TRUE.
+ *   If an item's callback is drupal_htmlspecialchars(),
+ *   $item['options']['html'] becomes TRUE.
  *   $item['description'] is translated using t().
  *   When doing link translation and the $item['options']['attributes']['title']
  *   (link title attribute) matches the description, it is translated as well.
@@ -1642,8 +1642,8 @@ function theme_menu_local_task($variables) {
     // Add text to indicate active tab for non-visual users.
     $active = '<span class="element-invisible">' . t('(active tab)') . '</span>';
 
-    // If the link does not contain HTML already, drupal_htmlspecialchars() it now.
-    // After we set 'html'=TRUE the link will not be sanitized by l().
+    // If the link does not contain HTML already, drupal_htmlspecialchars() it
+    // now. After we set 'html'=TRUE the link will not be sanitized by l().
     if (empty($link['localized_options']['html'])) {
       $link['title'] = drupal_htmlspecialchars($link['title']);
     }
diff --git a/core/includes/token.inc b/core/includes/token.inc
index be821f5..11ef69b 100644
--- a/core/includes/token.inc
+++ b/core/includes/token.inc
@@ -70,8 +70,8 @@
  *   - sanitize: A boolean flag indicating that tokens should be sanitized for
  *     display to a web browser. Defaults to TRUE. Developers who set this
  *     option to FALSE assume responsibility for running filter_xss(),
- *     drupal_htmlspecialchars() or other appropriate scrubbing functions before displaying
- *     data to users.
+ *     drupal_htmlspecialchars() or other appropriate scrubbing functions
+ *     before displaying data to users.
  *
  * @return
  *   Text with tokens replaced.
@@ -157,8 +157,8 @@ function token_scan($text) {
  *     encoding or truncation to a specific length.
  *   - sanitize: A boolean flag indicating that tokens should be sanitized for
  *     display to a web browser. Developers who set this option to FALSE assume
- *     responsibility for running filter_xss(), drupal_htmlspecialchars() or other
- *     appropriate scrubbing functions before displaying data to users.
+ *     responsibility for running filter_xss(), drupal_htmlspecialchars() or
+ *     other appropriate scrubbing functions before displaying data to users.
  *
  * @return
  *   An associative array of replacement values, keyed by the original 'raw'
diff --git a/core/includes/update.inc b/core/includes/update.inc
index bda9caf..3a0f4ff 100644
--- a/core/includes/update.inc
+++ b/core/includes/update.inc
@@ -214,7 +214,8 @@ function update_do_one($module, $number, $dependency_map, &$context) {
 
       require_once DRUPAL_ROOT . '/core/includes/errors.inc';
       $variables = _drupal_decode_exception($e);
-      // The exception message is run through drupal_htmlspecialchars() by _drupal_decode_exception().
+      // The exception message is run through drupal_htmlspecialchars() by
+      // _drupal_decode_exception().
       $ret['#abort'] = array('success' => FALSE, 'query' => t('%type: !message in %function (line %line of %file).', $variables));
     }
   }
diff --git a/core/modules/field/field.module b/core/modules/field/field.module
index 3cb4eb2..1b45591 100644
--- a/core/modules/field/field.module
+++ b/core/modules/field/field.module
@@ -1052,12 +1052,12 @@ function field_extract_bundle($entity_type, $bundle) {
 function template_preprocess_field(&$variables, $hook) {
   $element = $variables['element'];
 
-  // There's some overhead in calling drupal_htmlspecialchars() so only call it if the label
-  // variable is being displayed. Otherwise, set it to NULL to avoid PHP
-  // warnings if a theme implementation accesses the variable even when it's
-  // supposed to be hidden. If a theme implementation needs to print a hidden
-  // label, it needs to supply a preprocess function that sets it to the
-  // sanitized element title or whatever else is wanted in its place.
+  // There's some overhead in calling drupal_htmlspecialchars() so only call it
+  // if the label variable is being displayed. Otherwise, set it to NULL to
+  // avoid PHP warnings if a theme implementation accesses the variable even
+  // when it's supposed to be hidden. If a theme implementation needs to print
+  // a hidden label, it needs to supply a preprocess function that sets it to
+  // the sanitized element title or whatever else is wanted in its place.
   $variables['label_hidden'] = ($element['#label_display'] == 'hidden');
   $variables['label'] = $variables['label_hidden'] ? NULL : drupal_htmlspecialchars($element['#title']);
 
diff --git a/core/modules/simpletest/drupal_web_test_case.php b/core/modules/simpletest/drupal_web_test_case.php
index cffe19e..4fd188e 100644
--- a/core/modules/simpletest/drupal_web_test_case.php
+++ b/core/modules/simpletest/drupal_web_test_case.php
@@ -577,7 +577,8 @@ abstract class DrupalTestCase {
       'file' => $exception->getFile(),
     ));
     require_once DRUPAL_ROOT . '/core/includes/errors.inc';
-    // The exception message is run through drupal_htmlspecialchars() by _drupal_decode_exception().
+    // The exception message is run through drupal_htmlspecialchars() by
+    // _drupal_decode_exception().
     $this->error(t('%type: !message in %function (line %line of %file).', _drupal_decode_exception($exception)), 'Uncaught exception', _drupal_get_last_caller($backtrace));
   }
 
diff --git a/core/modules/simpletest/tests/common.test b/core/modules/simpletest/tests/common.test
index e894f2f..3ffe628 100644
--- a/core/modules/simpletest/tests/common.test
+++ b/core/modules/simpletest/tests/common.test
@@ -353,7 +353,8 @@ class CommonURLUnitTest extends DrupalWebTestCase {
 }
 
 /**
- * Tests for the drupal_htmlspecialchars(), filter_xss() and format_string() functions.
+ * Tests for the drupal_htmlspecialchars(), filter_xss() and format_string()
+ * functions.
  */
 class CommonXssUnitTest extends DrupalUnitTestCase {
 
diff --git a/core/modules/statistics/statistics.admin.inc b/core/modules/statistics/statistics.admin.inc
index d7f23c6..5daa4b8 100644
--- a/core/modules/statistics/statistics.admin.inc
+++ b/core/modules/statistics/statistics.admin.inc
@@ -198,8 +198,8 @@ function statistics_access_log($aid) {
       array('data' => t('URL'), 'header' => TRUE),
       l(url($access->path, array('absolute' => TRUE)), $access->path)
     );
-    // It is safe to avoid filtering $access->title through drupal_htmlspecialchars because
-    // it comes from drupal_get_title().
+    // It is safe to avoid filtering $access->title through
+    // drupal_htmlspecialchars because it comes from drupal_get_title().
     $rows[] = array(
       array('data' => t('Title'), 'header' => TRUE),
       $access->title
diff --git a/core/modules/system/system.test b/core/modules/system/system.test
index c97babc..9fea4f9 100644
--- a/core/modules/system/system.test
+++ b/core/modules/system/system.test
@@ -1328,8 +1328,8 @@ class PageTitleFiltering extends DrupalWebTestCase {
    */
   function testTitleTags() {
     $title = "string with <em>HTML</em>";
-    // drupal_set_title's $filter is DRUPAL_HTMLSPECIALCHARS by default, so the title should be
-    // returned with drupal_htmlspecialchars().
+    // drupal_set_title's $filter is DRUPAL_HTMLSPECIALCHARS by default, so the
+    // title should be returned with drupal_htmlspecialchars().
     drupal_set_title($title, DRUPAL_HTMLSPECIALCHARS);
     $this->assertTrue(strpos(drupal_get_title(), '<em>') === FALSE, t('Tags in title converted to entities when $output is DRUPAL_HTMLSPECIALCHARS.'));
     // drupal_set_title's $filter is passed as PASS_THROUGH, so the title should be
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 0e1ab62..b477876 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -1366,8 +1366,8 @@ function user_block_view($delta = '') {
  *
  * @return
  *   An unsanitized string with the username to display. The code receiving
- *   this result must ensure that drupal_htmlspecialchars() is called on it before it is
- *   printed to the page.
+ *   this result must ensure that drupal_htmlspecialchars() is called on it
+ *   before it is printed to the page.
  */
 function format_username($account) {
   $name = !empty($account->name) ? $account->name : variable_get('anonymous', t('Anonymous'));