diff --git a/components/date.inc b/components/date.inc
index 306d95a..644c8fa 100644
--- a/components/date.inc
+++ b/components/date.inc
@@ -405,7 +405,10 @@ function webform_validate_date($element, $form_state) {
     // Check that each part of the date has been filled in.
     foreach (array('day', 'month', 'year') as $field_type) {
       if (empty($element[$field_type]['#value'])) {
-        form_error($element[$field_type], t('!part in !name is missing.', array('!name' => $element['#title'], '!part' => $element[$field_type]['#title'])));
+        form_error($element[$field_type], t('@part in @name is missing.', array(
+          '@name' => filter_xss($element['#title']),
+          '@part' => filter_xss($element[$field_type]['#title'])
+          )));
         $missing_fields = TRUE;
       }
     }
@@ -415,7 +418,7 @@ function webform_validate_date($element, $form_state) {
 
     // Check for a valid date.
     if (!checkdate($element['month']['#value'], $element['day']['#value'], $element['year']['#value'])) {
-      form_error($element, t('Entered !name is not a valid date.', array('!name' => $element['#title'])));
+      form_error($element, t('Entered @name is not a valid date.', array('@name' => filter_xss($element['#title']))));
       return;
     }
 
@@ -447,7 +450,7 @@ function webform_validate_date($element, $form_state) {
     }
   }
   elseif ($element['#required']) {
-    form_error($element, t('!name field is required.', array('!name' => $element['#title'])));
+    form_error($element, t('@name field is required.', array('@name' => filter_xss($element['#title']))));
   }
 }
 
diff --git a/components/grid.inc b/components/grid.inc
index f5d9ec4..b65bfa7 100644
--- a/components/grid.inc
+++ b/components/grid.inc
@@ -499,7 +499,8 @@ function _webform_edit_grid_unique_validate($element) {
     // Fewer unique values than values means that at least one value is duplicated.
     // Fewer unique values than possible values means that there is a possible choice
     // that wasn't used.
-    form_error($element, t('!title is not allowed to have the same answer for more than one question.', array('!title' => $element['#title'])));
+    form_error($element, t('@title is not allowed to have the same answer for more than one question.', array(
+      '@title' => filter_xss($element['#title']))));
   }
 }
 
diff --git a/components/markup.inc b/components/markup.inc
index 6d85a6b..60e00f7 100644
--- a/components/markup.inc
+++ b/components/markup.inc
@@ -107,7 +107,7 @@ function _webform_render_markup($component, $value = NULL, $filter = TRUE, $subm
  *
  * Required to have access to current form values from $form_state.
  */
-function _webform_render_markup_after_build($form_element, &$form_state){
+function _webform_render_markup_after_build($form_element, &$form_state) {
   global $user;
   $node = node_load($form_element['#webform_nid']);
   $submission = NULL;
diff --git a/components/number.inc b/components/number.inc
index 40f5dea..8321f25 100644
--- a/components/number.inc
+++ b/components/number.inc
@@ -612,7 +612,10 @@ function _webform_validate_number($element, &$form_state) {
   if ($value != '') {
     // First check that the entered value matches the expected value.
     if (!webform_number_format_match($value, $element['#point'], $element['#separator'])) {
-      form_error($element, t('!name field value must format numbers as "@example".', array('!name' => $element['#title'], '@example' => webform_number_format(12345.6789, $element['#decimals'], $element['#point'], $element['#separator']))));
+      form_error($element, t('@name field value must format numbers as "@example".', array(
+        '@name' => $element['#title'],
+        '@example' => webform_number_format(12345.6789, filter_xss($element['#decimals']), filter_xss($element['#point']),
+        filter_xss($element['#separator'])))));
       return;
     }
 
@@ -631,19 +634,33 @@ function _webform_validate_number($element, &$form_state) {
           $max = $element['#min'];
         }
         if ($numeric_value > $max || $numeric_value < $min) {
-          form_error($element, t('!name field value of @value should be in the range @min to @max.', array('!name' => $element['#title'], '@value' => $value, '@min' => $element['#min'], '@max' => $element['#max'])));
+          form_error($element, t('@name field value of @value should be in the range @min to @max.', array(
+            '@name' => $element['#title'],
+            '@value' => filter_xss($value),
+            '@min' => filter_xss($element['#min']),
+            '@max' => filter_xss($element['#max'])
+            )));
         }
       }
       elseif ($element['#max'] != '' && $numeric_value > $element['#max']) {
-        form_error($element, t('!name field value must be less than @max.', array('!name' => $element['#title'], '@max' => $element['#max'])));
+        form_error($element, t('@name field value must be less than @max.', array(
+          '@name' => filter_xss($element['#title']),
+          '@max' => filter_xss($element['#max'])
+          )));
       }
       elseif ($element['#min'] != '' && $numeric_value < $element['#min']) {
-        form_error($element, t('!name field value must be greater than @min.', array('!name' => $element['#title'], '@min' => $element['#min'])));
+        form_error($element, t('@name field value must be greater than @min.', array(
+          '@name' => filter_xss($element['#title']),
+          '@min' => filter_xss($element['#min'])
+          )));
       }
 
       // Integer test.
       if ($element['#integer'] && !is_int($numeric_value * 1)) {
-        form_error($element, t('!name field value of @value must be an integer.', array('!name' => $element['#title'], '@value' => $value)));
+        form_error($element, t('@name field value of @value must be an integer.', array(
+          '@name' => filter_xss($element['#title']),
+          '@value' => filter_xss($value)
+          )));
       }
 
       // Step test.
@@ -656,15 +673,27 @@ function _webform_validate_number($element, &$form_state) {
           $starting_number + ($element['#step'] * 3),
         );
         if ($starting_number) {
-          form_error($element, t('!name field value must be @start plus a multiple of @step. i.e. @samples, etc.', array('!name' => $element['#title'], '@start' => $element['#min'], '@step' => $element['#step'], '@samples' => implode(', ', $samples))));
+          form_error($element, t('@name field value must be @start plus a multiple of @step. i.e. @samples, etc.', array(
+            '@name' => filter_xss($element['#title']),
+            '@start' => filter_xss($element['#min']),
+            '@step' => filter_xss($element['#step']),
+            '@samples' => implode(', ', filter_xss($samples))
+            )));
         }
         else {
-          form_error($element, t('!name field value must be a multiple of @step. i.e. @samples, etc.', array('!name' => $element['#title'], '@step' => $element['#step'], '@samples' => implode(', ', $samples))));
+          form_error($element, t('@name field value must be a multiple of @step. i.e. @samples, etc.', array(
+            '@name' => filter_xss($element['#title']),
+            '@step' => filter_xss($element['#step']),
+            '@samples' => implode(', ', filter_xss($samples))
+            )));
         }
       }
     }
     else {
-      form_error($element, t('!name field value of @value must be numeric.', array('!name' => $element['#title'], '@value' => $value)));
+      form_error($element, t('@name field value of @value must be numeric.', array(
+        '@name' => filter_xss($element['#title']),
+        '@value' => filter_xss($value)
+        )));
     }
   }
 }
diff --git a/components/select.inc b/components/select.inc
index 3025065..673b9c0 100644
--- a/components/select.inc
+++ b/components/select.inc
@@ -749,7 +749,7 @@ function _webform_action_set_select($component, &$element, &$form_state, $value)
   // Set the value as an array for multiple select or single value otherwise.
   if ($element['#type'] == 'checkboxes') {
     $checkbox_values = $element['#options'];
-    array_walk($checkbox_values, function(&$value, $key) use ($value) {
+    array_walk($checkbox_values, function(&$value, $key) use($value) {
       $value = (int)(strval($key) === $value);
     });
   }
diff --git a/components/time.inc b/components/time.inc
index b477470..a4e9e5c 100644
--- a/components/time.inc
+++ b/components/time.inc
@@ -309,7 +309,7 @@ function webform_validate_time($element, $form_state) {
   if ($element['#required']) {
     foreach (array('hour', 'minute', 'ampm') as $field_type) {
       if (isset($element[$field_type]) && $element[$field_type]['#value'] === '') {
-        form_error($element, t('!name field is required.', array('!name' => $element['#title'])));
+        form_error($element, t('@name field is required.', array('@name' => $element['#title'])));
         return;
       }
     }
@@ -318,7 +318,7 @@ function webform_validate_time($element, $form_state) {
   // Check for a valid time. Allow a minute with no hour as "no time set".
   if ($element['hour']['#value'] !== '' ) {
     if (!is_numeric($element['hour']['#value']) || !is_numeric($element['minute']['#value']) || (isset($element['ampm']) && $element['ampm']['#value'] === '')) {
-      form_error($element, t('Entered !name is not a valid time.', array('!name' => $element['#title'])));
+      form_error($element, t('Entered @name is not a valid time.', array('@name' => $element['#title'])));
       return;
     }
 
diff --git a/includes/webform.components.inc b/includes/webform.components.inc
index 444618b..41225cc 100644
--- a/includes/webform.components.inc
+++ b/includes/webform.components.inc
@@ -315,8 +315,7 @@ function webform_components_form_validate($form, &$form_state) {
         $items[] = webform_filter_xss($form['#node']->webform['components'][$cid]['name']);
       }
     }
-
-    form_error($form['components'], $error . theme('item_list', array('items' => $items)));
+    form_error($form['components'], t($error . theme('item_list', array('items' => $items))));
   }
 }
 
diff --git a/includes/webform.conditionals.inc b/includes/webform.conditionals.inc
index f6abf7f..e78355e 100644
--- a/includes/webform.conditionals.inc
+++ b/includes/webform.conditionals.inc
@@ -81,7 +81,7 @@ function webform_conditionals_form($form, &$form_state, $node) {
     );
     $form['conditionals'][$rgid]['weight'] = array(
       '#type' => 'weight',
-      '#title' => t('Weight for rule group !rgid', array('!rgid' => $rgid)),
+      '#title' => t('Weight for rule group @rgid', array('@rgid' => $rgid)),
       '#title_display' => 'invisible',
       '#default_value' => $weight,
       '#delta' => $delta,
diff --git a/includes/webform.emails.inc b/includes/webform.emails.inc
index b6c8d4f..78c41c9 100644
--- a/includes/webform.emails.inc
+++ b/includes/webform.emails.inc
@@ -235,7 +235,7 @@ function webform_email_edit_form($form, $form_state, $node, $email = array(), $c
     }
 
     $form[$field . '_option'] = array(
-      '#title' => $title,
+      '#title' => t($title),
       '#type' => 'radios',
       '#default_value' => is_numeric($email[$field]) ? 'component' : ((empty($default_value) || ($email[$field] != 'default' && isset($email[$field]))) ? 'custom' : 'default'),
       '#description' => $description,
diff --git a/includes/webform.report.inc b/includes/webform.report.inc
index 71fb469..c77ff10 100644
--- a/includes/webform.report.inc
+++ b/includes/webform.report.inc
@@ -1447,7 +1447,7 @@ function webform_results_batch_results($node, $format, $options, &$context) {
 function webform_results_batch_finished($success, $results, $operations) {
   if ($success) {
     $download_url = url('node/' . $results['node']->nid . '/webform-results/download-file');
-    drupal_set_message(t('Export creation complete. Your download should begin now. If it does not start, <a href="!href">download the file here</a>. This file may only be downloaded once.', array('!href' => $download_url)));
+    drupal_set_message(t('Export creation complete. Your download should begin now. If it does not start, <a href="@href">download the file here</a>. This file may only be downloaded once.', array('@href' => $download_url)));
   }
   else {
     drupal_set_message(t('An error occurred while generating the export file.'));
diff --git a/includes/webform.submissions.inc b/includes/webform.submissions.inc
index 3d2fcee..aee4800 100644
--- a/includes/webform.submissions.inc
+++ b/includes/webform.submissions.inc
@@ -321,7 +321,10 @@ function webform_submission_send_mail($node, $submission, $emails = NULL) {
     foreach ($addresses_final as $address) {
       if (_webform_submission_spam_check($address, $email['subject'], $email['from'], $email['headers'])) {
         watchdog('webform', 'Possible spam attempt from @remote !message',
-                 array('@remote' => ip_address(), '!message'=> "<br />\n" . nl2br(htmlentities($email['message']))));
+                 array(
+                   '@remote' => ip_address(),
+                   '!message' => "<br />\n" . nl2br(htmlentities($email['message'])),
+                   ));
         drupal_set_message(t('Illegal information. Data not submitted.'), 'error');
         return FALSE;
       }
diff --git a/includes/webform.webformconditionals.inc b/includes/webform.webformconditionals.inc
index 963b369..996b81f 100644
--- a/includes/webform.webformconditionals.inc
+++ b/includes/webform.webformconditionals.inc
@@ -322,7 +322,8 @@ class WebformConditionals {
       $this->setMap = $this->requiredMap;
       $this->markupMap = $this->requiredMap;
 
-    } else {
+    } 
+    else {
       array_walk($this->visibilityMap[$page_num], function (&$status) {
         $status = WebformConditionals::componentShown;
       });
@@ -414,7 +415,8 @@ class WebformConditionals {
               if ($action_result && empty($targetLocked[$target])) {
                 if ($components[$target]['type'] == 'markup') {
                   $this->markupMap[$page_num][$target] = $action['argument'];
-                } else {
+                } 
+                else {
                   $input_values[$target] = isset($input_values[$target]) && is_array($input_values[$target])
                                               ? array($action['argument'])
                                               : $action['argument'];
@@ -469,7 +471,8 @@ class WebformConditionals {
     $result = self::componentHidden;
     if ($page_num == 1 || empty($this->visibilityMap[$page_num])) {
       $result = self::componentShown;
-    } elseif (($page_map = $this->pageMap[$page_num]) && $this->componentVisibility(reset($page_map), $page_num)) {
+    } 
+    elseif (($page_map = $this->pageMap[$page_num]) && $this->componentVisibility(reset($page_map), $page_num)) {
       while ($cid = next($page_map)) {
         if ($this->componentVisibility($cid, $page_num) != self::componentHidden) {
           $result = self::componentShown;
diff --git a/js/webform-admin.js b/js/webform-admin.js
index 3fd774c..4b7d1b3 100644
--- a/js/webform-admin.js
+++ b/js/webform-admin.js
@@ -14,7 +14,7 @@
     Drupal.webform.updateTemplate(context);
     // Update the template select list upon changing a template.
     // Select all link for file extensions.
-    Drupal.webform.selectCheckboxesLink(context);
+    Drupal.webform.select_checkboxesLink(context);
     // Enhance the normal tableselect.js file to support indentations.
     Drupal.webform.tableSelectIndentation(context);
     // Automatically download exports if available.
@@ -51,22 +51,22 @@
   // Update e-mail templates between default and custom.
   Drupal.webform.updateTemplate = function (context) {
     var defaultTemplate = $('#edit-templates-default').val();
-    var $templateSelect = $('#webform-template-fieldset select#edit-template-option', context);
-    var $templateTextarea = $('#webform-template-fieldset textarea:visible', context);
+    var $template_select = $('#webform-template-fieldset select#edit-template-option', context);
+    var $template_textarea = $('#webform-template-fieldset textarea:visible', context);
 
     var updateTemplateSelect = function () {
       if ($(this).val() == defaultTemplate) {
-        $templateSelect.val('default');
+        $template_select.val('default');
       }
       else {
-        $templateSelect.val('custom');
+        $template_select.val('custom');
       }
     };
 
     var updateTemplateText = function () {
-      if ($(this).val() == 'default' && $templateTextarea.val() != defaultTemplate) {
+      if ($(this).val() == 'default' && $template_textarea.val() != defaultTemplate) {
         if (confirm(Drupal.settings.webform.revertConfirm)) {
-          $templateTextarea.val(defaultTemplate);
+          $template_textarea.val(defaultTemplate);
         }
         else {
           $(this).val('custom');
@@ -74,12 +74,12 @@
       }
     };
 
-    $templateTextarea.keyup(updateTemplateSelect);
-    $templateSelect.change(updateTemplateText);
+    $template_textarea.keyup(updateTemplateSelect);
+    $template_select.change(updateTemplateText);
   };
 
-  Drupal.webform.selectCheckboxesLink = function (context) {
-    function selectCheckboxes() {
+  Drupal.webform.select_checkboxesLink = function (context) {
+    function select_checkboxes() {
       var group = this.className.replace(/.*?webform-select-link-([^ ]*).*/, '$1');
       var $checkboxes = $('.webform-select-group-' + group + ' input[type=checkbox]');
       var reverseCheck = !$checkboxes[0].checked;
@@ -89,7 +89,7 @@
       $checkboxes.trigger('change');
       return false;
     }
-    $('a.webform-select-link', context).click(selectCheckboxes);
+    $('a.webform-select-link', context).click(select_checkboxes);
   };
 
   Drupal.webform.tableSelectIndentation = function (context) {
@@ -183,10 +183,10 @@
     // See if there are any remaining rules in this element.
     var rowCount = $(this).parents('.webform-conditional:first').find(this.webformRemoveClass).length;
     if (rowCount <= 1) {
-      var $tableRow = $(this).parents('tr:first');
+      var $table_row = $(this).parents('tr:first');
       var $table = $('#webform-conditionals-table');
-      if ($tableRow.length && $table.length) {
-        $tableRow.remove();
+      if ($table_row.length && $table.length) {
+        $table_row.remove();
         Drupal.webform.restripeTable($table[0]);
       }
     }
@@ -207,9 +207,9 @@
     }
 
     // Reference the original list to create a new list matching the data type.
-    var $originalList = $($operator[0]['webformConditionalOriginal']);
-    var $newList = $originalList.filter('optgroup[label=' + dataType + ']');
-    var newHTML = $newList[0].innerHTML;
+    var $original_list = $($operator[0]['webformConditionalOriginal']);
+    var $new_list = $original_list.filter('optgroup[label=' + dataType + ']');
+    var newhtml = $new_list[0].innerHTML;
 
     // Update the options and fire the change event handler on the list to update
     // the value field, only if the options have changed. This avoids resetting
@@ -273,11 +273,11 @@
     }
 
     // Set the name attribute to match the original placeholder field.
-    var $firstElement = $value.find('input, select, textarea').filter(':first');
-    $firstElement.attr('name', name);
+    var $first_element = $value.find('input, select, textarea').filter(':first');
+    $first_element.attr('name', name);
 
     if (originalValue) {
-      $firstElement.val(originalValue);
+      $first_element.val(originalValue);
     }
   };
 
diff --git a/js/webform.js b/js/webform.js
index 92e7b79..5235e06 100644
--- a/js/webform.js
+++ b/js/webform.js
@@ -23,8 +23,8 @@
 
   Drupal.webform.datepicker = function (context) {
     $('div.webform-datepicker').each(function () {
-      var $webformDatepicker = $(this);
-      var $calendar = $webformDatepicker.find('input.webform-calendar');
+      var $webform_datepicker = $(this);
+      var $calendar = $webform_datepicker.find('input.webform-calendar');
 
       // Ensure the page we're on actually contains a datepicker.
       if ($calendar.length == 0) {
@@ -57,15 +57,15 @@
         maxDate: endDate,
         onSelect: function (dateText, inst) {
           var date = dateText.split('-');
-          $webformDatepicker.find('select.year, input.year').val(+date[0]).trigger('change');
-          $webformDatepicker.find('select.month').val(+date[1]).trigger('change');
-          $webformDatepicker.find('select.day').val(+date[2]).trigger('change');
+          $webform_datepicker.find('select.year, input.year').val(+date[0]).trigger('change');
+          $webform_datepicker.find('select.month').val(+date[1]).trigger('change');
+          $webform_datepicker.find('select.day').val(+date[2]).trigger('change');
         },
         beforeShow: function (input, inst) {
           // Get the select list values.
-          var year = $webformDatepicker.find('select.year, input.year').val();
-          var month = $webformDatepicker.find('select.month').val();
-          var day = $webformDatepicker.find('select.day').val();
+          var year = $webform_datepicker.find('select.year, input.year').val();
+          var month = $webform_datepicker.find('select.month').val();
+          var day = $webform_datepicker.find('select.day').val();
 
           // If empty, default to the current year/month/day in the popup.
           var today = new Date();
@@ -95,9 +95,9 @@
     $.each(Drupal.settings.webform.conditionals, function (formKey, settings) {
       var $form = $('.' + formKey + ':not(.webform-conditional-processed)');
       $form.each(function (index, currentForm) {
-        var $currentForm = $(currentForm);
-        $currentForm.addClass('webform-conditional-processed');
-        $currentForm.bind('change', {'settings': settings}, Drupal.webform.conditionalCheck);
+        var $current_form = $(currentForm);
+        $current_form.addClass('webform-conditional-processed');
+        $current_form.bind('change', {'settings': settings}, Drupal.webform.conditionalCheck);
 
         // Trigger all the elements that cause conditionals on this form.
         Drupal.webform.doConditions($form, settings);
@@ -111,9 +111,9 @@
    * This event is bound to the entire form, not individual fields.
    */
   Drupal.webform.conditionalCheck = function (e) {
-    var $triggerElement = $(e.target).closest('.webform-component');
-    var $form = $triggerElement.closest('form');
-    var triggerElementKey = $triggerElement.attr('class').match(/webform-component--[^ ]+/)[0];
+    var $trigger_element = $(e.target).closest('.webform-component');
+    var $form = $trigger_element.closest('form');
+    var triggerElementKey = $trigger_element.attr('class').match(/webform-component--[^ ]+/)[0];
     var settings = e.data.settings;
     if (settings.sourceMap[triggerElementKey]) {
       Drupal.webform.doConditions($form, settings);
@@ -162,10 +162,10 @@
         switch (action['action']) {
           case 'show':
             if (actionResult != Drupal.webform.isVisible($target)) {
-              var $targetElements = actionResult
+              var $target_elements = actionResult
                                       ? $target.find('.webform-conditional-disabled').removeClass('webform-conditional-disabled')
                                       : $target.find(':input').addClass('webform-conditional-disabled');
-              $targetElements.webformProp('disabled', !actionResult);
+              $target_elements.webformProp('disabled', !actionResult);
               $target.toggleClass('webform-conditional-hidden', !actionResult);
               if (actionResult) {
                 $target.show();
@@ -178,21 +178,21 @@
             }
             break;
           case 'require':
-            var $requiredSpan = $target.find('.form-required, .form-optional').first();
-            if (actionResult != $requiredSpan.hasClass('form-required')) {
-              var $targetInputElements = $target.find("input:text,textarea,input[type='email'],select,input:radio,input:file");
+            var $required_span = $target.find('.form-required, .form-optional').first();
+            if (actionResult != $required_span.hasClass('form-required')) {
+              var $target_input_elements = $target.find("input:text,textarea,input[type='email'],select,input:radio,input:file");
               // Rather than hide the required tag, remove it so that other jQuery can respond via Drupal behaviors.
-              Drupal.detachBehaviors($requiredSpan);
-              $targetInputElements
+              Drupal.detachBehaviors($required_span);
+              $target_input_elements
                 .webformProp('required', actionResult)
                 .toggleClass('required', actionResult);
               if (actionResult) {
-                $requiredSpan.replaceWith('<span class="form-required" title="' + Drupal.t('This field is required.') + '">*</span>');
+                $required_span.replaceWith('<span class="form-required" title="' + Drupal.t('This field is required.') + '">*</span>');
               }
               else {
-                $requiredSpan.replaceWith('<span class="form-optional"></span>');
+                $required_span.replaceWith('<span class="form-optional"></span>');
               }
-              Drupal.attachBehaviors($requiredSpan);
+              Drupal.attachBehaviors($required_span);
             }
             break;
           case 'set':
diff --git a/webform.module b/webform.module
index b21b212..62a833b 100644
--- a/webform.module
+++ b/webform.module
@@ -2259,7 +2259,8 @@ function webform_block_view($delta = '') {
         '#node' => $node,
         '#sid' => $_SESSION['webform_confirmation'][$nid]['sid'],
       );
-    } elseif (strlen(trim(strip_tags($node->webform['confirmation'])))) {
+    } 
+    elseif (strlen(trim(strip_tags($node->webform['confirmation'])))) {
       // Display confirmation link drupal status messages, but in the block.
       $message = webform_replace_tokens($node->webform['confirmation'],
                                         $node,
@@ -2991,12 +2992,12 @@ function _webform_client_form_validate(&$elements, &$form_state, $form_id = NULL
       // length if it's a string, and the item count if it's an array. For
       // radios, FALSE means that no value was submitted, so check that too.
       if ($elements['#required'] && (!count($elements['#value']) || (is_string($elements['#value']) && strlen(trim($elements['#value'])) == 0) || $elements['#value'] === FALSE)) {
-        form_error($elements, t('!name field is required.', array('!name' => $elements['#title'])));
+        form_error($elements, t('@name field is required.', array('@name' => filter_xss($elements['#title']))));
       }
 
       // Verify that the value is not longer than #maxlength.
       if (isset($elements['#maxlength']) && drupal_strlen($elements['#value']) > $elements['#maxlength']) {
-        form_error($elements, t('!name cannot be longer than %max characters but is currently %length characters long.', array('!name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title'], '%max' => $elements['#maxlength'], '%length' => drupal_strlen($elements['#value']))));
+        form_error($elements, t('@name cannot be longer than @max characters but is currently @length characters long.', array('@name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title'], '@max' => filter_xss($elements['#maxlength']), '@length' => drupal_strlen($elements['#value']))));
       }
 
       if (isset($elements['#options']) && isset($elements['#value'])) {
@@ -3011,13 +3012,13 @@ function _webform_client_form_validate(&$elements, &$form_state, $form_id = NULL
           foreach ($value as $v) {
             if (!isset($options[$v])) {
               form_error($elements, t('An illegal choice has been detected. Please contact the site administrator.'));
-              watchdog('form', 'Illegal choice %choice in !name element.', array('%choice' => $v, '!name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title']), WATCHDOG_ERROR);
+              watchdog('form', 'Illegal choice @choice in !name element.', array('@choice' => $v, '@name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title']), WATCHDOG_ERROR);
             }
           }
         }
         elseif ($elements['#value'] !== '' && !isset($options[$elements['#value']])) {
           form_error($elements, t('An illegal choice has been detected. Please contact the site administrator.'));
-          watchdog('form', 'Illegal choice %choice in %name element.', array('%choice' => $elements['#value'], '%name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title']), WATCHDOG_ERROR);
+          watchdog('form', 'Illegal choice @choice in @name element.', array('@choice' => $elements['#value'], '@name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title']), WATCHDOG_ERROR);
         }
       }
     }
@@ -3364,9 +3365,8 @@ function webform_client_form_submit($form, &$form_state) {
   }
   // If redirecting and we have a confirmation message, show it as a message.
   elseif ($message) {
-    drupal_set_message(webform_replace_tokens($node->webform['confirmation'], $node, $submission, NULL, $node->webform['confirmation_format']));
+    drupal_set_message(filter_xss(webform_replace_tokens($node->webform['confirmation'], $node, $submission, NULL, $node->webfor['confirmation_format'])));
   }
-
   $form_state['redirect'] = $redirect;
 }
 
