diff --git a/resources/mail/account_deletion_request_admin.php b/resources/mail/account_deletion_request_admin.php
index 6d8fde1ad..440324da2 100644
--- a/resources/mail/account_deletion_request_admin.php
+++ b/resources/mail/account_deletion_request_admin.php
@@ -8,9 +8,9 @@
 <p>A user has requested deletion of their account. User details are below:</p>
 
 <p>
-    <strong>Username</strong> <?php echo $data["user"]; ?>
+    <strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
     <br>
-    <strong>Name</strong> <?php echo $data["name"]; ?>
+    <strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
     <br>
-    <strong>Email</strong> <?php echo $data["email"]; ?>
+    <strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
diff --git a/resources/mail/account_deletion_request_cancelled_admin.php b/resources/mail/account_deletion_request_cancelled_admin.php
index 39f105fbe..869c271ef 100644
--- a/resources/mail/account_deletion_request_cancelled_admin.php
+++ b/resources/mail/account_deletion_request_cancelled_admin.php
@@ -7,9 +7,9 @@
 <p>A user has cancelled their request for account deletion. User details are below:</p>
 
 <p>
-    <strong>Username</strong> <?php echo $data["user"]; ?>
+    <strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
     <br>
-    <strong>Name</strong> <?php echo $data["name"]; ?>
+    <strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
     <br>
-    <strong>Email</strong> <?php echo $data["email"]; ?>
+    <strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
diff --git a/resources/mail/group_disband.php b/resources/mail/group_disband.php
index f40129767..fd1c67d4b 100644
--- a/resources/mail/group_disband.php
+++ b/resources/mail/group_disband.php
@@ -5,7 +5,7 @@
 
 <p>Hello,</p>
 
-<p>Your PI group, <?php echo $data["group_name"]; ?>, has been disbanded on the UnityHPC Platform.
+<p>Your PI group, <?php echo htmlspecialchars($data["group_name"]); ?>, has been disbanded on the UnityHPC Platform.
 Any jobs associated with this PI account have been killed.</p>
 
 <p>If you believe this to be a mistake, please reply to this email</p>
diff --git a/resources/mail/group_join_request_cancelled.php b/resources/mail/group_join_request_cancelled.php
index 90119b807..e61b3a618 100644
--- a/resources/mail/group_join_request_cancelled.php
+++ b/resources/mail/group_join_request_cancelled.php
@@ -1,4 +1,4 @@
 <?php
 $this->Subject = "Unity PI Membership Request Cancelled: '" . $data["uid"] . "'"; ?>
 <p>Hello,</p>
-<p>The user '<?php echo $data["uid"]; ?>' has cancelled their request to join your PI group.</p>
+<p>The user '<?php echo htmlspecialchars($data["uid"]); ?>' has cancelled their request to join your PI group.</p>
diff --git a/resources/mail/group_request_admin.php b/resources/mail/group_request_admin.php
index 0dfd82011..41eda93a1 100644
--- a/resources/mail/group_request_admin.php
+++ b/resources/mail/group_request_admin.php
@@ -8,13 +8,13 @@
 <p>A user has requested a PI account. User details are below:</p>
 
 <p>
-    <strong>Username</strong> <?php echo $data["user"]; ?>
+    <strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
     <br>
-    <strong>Organization</strong> <?php echo $data["org"]; ?>
+    <strong>Organization</strong> <?php echo htmlspecialchars($data["org"]); ?>
     <br>
-    <strong>Name</strong> <?php echo $data["name"]; ?>
+    <strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
     <br>
-    <strong>Email</strong> <?php echo $data["email"]; ?>
+    <strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
 
 <p>
diff --git a/resources/mail/group_request_cancelled.php b/resources/mail/group_request_cancelled.php
index 1af2e8bba..324a5f941 100644
--- a/resources/mail/group_request_cancelled.php
+++ b/resources/mail/group_request_cancelled.php
@@ -1,4 +1,4 @@
 <?php
 $this->Subject = "PI Request Cancelled: '" . $data["uid"] . "'"; ?>
 <p>Hello,</p>
-<p>The user '<?php echo $data["uid"]; ?>' has cancelled their request to become a PI.</p>
+<p>The user '<?php echo htmlspecialchars($data["uid"]); ?>' has cancelled their request to become a PI.</p>
diff --git a/resources/mail/group_user_added.php b/resources/mail/group_user_added.php
index 1fb9d6bde..7396206f1 100644
--- a/resources/mail/group_user_added.php
+++ b/resources/mail/group_user_added.php
@@ -5,7 +5,7 @@
 
 <p>Hello,</p>
 
-<p>You have been approved to join the PI group <?php echo $data["group"]; ?>.
+<p>You have been approved to join the PI group <?php echo htmlspecialchars($data["group"]); ?>.
 Navigate to the <?php echo getHyperlink("my groups", "panel/groups.php"); ?>
 page to see your PI groups.</p>
 
diff --git a/resources/mail/group_user_added_owner.php b/resources/mail/group_user_added_owner.php
index a082f30eb..371b5b9d7 100644
--- a/resources/mail/group_user_added_owner.php
+++ b/resources/mail/group_user_added_owner.php
@@ -7,18 +7,18 @@
 
 <p>
 A new user has been added to your PI group,
-'<?php echo $data["group"]; ?>'.
+'<?php echo htmlspecialchars($data["group"]); ?>'.
 The details of the new user are below:
 </p>
 
 <p>
-<strong>Username</strong> <?php echo $data["user"]; ?>
+<strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
 <br>
-<strong>Organization</strong> <?php echo $data["org"]; ?>
+<strong>Organization</strong> <?php echo htmlspecialchars($data["org"]); ?>
 <br>
-<strong>Name</strong> <?php echo $data["name"]; ?>
+<strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
 <br>
-<strong>Email</strong> <?php echo $data["email"]; ?>
+<strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
 
 <p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
diff --git a/resources/mail/group_user_denied.php b/resources/mail/group_user_denied.php
index 8e1f2ae0c..fcfb602bd 100644
--- a/resources/mail/group_user_denied.php
+++ b/resources/mail/group_user_denied.php
@@ -5,6 +5,6 @@
 
 <p>Hello,</p>
 
-<p>You have been denied from joining the PI group <?php echo $data["group"]; ?>.</p>
+<p>You have been denied from joining the PI group <?php echo htmlspecialchars($data["group"]); ?>.</p>
 
 <p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
diff --git a/resources/mail/group_user_denied_owner.php b/resources/mail/group_user_denied_owner.php
index f98b161f2..d15d79e07 100644
--- a/resources/mail/group_user_denied_owner.php
+++ b/resources/mail/group_user_denied_owner.php
@@ -5,17 +5,17 @@
 
 <p>Hello,</p>
 
-<p>A user has been denied from joining your PI group, <?php echo $data["group"]; ?>.
+<p>A user has been denied from joining your PI group, <?php echo htmlspecialchars($data["group"]); ?>.
 The details of the denied user are below:</p>
 
 <p>
-<strong>Username</strong> <?php echo $data["user"]; ?>
+<strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
 <br>
-<strong>Organization</strong> <?php echo $data["org"]; ?>
+<strong>Organization</strong> <?php echo htmlspecialchars($data["org"]); ?>
 <br>
-<strong>Name</strong> <?php echo $data["name"]; ?>
+<strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
 <br>
-<strong>Email</strong> <?php echo $data["email"]; ?>
+<strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
 
 <p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
diff --git a/resources/mail/group_user_removed.php b/resources/mail/group_user_removed.php
index 83a1786e1..3c2a291a6 100644
--- a/resources/mail/group_user_removed.php
+++ b/resources/mail/group_user_removed.php
@@ -5,6 +5,6 @@
 
 <p>Hello,</p>
 
-<p>You have been removed from the PI group <?php echo $data["group"]; ?>.</p>
+<p>You have been removed from the PI group <?php echo htmlspecialchars($data["group"]); ?>.</p>
 
 <p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
diff --git a/resources/mail/group_user_removed_owner.php b/resources/mail/group_user_removed_owner.php
index 2cff0e54c..5c798a586 100644
--- a/resources/mail/group_user_removed_owner.php
+++ b/resources/mail/group_user_removed_owner.php
@@ -7,18 +7,18 @@
 
 <p>
 A user has been removed from your PI group,
-'<?php echo $data["group"]; ?>'.
+'<?php echo htmlspecialchars($data["group"]); ?>'.
 The details of the removed user are below:
 </p>
 
 <p>
-<strong>Username</strong> <?php echo $data["user"]; ?>
+<strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
 <br>
-<strong>Organization</strong> <?php echo $data["org"]; ?>
+<strong>Organization</strong> <?php echo htmlspecialchars($data["org"]); ?>
 <br>
-<strong>Name</strong> <?php echo $data["name"]; ?>
+<strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
 <br>
-<strong>Email</strong> <?php echo $data["email"]; ?>
+<strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
 
 <p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
diff --git a/resources/mail/group_user_request.php b/resources/mail/group_user_request.php
index ad40d215c..7bbbb2018 100644
--- a/resources/mail/group_user_request.php
+++ b/resources/mail/group_user_request.php
@@ -5,6 +5,6 @@
 
 <p>Hello,</p>
 
-<p>You have requested to join the group <?php echo $data["group"]; ?>.</p>
+<p>You have requested to join the group <?php echo htmlspecialchars($data["group"]); ?>.</p>
 
 <p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
diff --git a/resources/mail/group_user_request_owner.php b/resources/mail/group_user_request_owner.php
index b2db8638a..cff157d9d 100644
--- a/resources/mail/group_user_request_owner.php
+++ b/resources/mail/group_user_request_owner.php
@@ -7,18 +7,18 @@
 
 <p>
 A user has requested to join your PI group,
-'<?php echo $data["group"]; ?>'.
+'<?php echo htmlspecialchars($data["group"]); ?>'.
 The details of the user are below:
 </p>
 
 <p>
-<strong>Username</strong> <?php echo $data["user"]; ?>
+<strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
 <br>
-<strong>Organization</strong> <?php echo $data["org"]; ?>
+<strong>Organization</strong> <?php echo htmlspecialchars($data["org"]); ?>
 <br>
-<strong>Name</strong> <?php echo $data["name"]; ?>
+<strong>Name</strong> <?php echo htmlspecialchars($data["name"]); ?>
 <br>
-<strong>Email</strong> <?php echo $data["email"]; ?>
+<strong>Email</strong> <?php echo htmlspecialchars($data["email"]); ?>
 </p>
 
 <p>You can approve or deny this user on the
diff --git a/resources/mail/user_flag_added.php b/resources/mail/user_flag_added.php
index 268d0e44f..d71ebe153 100644
--- a/resources/mail/user_flag_added.php
+++ b/resources/mail/user_flag_added.php
@@ -5,9 +5,9 @@
 <p>Hello,</p>
 <p>Your account on the UnityHPC Platform has been activated. Your account details are below:</p>
 <p>
-<strong>Username</strong> <?php echo $data["user"]; ?>
+<strong>Username</strong> <?php echo htmlspecialchars($data["user"]); ?>
 <br>
-<strong>Organization</strong> <?php echo $data["org"]; ?>
+<strong>Organization</strong> <?php echo htmlspecialchars($data["org"]); ?>
 </p>
 <p>
 See the
diff --git a/resources/mail/user_flag_added_admin.php b/resources/mail/user_flag_added_admin.php
index 3a40153e9..41ee2dc79 100644
--- a/resources/mail/user_flag_added_admin.php
+++ b/resources/mail/user_flag_added_admin.php
@@ -3,35 +3,35 @@
 case UserFlag::QUALIFIED: ?>
 <?php $this->Subject = "User Qualified"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been qualified. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been qualified. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::GHOST: ?>
 <?php $this->Subject = "User Ghosted"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been marked as ghost. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been marked as ghost. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::LOCKED: ?>
 <?php $this->Subject = "User Locked"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been locked. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been locked. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::IDLELOCKED: ?>
 <?php $this->Subject = "User Idle Locked"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been idle locked. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been idle locked. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::ADMIN: ?>
 <?php $this->Subject = "User Promoted"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been promoted to admin. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been promoted to admin. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
diff --git a/resources/mail/user_flag_removed_admin.php b/resources/mail/user_flag_removed_admin.php
index 9df4d136c..09fce452c 100644
--- a/resources/mail/user_flag_removed_admin.php
+++ b/resources/mail/user_flag_removed_admin.php
@@ -3,35 +3,35 @@
 case UserFlag::QUALIFIED: ?>
 <?php $this->Subject = "User Dequalified"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been dequalified. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been dequalified. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::GHOST: ?>
 <?php $this->Subject = "User Resurrected"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been resurrected (no longer marked as ghost). </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been resurrected (no longer marked as ghost). </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::LOCKED: ?>
 <?php $this->Subject = "User Unlocked"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been unlocked. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been unlocked. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::IDLELOCKED: ?>
 <?php $this->Subject = "User Idle Unlocked"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been idle unlocked. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been idle unlocked. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
 <?php case UserFlag::ADMIN: ?>
 <?php $this->Subject = "User Demoted"; ?>
 <p>Hello,</p>
-<p>User "<?php echo $data["user"] ?>" has been demoted from admin. </p>
+<p>User "<?php echo htmlspecialchars($data["user"]) ?>" has been demoted from admin. </p>
 <?php break; ?>
 
 <?php /////////////////////////////////////////////////////////////////////////////////////////// ?>
diff --git a/resources/mail/user_loginshell.php b/resources/mail/user_loginshell.php
index a86e82088..8d42026f5 100644
--- a/resources/mail/user_loginshell.php
+++ b/resources/mail/user_loginshell.php
@@ -5,7 +5,7 @@
 
 <p>Hello,</p>
 
-<p>You have updated your login shell on the UnityHPC Platform to <?php echo $data["new_shell"]; ?>.
+<p>You have updated your login shell on the UnityHPC Platform to <?php echo htmlspecialchars($data["new_shell"]); ?>.
 You can view the login shell settings on the
 <?php echo getHyperlink("account settings", "panel/account.php"); ?> page</p>
 
diff --git a/resources/mail/user_sshkey.php b/resources/mail/user_sshkey.php
index 8ec90a860..c8f78f5ca 100644
--- a/resources/mail/user_sshkey.php
+++ b/resources/mail/user_sshkey.php
@@ -10,7 +10,7 @@
 </p>
 
 <?php foreach ($data["keys"] as $key) {
-    echo "<pre>$key</pre>";
+    echo "<pre>" . htmlspecialchars($key) . "</pre>";
 } ?>
 
 <p>
diff --git a/webroot/admin/ajax/get_group_members.php b/webroot/admin/ajax/get_group_members.php
index 7d0dbde8e..a6312d032 100644
--- a/webroot/admin/ajax/get_group_members.php
+++ b/webroot/admin/ajax/get_group_members.php
@@ -26,11 +26,14 @@
     } else {
         echo "<tr class='expanded $i'>";
     }
-    $fullname = $attributes["gecos"][0];
-    $mail = $attributes["mail"][0];
-    echo "<td>$fullname</td>";
-    echo "<td>$uid</td>";
-    echo "<td><a href='mailto:$mail'>$mail</a></td>";
+    $uid_escaped = htmlspecialchars($uid);
+    $gecos = htmlspecialchars($attributes["gecos"][0]);
+    $mail_link = "mailto:" . urlencode($attributes["mail"][0]);
+    $mail_display = htmlspecialchars($attributes["mail"][0]);
+    $gid_escaped = htmlspecialchars($group->gid);
+    echo "<td>$gecos</td>";
+    echo "<td>$uid_escaped</td>";
+    echo "<td><a href='$mail_link'>$mail_display</a></td>";
     echo "<td>";
     $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo "
@@ -38,13 +41,13 @@
             action=''
             method='POST'
             onsubmit='
-                return confirm(\"Are you sure you want to remove $uid from this group?\");
+                return confirm(\"Are you sure you want to remove $uid_escaped from this group?\");
             '
         >
         $CSRFTokenHiddenFormInput
         <input type='hidden' name='form_type' value='remUserChild'>
-        <input type='hidden' name='uid' value='$uid'>
-        <input type='hidden' name='pi' value='$group->gid'>
+        <input type='hidden' name='uid' value='$uid_escaped'>
+        <input type='hidden' name='pi' value='$gid_escaped'>
         <input type='submit' value='Remove'>
         </form>
     ";
@@ -59,20 +62,23 @@
     } else {
         echo "<tr class='expanded $i'>";
     }
-    $name = $user->getFullName();
-    $email = $user->getMail();
-    echo "<td>$name</td>";
-    echo "<td>$user->uid</td>";
-    echo "<td><a href='mailto:$email'>$email</a></td>";
+    $gecos = htmlspecialchars($user->getFullName());
+    $uid_escaped = htmlspecialchars($user->uid);
+    $mail_link = "mailto:" . urlencode($user->getMail());
+    $mail_display = htmlspecialchars($user->getMail());
+    $gid_escaped = htmlspecialchars($group->gid);
+    echo "<td>$gecos</td>";
+    echo "<td>$uid_escaped</td>";
+    echo "<td><a href='$mail_link'>$mail_display</a></td>";
     echo "<td>";
     $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo
         "<form action='' method='POST'
-    onsubmit='return confirm(\"Are you sure you want to approve $user->uid ?\");'>
+    onsubmit='return confirm(\"Are you sure you want to approve $uid_escaped ?\");'>
     $CSRFTokenHiddenFormInput
     <input type='hidden' name='form_type' value='reqChild'>
-    <input type='hidden' name='uid' value='$user->uid'>
-    <input type='hidden' name='pi' value='$group->gid'>
+    <input type='hidden' name='uid' value='$uid_escaped'>
+    <input type='hidden' name='pi' value='$gid_escaped'>
     <input type='submit' name='action' value='Approve'>
     <input type='submit' name='action' value='Deny'></form>";
     echo "</td>";
diff --git a/webroot/admin/pi-mgmt.php b/webroot/admin/pi-mgmt.php
index 135a10310..0adfa3f0c 100644
--- a/webroot/admin/pi-mgmt.php
+++ b/webroot/admin/pi-mgmt.php
@@ -69,14 +69,15 @@
     $requests = $SQL->getRequests(UnitySQL::REQUEST_BECOME_PI);
 
     foreach ($requests as $request) {
-        $uid = $request["uid"];
-        $request_user = new UnityUser($uid, $LDAP, $SQL, $MAILER, $WEBHOOK);
-        $name = $request_user->getFullname();
-        $email = $request_user->getMail();
+        $request_user = new UnityUser($request["uid"], $LDAP, $SQL, $MAILER, $WEBHOOK);
+        $uid = htmlspecialchars($request["uid"]);
+        $gecos = htmlspecialchars($request_user->getFullname());
+        $mail_link = "mailto:" . urlencode($request_user->getMail());
+        $mail_display = htmlspecialchars($request_user->getMail());
         echo "<tr>";
-        echo "<td>$name</td>";
+        echo "<td>$gecos</td>";
         echo "<td>$uid</td>";
-        echo "<td><a href='mailto:$email'>$email</a></td>";
+        echo "<td><a href='$mail_link'>$mail_display</a></td>";
         echo "<td>" . date("jS F, Y", strtotime($request['timestamp'])) . "</td>";
         echo "<td>";
         $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
@@ -123,11 +124,14 @@ class="filterSearch"
     );
     usort($owner_attributes, fn($a, $b) => strcmp($a["uid"][0], $b["uid"][0]));
     foreach ($owner_attributes as $attributes) {
-        $mail = $attributes["mail"][0];
+        $gecos = htmlspecialchars($attributes["gecos"][0]);
+        $gid = htmlspecialchars(UnityGroup::OwnerUID2GID($attributes["uid"][0]));
+        $mail_link = "mailto:" . urlencode($attributes["mail"][0]);
+        $mail_display = htmlspecialchars($attributes["mail"][0]);
         echo "<tr class='expandable'>";
-        echo "<td><button class='btnExpand'>&#9654;</button>" . $attributes["gecos"][0] . "</td>";
-        echo "<td>" . UnityGroup::OwnerUID2GID($attributes["uid"][0]) . "</td>";
-        echo "<td><a href='mailto:$mail'>$mail</a></td>";
+        echo "<td><button class='btnExpand'>&#9654;</button>$gecos</td>";
+        echo "<td>$gid</td>";
+        echo "<td><a href='$mail_link'>$mail_display</a></td>";
         echo "</tr>";
     }
     ?>
diff --git a/webroot/admin/user-mgmt.php b/webroot/admin/user-mgmt.php
index f327aa78f..68595ffa7 100644
--- a/webroot/admin/user-mgmt.php
+++ b/webroot/admin/user-mgmt.php
@@ -57,24 +57,25 @@ class="filterSearch"
     usort($user_attributes, fn ($a, $b) => strcmp($a["uid"][0], $b["uid"][0]));
     foreach ($user_attributes as $attributes) {
         $uid = $attributes["uid"][0];
+        $uid_escaped = htmlspecialchars($uid);
+        $gecos = htmlspecialchars($attributes["gecos"][0]);
+        $org = htmlspecialchars($attributes["o"][0]);
+        $mail_link = "mailto:" . urlencode($attributes["mail"][0]);
+        $mail_display = htmlspecialchars($attributes["mail"][0]);
         if ($SQL->accDeletionRequestExists($uid)) {
             echo "<tr style='color:grey; font-style: italic'>";
         } else {
             echo "<tr>";
         }
-        echo "<td>" . $attributes["gecos"][0] . "</td>";
-        echo "<td>" . $uid . "</td>";
-        echo "<td>" . $attributes["o"][0] . "</td>";
-        echo "
-            <td>
-                <a href='mailto:" . $attributes["mail"][0] . "'>" . $attributes["mail"][0] . "</a>
-            </td>
-        ";
+        echo "<td>$gecos</td>";
+        echo "<td>$uid_escaped</td>";
+        echo "<td>$org</td>";
+        echo "<td><a href='$mail_link'>$mail_display</a></td>";
         echo "<td>";
         if (count($UID2PIGIDs[$uid]) > 0) {
             echo "<table>";
             foreach ($UID2PIGIDs[$uid] as $gid) {
-                echo "<tr><td>$gid</td></tr>";
+                echo "<tr><td>" . htmlspecialchars($gid) . "</td></tr>";
             }
             echo "</table>";
         }
@@ -82,10 +83,10 @@ class="filterSearch"
         echo "<td>";
         $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
         echo "<form class='viewAsUserForm' action='' method='POST'
-        onsubmit='return confirm(\"Are you sure you want to switch to the user $uid?\");'>
+        onsubmit='return confirm(\"Are you sure you want to switch to the user $uid_escaped?\");'>
         $CSRFTokenHiddenFormInput
         <input type='hidden' name='form_type' value='viewAsUser'>
-        <input type='hidden' name='uid' value='$uid'>
+        <input type='hidden' name='uid' value='$uid_escaped'>
         <input type='submit' name='action' value='Access'>
         </form>";
         echo "</td>";
diff --git a/webroot/panel/ajax/get_group_members.php b/webroot/panel/ajax/get_group_members.php
index 15c0b08a8..669a95e0b 100644
--- a/webroot/panel/ajax/get_group_members.php
+++ b/webroot/panel/ajax/get_group_members.php
@@ -23,12 +23,14 @@
     } else {
         echo "<tr class='expanded $i'>";
     }
-    $fullname = $attributes["gecos"][0];
-    $mail = $attributes["mail"][0];
-    echo "<td>$fullname</td>";
-    echo "<td>$uid</td>";
-    echo "<td><a href='mailto:$mail'>$mail</a></td>";
-    echo "<td><input type='hidden' name='uid' value='$uid'></td>";
+    $uid_escaped = htmlspecialchars($uid);
+    $gecos = htmlspecialchars($attributes["gecos"][0]);
+    $mail_link = "mailto:" . urlencode($attributes["mail"][0]);
+    $mail_display = htmlspecialchars($attributes["mail"][0]);
+    echo "<td>$gecos</td>";
+    echo "<td>$uid_escaped</td>";
+    echo "<td><a href='$mail_link'>$mail_display</a></td>";
+    echo "<td><input type='hidden' name='uid' value='$uid_escaped'></td>";
     echo "</tr>";
     $i++;
 }
diff --git a/webroot/panel/groups.php b/webroot/panel/groups.php
index d1a791232..580c32fe1 100644
--- a/webroot/panel/groups.php
+++ b/webroot/panel/groups.php
@@ -98,18 +98,20 @@
             $WEBHOOK
         );
         $requested_owner = $requested_account->getOwner();
-        $full_name = $requested_owner->getFirstname() . " " . $requested_owner->getLastname();
-        $mail = $requested_owner->getMail();
+        $gecos = htmlspecialchars($requested_owner->getFullname());
+        $mail_link = "mailto:" . urlencode($requested_owner->getMail());
+        $mail_display = htmlspecialchars($requested_owner->getMail());
+        $gid = htmlspecialchars($requested_account->gid);
         echo "<tr class='pending_request'>";
-        echo "<td>$full_name</td>";
+        echo "<td>$gecos</td>";
         echo "<td>" . $requested_account->gid . "</td>";
-        echo "<td><a href='mailto:$mail'>$mail</a></td>";
+        echo "<td><a href='$mail_link'>$mail_display</a></td>";
         echo "<td>" . date("jS F, Y", strtotime($request['timestamp'])) . "</td>";
         echo "<td>";
         $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
         echo "<form action='' method='POST' id='cancelPI'>
             $CSRFTokenHiddenFormInput
-            <input type='hidden' name='pi' value='$requested_account->gid'>
+            <input type='hidden' name='pi' value='$gid'>
             <input type='hidden' name='form_type' value='cancelPIForm'>
             <input name='cancel' style='margin-top: 10px;' type='submit' value='Cancel Request'/>
             </form>";
@@ -146,23 +148,25 @@
 foreach ($PIGroupGIDs as $gid) {
     $group = new UnityGroup($gid, $LDAP, $SQL, $MAILER, $WEBHOOK);
     $owner = $group->getOwner();
-    $full_name = $owner->getFirstname() . " " . $owner->getLastname();
     if ($USER->uid == $owner->uid) {
         continue;
     }
-
+    $gecos = htmlspecialchars($owner->getFullname());
+    $gid_escaped = htmlspecialchars($group->gid);
+    $mail_link = "mailto:" . urlencode($owner->getMail());
+    $mail_display = htmlspecialchars($owner->getMail());
     echo "<tr class='expandable'>";
-    echo "<td><button class='btnExpand'>&#9654;</button>$full_name</td>";
-    echo "<td>" . $group->gid . "</td>";
-    echo "<td><a href='mailto:" . $owner->getMail() . "'>" . $owner->getMail() . "</a></td>";
+    echo "<td><button class='btnExpand'>&#9654;</button>$gecos</td>";
+    echo "<td>$gid_escaped</td>";
+    echo "<td><a href='$mail_link'>$mail_display</a></td>";
     $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo
         "<td>
     <form action='' method='POST'
-    onsubmit='return confirm(\"Are you sure you want to leave the PI group " . $group->gid . "?\")'>
+    onsubmit='return confirm(\"Are you sure you want to leave the PI group $gid_escaped?\")'>
     $CSRFTokenHiddenFormInput
     <input type='hidden' name='form_type' value='removePIForm'>
-    <input type='hidden' name='pi' value='" . $group->gid . "'>
+    <input type='hidden' name='pi' value='$gid_escaped'>
     <input type='submit' value='Leave Group'>
     </form>
     </td>";
diff --git a/webroot/panel/pi.php b/webroot/panel/pi.php
index fc031d647..c6375131d 100644
--- a/webroot/panel/pi.php
+++ b/webroot/panel/pi.php
@@ -57,14 +57,15 @@
     echo "<table>";
 
     foreach ($requests as [$user, $timestamp]) {
-        $uid = $user->uid;
-        $name = $user->getFullName();
-        $email = $user->getMail();
+        $uid = htmlspecialchars($user->uid);
+        $gecos = htmlspecialchars($user->getFullName());
+        $mail_link = "mailto:" . urlencode($user->getMail());
+        $mail_display = htmlspecialchars($user->getMail());
         $date = date("jS F, Y", strtotime($timestamp));
         echo "<tr>";
-        echo "<td>$name</td>";
+        echo "<td>$gecos</td>";
         echo "<td>$uid</td>";
-        echo "<td><a href='mailto:$email'>$email</a></td>";
+        echo "<td><a href='$mail_link'>$mail_display</a></td>";
         echo "<td>$date</td>";
         echo "<td>";
         $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
@@ -96,7 +97,10 @@
     if ($assoc->uid == $USER->uid) {
         continue;
     }
-
+    $uid = htmlspecialchars($assoc->uid);
+    $gecos = htmlspecialchars($assoc->getFullName());
+    $mail_link = "mailto:" . urlencode($assoc->getMail());
+    $mail_display = htmlspecialchars($assoc->getMail());
     echo "<tr>";
     echo "<td>";
     $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
@@ -114,9 +118,9 @@
     >
     </form>";
     echo "</td>";
-    echo "<td>" . $assoc->getFirstname() . " " . $assoc->getLastname() . "</td>";
-    echo "<td>" . $assoc->uid . "</td>";
-    echo "<td><a href='mailto:" . $assoc->getMail() . "'>" . $assoc->getMail() . "</a></td>";
+    echo "<td>$gecos</td>";
+    echo "<td>$uid</td>";
+    echo "<td><a href='$mail_link'>$mail_display</a></td>";
     echo "</tr>";
 }