diff --git a/htdocs/boutique/admin/boutique.php b/htdocs/boutique/admin/boutique.php
index 664a7041480eea631b7b19829c4a50a40dd6e118..ba6dc123bac1aeff391542ae3b094a7229d8a998 100644
--- a/htdocs/boutique/admin/boutique.php
+++ b/htdocs/boutique/admin/boutique.php
@@ -3,6 +3,7 @@
  * Copyright (C) 2004 Sebastien Di Cintio  <sdicintio@ressource-toi.org>
  * Copyright (C) 2004 Benoit Mortier       <benoit.mortier@opensides.be>
  * Copyright (C) 2006 Laurent Destailleur  <eldy@users.sourceforge.net>
+ * Copyright (C) 2012 Juanjo Menent		   <jmenent@2byte.es>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -39,17 +40,17 @@ if (!$user->admin) accessforbidden();
  * Actions
  */
 
-if ($_POST["save"])
+if (GETPOST('save','alpha'))
 {
 	$db->begin();
 
 	$i=0;
 
-	$i+=dolibarr_set_const($db,'OSC_DB_HOST',trim($_POST["oscommerce_dbhost"]),'chaine',0,'',$conf->entity);
-	$i+=dolibarr_set_const($db,'OSC_DB_NAME',trim($_POST["oscommerce_dbname"]),'chaine',0,'',$conf->entity);
-	$i+=dolibarr_set_const($db,'OSC_DB_USER',trim($_POST["oscommerce_dbuser"]),'chaine',0,'',$conf->entity);
-	$i+=dolibarr_set_const($db,'OSC_DB_PASS',trim($_POST["oscommerce_dbpass"]),'chaine',0,'',$conf->entity);
-	$i+=dolibarr_set_const($db,'OSC_DB_TABLE_PREFIX',trim($_POST["oscommerce_db_table_prefix"]),'chaine',0,'',$conf->entity);
+	$i+=dolibarr_set_const($db,'OSC_DB_HOST',trim(GETPOST('oscommerce_dbhost','alpha')),'chaine',0,'',$conf->entity);
+	$i+=dolibarr_set_const($db,'OSC_DB_NAME',trim(GETPOST('oscommerce_dbname','alpha')),'chaine',0,'',$conf->entity);
+	$i+=dolibarr_set_const($db,'OSC_DB_USER',trim(GETPOST('oscommerce_dbuser','alpha')),'chaine',0,'',$conf->entity);
+	$i+=dolibarr_set_const($db,'OSC_DB_PASS',trim(GETPOST('oscommerce_dbpass','alpha')),'chaine',0,'',$conf->entity);
+	$i+=dolibarr_set_const($db,'OSC_DB_TABLE_PREFIX',trim(GETPOST('oscommerce_db_table_prefix','alpha')),'chaine',0,'',$conf->entity);
 	$i+=dolibarr_set_const($db,'OSC_LANGUAGE_ID',1,'chaine',0,'',$conf->entity);
 
 	if ($i >= 4)
@@ -64,18 +65,18 @@ if ($_POST["save"])
 		exit;
 	}
 }
-elseif ($_POST["test"])
+elseif (GETPOST('test','alpha'))
 {
 	//$resql=$db->query("select count(*) from ".MAIN_DB_PREFIX."const");
 	//print "< ".$db." - ".$db->db." - ".$resql." - ".$db->error()."><br>\n";
 
 	// Test de la connexion a la database webcalendar
 	$conf->oscommerce->db->type=$dolibarr_main_db_type;
-	$conf->oscommerce->db->host=$_POST["oscommerce_dbhost"];
-	$conf->oscommerce->db->port=$_POST["oscommerce_dbport"];
-	$conf->oscommerce->db->name=$_POST["oscommerce_dbname"];
-	$conf->oscommerce->db->user=$_POST["oscommerce_dbuser"];
-	$conf->oscommerce->db->pass=$_POST["oscommerce_dbpass"];
+	$conf->oscommerce->db->host=GETPOST('oscommerce_dbhost','alpha');
+	$conf->oscommerce->db->port=GETPOST('oscommerce_dbport','alpha');
+	$conf->oscommerce->db->name=GETPOST('oscommerce_dbname','alpha');
+	$conf->oscommerce->db->user=GETPOST('oscommerce_dbuser','alpha');
+	$conf->oscommerce->db->pass=GETPOST('oscommerce_dbpass','alpha');
 
     $oscommercedb=getDoliDBInstance($conf->oscommerce->db->type,$conf->oscommerce->db->host,$conf->oscommerce->db->user,$conf->oscommerce->db->pass,$conf->oscommerce->db->name,$conf->oscommerce->db->port);
 
@@ -87,11 +88,11 @@ elseif ($_POST["test"])
 		$sql.=" WHERE configuration_key='STORE_NAME'";
 		$resql=$oscommercedb->query($sql);
 		if ($resql) {
-			$mesg ="<div class=\"ok\">".$langs->trans("OSCommerceTestOk",$_POST["oscommerce_dbhost"],$_POST["oscommerce_dbname"],$_POST["oscommerce_dbuser"]);
+			$mesg ="<div class=\"ok\">".$langs->trans("OSCommerceTestOk",GETPOST('oscommerce_dbhost','alpha'),GETPOST('oscommerce_dbname','alpha'),GETPOST('oscommerce_dbuser','alpha'));
 			$mesg.="</div>";
 		}
 		else {
-			$mesg ="<div class=\"error\">".$langs->trans("OSCommerceErrorConnectOkButWrongDatabase",'STORE_NAME',$_POST["oscommerce_db_table_prefix"]."configuration");
+			$mesg ="<div class=\"error\">".$langs->trans("OSCommerceErrorConnectOkButWrongDatabase",'STORE_NAME',GETPOST('oscommerce_db_table_prefix','alpha')."configuration");
 			$mesg.="</div>";
 		}
 
@@ -99,14 +100,14 @@ elseif ($_POST["test"])
 	}
 	elseif ($oscommercedb->connected == 1 && $oscommercedb->database_selected != 1)
 	{
-		$mesg ="<div class=\"error\">".$langs->trans("OSCommerceTestKo1",$_POST["oscommerce_dbhost"],$_POST["oscommerce_dbname"]);
+		$mesg ="<div class=\"error\">".$langs->trans("OSCommerceTestKo1",GETPOST('oscommerce_dbhost','alpha'),GETPOST('oscommerce_dbname','alpha'));
 		$mesg.="<br>".$oscommercedb->error();
 		$mesg.="</div>";
 		//$oscommercedb->close();    Ne pas fermer car la conn de webcal est la meme que dolibarr si parametre host/user/pass identique
 	}
 	else
 	{
-		$mesg ="<div class=\"error\">".$langs->trans("OSCommerceTestKo2",$_POST["oscommerce_dbhost"],$_POST["oscommerce_dbuser"]);
+		$mesg ="<div class=\"error\">".$langs->trans("OSCommerceTestKo2",GETPOST('oscommerce_dbhost','alpha'),GETPOST('oscommerce_dbuser','alpha'));
 		$mesg.="<br>".$oscommercedb->error();
 		$mesg.="</div>";
 	}
@@ -142,7 +143,7 @@ print "</tr>";
 $var=!$var;
 print "<tr ".$bc[$var].">";
 print "<td>".$langs->trans("OSCommerceServer")."</td>";
-print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_dbhost\" value=\"". ($_POST["oscommerce_dbhost"]?$_POST["oscommerce_dbhost"]:$conf->global->OSC_DB_HOST) . "\" size=\"30\"></td>";
+print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_dbhost\" value=\"". (GETPOST('oscommerce_dbhost','alpha')?GETPOST('oscommerce_dbhost','alpha'):$conf->global->OSC_DB_HOST) . "\" size=\"30\"></td>";
 print "<td>localhost";
 //print "<br>__dolibarr_main_db_host__ <i>(".$dolibarr_main_db_host.")</i>"
 print "</td>";
@@ -150,7 +151,7 @@ print "</tr>";
 $var=!$var;
 print "<tr ".$bc[$var].">";
 print "<td>".$langs->trans("OSCommerceDatabaseName")."</td>";
-print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_dbname\" value=\"". ($_POST["oscommerce_dbname"]?$_POST["oscommerce_dbname"]:$conf->global->OSC_DB_NAME) . "\" size=\"30\"></td>";
+print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_dbname\" value=\"". (GETPOST('oscommerce_dbname','alpha')?GETPOST('oscommerce_dbname','alpha'):$conf->global->OSC_DB_NAME) . "\" size=\"30\"></td>";
 print "<td>oscommerce";
 //print "<br>__dolibarr_main_db_name__ <i>(".$dolibarr_main_db_name.")</i>";
 print "</td>";
@@ -158,14 +159,14 @@ print "</tr>";
 $var=!$var;
 print "<tr ".$bc[$var].">";
 print "<td>".$langs->trans("OSCommercePrefix")."</td>";
-print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_db_table_prefix\" value=\"". ($_POST["oscommerce_db_table_prefix"]?$_POST["oscommerce_db_table_prefix"]:$conf->global->DB_TABLE_PREFIX) . "\" size=\"30\"></td>";
+print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_db_table_prefix\" value=\"". (GETPOST('oscommerce_db_table_prefix','alpha')?GETPOST('oscommerce_db_table_prefix','alpha'):$conf->global->DB_TABLE_PREFIX) . "\" size=\"30\"></td>";
 print "<td>osc_";
 print "</td>";
 print "</tr>";
 $var=!$var;
 print "<tr ".$bc[$var].">";
 print "<td>".$langs->trans("OSCommerceUser")."</td>";
-print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_dbuser\" value=\"". ($_POST["oscommerce_dbuser"]?$_POST["oscommerce_dbuser"]:$conf->global->OSC_DB_USER) . "\" size=\"30\"></td>";
+print "<td><input type=\"text\" class=\"flat\" name=\"oscommerce_dbuser\" value=\"". (GETPOST('oscommerce_dbuser','alpha')?GETPOST('oscommerce_dbuser','alpha'):$conf->global->OSC_DB_USER) . "\" size=\"30\"></td>";
 print "<td>oscommerceuser";
 //print "<br>__dolibarr_main_db_user__ <i>(".$dolibarr_main_db_user.")</i>";
 print "</td>";
@@ -173,7 +174,7 @@ print "</tr>";
 $var=!$var;
 print "<tr ".$bc[$var].">";
 print "<td>".$langs->trans("Password")."</td>";
-print "<td><input type=\"password\" class=\"flat\" name=\"oscommerce_dbpass\" value=\"" . ($_POST["oscommerce_dbpass"]?$_POST["oscommerce_dbpass"]:$conf->global->OSC_DB_PASS) . "\" size=\"30\"></td>";
+print "<td><input type=\"password\" class=\"flat\" name=\"oscommerce_dbpass\" value=\"" . (GETPOST('oscommerce_dbpass','alpha')?GETPOST('oscommerce_dbpass','alpha'):$conf->global->OSC_DB_PASS) . "\" size=\"30\"></td>";
 print '<td>';
 //if ($dolibarr_main_db_pass) print '__dolibarr_main_db_pass__ <i>('.preg_replace('/./i','*',$dolibarr_main_db_pass).')</i>';
 print '&nbsp;</td>';
@@ -181,7 +182,7 @@ print "</tr>";
 $var=!$var;
 print "<tr ".$bc[$var].">";
 print "<td>".$langs->trans("PasswordRetype")."</td>";
-print "<td><input type=\"password\" class=\"flat\" name=\"oscommerce_dbpass2\" value=\"" . ($_POST["oscommerce_dbpass2"]?$_POST["oscommerce_dbpass2"]:$conf->global->OSC_DB_PASS) ."\" size=\"30\"></td>";
+print "<td><input type=\"password\" class=\"flat\" name=\"oscommerce_dbpass2\" value=\"" . (GETPOST('oscommerce_dbpass2','alpha')?GETPOST('oscommerce_dbpass2','alpha'):$conf->global->OSC_DB_PASS) ."\" size=\"30\"></td>";
 print '<td>';
 //if ($dolibarr_main_db_pass) print '__dolibarr_main_db_pass__ <i>('.preg_replace('/./i','*',$dolibarr_main_db_pass).')</i>';
 print '&nbsp;</td>';
diff --git a/htdocs/paybox/admin/paybox.php b/htdocs/paybox/admin/paybox.php
index c6f0966ed66d98c7835cc033e3b8f014e38e0f8e..b28fe5f084eb751f9d5bdfaf64cecbb33411448c 100644
--- a/htdocs/paybox/admin/paybox.php
+++ b/htdocs/paybox/admin/paybox.php
@@ -1,7 +1,7 @@
 <?php
 /* Copyright (C) 2004      Rodolphe Quiedeville <rodolphe@quiedeville.org>
  * Copyright (C) 2005-2010 Laurent Destailleur  <eldy@users.sourceforge.org>
- * Copyright (C) 2011 	   Juanjo Menent		<jmenent@2byte.es>
+ * Copyright (C) 2011-2012 Juanjo Menent		<jmenent@2byte.es>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -36,30 +36,30 @@ $langs->load("paybox");
 if (!$user->admin)
   accessforbidden();
   
-$action = GETPOST("action");
+$action = GETPOST('action','alpha');
 
 
 if ($action == 'setvalue' && $user->admin)
 {
 	$db->begin();
 	//$result=dolibarr_set_const($db, "PAYBOX_IBS_DEVISE",$_POST["PAYBOX_IBS_DEVISE"],'chaine',0,'',$conf->entity);
-	$result=dolibarr_set_const($db, "PAYBOX_CGI_URL_V1", GETPOST("PAYBOX_CGI_URL_V1"),'chaine',0,'',$conf->entity);
+	$result=dolibarr_set_const($db, "PAYBOX_CGI_URL_V1", GETPOST('PAYBOX_CGI_URL_V1','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-	$result=dolibarr_set_const($db, "PAYBOX_CGI_URL_V2",GETPOST("PAYBOX_CGI_URL_V2"),'chaine',0,'',$conf->entity);
+	$result=dolibarr_set_const($db, "PAYBOX_CGI_URL_V2",GETPOST('PAYBOX_CGI_URL_V2','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-	$result=dolibarr_set_const($db, "PAYBOX_IBS_SITE",GETPOST("PAYBOX_IBS_SITE"),'chaine',0,'',$conf->entity);
+	$result=dolibarr_set_const($db, "PAYBOX_IBS_SITE",GETPOST('PAYBOX_IBS_SITE','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-	$result=dolibarr_set_const($db, "PAYBOX_IBS_RANG",GETPOST("PAYBOX_IBS_RANG"),'chaine',0,'',$conf->entity);
+	$result=dolibarr_set_const($db, "PAYBOX_IBS_RANG",GETPOST('PAYBOX_IBS_RANG','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-	$result=dolibarr_set_const($db, "PAYBOX_PBX_IDENTIFIANT",GETPOST("PAYBOX_PBX_IDENTIFIANT"),'chaine',0,'',$conf->entity);
+	$result=dolibarr_set_const($db, "PAYBOX_PBX_IDENTIFIANT",GETPOST('PAYBOX_PBX_IDENTIFIANT','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYBOX_CREDITOR",GETPOST("PAYBOX_CREDITOR"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYBOX_CREDITOR",GETPOST('PAYBOX_CREDITOR','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-	$result=dolibarr_set_const($db, "PAYBOX_CSS_URL",GETPOST("PAYBOX_CSS_URL"),'chaine',0,'',$conf->entity);
+	$result=dolibarr_set_const($db, "PAYBOX_CSS_URL",GETPOST('PAYBOX_CSS_URL','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYBOX_MESSAGE_OK",GETPOST("PAYBOX_MESSAGE_OK"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYBOX_MESSAGE_OK",GETPOST('PAYBOX_MESSAGE_OK','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYBOX_MESSAGE_KO",GETPOST("PAYBOX_MESSAGE_KO"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYBOX_MESSAGE_KO",GETPOST('PAYBOX_MESSAGE_KO','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
 	
     if (! $error)
diff --git a/htdocs/paypal/admin/paypal.php b/htdocs/paypal/admin/paypal.php
index cf254f1de30ef2d593087e6c628236009d8f5e61..7d185c65c03a56e92673ef2c46043f22f63d43d3 100644
--- a/htdocs/paypal/admin/paypal.php
+++ b/htdocs/paypal/admin/paypal.php
@@ -2,7 +2,7 @@
 /* Copyright (C) 2004		Rodolphe Quiedeville	<rodolphe@quiedeville.org>
  * Copyright (C) 2005-2011	Laurent Destailleur		<eldy@users.sourceforge.org>
  * Copyright (C) 2011-2012	Regis Houssin			<regis@dolibarr.fr>
- * Copyright (C) 2011		Juanjo Menent			<jmenent@2byte.es>
+ * Copyright (C) 2011-2012  Juanjo Menent			<jmenent@2byte.es>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -39,34 +39,34 @@ $langs->load("paybox");
 if (!$user->admin)
   accessforbidden();
 
-$action = GETPOST("action");
+$action = GETPOST('action','alpha');
 
 if ($action == 'setvalue' && $user->admin)
 {
 	$db->begin();
-    $result=dolibarr_set_const($db, "PAYPAL_API_SANDBOX",GETPOST("PAYPAL_API_SANDBOX"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_API_SANDBOX",GETPOST('PAYPAL_API_SANDBOX','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_API_USER",GETPOST("PAYPAL_API_USER"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_API_USER",GETPOST('PAYPAL_API_USER','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_API_PASSWORD",GETPOST("PAYPAL_API_PASSWORD"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_API_PASSWORD",GETPOST('PAYPAL_API_PASSWORD','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_API_SIGNATURE",GETPOST("PAYPAL_API_SIGNATURE"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_API_SIGNATURE",GETPOST('PAYPAL_API_SIGNATURE','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_CREDITOR",GETPOST("PAYPAL_CREDITOR"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_CREDITOR",GETPOST('PAYPAL_CREDITOR','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_API_INTEGRAL_OR_PAYPALONLY",GETPOST("PAYPAL_API_INTEGRAL_OR_PAYPALONLY"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_API_INTEGRAL_OR_PAYPALONLY",GETPOST('PAYPAL_API_INTEGRAL_OR_PAYPALONLY','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_CSS_URL",GETPOST("PAYPAL_CSS_URL"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_CSS_URL",GETPOST('PAYPAL_CSS_URL','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_SECURITY_TOKEN",GETPOST("PAYPAL_SECURITY_TOKEN"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_SECURITY_TOKEN",GETPOST('PAYPAL_SECURITY_TOKEN','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_SECURITY_TOKEN_UNIQUE",GETPOST("PAYPAL_SECURITY_TOKEN_UNIQUE"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_SECURITY_TOKEN_UNIQUE",GETPOST('PAYPAL_SECURITY_TOKEN_UNIQUE','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_ADD_PAYMENT_URL",GETPOST("PAYPAL_ADD_PAYMENT_URL"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_ADD_PAYMENT_URL",GETPOST('PAYPAL_ADD_PAYMENT_URL','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_MESSAGE_OK",GETPOST("PAYPAL_MESSAGE_OK"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_MESSAGE_OK",GETPOST('PAYPAL_MESSAGE_OK','alpha'),'chaine',0,'',$conf->entity);
     if (! $result > 0) $error++;
-    $result=dolibarr_set_const($db, "PAYPAL_MESSAGE_KO",GETPOST("PAYPAL_MESSAGE_KO"),'chaine',0,'',$conf->entity);
+    $result=dolibarr_set_const($db, "PAYPAL_MESSAGE_KO",GETPOST('PAYPAL_MESSAGE_KO','alpha'),'chaine',0,'',$conf->entity);
 	if (! $result > 0) $error++;
 	
 	if (! $error)
@@ -286,12 +286,12 @@ if ($conf->commande->enabled)
 	    $langs->load("orders");
 	    print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
 	    print $langs->trans("EnterRefToBuildUrl",$langs->transnoentitiesnoconv("Order")).': ';
-        print '<input type="text class="flat" id="generate_order_ref" name="generate_order_ref" value="'.GETPOST('generate_order_ref').'" size="10">';
+        print '<input type="text class="flat" id="generate_order_ref" name="generate_order_ref" value="'.GETPOST('generate_order_ref','alpha').'" size="10">';
         print '<input type="submit" class="none" value="'.$langs->trans("GetSecuredUrl").'">';
-        if (GETPOST('generate_order_ref'))
+        if (GETPOST('generate_order_ref','alpha'))
         {
             print '<br> -> <strong>';
-            $url=getPaypalPaymentUrl(0,'order',GETPOST('generate_order_ref'));
+            $url=getPaypalPaymentUrl(0,'order',GETPOST('generate_order_ref','alpha'));
             print $url;
             print "</strong><br>\n";
         }
@@ -308,12 +308,12 @@ if ($conf->facture->enabled)
 	    $langs->load("bills");
 	    print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
 	    print $langs->trans("EnterRefToBuildUrl",$langs->transnoentitiesnoconv("Invoice")).': ';
-        print '<input type="text class="flat" id="generate_invoice_ref" name="generate_invoice_ref" value="'.GETPOST('generate_invoice_ref').'" size="10">';
+        print '<input type="text class="flat" id="generate_invoice_ref" name="generate_invoice_ref" value="'.GETPOST('generate_invoice_ref','alpha').'" size="10">';
         print '<input type="submit" class="none" value="'.$langs->trans("GetSecuredUrl").'">';
-        if (GETPOST('generate_invoice_ref'))
+        if (GETPOST('generate_invoice_ref','alpha'))
         {
             print '<br> -> <strong>';
-            $url=getPaypalPaymentUrl(0,'invoice',GETPOST('generate_invoice_ref'));
+            $url=getPaypalPaymentUrl(0,'invoice',GETPOST('generate_invoice_ref','alpha'));
             print $url;
             print "</strong><br>\n";
         }
@@ -330,12 +330,12 @@ if ($conf->contrat->enabled)
 	    $langs->load("contract");
 	    print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
 	    print $langs->trans("EnterRefToBuildUrl",$langs->transnoentitiesnoconv("Contract")).': ';
-        print '<input type="text class="flat" id="generate_contract_ref" name="generate_contract_ref" value="'.GETPOST('generate_contract_ref').'" size="10">';
+        print '<input type="text class="flat" id="generate_contract_ref" name="generate_contract_ref" value="'.GETPOST('generate_contract_ref','alpha').'" size="10">';
         print '<input type="submit" class="none" value="'.$langs->trans("GetSecuredUrl").'">';
         if (GETPOST('generate_contract_ref'))
         {
             print '<br> -> <strong>';
-            $url=getPaypalPaymentUrl(0,'contractline',GETPOST('generate_contract_ref'));
+            $url=getPaypalPaymentUrl(0,'contractline',GETPOST('generate_contract_ref','alpha'));
             print $url;
             print "</strong><br>\n";
         }
@@ -352,12 +352,12 @@ if ($conf->adherent->enabled)
 	    $langs->load("members");
 	    print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
 	    print $langs->trans("EnterRefToBuildUrl",$langs->transnoentitiesnoconv("Member")).': ';
-        print '<input type="text class="flat" id="generate_member_ref" name="generate_member_ref" value="'.GETPOST('generate_member_ref').'" size="10">';
+        print '<input type="text class="flat" id="generate_member_ref" name="generate_member_ref" value="'.GETPOST('generate_member_ref','alpha').'" size="10">';
         print '<input type="submit" class="none" value="'.$langs->trans("GetSecuredUrl").'">';
         if (GETPOST('generate_member_ref'))
         {
             print '<br> -> <strong>';
-            $url=getPaypalPaymentUrl(0,'membersubscription',GETPOST('generate_member_ref'));
+            $url=getPaypalPaymentUrl(0,'membersubscription',GETPOST('generate_member_ref','alpha'));
             print $url;
             print "</strong><br>\n";
         }