diff --git a/contrib/forms/xmlformgen/xslt/new.php.xslt b/contrib/forms/xmlformgen/xslt/new.php.xslt
index 91e9892e696..30511a729c5 100644
--- a/contrib/forms/xmlformgen/xslt/new.php.xslt
+++ b/contrib/forms/xmlformgen/xslt/new.php.xslt
@@ -71,7 +71,7 @@ $submiturl = $GLOBALS['rootdir'].'/forms/'.$form_folder.'/save.php?mode=new&
 
 <script>
 // this line is to assist the calendar text boxes
-var mypcc = '<?php echo $GLOBALS['phone_country_code']; ?>';
+var mypcc = <?php echo js_escape($GLOBALS['phone_country_code']); ?>;
 
 <!-- a validator for all the fields expected in this form -->
 function validate() {
diff --git a/contrib/forms/xmlformgen/xslt/view.php.xslt b/contrib/forms/xmlformgen/xslt/view.php.xslt
index 73064f20254..3b2127f1f45 100644
--- a/contrib/forms/xmlformgen/xslt/view.php.xslt
+++ b/contrib/forms/xmlformgen/xslt/view.php.xslt
@@ -84,7 +84,7 @@ else
 
 <script>
 // this line is to assist the calendar text boxes
-var mypcc = '<?php echo $GLOBALS['phone_country_code']; ?>';
+var mypcc = <?php echo js_escape($GLOBALS['phone_country_code']); ?>;
 
 <!-- FIXME: this needs to detect access method, and construct a URL appropriately! -->
 function PrintForm() {
diff --git a/interface/main/calendar/add_edit_event.php b/interface/main/calendar/add_edit_event.php
index 2ffd0a9cfb5..201c58a5d50 100644
--- a/interface/main/calendar/add_edit_event.php
+++ b/interface/main/calendar/add_edit_event.php
@@ -942,7 +942,7 @@ function setEventDate($start_date, $recurrence)
 <script>
 <?php require $GLOBALS['srcdir'] . "/formatting_DateToYYYYMMDD_js.js.php" ?>
 
- var mypcc = '<?php echo $GLOBALS['phone_country_code'] ?>';
+ var mypcc = <?php echo js_escape($GLOBALS['phone_country_code']); ?>;
 
  var durations = new Array();
 <?php
diff --git a/interface/modules/zend_modules/module/Carecoordination/view/carecoordination/setup/index.phtml b/interface/modules/zend_modules/module/Carecoordination/view/carecoordination/setup/index.phtml
index 68edde42ec9..7501eeb63a7 100644
--- a/interface/modules/zend_modules/module/Carecoordination/view/carecoordination/setup/index.phtml
+++ b/interface/modules/zend_modules/module/Carecoordination/view/carecoordination/setup/index.phtml
@@ -135,7 +135,7 @@ $(function () {
                 }
                 ?>
                 <li class='ui-state-default sortable_li <?php echo $this->escapeHtml($rowforms[1]);?>' id='<?php echo preg_replace('/\s/','_',$this->escapeHtml($rowforms[0]));?>'>
-                    <?php echo $rowforms[0];
+                    <?php echo text($rowforms[0]);
                     if(is_array($rowforms[2] ?? null)){
                         ?>
                         <ul class='droptrue' style='display: none;' id='sub_<?php echo preg_replace('/\s/','_',$this->escapeHtml($rowforms[0]));?>'>
diff --git a/interface/orders/single_order_results.inc.php b/interface/orders/single_order_results.inc.php
index ce1f6917c8b..bb26c01b038 100644
--- a/interface/orders/single_order_results.inc.php
+++ b/interface/orders/single_order_results.inc.php
@@ -436,7 +436,7 @@ function generate_order_report($orderid, $input_form = false, $genstyles = true,
 
     <?php if (empty($GLOBALS['PATIENT_REPORT_ACTIVE'])) { ?>
 <script>
-    var mypcc = '<?php echo $GLOBALS['phone_country_code'] ?>';
+    var mypcc = <?php echo js_escape($GLOBALS['phone_country_code']); ?>;
     if (typeof top.webroot_url === "undefined") {
         if (typeof opener.top.webroot_url !== "undefined") {
             top.webroot_url = opener.top.webroot_url;
diff --git a/interface/reports/patient_flow_board_report.php b/interface/reports/patient_flow_board_report.php
index df60d0212f2..24d4bcd3413 100644
--- a/interface/reports/patient_flow_board_report.php
+++ b/interface/reports/patient_flow_board_report.php
@@ -470,7 +470,7 @@ function setpatient(pid, lname, fname, dob) {
     <tr bgcolor='<?php echo attr($bgcolor ?? ''); ?>'>
         <?php
         if (!$chk_show_drug_screens && !$chk_show_completed_drug_screens) { # the first part of this block is for the Patient Flow Board report ?>
-        <td class="detail">&nbsp;<?php echo ($docname == $lastdocname) ? "" : $docname ?>
+        <td class="detail">&nbsp;<?php echo text(($docname == $lastdocname) ? "" : $docname) ?>
         </td>
 
         <td class="detail"><?php echo text(oeFormatShortDate($appointment['pc_eventDate'])) ?>
diff --git a/portal/report/portal_custom_report.php b/portal/report/portal_custom_report.php
index 0527e95918d..78d875a8121 100644
--- a/portal/report/portal_custom_report.php
+++ b/portal/report/portal_custom_report.php
@@ -545,7 +545,7 @@ function next_prev(action){
     <h2><?php echo text($facility['name']); ?></h2>
     <?php echo text($facility['street']); ?><br />
     <?php echo text($facility['city']); ?>, <?php echo text($facility['state']); ?> <?php echo text($facility['postal_code']); ?><br clear='all'>
-    <?php echo $facility['phone'] ?><br />
+    <?php echo text($facility['phone']) ?><br />
 
 <a href="javascript:window.close();"><span class='title'><?php echo text($titleres['fname']) . " " . text($titleres['lname']); ?></span></a><br />
 <span class='text'><?php echo xlt('Generated on'); ?>: <?php echo text(oeFormatShortDate()); ?></span>
diff --git a/portal/report/portal_patient_report.php b/portal/report/portal_patient_report.php
index e76dd33c596..0071131f5e5 100644
--- a/portal/report/portal_patient_report.php
+++ b/portal/report/portal_patient_report.php
@@ -224,7 +224,9 @@ function show_date_fun(){
   }
   return;
 }
-var mypcc = '<?php echo $GLOBALS['phone_country_code']; ?>';
+
+var mypcc = <?php echo js_escape($GLOBALS['phone_country_code']); ?>;
+
 </script>
 
 <body class="body_top">