diff --git a/html/priv_user.php b/html/priv_user.php
index 217fc9b58..99d75759c 100644
--- a/html/priv_user.php
+++ b/html/priv_user.php
@@ -83,8 +83,16 @@ if ( isset ($_POST['SAVE']) ){
   echo_debug('priv_user.php',__LINE__,"SAVE is set");
   // Update User 
   $cn=DbConnect();
-  $Sql="update ac_users set use_first_name='".$_POST['fname']."', use_name='".$_POST['lname']."'
-        ,use_login='".$_POST['login']."',use_active=".$_POST['Actif'].",use_admin=".$_POST['Admin']." where
+  $first_name=pg_escape_string($_POST['fname']);
+  $last_name=pg_escape_string($_POST['lname']);
+  $login=$_POST['login'];
+  $login=str_replace("'","",$login);
+  $login=str_replace('"',"",$login);
+  $login=str_replace(" ","",$login);
+  $login=strtolower($login);
+
+  $Sql="update ac_users set use_first_name='".$first_name."', use_name='".$last_name."'
+        ,use_login='".$login."',use_active=".$_POST['Actif'].",use_admin=".$_POST['Admin']." where
          use_id=".$uid;
   $Res=ExecSql($cn,$Sql);
   // Update Priv on Folder
diff --git a/include/user.inc.php b/include/user.inc.php
index 0d9ebb214..0a28ca4ba 100644
--- a/include/user.inc.php
+++ b/include/user.inc.php
@@ -31,8 +31,17 @@
 if ( isset ($_POST["LOGIN"]) ) {
   $cn=DbConnect();
   $pass5=md5($_POST['PASS']);
+
+  $first_name=pg_escape_string($_POST['FNAME']);
+  $last_name=pg_escape_string($_POST['LNAME']);
+  $login=$_POST['LOGIN'];
+  $login=str_replace("'","",$login);
+  $login=str_replace('"',"",$login);
+  $login=str_replace(" ","",$login);
+  $login=strtolower($login);
+
   $Res=ExecSql($cn,"insert into ac_users(use_first_name,use_name,use_login,use_active,use_pass)
-                    values ('".$_POST["FNAME"]."','".$_POST["LNAME"]."','".$_POST["LOGIN"]."',1,'$pass5')");
+                    values ('".$first_name."','".$last_name."','".$login."',1,'$pass5')");
 } //SET login
 
 // Show all the existing user on 7 columns