diff --git a/application/controllers/Awards.php b/application/controllers/Awards.php
index 293790327..e928814e0 100644
--- a/application/controllers/Awards.php
+++ b/application/controllers/Awards.php
@@ -84,7 +84,7 @@ class Awards extends CI_Controller
         }
 
         if ($logbooks_locations_array) {
-            $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+            $location_list = implode(',', array_map('intval', $logbooks_locations_array));
             $data['dok_array'] = $this->dok->get_dok_array($bands, $postdata, $location_list);
             $data['dok_summary'] = $this->dok->get_dok_summary($bands, $postdata, $location_list);
         } else {
diff --git a/application/models/Bands.php b/application/models/Bands.php
index 0e1726b40..675d285bf 100644
--- a/application/models/Bands.php
+++ b/application/models/Bands.php
@@ -193,7 +193,7 @@ class Bands extends CI_Model {
 			return array();
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		// get all worked slots from database
 		$data = $this->db->query(
@@ -233,7 +233,7 @@ class Bands extends CI_Model {
 		if (!$logbooks_locations_array) {
 			return array();
 		}
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         // get all worked slots from database
         $sql = "SELECT distinct LOWER(COL_BAND) as COL_BAND FROM ".$this->config->item('table_name')." WHERE station_id in (" . $location_list . ")";
@@ -265,7 +265,7 @@ class Bands extends CI_Model {
 			return array();
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         // get all worked sats from database
         $sql = "SELECT distinct col_sat_name FROM ".$this->config->item('table_name')." WHERE station_id in (" . $location_list . ") and coalesce(col_sat_name, '') <> '' ORDER BY col_sat_name";
@@ -289,7 +289,7 @@ class Bands extends CI_Model {
 			return array();
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		// get all worked slots from database
 		$data = $this->db->query(
@@ -321,7 +321,7 @@ class Bands extends CI_Model {
 			return array();
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         // get all worked powers from database
         $sql = "SELECT distinct col_tx_pwr FROM ".$this->config->item('table_name')." WHERE station_id in (" . $location_list . ") ORDER BY col_tx_pwr";
diff --git a/application/models/Counties.php b/application/models/Counties.php
index ec2bf0fc9..001cf256a 100644
--- a/application/models/Counties.php
+++ b/application/models/Counties.php
@@ -31,13 +31,13 @@ class Counties extends CI_Model
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $this->load->model('bands');
 
 		$bandslots = $this->bands->get_worked_bands('uscounties');
 
-		$bandslots_list = "'".implode("','",$bandslots)."'";
+        $bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 
         // Normalize county/state values so imported variants group consistently.
         $normalizedCountyExpression = "LOWER(TRIM(SUBSTRING_INDEX(COL_CNTY, ',', -1)))";
@@ -98,13 +98,13 @@ class Counties extends CI_Model
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $this->load->model('bands');
 
 		$bandslots = $this->bands->get_worked_bands('uscounties');
 
-		$bandslots_list = "'".implode("','",$bandslots)."'";
+        $bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 
         $normalizedCountySelect = "TRIM(SUBSTRING_INDEX(COL_CNTY, ',', -1))";
         $normalizedCountyOrder = "LOWER(TRIM(SUBSTRING_INDEX(COL_CNTY, ',', -1)))";
diff --git a/application/models/Dayswithqso_model.php b/application/models/Dayswithqso_model.php
index 65a900a98..75248ebe9 100644
--- a/application/models/Dayswithqso_model.php
+++ b/application/models/Dayswithqso_model.php
@@ -13,7 +13,7 @@ class Dayswithqso_model extends CI_Model
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = "select year(COL_TIME_ON) Year, COUNT(DISTINCT TO_DAYS(COL_TIME_ON)) as Days from "
             .$this->config->item('table_name'). " thcv
@@ -169,7 +169,7 @@ class Dayswithqso_model extends CI_Model
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = "select distinct cast(col_time_on as date) as date from "
             .$this->config->item('table_name'). " thcv
@@ -193,7 +193,7 @@ class Dayswithqso_model extends CI_Model
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = "SELECT DAYNAME(col_time_off) AS weekday, COUNT(*) AS qsos FROM " . $this->config->item('table_name')
               . " WHERE WEEKDAY(col_time_off) BETWEEN 0 AND 6 AND station_id in (" . $location_list . ")"
@@ -222,7 +222,7 @@ class Dayswithqso_model extends CI_Model
         $max_date_query = $this->db->query('SELECT MAX(DATE(col_time_off)) AS max_date FROM ' . $this->config->item('table_name'));
         $max_date = $max_date_query->row()->max_date;
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = "WITH RECURSIVE all_dates AS (
                     SELECT ? AS date
diff --git a/application/models/Dok.php b/application/models/Dok.php
index 2f7fc297c..3f09ac7eb 100644
--- a/application/models/Dok.php
+++ b/application/models/Dok.php
@@ -91,9 +91,7 @@ function get_dok_array($bands, $postdata, $location_list) {
 		$sql = "SELECT DISTINCT COL_DARC_DOK FROM " . $this->config->item('table_name') . " thcv
 			WHERE station_id IN (" . $location_list . ") AND COL_DARC_DOK <> '' AND COL_DARC_DOK <> 'NM'";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " AND (COL_MODE = '" . $postdata['mode'] . "' OR COL_SUBMODE = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 		$sql .= $this->addDokTypeToQuery($postdata['doks']);
 		$sql .= $this->addBandToQuery($band);
 		$sql .= " AND NOT EXISTS (SELECT 1 from " . $this->config->item('table_name') .
@@ -112,9 +110,7 @@ function get_dok_array($bands, $postdata, $location_list) {
 	function getDokConfirmed($location_list, $band, $postdata) {
 		$sql = "SELECT DISTINCT COL_DARC_DOK FROM " . $this->config->item('table_name') . " thcv
 			WHERE station_id IN (" . $location_list . ") AND COL_DARC_DOK <> '' AND COL_DARC_DOK <> '' AND COL_DARC_DOK <> 'NM'";
-		if ($postdata['mode'] != 'All') {
-			$sql .= " AND (COL_MODE = '" . $postdata['mode'] . "' or COL_SUBMODE = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 		$sql .= $this->addDokTypeToQuery($postdata['doks']);
 		$sql .= $this->addBandToQuery($band);
 		$sql .= $this->addQslToQuery($postdata);
@@ -145,16 +141,25 @@ function get_dok_array($bands, $postdata, $location_list) {
 	function addBandToQuery($band) {
 		$sql = '';
 		if ($band != 'All') {
+			$safeBand = $this->db->escape_str($band);
 			if ($band == 'SAT') {
-				$sql .= " AND COL_PROP_MODE ='" . $band . "'";
+				$sql .= " AND COL_PROP_MODE ='" . $safeBand . "'";
 			} else {
 				$sql .= " AND COL_PROP_MODE !='SAT'";
-				$sql .= " AND col_BAND ='" . $band . "'";
+				$sql .= " AND col_BAND ='" . $safeBand . "'";
 			}
 		}
 		return $sql;
 	}
 
+	function addModeToQuery($mode) {
+		if ($mode == 'All') {
+			return '';
+		}
+		$safeMode = $this->db->escape_str($mode);
+		return " AND (COL_MODE = '" . $safeMode . "' OR COL_SUBMODE = '" . $safeMode . "')";
+	}
+
 	function addDokTypeToQuery($doks) {
 		$sql = '';
 		if ($doks == 'dok') {
@@ -187,15 +192,15 @@ function get_dok_array($bands, $postdata, $location_list) {
 		$sql = "SELECT count(distinct thcv.COL_DARC_DOK) AS count FROM " . $this->config->item('table_name') . " thcv";
 		$sql .= " WHERE station_id IN (" . $location_list . ') AND COL_DARC_DOK != "" AND COL_DARC_DOK <> "NM"';
 		if ($band == 'SAT') {
-			$sql .= " AND thcv.COL_PROP_MODE ='" . $band . "'";
+			$sql .= " AND thcv.COL_PROP_MODE ='" . $this->db->escape_str($band) . "'";
 		} else if ($band == 'All') {
 			$this->load->model('bands');
 			$bandslots = $this->bands->get_worked_bands('dok');
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			$sql .= " AND thcv.COL_BAND in (" . $bandslots_list . ")";
 		} else {
 			$sql .= " AND thcv.COL_PROP_MODE !='SAT'";
-			$sql .= " AND thcv.COL_BAND ='" . $band . "'";
+			$sql .= " AND thcv.COL_BAND ='" . $this->db->escape_str($band) . "'";
 		}
 		if ($postdata['doks'] == 'dok') {
 			$sql .= " AND COL_DARC_DOK REGEXP '^[A-Z][0-9]{2}$'";
@@ -210,15 +215,15 @@ function get_dok_array($bands, $postdata, $location_list) {
 		$sql = "SELECT count(distinct thcv.COL_DARC_DOK) AS count FROM " . $this->config->item('table_name') . " thcv";
 		$sql .= " WHERE station_id IN (" . $location_list . ') AND COL_DARC_DOK != "" AND COL_DARC_DOK <> "NM"';
 		if ($band == 'SAT') {
-			$sql .= " AND thcv.COL_PROP_MODE ='" . $band . "'";
+			$sql .= " AND thcv.COL_PROP_MODE ='" . $this->db->escape_str($band) . "'";
 		} else if ($band == 'All') {
 			$this->load->model('bands');
 			$bandslots = $this->bands->get_worked_bands('dok');
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			$sql .= " AND thcv.COL_BAND in (" . $bandslots_list . ")";
 		} else {
 			$sql .= " AND thcv.COL_PROP_MODE !='SAT'";
-			$sql .= " AND thcv.COL_BAND ='" . $band . "'";
+			$sql .= " AND thcv.COL_BAND ='" . $this->db->escape_str($band) . "'";
 		}
 		if ($postdata['doks'] == 'dok') {
 			$sql .= " AND COL_DARC_DOK REGEXP '^[A-Z][0-9]{2}$'";
diff --git a/application/models/Dxcc.php b/application/models/Dxcc.php
index 4a1585beb..54a33609d 100644
--- a/application/models/Dxcc.php
+++ b/application/models/Dxcc.php
@@ -73,7 +73,7 @@ class DXCC extends CI_Model {
 			return null;
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		$qsl = "";
 		if ($postdata['confirmed'] != NULL) {
@@ -151,9 +151,7 @@ class DXCC extends CI_Model {
 
 		$sql .= $this->addBandToQuery($band);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addYearToQuery($postdata);
 		$sql .= $this->addQslToQuery($postdata);
@@ -181,9 +179,7 @@ class DXCC extends CI_Model {
 
 		$sql .= $this->addBandToQuery($band);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addYearToQuery($postdata);
 
@@ -204,16 +200,25 @@ class DXCC extends CI_Model {
 	function addBandToQuery($band) {
         $sql = '';
         if ($band != 'All') {
+			$safeBand = $this->db->escape_str($band);
             if ($band == 'SAT') {
-                $sql .= " and col_prop_mode ='" . $band . "'";
+				$sql .= " and col_prop_mode ='" . $safeBand . "'";
             } else {
                 $sql .= " and col_prop_mode !='SAT'";
-                $sql .= " and col_band ='" . $band . "'";
+				$sql .= " and col_band ='" . $safeBand . "'";
             }
         }
         return $sql;
     }
 
+	function addModeToQuery($mode) {
+		if ($mode == 'All') {
+			return '';
+		}
+		$safeMode = $this->db->escape_str($mode);
+		return " and (col_mode = '" . $safeMode . "' or col_submode = '" . $safeMode . "')";
+	}
+
 	function addYearToQuery($postdata) {
 		$sql = '';
 		if (!empty($postdata['year']) && $postdata['year'] !== 'All') {
@@ -230,7 +235,7 @@ class DXCC extends CI_Model {
 		if (!$logbooks_locations_array) {
 			return [];
 		}
-		$location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 		$sql = "SELECT DISTINCT YEAR(col_time_on) as year FROM " . $this->config->item('table_name') .
 			" WHERE station_id IN (" . $location_list . ") AND col_dxcc > 0 AND col_time_on IS NOT NULL ORDER BY year DESC";
 		$query = $this->db->query($sql);
@@ -246,7 +251,7 @@ class DXCC extends CI_Model {
 			return null;
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		$sql = "select adif, prefix, name, cont, date(end) Enddate, date(start) Startdate, lat, `long`
             from dxcc_entities";
@@ -254,19 +259,9 @@ class DXCC extends CI_Model {
 		if ($postdata['notworked'] == NULL) {
 			$sql .= " join (select col_dxcc from " . $this->config->item('table_name') . " where station_id in (" . $location_list . ") and col_dxcc > 0";
 
-			if ($postdata['band'] != 'All') {
-				if ($postdata['band'] == 'SAT') {
-					$sql .= " and col_prop_mode ='" . $postdata['band'] . "'";
-				}
-				else {
-					$sql .= " and col_prop_mode !='SAT'";
-					$sql .= " and col_band ='" . $postdata['band'] . "'";
-				}
-			}
+			$sql .= $this->addBandToQuery($postdata['band']);
 
-			if ($postdata['mode'] != 'All') {
-				$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-			}
+			$sql .= $this->addModeToQuery($postdata['mode']);
 
 			$sql .= ' group by col_dxcc) x on dxcc_entities.adif = x.col_dxcc';
 		}
@@ -295,9 +290,7 @@ class DXCC extends CI_Model {
 
 		$sql .= $this->addBandToQuery($postdata['band']);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addYearToQuery($postdata);
 
@@ -305,9 +298,7 @@ class DXCC extends CI_Model {
 
 		$sql .= $this->addBandToQuery($postdata['band']);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addYearToQuery($postdata);
 
@@ -340,9 +331,7 @@ class DXCC extends CI_Model {
 
 		$sql .= $this->addBandToQuery($postdata['band']);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addYearToQuery($postdata);
 		$sql .= $this->addQslToQuery($postdata);
@@ -429,7 +418,7 @@ class DXCC extends CI_Model {
 			return null;
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		foreach ($bands as $band) {
 			$worked = $this->getSummaryByBand($band, $postdata, $location_list);
@@ -455,24 +444,22 @@ class DXCC extends CI_Model {
 		$sql .= " where station_id in (" . $location_list . ") and col_dxcc > 0";
 
 		if ($band == 'SAT') {
-			$sql .= " and thcv.col_prop_mode ='" . $band . "'";
+			$sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
 		} else if ($band == 'All') {
 			$this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('dxcc');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and thcv.col_band in (" . $bandslots_list . ")" .
 					" and thcv.col_prop_mode !='SAT'";
 		} else {
 			$sql .= " and thcv.col_prop_mode !='SAT'";
-			$sql .= " and thcv.col_band ='" . $band . "'";
+			$sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
 		}
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		if ($postdata['includedeleted'] == NULL) {
 			$sql .= " and d.end is null";
@@ -493,24 +480,22 @@ class DXCC extends CI_Model {
 		$sql .= " where station_id in (" . $location_list . ")";
 
 		if ($band == 'SAT') {
-			$sql .= " and thcv.col_prop_mode ='" . $band . "'";
+			$sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
 		} else if ($band == 'All') {
 			$this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('dxcc');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and thcv.col_band in (" . $bandslots_list . ")" .
 					" and thcv.col_prop_mode !='SAT'";
 		} else {
 			$sql .= " and thcv.col_prop_mode !='SAT'";
-			$sql .= " and thcv.col_band ='" . $band . "'";
+			$sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
 		}
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addQslToQuery($postdata);
 
diff --git a/application/models/Ffma_model.php b/application/models/Ffma_model.php
index b78f7b9f5..cd9aea9cd 100644
--- a/application/models/Ffma_model.php
+++ b/application/models/Ffma_model.php
@@ -43,7 +43,7 @@ class Ffma_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct substring(COL_GRIDSQUARE,1,4) as GRID_SQUARES FROM '
            .$this->config->item('table_name')
@@ -62,7 +62,7 @@ class Ffma_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct substring(COL_GRIDSQUARE,1,4) as GRID_SQUARES FROM '
            .$this->config->item('table_name')
@@ -81,7 +81,7 @@ class Ffma_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct substring(COL_GRIDSQUARE,1,4) as GRID_SQUARES FROM '
            .$this->config->item('table_name')
@@ -99,7 +99,7 @@ class Ffma_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct COL_VUCC_GRIDS as VUCC_GRIDS FROM '
            .$this->config->item('table_name')
@@ -131,7 +131,7 @@ class Ffma_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct COL_VUCC_GRIDS as VUCC_GRIDS FROM '
            .$this->config->item('table_name')
@@ -163,7 +163,7 @@ class Ffma_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct COL_VUCC_GRIDS as VUCC_GRIDS FROM '
            .$this->config->item('table_name')
diff --git a/application/models/Gmdxsummer_model.php b/application/models/Gmdxsummer_model.php
index 4d7dfe2ca..17be4832e 100644
--- a/application/models/Gmdxsummer_model.php
+++ b/application/models/Gmdxsummer_model.php
@@ -12,15 +12,18 @@ class Gmdxsummer_model extends CI_Model
         $CI->load->model('logbooks_model');
         $logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        if (!$logbooks_locations_array) {
+            return 0;
+        }
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $query = $this->db->query("
             SELECT COUNT(DISTINCT SUBSTRING(COL_GRIDSQUARE, 1, 4)) AS count
             FROM " . $table_name . "
-            WHERE station_id in (" . $location_list . ") AND COL_MODE = '" . $mode . "' AND COL_BAND = '" . $band . "'
+            WHERE station_id in (" . $location_list . ") AND COL_MODE = ? AND COL_BAND = ?
             AND COL_GRIDSQUARE IS NOT NULL AND COL_GRIDSQUARE != ''
-            AND (COL_TIME_ON >= '" . self::START_DATE . "' AND COL_TIME_ON <= '" . $end_date . "')
-        ");
+            AND (COL_TIME_ON >= ? AND COL_TIME_ON <= ?)
+        ", array($mode, $band, self::START_DATE, $end_date));
 
         return $query->row()->count;
     }
@@ -33,15 +36,18 @@ class Gmdxsummer_model extends CI_Model
         $CI->load->model('logbooks_model');
         $logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        if (!$logbooks_locations_array) {
+            return 0;
+        }
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $query = $this->db->query("
         SELECT COUNT(DISTINCT SUBSTRING(COL_GRIDSQUARE, 1, 4)) AS count
         FROM " . $table_name . "
-        WHERE station_id in (".$location_list.") AND COL_MODE IN ('SSB', 'AM', 'FM') AND COL_BAND = '" . $band . "'
+        WHERE station_id in (".$location_list.") AND COL_MODE IN ('SSB', 'AM', 'FM') AND COL_BAND = ?
         AND COL_GRIDSQUARE IS NOT NULL AND COL_GRIDSQUARE != ''
-        AND (COL_TIME_ON >= '" . self::START_DATE . "' AND COL_TIME_ON <= '" . $end_date . "')
-        ");
+        AND (COL_TIME_ON >= ? AND COL_TIME_ON <= ?)
+        ", array($band, self::START_DATE, $end_date));
 
 
         return $query->row()->count;
@@ -55,15 +61,18 @@ class Gmdxsummer_model extends CI_Model
         $CI->load->model('logbooks_model');
         $logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        if (!$logbooks_locations_array) {
+            return 0;
+        }
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $query = $this->db->query("
         SELECT COUNT(DISTINCT SUBSTRING(COL_GRIDSQUARE, 1, 4)) AS count
         FROM " . $table_name . "
-        WHERE station_id in (".$location_list.") AND COL_MODE NOT IN ('CW', 'FM', 'SSB', 'AM') AND COL_BAND = '" . $band . "'
+        WHERE station_id in (".$location_list.") AND COL_MODE NOT IN ('CW', 'FM', 'SSB', 'AM') AND COL_BAND = ?
         AND COL_GRIDSQUARE IS NOT NULL AND COL_GRIDSQUARE != ''
-        AND (COL_TIME_ON >= '" . self::START_DATE . "' AND COL_TIME_ON <= '" . $end_date . "')
-        ");
+        AND (COL_TIME_ON >= ? AND COL_TIME_ON <= ?)
+        ", array($band, self::START_DATE, $end_date));
 
         return $query->row()->count;
     }
@@ -76,9 +85,12 @@ class Gmdxsummer_model extends CI_Model
         $CI->load->model('logbooks_model');
         $logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        if (!$logbooks_locations_array) {
+            return 0;
+        }
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
-        $query = $this->db->query("
+		$query = $this->db->query("
         SELECT COUNT(DISTINCT CONCAT(
             UPPER(SUBSTRING(COL_GRIDSQUARE, 1, 4)),
             '-',
@@ -89,10 +101,10 @@ class Gmdxsummer_model extends CI_Model
             END
         )) AS count
         FROM " . $table_name . "
-        WHERE station_id in (".$location_list.") AND COL_BAND = '" . $band . "'
+		WHERE station_id in (".$location_list.") AND COL_BAND = ?
         AND COL_GRIDSQUARE IS NOT NULL AND COL_GRIDSQUARE != ''
-        AND (COL_TIME_ON >= '" . self::START_DATE . "' AND COL_TIME_ON <= '" . $end_date . "')
-        ");
+		AND (COL_TIME_ON >= ? AND COL_TIME_ON <= ?)
+		", array($band, self::START_DATE, $end_date));
 
         return $query->row()->count;
     }
diff --git a/application/models/Gridmaster_model.php b/application/models/Gridmaster_model.php
index 99c7debf5..2178cae54 100644
--- a/application/models/Gridmaster_model.php
+++ b/application/models/Gridmaster_model.php
@@ -75,7 +75,7 @@ class Gridmaster_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct substring(COL_GRIDSQUARE,1,4) as GRID_SQUARES FROM '
            .$this->config->item('table_name')
@@ -94,7 +94,7 @@ class Gridmaster_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct substring(COL_GRIDSQUARE,1,4) as GRID_SQUARES FROM '
            .$this->config->item('table_name')
@@ -113,7 +113,7 @@ class Gridmaster_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct substring(COL_GRIDSQUARE,1,4) as GRID_SQUARES FROM '
            .$this->config->item('table_name')
@@ -131,7 +131,7 @@ class Gridmaster_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct COL_VUCC_GRIDS as VUCC_GRIDS FROM '
            .$this->config->item('table_name')
@@ -163,7 +163,7 @@ class Gridmaster_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct COL_VUCC_GRIDS as VUCC_GRIDS FROM '
            .$this->config->item('table_name')
@@ -195,7 +195,7 @@ class Gridmaster_model extends CI_Model {
         if (!$logbooks_locations_array) {
             return null;
         }
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+      $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = 'SELECT distinct COL_VUCC_GRIDS as VUCC_GRIDS FROM '
            .$this->config->item('table_name')
diff --git a/application/models/Iota.php b/application/models/Iota.php
index 895298d62..58603e11f 100644
--- a/application/models/Iota.php
+++ b/application/models/Iota.php
@@ -11,7 +11,7 @@ class IOTA extends CI_Model {
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         foreach ($bands as $band) {             	// Looping through bands and iota to generate the array needed for display
             foreach ($iotaArray as $iota) {
@@ -74,9 +74,7 @@ class IOTA extends CI_Model {
             ") and thcv.col_iota is not null
             and (col_qsl_rcvd = 'Y' or col_lotw_qsl_rcvd = 'Y')";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addBandToQuery($band);
 
@@ -97,9 +95,7 @@ class IOTA extends CI_Model {
             where station_id in (' . $location_list .
             ') and thcv.col_iota is not null';
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addBandToQuery($band);
 
@@ -123,7 +119,7 @@ class IOTA extends CI_Model {
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = "select tag, name, prefix, dxccid, status, lat1, lat2, lon1, lon2 from iota where 1=1";
 
@@ -136,19 +132,9 @@ class IOTA extends CI_Model {
         if ($postdata['notworked'] == NULL) {
             $sql .= " and exists (select 1 from " . $this->config->item('table_name') . " where station_id in (". $location_list . ") and col_iota = iota.tag";
 
-			if ($postdata['mode'] != 'All') {
-				$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-			}
+            $sql .= $this->addModeToQuery($postdata['mode']);
 
-            if ($postdata['band'] != 'All') {
-                if ($postdata['band'] == 'SAT') {
-                    $sql .= " and col_prop_mode ='" . $postdata['band'] . "'";
-                }
-                else {
-                    $sql .= " and col_prop_mode !='SAT'";
-                    $sql .= " and col_band ='" . $postdata['band'] . "'";
-                }
-            }
+            $sql .= $this->addBandToQuery($postdata['band']);
             $sql .= ")";
         }
 
@@ -166,9 +152,7 @@ class IOTA extends CI_Model {
             and not exists (select 1 from ". $this->config->item('table_name') . " where station_id in (" . $location_list . ")
             and col_iota = thcv.col_iota";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addBandToQuery($postdata['band']);
 
@@ -180,9 +164,7 @@ class IOTA extends CI_Model {
             $sql .= " and coalesce(iota.status, '') <> 'D'";
         }
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addContinentsToQuery($postdata);
 
@@ -198,9 +180,7 @@ class IOTA extends CI_Model {
             ") and thcv.col_iota is not null
             and (col_qsl_rcvd = 'Y' or col_lotw_qsl_rcvd = 'Y')";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         if ($postdata['includedeleted'] == NULL) {
             $sql .= " and coalesce(iota.status, '') <> 'D'";
@@ -261,7 +241,7 @@ class IOTA extends CI_Model {
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         foreach ($bands as $band) {
             $worked = $this->getSummaryByBand($band, $postdata, $location_list);
@@ -287,28 +267,26 @@ class IOTA extends CI_Model {
         $sql .= " where station_id in (" . $location_list . ")";
 
         if ($band == 'SAT') {
-            $sql .= " and thcv.col_prop_mode ='" . $band . "'";
+            $sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
         } else if ($band == 'All') {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('iota');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+            $bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and thcv.col_band in (" . $bandslots_list . ")" .
 					" and thcv.col_prop_mode !='SAT'";
         } else {
             $sql .= " and thcv.col_prop_mode !='SAT'";
-            $sql .= " and thcv.col_band ='" . $band . "'";
+            $sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
         }
 
         if ($postdata['includedeleted'] == NULL) {
             $sql .= " and coalesce(iota.status, '') <> 'D'";
         }
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addContinentsToQuery($postdata);
 
@@ -325,28 +303,26 @@ class IOTA extends CI_Model {
         $sql .= " where station_id in (" . $location_list . ")";
 
         if ($band == 'SAT') {
-            $sql .= " and thcv.col_prop_mode ='" . $band . "'";
+            $sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
         } else if ($band == 'All') {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('iota');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+            $bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and thcv.col_band in (" . $bandslots_list . ")" .
 					" and thcv.col_prop_mode !='SAT'";
         } else {
             $sql .= " and thcv.col_prop_mode !='SAT'";
-            $sql .= " and thcv.col_band ='" . $band . "'";
+            $sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
         }
 
         if ($postdata['includedeleted'] == NULL) {
             $sql .= " and coalesce(iota.status, '') <> 'D'";
         }
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addContinentsToQuery($postdata);
 
@@ -360,14 +336,23 @@ class IOTA extends CI_Model {
     function addBandToQuery($band) {
         $sql = '';
         if ($band != 'All') {
+            $safeBand = $this->db->escape_str($band);
             if ($band == 'SAT') {
-                $sql .= " and col_prop_mode ='" . $band . "'";
+                $sql .= " and col_prop_mode ='" . $safeBand . "'";
             } else {
                 $sql .= " and col_prop_mode !='SAT'";
-                $sql .= " and col_band ='" . $band . "'";
+                $sql .= " and col_band ='" . $safeBand . "'";
             }
         }
         return $sql;
     }
+
+    function addModeToQuery($mode) {
+        if ($mode == 'All') {
+            return '';
+        }
+        $safeMode = $this->db->escape_str($mode);
+        return " and (col_mode = '" . $safeMode . "' or col_submode = '" . $safeMode . "')";
+    }
 }
 ?>
diff --git a/application/models/Vucc.php b/application/models/Vucc.php
index 1d67bc3a2..5103edef3 100644
--- a/application/models/Vucc.php
+++ b/application/models/Vucc.php
@@ -108,7 +108,7 @@ class VUCC extends CI_Model
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $sql = "select col_vucc_grids
             from " . $this->config->item('table_name') .
@@ -125,14 +125,7 @@ class VUCC extends CI_Model
             $sql .= " and col_lotw_qsl_rcvd='Y'";
         }
 
-        if ($band != 'All') {
-            if ($band == 'SAT') {
-                $sql .= " and col_prop_mode ='" . $band . "'";
-            } else {
-                $sql .= " and col_prop_mode !='SAT'";
-                $sql .= " and col_band ='" . $band . "'";
-            }
-        }
+        $sql .= $this->addBandToQuery($band, false);
 
         $query = $this->db->query($sql);
         return $query->result_array();
@@ -152,7 +145,7 @@ class VUCC extends CI_Model
 		    return null;
 	    }
 
-	    $location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 	    $sql = "select distinct upper(substring(log.col_gridsquare, 1, 4)) gridsquare
 		    from " . $this->config->item('table_name') . " log".
@@ -172,16 +165,7 @@ class VUCC extends CI_Model
 		    $sql .= " and log.col_lotw_qsl_rcvd='Y'";
 	    }
 
-	    if ($band != 'All') {
-		    if ($band == 'SAT') {
-			    $sql .= " and log.col_prop_mode ='" . $band . "'";
-		    } else {
-			    $sql .= " and log.col_prop_mode !='SAT'";
-			    $sql .= " and log.col_band ='" . $band . "'";
-		    }
-	    } else {
-		    $sql .= " and log.col_prop_mode !='SAT'";
-	    }
+        $sql .= $this->addBandToQuery($band, true);
 	    $query = $this->db->query($sql);
 
 	    return $query->result_array();
@@ -334,6 +318,18 @@ class VUCC extends CI_Model
         return $workedGridArray;
     }
 
+    private function addBandToQuery($band, $withLogPrefix) {
+        $prefix = $withLogPrefix ? 'log.' : '';
+        if ($band == 'All') {
+            return " and " . $prefix . "col_prop_mode !='SAT'";
+        }
+        $safeBand = $this->db->escape_str($band);
+        if ($band == 'SAT') {
+            return " and " . $prefix . "col_prop_mode ='" . $safeBand . "'";
+        }
+        return " and " . $prefix . "col_prop_mode !='SAT' and " . $prefix . "col_band ='" . $safeBand . "'";
+    }
+
     /*
     * Builds the array to display worked/confirmed vucc on dashboard page
     */
diff --git a/application/models/Waja.php b/application/models/Waja.php
index 592cd9b48..ae21d9419 100644
--- a/application/models/Waja.php
+++ b/application/models/Waja.php
@@ -62,7 +62,7 @@ class WAJA extends CI_Model {
             return null;
         }
 
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $wajaArray = explode(',', $this->prefectureString);
 
@@ -150,9 +150,7 @@ class WAJA extends CI_Model {
 
 		$sql .= $this->addBandToQuery($band);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= $this->addQslToQuery($postdata);
 
@@ -179,9 +177,7 @@ class WAJA extends CI_Model {
 
 		$sql .= $this->addBandToQuery($band);
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
 		$sql .= " group by col_dxcc
 				) x on dxcc_entities.adif = x.col_dxcc";;
@@ -200,16 +196,25 @@ class WAJA extends CI_Model {
 	function addBandToQuery($band) {
         $sql = '';
         if ($band != 'All') {
+            $safeBand = $this->db->escape_str($band);
             if ($band == 'SAT') {
-                $sql .= " and col_prop_mode ='" . $band . "'";
+				$sql .= " and col_prop_mode ='" . $safeBand . "'";
             } else {
                 $sql .= " and col_prop_mode !='SAT'";
-                $sql .= " and col_band ='" . $band . "'";
+				$sql .= " and col_band ='" . $safeBand . "'";
             }
         }
         return $sql;
     }
 
+	function addModeToQuery($mode) {
+		if ($mode == 'All') {
+			return '';
+		}
+		$safeMode = $this->db->escape_str($mode);
+		return " and (col_mode = '" . $safeMode . "' or col_submode = '" . $safeMode . "')";
+	}
+
 	/*
      * Function returns all worked, but not confirmed states
      * $postdata contains data from the form, in this case Lotw or QSL are used
@@ -218,9 +223,7 @@ class WAJA extends CI_Model {
         $sql = "SELECT distinct LPAD(col_state, 2, '0') AS col_state FROM " . $this->config->item('table_name') . " thcv
         where station_id in (" . $location_list . ")";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addStateToQuery();
 
@@ -230,9 +233,7 @@ class WAJA extends CI_Model {
             " where station_id in (". $location_list . ")" .
             " and col_state = thcv.col_state";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addBandToQuery($band);
 
@@ -255,9 +256,7 @@ class WAJA extends CI_Model {
         $sql = "SELECT distinct LPAD(col_state, 2, '0') AS col_state FROM " . $this->config->item('table_name') . " thcv
             where station_id in (" . $location_list . ")";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addStateToQuery();
 
@@ -305,7 +304,7 @@ class WAJA extends CI_Model {
 			return null;
 		}
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		foreach ($bands as $band) {
 			$worked = $this->getSummaryByBand($band, $postdata, $location_list);
@@ -330,23 +329,21 @@ class WAJA extends CI_Model {
         $sql .= " where station_id in (" . $location_list . ")";
 
         if ($band == 'SAT') {
-            $sql .= " and thcv.col_prop_mode ='" . $band . "'";
+			$sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
         } else if ($band == 'All') {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('waja');
 
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 
 			$sql .= " and (thcv.col_band in (" . $bandslots_list . ") or thcv.col_prop_mode ='SAT')";
         } else {
             $sql .= " and thcv.col_prop_mode !='SAT'";
-            $sql .= " and thcv.col_band ='" . $band . "'";
+			$sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
         }
 
-        if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addStateToQuery();
 
@@ -362,23 +359,21 @@ class WAJA extends CI_Model {
         $sql .= " where station_id in (" . $location_list . ")";
 
         if ($band == 'SAT') {
-            $sql .= " and thcv.col_prop_mode ='" . $band . "'";
+			$sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
         } else if ($band == 'All') {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('waja');
 
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 
 			$sql .= " and (thcv.col_band in (" . $bandslots_list . ") or thcv.col_prop_mode ='SAT')";
         } else {
             $sql .= " and thcv.col_prop_mode !='SAT'";
-            $sql .= " and thcv.col_band ='" . $band . "'";
+			$sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
         }
 
-        if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+		$sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addQslToQuery($postdata);
 
diff --git a/application/models/Was.php b/application/models/Was.php
index f53e8638f..1cec90e5d 100644
--- a/application/models/Was.php
+++ b/application/models/Was.php
@@ -13,7 +13,7 @@ class was extends CI_Model {
             return null;
         }
 
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         $stateArray = explode(',', $this->stateString);
 
@@ -103,7 +103,7 @@ class was extends CI_Model {
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         foreach ($bands as $band) {
             $worked = $this->getSummaryByBand($band, $postdata, $location_list);
@@ -128,24 +128,22 @@ class was extends CI_Model {
         $sql .= " where station_id in (" . $location_list . ")";
 
         if ($band == 'SAT') {
-            $sql .= " and thcv.col_prop_mode ='" . $band . "'";
+            $sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
         } else if ($band == 'All') {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('was');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+            $bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and thcv.col_band in (" . $bandslots_list . ")" .
 					" and thcv.col_prop_mode !='SAT'";
         } else {
             $sql .= " and thcv.col_prop_mode !='SAT'";
-            $sql .= " and thcv.col_band ='" . $band . "'";
+            $sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
         }
 
-        if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addStateToQuery();
 
@@ -161,24 +159,22 @@ class was extends CI_Model {
         $sql .= " where station_id in (" . $location_list . ")";
 
         if ($band == 'SAT') {
-            $sql .= " and thcv.col_prop_mode ='" . $band . "'";
+            $sql .= " and thcv.col_prop_mode ='" . $this->db->escape_str($band) . "'";
         } else if ($band == 'All') {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('was');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+            $bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and thcv.col_band in (" . $bandslots_list . ")" .
 					" and thcv.col_prop_mode !='SAT'";
         } else {
             $sql .= " and thcv.col_prop_mode !='SAT'";
-            $sql .= " and thcv.col_band ='" . $band . "'";
+            $sql .= " and thcv.col_band ='" . $this->db->escape_str($band) . "'";
         }
 
-        if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addQslToQuery($postdata);
 
@@ -197,9 +193,7 @@ class was extends CI_Model {
         $sql = "SELECT distinct col_state FROM " . $this->config->item('table_name') . " thcv
         where station_id in (" . $location_list . ")";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addStateToQuery();
 
@@ -209,9 +203,7 @@ class was extends CI_Model {
             " where station_id in (". $location_list . ")" .
             " and col_state = thcv.col_state";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addBandToQuery($band);
 
@@ -234,9 +226,7 @@ class was extends CI_Model {
         $sql = "SELECT distinct col_state FROM " . $this->config->item('table_name') . " thcv
             where station_id in (" . $location_list . ")";
 
-		if ($postdata['mode'] != 'All') {
-			$sql .= " and (col_mode = '" . $postdata['mode'] . "' or col_submode = '" . $postdata['mode'] . "')";
-		}
+        $sql .= $this->addModeToQuery($postdata['mode']);
 
         $sql .= $this->addStateToQuery();
 
@@ -272,18 +262,19 @@ class was extends CI_Model {
     function addBandToQuery($band) {
         $sql = '';
         if ($band != 'All') {
+            $safeBand = $this->db->escape_str($band);
             if ($band == 'SAT') {
-                $sql .= " and col_prop_mode ='" . $band . "'";
+                $sql .= " and col_prop_mode ='" . $safeBand . "'";
             } else {
                 $sql .= " and col_prop_mode !='SAT'";
-                $sql .= " and col_band ='" . $band . "'";
+                $sql .= " and col_band ='" . $safeBand . "'";
             }
         } else {
             $this->load->model('bands');
 
 			$bandslots = $this->bands->get_worked_bands('was');
 	
-			$bandslots_list = "'".implode("','",$bandslots)."'";
+			$bandslots_list = "'".implode("','", array_map(array($this->db, 'escape_str'), $bandslots))."'";
 			
 			$sql .= " and col_band in (" . $bandslots_list . ")" .
 					" and col_prop_mode !='SAT'";
@@ -291,6 +282,14 @@ class was extends CI_Model {
         return $sql;
     }
 
+    function addModeToQuery($mode) {
+        if ($mode == 'All') {
+            return '';
+        }
+        $safeMode = $this->db->escape_str($mode);
+        return " and (col_mode = '" . $safeMode . "' or col_submode = '" . $safeMode . "')";
+    }
+
     function addStateToQuery() {
         $sql = '';
         $sql .= " and COL_DXCC in ('291', '6', '110')";