diff --git a/blog/index.php b/blog/index.php
index 0398a015ad5..d479c24ff9b 100755
--- a/blog/index.php
+++ b/blog/index.php
@@ -165,7 +165,7 @@ if (empty($courseid)) {
 
 include($CFG->dirroot .'/blog/header.php');
 
-blog_print_html_formatted_entries($postid, $filtertype, $filterselect, $tagid, $tag);
+blog_print_html_formatted_entries($postid, $filtertype, $filterselect, $tagid, stripslashes($tag));
 
 add_to_log($courseid, 'blog', 'view', 'index.php?filtertype='.$filtertype.'&filterselect='.$filterselect.'&postid='.$postid.'&tagid='.$tagid.'&tag='.$tag, 'view blog entry');
 
diff --git a/blog/lib.php b/blog/lib.php
index 87ff76c0c18..d038b6d3524 100755
--- a/blog/lib.php
+++ b/blog/lib.php
@@ -495,7 +495,7 @@
         if ($tagid) {
             $tag = $tagid;
         } else if ($tag) {
-            if ($tagrec = get_record_sql('SELECT * FROM '.$CFG->prefix.'tag WHERE name LIKE "'.$tag.'"')) {
+            if ($tagrec = get_record_sql('SELECT * FROM '.$CFG->prefix.'tag WHERE name LIKE "'.addslashes($tag).'"')) {
                 $tag = $tagrec->id;
             } else {
                 $tag = -1;    //no records found
diff --git a/lib/db/upgrade.php b/lib/db/upgrade.php
index 5f1f5097e06..3dec7a42383 100644
--- a/lib/db/upgrade.php
+++ b/lib/db/upgrade.php
@@ -1780,7 +1780,7 @@ function xmldb_main_upgrade($oldversion=0) {
                 $raw_normalized = clean_param($oldtag->text, PARAM_TAG);
                 $normalized     = moodle_strtolower($raw_normalized);
                 // if this tag does not exist in tag table yet
-                if (!$newtag = get_record('tag', 'name', $normalized, '', '', '', '', 'id')) {
+                if (!$newtag = get_record('tag', 'name', addslashes($normalized), '', '', '', '', 'id')) {
                     $itag = new object();
                     $itag->name         = $normalized;
                     $itag->rawname      = $raw_normalized;
@@ -1793,7 +1793,7 @@ function xmldb_main_upgrade($oldversion=0) {
                         $itag->tagtype  = 'default';
                     }
 
-                    if ($idx = insert_record('tag', $itag)) {
+                    if ($idx = insert_record('tag', addslashes_recursive($itag))) {
                         $tagrefs[$oldtag->id] = $idx;
                     }
                 // if this tag is already used by tag table