diff --git a/lib/editor/htmlarea.php b/lib/editor/htmlarea.php
index 3d6a58db785..2c74eb3bd11 100644
--- a/lib/editor/htmlarea.php
+++ b/lib/editor/htmlarea.php
@@ -1,6 +1,8 @@
 <?php
     include("../../config.php");
 
+    $id = optional_param('id', 0, PARAM_INT);
+
     $lastmodified = filemtime("htmlarea.php");
     $lifetime = 1800;
 
diff --git a/lib/editor/popups/insert_image.php b/lib/editor/popups/insert_image.php
index eb2cd3ad996..329997d2010 100644
--- a/lib/editor/popups/insert_image.php
+++ b/lib/editor/popups/insert_image.php
@@ -2,7 +2,7 @@
 
     include("../../../config.php");
 
-    require_variable($id);
+    $id = required_param('id', PARAM_INT);
 
     if (!$course = get_record("course", "id", $id)) {
         $course->fullname = "";   // Just to keep display happy, though browsing may fail
diff --git a/lib/editor/popups/insert_image_std.php b/lib/editor/popups/insert_image_std.php
index 81547a64689..c986933fa97 100644
--- a/lib/editor/popups/insert_image_std.php
+++ b/lib/editor/popups/insert_image_std.php
@@ -2,7 +2,7 @@
 
     include("../../../config.php");
 
-    require_variable($id);
+    $id = required_param('id', PARAM_INT);
 
     if (!$course = get_record("course", "id", $id)) {
         $course->fullname = "";   // Just to keep display happy, though browsing may fail
diff --git a/lib/editor/popups/link.php b/lib/editor/popups/link.php
index 8109757c634..bdb056313be 100644
--- a/lib/editor/popups/link.php
+++ b/lib/editor/popups/link.php
@@ -1,9 +1,7 @@
 <?php // $Id$
     include("../../../config.php");
 
-    $id = $_GET['id'];
-
-    require_variable($id);
+    $id = required_param('id', PARAM_INT);
 
     if (!$course = get_record("course", "id", $id)) {
         $course->fullname = "";   // Just to keep display happy, though browsing may fail
diff --git a/lib/editor/popups/link_std.php b/lib/editor/popups/link_std.php
index 503ed5ed2f6..beee05dc961 100644
--- a/lib/editor/popups/link_std.php
+++ b/lib/editor/popups/link_std.php
@@ -1,7 +1,7 @@
 <?php // $Id$
     include("../../../config.php");
 
-    $id = required_param('id');
+    $id = required_param('id', PARAM_INT);
 
     if ($course = get_record("course", "id", $id)) {
         $isteacher = isteacher($course->id);