diff --git a/mod/feedback/complete.php b/mod/feedback/complete.php
index c4d72b71d67..f62d7444f29 100644
--- a/mod/feedback/complete.php
+++ b/mod/feedback/complete.php
@@ -241,7 +241,7 @@
                 $tracking->completed = $new_completed_id;
                 $DB->insert_record('feedback_tracking', $tracking);
                 unset($SESSION->feedback->is_started);
-                
+
                 // Update completion state
                 $completion = new completion_info($course);
                 if ($completion->is_enabled($cm) && $feedback->completionsubmit) {
@@ -434,7 +434,8 @@
                         //get the value
                         $frmvaluename = $feedbackitem->typ . '_'. $feedbackitem->id;
                         if(isset($savereturn)) {
-                            $value =  isset($formdata->{$frmvaluename})?$formdata->{$frmvaluename}:NULL;
+                            $value = isset($formdata->{$frmvaluename})?$formdata->{$frmvaluename}:NULL;
+                            $value = feedback_clean_input_value($feedbackitem, $value);
                         }else {
                             if(isset($feedbackcompletedtmp->id)) {
                                 $value = feedback_get_item_value($feedbackcompletedtmp->id, $feedbackitem->id, true);
diff --git a/mod/feedback/complete_guest.php b/mod/feedback/complete_guest.php
index 99c530f41ce..81c68667e25 100644
--- a/mod/feedback/complete_guest.php
+++ b/mod/feedback/complete_guest.php
@@ -54,7 +54,7 @@
 
     //if the use hit enter into a textfield so the form should not submit
     if(isset($formdata->sesskey) AND !isset($formdata->savevalues) AND !isset($formdata->gonextpage) AND !isset($formdata->gopreviouspage)) {
-        $gopage = $formdata->lastpage;
+        $gopage = (int)$formdata->lastpage;
     }
     if(isset($formdata->savevalues)) {
         $savevalues = true;
@@ -383,7 +383,8 @@
                         //get the value
                         $frmvaluename = $feedbackitem->typ . '_'. $feedbackitem->id;
                         if(isset($savereturn)) {
-                            $value =  isset($formdata->{$frmvaluename})?$formdata->{$frmvaluename}:NULL;
+                            $value = isset($formdata->{$frmvaluename})?$formdata->{$frmvaluename}:NULL;
+                            $value = feedback_clean_input_value($feedbackitem, $value);
                         }else {
                             if(isset($feedbackcompletedtmp->id)) {
                                 $value = feedback_get_item_value($feedbackcompletedtmp->id, $feedbackitem->id, sesskey());
diff --git a/mod/feedback/item/captcha/lib.php b/mod/feedback/item/captcha/lib.php
index 0dcca48e483..8f6ade08ac2 100644
--- a/mod/feedback/item/captcha/lib.php
+++ b/mod/feedback/item/captcha/lib.php
@@ -280,4 +280,8 @@ class feedback_item_captcha extends feedback_item_base {
     function can_switch_require() {
         return false;
     }
+
+    function clean_input_value($value) {
+        return clean_param($value, PARAM_RAW);
+    }
 }
diff --git a/mod/feedback/item/feedback_item_class.php b/mod/feedback/item/feedback_item_class.php
index ddcfcd71496..437c82066a8 100644
--- a/mod/feedback/item/feedback_item_class.php
+++ b/mod/feedback/item/feedback_item_class.php
@@ -104,6 +104,14 @@ abstract class feedback_item_base {
      */
     abstract function print_item_show_value($item, $value = '');
 
+    /**
+     * cleans the userinput while submitting the form
+     *
+     * @param mixed $value
+     * @return mixed
+     */
+    abstract function clean_input_value($value);
+
 }
 
 //a dummy class to realize pagebreaks
@@ -129,6 +137,7 @@ class feedback_item_pagebreak extends feedback_item_base {
     function print_item_complete($item, $value = '', $highlightrequire = false) {}
     function print_item_show_value($item, $value = '') {}
     function can_switch_require(){}
+    function clean_input_value($value){}
 
 }
 
diff --git a/mod/feedback/item/info/lib.php b/mod/feedback/item/info/lib.php
index cefe0003d01..84222d0bd4c 100644
--- a/mod/feedback/item/info/lib.php
+++ b/mod/feedback/item/info/lib.php
@@ -323,4 +323,8 @@ class feedback_item_info extends feedback_item_base {
     function can_switch_require() {
         return false;
     }
+
+    function clean_input_value($value) {
+        return clean_param($value, PARAM_INT);
+    }
 }
diff --git a/mod/feedback/item/label/lib.php b/mod/feedback/item/label/lib.php
index f1beca5ac2b..be51d4f7819 100644
--- a/mod/feedback/item/label/lib.php
+++ b/mod/feedback/item/label/lib.php
@@ -233,4 +233,8 @@ class feedback_item_label extends feedback_item_base {
     function print_analysed($item, $itemnr = '', $groupid = false, $courseid = false) {}
     function get_printval($item, $value) {}
     function get_analysed($item, $groupid = false, $courseid = false) {}
+
+    function clean_input_value($value) {
+        return '';
+    }
 }
diff --git a/mod/feedback/item/multichoice/lib.php b/mod/feedback/item/multichoice/lib.php
index cb5cb8f1e42..673f8aa4ca1 100644
--- a/mod/feedback/item/multichoice/lib.php
+++ b/mod/feedback/item/multichoice/lib.php
@@ -710,8 +710,11 @@ class feedback_item_multichoice extends feedback_item_base {
         return false;
     }
 
-
     function can_switch_require() {
         return true;
     }
+
+    function clean_input_value($value) {
+        return clean_param($value, PARAM_INT);
+    }
 }
diff --git a/mod/feedback/item/multichoicerated/lib.php b/mod/feedback/item/multichoicerated/lib.php
index e803cd62ec9..2dbd6e52ae5 100644
--- a/mod/feedback/item/multichoicerated/lib.php
+++ b/mod/feedback/item/multichoicerated/lib.php
@@ -589,4 +589,7 @@ class feedback_item_multichoicerated extends feedback_item_base {
         return true;
     }
 
+    function clean_input_value($value) {
+        return clean_param($value, PARAM_INT);
+    }
 }
diff --git a/mod/feedback/item/numeric/lib.php b/mod/feedback/item/numeric/lib.php
index cf646d1348d..168fb31dc2b 100644
--- a/mod/feedback/item/numeric/lib.php
+++ b/mod/feedback/item/numeric/lib.php
@@ -282,16 +282,16 @@ class feedback_item_numeric extends feedback_item_base {
             }
             echo '</span>';
         echo '</div>';
-        
+
         //print the presentation
         echo '<div class="feedback_item_presentation_'.$align.$highlight.'">';
         echo '<span class="feedback_item_textfield">';
-        echo '<input type="text" name="'.$item->typ.'_'.$item->id.'" size="10" maxlength="10" value="'.($value ? $value : '').'" />';
+        echo '<input type="text" name="'.$item->typ.'_'.$item->id.'" size="10" maxlength="10" value="'.$value.'" />';
         echo '</span>';
         echo '</div>';
     }
 
-    /**     
+    /**
      * print the item at the complete-page of feedback
      *
      * @global object
@@ -416,8 +416,15 @@ class feedback_item_numeric extends feedback_item_base {
     function get_hasvalue() {
         return 1;
     }
-    
+
     function can_switch_require() {
         return true;
     }
+
+    function clean_input_value($value) {
+        if (!is_numeric($value)) {
+            return null;
+        }
+        return clean_param($value, PARAM_FLOAT);
+    }
 }
diff --git a/mod/feedback/item/textarea/lib.php b/mod/feedback/item/textarea/lib.php
index 1b4cd134423..6c26ef6bf95 100644
--- a/mod/feedback/item/textarea/lib.php
+++ b/mod/feedback/item/textarea/lib.php
@@ -215,7 +215,7 @@ class feedback_item_textarea extends feedback_item_base {
         //print the presentation
         echo '<div class="feedback_item_presentation_'.$align.$highlight.'">';
         echo '<span class="feedback_item_textarea">';
-        echo '<textarea name="'.$item->typ.'_'.$item->id.'" cols="'.$presentation[0].'" rows="'.$presentation[1].'">'.($value ? htmlspecialchars($value) : '').'</textarea>';
+        echo '<textarea name="'.$item->typ.'_'.$item->id.'" cols="'.$presentation[0].'" rows="'.$presentation[1].'">'.$value.'</textarea>';
         echo '</span>';
         echo '</div>';
     }
@@ -255,7 +255,7 @@ class feedback_item_textarea extends feedback_item_base {
     }
 
     function create_value($data) {
-        $data = clean_text($data);
+        $data = s($data);
         return $data;
     }
 
@@ -280,4 +280,8 @@ class feedback_item_textarea extends feedback_item_base {
     function can_switch_require() {
         return true;
     }
+
+    function clean_input_value($value) {
+        return s($value);
+    }
 }
diff --git a/mod/feedback/item/textfield/lib.php b/mod/feedback/item/textfield/lib.php
index 74f9b88657f..efb844b7d4d 100644
--- a/mod/feedback/item/textfield/lib.php
+++ b/mod/feedback/item/textfield/lib.php
@@ -211,7 +211,7 @@ class feedback_item_textfield extends feedback_item_base {
         //print the presentation
         echo '<div class="feedback_item_presentation_'.$align.$highlight.'">';
         echo '<span class="feedback_item_textfield">';
-        echo '<input type="text" name="'.$item->typ.'_'.$item->id.'" size="'.$presentation[0].'" maxlength="'.$presentation[1].'" value="'.($value ? htmlspecialchars($value) : '').'" />';
+        echo '<input type="text" name="'.$item->typ.'_'.$item->id.'" size="'.$presentation[0].'" maxlength="'.$presentation[1].'" value="'.$value.'" />';
         echo '</span>';
         echo '</div>';
     }
@@ -249,7 +249,7 @@ class feedback_item_textfield extends feedback_item_base {
     }
 
     function create_value($data) {
-        $data = clean_text($data);
+        $data = s($data);
         return $data;
     }
 
@@ -274,4 +274,8 @@ class feedback_item_textfield extends feedback_item_base {
     function can_switch_require() {
         return true;
     }
+
+    function clean_input_value($value) {
+        return s($value);
+    }
 }
diff --git a/mod/feedback/lib.php b/mod/feedback/lib.php
index 5ecf3d0ac6c..fe058043356 100644
--- a/mod/feedback/lib.php
+++ b/mod/feedback/lib.php
@@ -1927,6 +1927,17 @@ function feedback_get_page_to_continue($feedbackid, $courseid = false, $guestid
 //functions to handle the values
 ////////////////////////////////////////////////
 
+/**
+ * cleans the userinput while submitting the form.
+ *
+ * @param mixed $value
+ * @return mixed
+ */
+function feedback_clean_input_value($item, $value) {
+    $itemobj = feedback_get_item_class($item->typ);
+    return $itemobj->clean_input_value($value);
+}
+
 /**
  * this saves the values of an completed.
  * if the param $tmp is set true so the values are saved temporary in table feedback_valuetmp.