diff --git a/auth/db/tests/db_test.php b/auth/db/tests/db_test.php
index e0d68d3462c..b36ce63b59b 100644
--- a/auth/db/tests/db_test.php
+++ b/auth/db/tests/db_test.php
@@ -456,7 +456,7 @@ class auth_db_testcase extends advanced_testcase {
         $user3->username = 'john%#&~%*_doe';
         $user3->email = ' john@testing.com ';
         $user3->deleted = 'no';
-        $user3->description = '<b>A description <script>alert(123)</script>about myself.</b>';
+        $user3->description = '<b>A description about myself.</b>';
         $user3cleaned = $auth->clean_data($user3);
 
         // Expected results.
diff --git a/lib/classes/user.php b/lib/classes/user.php
index 07c1faf302b..83288cb858c 100644
--- a/lib/classes/user.php
+++ b/lib/classes/user.php
@@ -293,15 +293,15 @@ class core_user {
         // Every new field on the user table should be added here otherwise it won't be validated.
         $fields = array();
         $fields['id'] = array('type' => PARAM_INT);
-        $fields['auth'] = array('type' => PARAM_NOTAGS);
+        $fields['auth'] = array('type' => PARAM_AUTH);
         $fields['confirmed'] = array('type' => PARAM_BOOL);
         $fields['policyagreed'] = array('type' => PARAM_BOOL);
         $fields['deleted'] = array('type' => PARAM_BOOL);
         $fields['suspended'] = array('type' => PARAM_BOOL);
-        $fields['mnethostid'] = array('type' => PARAM_BOOL);
+        $fields['mnethostid'] = array('type' => PARAM_INT);
         $fields['username'] = array('type' => PARAM_USERNAME);
-        $fields['password'] = array('type' => PARAM_NOTAGS);
-        $fields['idnumber'] = array('type' => PARAM_NOTAGS);
+        $fields['password'] = array('type' => PARAM_RAW);
+        $fields['idnumber'] = array('type' => PARAM_RAW);
         $fields['firstname'] = array('type' => PARAM_NOTAGS);
         $fields['lastname'] = array('type' => PARAM_NOTAGS);
         $fields['surname'] = array('type' => PARAM_NOTAGS);
@@ -318,20 +318,20 @@ class core_user {
         $fields['department'] = array('type' => PARAM_TEXT);
         $fields['address'] = array('type' => PARAM_TEXT);
         $fields['city'] = array('type' => PARAM_TEXT);
-        $fields['country'] = array('type' => PARAM_TEXT);
-        $fields['lang'] = array('type' => PARAM_TEXT);
+        $fields['country'] = array('type' => PARAM_ALPHA);
+        $fields['lang'] = array('type' => PARAM_LANG);
         $fields['calendartype'] = array('type' => PARAM_NOTAGS);
-        $fields['theme'] = array('type' => PARAM_NOTAGS);
-        $fields['timezones'] = array('type' => PARAM_TEXT);
+        $fields['theme'] = array('type' => PARAM_THEME);
+        $fields['timezone'] = array('type' => PARAM_TIMEZONE);
         $fields['firstaccess'] = array('type' => PARAM_INT);
         $fields['lastaccess'] = array('type' => PARAM_INT);
         $fields['lastlogin'] = array('type' => PARAM_INT);
         $fields['currentlogin'] = array('type' => PARAM_INT);
         $fields['lastip'] = array('type' => PARAM_NOTAGS);
-        $fields['secret'] = array('type' => PARAM_TEXT);
+        $fields['secret'] = array('type' => PARAM_RAW);
         $fields['picture'] = array('type' => PARAM_INT);
         $fields['url'] = array('type' => PARAM_URL);
-        $fields['description'] = array('type' => PARAM_CLEANHTML);
+        $fields['description'] = array('type' => PARAM_RAW);
         $fields['descriptionformat'] = array('type' => PARAM_INT);
         $fields['mailformat'] = array('type' => PARAM_INT);
         $fields['maildigest'] = array('type' => PARAM_INT);