diff --git a/filter/mediaplugin/filter.php b/filter/mediaplugin/filter.php
index 5df366cdb44..c557db0442f 100644
--- a/filter/mediaplugin/filter.php
+++ b/filter/mediaplugin/filter.php
@@ -36,39 +36,39 @@ function mediaplugin_filter($courseid, $text) {
     $newtext = $text; // fullclone is slow and not needed here
 
     if ($CFG->filter_mediaplugin_enable_mp3) {
-        $search = '/<a.*?href="([^<]+\.mp3)"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.mp3)"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_mp3_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_ogg) {
-        $search =   '/<a[^>]*?href="([^<]+\.ogg)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a[^>]*?href="([^"]+\.ogg)"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogg_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_ogv) {
-        $search =   '/<a[^>]*?href="([^<]+\.ogv)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a[^>]*?href="([^"]+\.ogv)"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogv_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_swf) {
-        $search = '/<a.*?href="([^<]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_swf_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_flv) {
-        $search = '/<a.*?href="([^<]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_flv_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_mov) {
-        $search = '/<a.*?href="([^<]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
 
         // MDL-18658
-        $search = '/<a.*?href="([^<]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
 
-        $search = '/<a.*?href="([^<]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
 
         $search = '/<a.*?href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
@@ -76,40 +76,40 @@ function mediaplugin_filter($courseid, $text) {
     }
 
     if ($CFG->filter_mediaplugin_enable_wmv) {
-        $search = '/<a.*?href="([^<]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_mpg) {
-        $search = '/<a.*?href="([^<]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_avi) {
-        $search = '/<a.*?href="([^<]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_ram) {
-        $search = '/<a.*?href="([^<]+\.ram)"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.ram)"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_rpm) {
-        $search = '/<a.*?href="([^<]+\.rpm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.rpm)"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
     }
 
     if ($CFG->filter_mediaplugin_enable_rm) {
-        $search = '/<a.*?href="([^<]+\.rm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a.*?href="([^"]+\.rm)"[^>]*>.*?<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
     }
 
     if (!empty($CFG->filter_mediaplugin_enable_youtube)) {
-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a[^>]*?href="([^"]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);
 
-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a[^>]*?href="([^"]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
         $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);
     }
 
@@ -241,7 +241,7 @@ function mediaplugin_filter_flv_callback($link) {
 '<span class="mediaplugin mediaplugin_flv" id="'.$id.'">('.get_string('flashvideo', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$jsurl.'",
     width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
     allowscriptaccess:"never", quality: "high", allowfullscreen: "true" };
   UFO.create(FO, "'.$id.'");
@@ -285,9 +285,9 @@ document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" wi
  */
 function mediaplugin_filter_youtube_callback($link, $autostart=false) {
 
-    $site = addslashes_js($link[1]);
+    $site = s($link[1]);
     $url = $link[2];
-    $info = addslashes_js($link[3]);
+    $info = s($link[3]);
 
     return '<span class="mediaplugin mediaplugin_youtube">'.
            '<object title="'.$info.'"