diff --git a/mod/scorm/api.php b/mod/scorm/api.php
index 97b4c3817e8..b90f1ac7c84 100644
--- a/mod/scorm/api.php
+++ b/mod/scorm/api.php
@@ -35,9 +35,11 @@
 
     require_login($course->id, false, $cm);
     
-    if ($usertrack=scorm_get_tracks($scoid,$USER->id,$attempt)) {
+    if ($usertrack = scorm_get_tracks($scoid,$USER->id,$attempt)) {
         if ((isset($usertrack->{'cmi.exit'}) && ($usertrack->{'cmi.exit'} != 'time-out')) || ($scorm->version != "SCORM_1.3")) {
-            $userdata = $usertrack;
+            foreach ($usertrack as $key => $value) {
+                $userdata->$key = addslashes_js($value);
+            }
         } else {
             $userdata->status = '';
             $userdata->score_raw = '';
@@ -46,8 +48,8 @@
         $userdata->status = '';
         $userdata->score_raw = '';
     }
-    $userdata->student_id = addslashes($USER->username);
-    $userdata->student_name = addslashes($USER->lastname .', '. $USER->firstname);
+    $userdata->student_id = addslashes_js($USER->username);
+    $userdata->student_name = addslashes_js($USER->lastname .', '. $USER->firstname);
     $userdata->mode = 'normal';
     if (isset($mode)) {
         $userdata->mode = $mode;
@@ -59,7 +61,7 @@
     }    
     if ($scodatas = scorm_get_sco($scoid, SCO_DATA)) {
         foreach ($scodatas as $key => $value) {
-            $userdata->$key = $value;
+            $userdata->$key = addslashes_js($value);
         }
     } else {
         error('Sco not found');
@@ -74,6 +76,6 @@
 
 var errorCode = "0";
 function underscore(str) {
-    str = str.replace(/.N/g,".");
+    str = String(str).replace(/.N/g,".");
     return str.replace(/\./g,"__");
 }
diff --git a/mod/scorm/datamodels/aicc.js.php b/mod/scorm/datamodels/aicc.js.php
index 073d2869d4c..e061f812d10 100644
--- a/mod/scorm/datamodels/aicc.js.php
+++ b/mod/scorm/datamodels/aicc.js.php
@@ -16,9 +16,8 @@
 //
 function AICCapi() {
     // Standard Data Type Definition
-    CMIString256 = '^.{0,255}$';
-    //CMIString4096 = '^[.|\\n|\\r]{0,4095}$';
-    CMIString4096 = '^.{0,4096}$';
+    CMIString256 = '^[\\u0000-\\uffff]{0,255}$';
+    CMIString4096 = '^[\\u0000-\\uffff]{0,4096}$';
     CMITime = '^([0-2]{1}[0-9]{1}):([0-5]{1}[0-9]{1}):([0-5]{1}[0-9]{1})(\.[0-9]{1,2})?$';
     CMITimespan = '^([0-9]{2,4}):([0-9]{2}):([0-9]{2})(\.[0-9]{1,2})?$';
     CMIInteger = '^\\d+$';
@@ -126,6 +125,8 @@ function AICCapi() {
         cmi.student_data = new Object();
         cmi.student_preference = new Object();
         cmi.interactions = new Object();
+        cmi.evaluation = new Object();
+        cmi.evaluation.comments = new Object();
 
     // Navigation Object
     var nav = new Object();
@@ -224,10 +225,10 @@ function AICCapi() {
         if (Initialized) {
             if (element !="") {
                 expression = new RegExp(CMIIndex,'g');
-                elementmodel = element.replace(expression,'.n.');
+                elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'w') {
-                            element = element.replace(expression, "_$1.");
+                            element = String(element).replace(expression, "_$1.");
                             elementIndexes = element.split('.');
                         subelement = 'cmi';
                         i = 1;
@@ -278,7 +279,7 @@ function AICCapi() {
         if (Initialized) {
             if (element != "") {
                 expression = new RegExp(CMIIndex,'g');
-                elementmodel = element.replace(expression,'.n.');
+                elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'r') {
                         expression = new RegExp(eval('datamodel["'+elementmodel+'"].format'));
@@ -474,7 +475,7 @@ function AICCapi() {
             } else {
                 element = parent+'.'+property;
                 expression = new RegExp(CMIIndex,'g');
-                elementmodel = element.replace(expression,'.n.');
+                elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'r') {
                         elementstring = '&'+underscore(element)+'='+escape(data[property]);
diff --git a/mod/scorm/datamodels/scorm_12.js.php b/mod/scorm/datamodels/scorm_12.js.php
index 7f0fb2e456f..cb7e433a0bd 100644
--- a/mod/scorm/datamodels/scorm_12.js.php
+++ b/mod/scorm/datamodels/scorm_12.js.php
@@ -16,10 +16,8 @@
 //
 function SCORMapi1_2() {
     // Standard Data Type Definition
-    CMIString256 = '^.{0,255}$';
-    CMIString4096 = '^.{0,4096}$';
-    //CMIString256 = '^[\.|\\n|\\r]{0,255}$';
-    //CMIString4096 = '^[\.|\\n|\\r]{0,4095}$';
+    CMIString256 = '^[\\u0000-\\uffff]{0,255}$';
+    CMIString4096 = '^[\\u0000-\\uffff]{0,4096}$';
     CMITime = '^([0-2]{1}[0-9]{1}):([0-5]{1}[0-9]{1}):([0-5]{1}[0-9]{1})(\.[0-9]{1,2})?$';
     CMITimespan = '^([0-9]{2,4}):([0-9]{2}):([0-9]{2})(\.[0-9]{1,2})?$';
     CMIInteger = '^\\d+$';
@@ -55,7 +53,7 @@ function SCORMapi1_2() {
         'cmi._version':{'defaultvalue':'3.4', 'mod':'r', 'writeerror':'402'},
         'cmi.core._children':{'defaultvalue':core_children, 'mod':'r', 'writeerror':'402'},
         'cmi.core.student_id':{'defaultvalue':'<?php echo $userdata->student_id ?>', 'mod':'r', 'writeerror':'403'},
-        'cmi.core.student_name':{'defaultvalue':'<?php echo addslashes($userdata->student_name) ?>', 'mod':'r', 'writeerror':'403'},
+        'cmi.core.student_name':{'defaultvalue':'<?php echo $userdata->student_name ?>', 'mod':'r', 'writeerror':'403'},
         'cmi.core.lesson_location':{'defaultvalue':'<?php echo isset($userdata->{'cmi.core.lesson_location'})?$userdata->{'cmi.core.lesson_location'}:'' ?>', 'format':CMIString256, 'mod':'rw', 'writeerror':'405'},
         'cmi.core.credit':{'defaultvalue':'<?php echo $userdata->credit ?>', 'mod':'r', 'writeerror':'403'},
         'cmi.core.lesson_status':{'defaultvalue':'<?php echo isset($userdata->{'cmi.core.lesson_status'})?$userdata->{'cmi.core.lesson_status'}:'' ?>', 'format':CMIStatus, 'mod':'rw', 'writeerror':'405'},
@@ -104,6 +102,7 @@ function SCORMapi1_2() {
         'cmi.interactions.n.latency':{'pattern':CMIIndex, 'format':CMITimespan, 'mod':'w', 'readerror':'404', 'writeerror':'405'},
         'nav.event':{'defaultvalue':'', 'format':NAVEvent, 'mod':'w', 'readerror':'404', 'writeerror':'405'}
     };
+    
     //
     // Datamodel inizialization
     //
@@ -223,10 +222,10 @@ function SCORMapi1_2() {
         if (Initialized) {
             if (element !="") {
                 expression = new RegExp(CMIIndex,'g');
-                elementmodel = element.replace(expression,'.n.');
+                elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'w') {
-                            element = element.replace(expression, "_$1.");
+                            element = String(element).replace(expression, "_$1.");
                             elementIndexes = element.split('.');
                         subelement = 'cmi';
                         i = 1;
@@ -282,7 +281,7 @@ function SCORMapi1_2() {
         if (Initialized) {
             if (element != "") {
                 expression = new RegExp(CMIIndex,'g');
-                elementmodel = element.replace(expression,'.n.');
+                elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'r') {
                         expression = new RegExp(eval('datamodel["'+elementmodel+'"].format'));
@@ -493,7 +492,7 @@ function SCORMapi1_2() {
             } else {
                 element = parent+'.'+property;
                 expression = new RegExp(CMIIndex,'g');
-                elementmodel = element.replace(expression,'.n.');
+                elementmodel = String(element).replace(expression,'.n.');
                 if (elementmodel != "cmi.core.session_time") {
                     if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                         if (eval('datamodel["'+elementmodel+'"].mod') != 'r') {
diff --git a/mod/scorm/datamodels/scorm_13.js.php b/mod/scorm/datamodels/scorm_13.js.php
index 07bca0fb97f..cd18ea9d9db 100644
--- a/mod/scorm/datamodels/scorm_13.js.php
+++ b/mod/scorm/datamodels/scorm_13.js.php
@@ -138,7 +138,7 @@ function SCORMapi1_3() {
         'cmi.interactions.n.description':{'pattern':CMIIndex, 'format':CMILangString250, 'mod':'rw'},
         'cmi.launch_data':{'defaultvalue':<?php echo isset($userdata->datafromlms)?'\''.$userdata->datafromlms.'\'':'null' ?>, 'mod':'r'},
         'cmi.learner_id':{'defaultvalue':'<?php echo $userdata->student_id ?>', 'mod':'r'},
-        'cmi.learner_name':{'defaultvalue':'<?php echo addslashes($userdata->student_name) ?>', 'mod':'r'},
+        'cmi.learner_name':{'defaultvalue':'<?php echo $userdata->student_name ?>', 'mod':'r'},
         'cmi.learner_preference._children':{'defaultvalue':student_preference_children, 'mod':'r'},
         'cmi.learner_preference.audio_level':{'defaultvalue':'1', 'format':CMIDecimal, 'range':audio_range, 'mod':'rw'},
         'cmi.learner_preference.language':{'defaultvalue':'', 'format':CMILang, 'mod':'rw'},
@@ -330,12 +330,12 @@ function SCORMapi1_3() {
         if ((Initialized) && (!Terminated)) {
             if (element !="") {
                 var expression = new RegExp(CMIIndex,'g');
-                var elementmodel = element.replace(expression,'.n.');
+                var elementmodel = String(element).replace(expression,'.n.');
 
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'w') {
 
-                        element = element.replace(/\.(\d+)\./, ".N$1.");
+                        element = String(element).replace(/\.(\d+)\./, ".N$1.");
                         element = element.replace(/\.(\d+)\./, ".N$1.");
 
                         var elementIndexes = element.split('.');
@@ -429,7 +429,7 @@ function SCORMapi1_3() {
         if ((Initialized) && (!Terminated)) {
             if (element != "") {
                 var expression = new RegExp(CMIIndex,'g');
-                var elementmodel = element.replace(expression,'.n.');
+                var elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'r') {
                         if (eval('datamodel["'+elementmodel+'"].format') != 'CMIFeedback') {
@@ -533,7 +533,7 @@ function SCORMapi1_3() {
 
                                                     // Use cmi.interactions.n.type value to check the right dataelement format
                                                     if (elementIndexes[elementIndexes.length-2] == eval(parentelement+'._count')) {
-                                                        var interactiontype = eval(parentelement.replace('correct_responses','type'));
+                                                        var interactiontype = eval(String(parentelement).replace('correct_responses','type'));
                                                         if ((typeof correct_responses[interactiontype].limit == 'undefined') ||
                                                             (eval(parentelement+'._count') < correct_responses[interactiontype].limit)) {
                                                             if (correct_responses[interactiontype].pre != '') {
@@ -550,7 +550,7 @@ function SCORMapi1_3() {
                                                             }
                                                             if ((nodes.length > 0) && (nodes.length <= correct_responses[interactiontype].max)) {
                                                                 expression = new RegExp(correct_responses[interactiontype].format);
-                                                                for (var i=0; (i<nodes.length) && (errorCode=="0"); i++) {
+                                                                for (var i=0; (i < nodes.length) && (errorCode=="0"); i++) {
                                                                     if (typeof correct_responses[interactiontype].delimiter2 != 'undefined') {
                                                                         values = nodes[i].split(correct_responses[interactiontype].delimiter2);
                                                                         if (values.length == 2) {
@@ -654,7 +654,7 @@ function SCORMapi1_3() {
                                                     }
                                                     if ((nodes.length > 0) && (nodes.length <= learner_response[interactiontype].max)) {
                                                         expression = new RegExp(learner_response[interactiontype].format);
-                                                        for (var i=0; (i<nodes.length) && (errorCode=="0"); i++) {
+                                                        for (var i=0; (i < nodes.length) && (errorCode=="0"); i++) {
                                                             if (typeof learner_response[interactiontype].delimiter2 != 'undefined') {
                                                                 values = nodes[i].split(learner_response[interactiontype].delimiter2);
                                                                 if (values.length == 2) {
@@ -720,7 +720,7 @@ function SCORMapi1_3() {
 	
                                                     if ((nodes.length > 0) && (nodes.length <= correct_responses[interactiontype].max)) {
                                                         expression = new RegExp(correct_responses[interactiontype].format);
-                                                        for (var i=0; (i<nodes.length) && (errorCode=="0"); i++) {
+                                                        for (var i=0; (i < nodes.length) && (errorCode=="0"); i++) {
                                                             if (typeof correct_responses[interactiontype].delimiter2 != 'undefined') {
 		
 	
@@ -968,7 +968,7 @@ function SCORMapi1_3() {
     function duplicatedID (element, parent, value) {
         var found = false;
         var elements = eval(parent+'._count');
-        for (var n=0;(n<elements) && (!found);n++) {
+        for (var n=0;(n < elements) && (!found);n++) {
             if ((parent+'.N'+n+'.id' != element) && (eval(parent+'.N'+n+'.id') == value)) {
                 found = true;
             }
@@ -979,7 +979,7 @@ function SCORMapi1_3() {
     function duplicatedPA (element, parent, value) {
         var found = false;
         var elements = eval(parent+'._count');
-        for (var n=0;(n<elements) && (!found);n++) {
+        for (var n=0;(n < elements) && (!found);n++) {
             if ((parent+'.N'+n+'.pattern' != element) && (eval(parent+'.N'+n+'.pattern') == value)) {
                 found = true;
             }
@@ -992,7 +992,7 @@ function SCORMapi1_3() {
             return element;
         } else {
             var expression = new RegExp(CMIIndex,'g');
-            var elementmodel = element.replace(expression,'.n.');
+            var elementmodel = String(element).replace(expression,'.n.');
             if (typeof datamodel[elementmodel] != "undefined") {
                 return elementmodel;
             }
@@ -1017,7 +1017,7 @@ function SCORMapi1_3() {
             var mins = parseInt(firstarray[11],10)+parseInt(secondarray[11],10)+change;   //Minutes
             change = Math.floor(mins / 60);
             mins = mins - (change * 60);
-            var hours = parseInt(firstarray[10],10)+parseInt(secondarray[10],10)+change;  //Hours
+            var hours = parseInt(firstarray[9],10)+parseInt(secondarray[9],10)+change;  //Hours
             change = Math.floor(hours / 24);
             hours = hours - (change * 24);
             var days = parseInt(firstarray[6],10)+parseInt(secondarray[6],10)+change; // Days
@@ -1061,7 +1061,7 @@ function SCORMapi1_3() {
             } else {
                 var element = parent+'.'+property;
                 var expression = new RegExp(CMIIndexStore,'g');
-                var elementmodel = element.replace(expression,'.n.');
+                var elementmodel = String(element).replace(expression,'.n.');
                 if ((typeof eval('datamodel["'+elementmodel+'"]')) != "undefined") {
                     if (eval('datamodel["'+elementmodel+'"].mod') != 'r') {
                         var elementstring = '&'+underscore(element)+'='+encodeURIComponent(data[property]);