diff --git a/auth/cas/auth.php b/auth/cas/auth.php
index 3dacdbdd82b..2b10451411d 100644
--- a/auth/cas/auth.php
+++ b/auth/cas/auth.php
@@ -90,7 +90,7 @@ class auth_plugin_cas extends auth_plugin_base {
 
       $site = get_site();
       $CASform = get_string("CASform","auth_cas");
-      $username = optional_param("username");
+      $username = optional_param("username", '', PARAM_RAW);
 
       if (!empty($username)) {
 		  if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
@@ -124,7 +124,7 @@ class auth_plugin_cas extends auth_plugin_base {
 	  }		
 	 
      if ($this->config->multiauth) {
-          $authCAS = optional_param("authCAS");
+          $authCAS = optional_param("authCAS", '', PARAM_RAW);
           if ($authCAS=="NOCAS")
             return;
 
diff --git a/mod/wiki/ewiki/ewiki.php b/mod/wiki/ewiki/ewiki.php
index 651fd3c620b..6e4a5a967e8 100644
--- a/mod/wiki/ewiki/ewiki.php
+++ b/mod/wiki/ewiki/ewiki.php
@@ -1159,8 +1159,8 @@ function ewiki_page_info($id, &$data, $action) {
    global $ewiki_plugins, $ewiki_config, $ewiki_links;
    global $CFG, $COURSE, $DB, $OUTPUT;  // MOODLE HACK
 
-   $pnum = optional_param(EWIKI_UP_PAGENUM, 0);
-   $pend = optional_param(EWIKI_UP_PAGEEND, 0);
+   $pnum = optional_param(EWIKI_UP_PAGENUM, 0, PARAM_INT);
+   $pend = optional_param(EWIKI_UP_PAGEEND, 0, PARAM_INT);
 
    $o = ewiki_make_title($id, ewiki_t("INFOABOUTPAGE")." '{$id}'", 2, $action,"", "_MAY_SPLIT=1"); 
 
@@ -1662,7 +1662,7 @@ function ewiki_page_edit_form_final_imgupload(&$o, &$id, &$data, &$action) {
 function ewiki_page_edit_preview(&$data) {
 #### BEGIN MOODLE CHANGES   
    global $moodle_format;   
-   $preview_text=$GLOBALS["ewiki_plugins"]["render"][0](optional_param("content", null), 1, EWIKI_ALLOW_HTML || (@$data["flags"]&EWIKI_DB_F_HTML));
+   $preview_text=$GLOBALS["ewiki_plugins"]["render"][0](optional_param("content", null, PARAM_CLEAN), 1, EWIKI_ALLOW_HTML || (@$data["flags"]&EWIKI_DB_F_HTML));
    return( '<div class="preview">'
            . "<hr noshade>"
            . "<div class='mdl-right'>" . ewiki_t("PREVIEW") . "</div><hr noshade><br />\n"
diff --git a/webservice/xmlrpc/lib.php b/webservice/xmlrpc/lib.php
index f693c8f8f7c..b5fb1d51f64 100644
--- a/webservice/xmlrpc/lib.php
+++ b/webservice/xmlrpc/lib.php
@@ -66,7 +66,7 @@ final class xmlrpc_server extends webservice_server {
             }
 
             //retrieve the api name
-            $classpath = optional_param(classpath,null,PARAM_ALPHA);
+            $classpath = optional_param('classpath', null, PARAM_SAFEDIR);
             require_once(dirname(__FILE__) . '/../../'.$classpath.'/external.php');
 
             /// run the server