diff --git a/README.md b/README.md
index cf2f8601..022c0c03 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,9 @@
 ## About
 Anuko [Time Tracker](https://www.anuko.com/time-tracker/index.htm) is an open source, web-based time tracking application written in PHP. It allows you to track the time that employees or colleagues spend working on projects and tasks. It needs a web server such as Apache, IIS, etc. to run on, and a database to keep the data in, such as MySQL.
 
+## Terminal Illness of the Owner
+December 28, 2023: Nik Okuntseff, the owner and lead software developer at Anuko, developed a terminal illness. Anuko, the company behind Time Tracker, will cease to exist at soon.
+
 ## Free Hosting
 [Anuko](https://www.anuko.com) provides [free hosting](https://www.anuko.com/time-tracker/free-hosting/index.htm) of Time Tracker to individuals and small groups up to 5 users. To start using Time Tracker immediately, create a group at https://timetracker.anuko.com
 
diff --git a/WEB-INF/lib/common.lib.php b/WEB-INF/lib/common.lib.php
index 86570a5f..79aba106 100644
--- a/WEB-INF/lib/common.lib.php
+++ b/WEB-INF/lib/common.lib.php
@@ -126,7 +126,7 @@ function isTrue($val)
 }
 
 // ttValidString is used to check user input to validate a string.
-function ttValidString($val, $emptyValid = false)
+function ttValidString($val, $emptyValid = false, $maxChars = 0)
 {
   if (is_null($val)) {
     return $emptyValid ? true : false;
@@ -140,6 +140,10 @@ function ttValidString($val, $emptyValid = false)
   if (stristr($val, '<script>') || stristr($val, '<script '))
     return false;
 
+  // Count of UTF-8 characters in string must not exceeed $maxChars.
+  if ($maxChars > 0 && mb_strlen($val, 'UTF-8') > $maxChars) // 4 byte emojis are counted as 1 each, newlines as 2.
+    return false;
+
   return true;    
 }
 
@@ -374,6 +378,15 @@ function ttValidInteger($val, $emptyValid = false)
   return true;
 }
 
+// ttValidCheckbox is used to check user input to validate a checkbox on form.
+function ttValidCheckbox($val)
+{
+  if ($val == null)
+    return true;
+
+  return ($val == '1');
+}
+
 // ttValidCronSpec is used to check user input to validate cron specification.
 function ttValidCronSpec($val)
 {
diff --git a/WEB-INF/lib/form/ActionForm.class.php b/WEB-INF/lib/form/ActionForm.class.php
index 253091b4..358f8af5 100644
--- a/WEB-INF/lib/form/ActionForm.class.php
+++ b/WEB-INF/lib/form/ActionForm.class.php
@@ -69,6 +69,11 @@ function initAttributes(&$request) {
         if ($this->mForm) {
 	        $elements = $this->mForm->getElements();
 			foreach ($elements as $name=>$el) {
+// TODO: Refactor this. This is a temporary fix for project multiple select. mValues should probably contain just project, not project[].
+if ($name == 'project' && isset($this->mValues['project[]'])) {
+    $this->mForm->elements['project']->setValue($this->mValues['project[]']);
+}
+// End of TODO.
     			if ($this->mForm->elements[$name] && isset($this->mValues[$name])) {
 				    $this->mForm->elements[$name]->setValue($this->mValues[$name]);
 	    	    }
@@ -164,14 +169,12 @@ function loadBean() {
     	$el_list = @$_SESSION[$this->mSessionCell . "session_store_elements"];
     	if (is_array($el_list)) {
     		foreach ($el_list as $ref_el) {
-    			
     			// restore form elements
     			import('form.'.$ref_el["class"]);
     			$class_name = $ref_el["class"];
     			$el = new $class_name($ref_el["name"]);
                         $el->localize();
     			$el->setValueSafe(@$_SESSION[$this->mSessionCell . "_" .$el->getName()]);
-    			
 				if ($this->mForm && !isset($this->mForm->elements[$ref_el["name"]])) {
 					$this->mForm->elements[$ref_el["name"]] = &$el;
 				}
diff --git a/WEB-INF/lib/form/Form.class.php b/WEB-INF/lib/form/Form.class.php
index 27a36e9b..cee608fe 100644
--- a/WEB-INF/lib/form/Form.class.php
+++ b/WEB-INF/lib/form/Form.class.php
@@ -103,6 +103,16 @@ function addInput($params) {
 			    if (isset($params["datakeys"])) $el->setDataKeys($params["datakeys"]);
 			    break;
 
+                        case "multipleselectcombobox":
+			    import('form.MultipleSelectCombobox');
+                            $multipleSelectComboboxName = $params["name"].'[]';
+			    $el = new MultipleSelectCombobox($multipleSelectComboboxName);
+			    $el->setData(@$params["data"]);
+			    $el->setDataDefault(@$params["empty"]);
+                            if (isset($params['class'])) $el->setCssClass($params['class']);
+			    if (isset($params["datakeys"])) $el->setDataKeys($params["datakeys"]);
+			    break;
+
 			case "calendar":
 			    import('form.Calendar');
 			    $el = new Calendar($params["name"]);
diff --git a/WEB-INF/lib/form/MultipleSelectCombobox.class.php b/WEB-INF/lib/form/MultipleSelectCombobox.class.php
new file mode 100644
index 00000000..2c2cf050
--- /dev/null
+++ b/WEB-INF/lib/form/MultipleSelectCombobox.class.php
@@ -0,0 +1,88 @@
+<?php
+/* Copyright (c) Anuko International Ltd. https://www.anuko.com
+License: See license.txt */
+
+import('form.FormElement');
+
+//  name        CDATA          #IMPLIED  -- field name --
+//  size        NUMBER         #IMPLIED  -- rows visible --
+//  multiple    (multiple)     #IMPLIED  -- default is single selection --
+//  disabled    (disabled)     #IMPLIED  -- unavailable in this context --
+//  tabindex    NUMBER         #IMPLIED  -- position in tabbing order --
+//  onfocus     %Script;       #IMPLIED  -- the element got the focus --
+//  onblur      %Script;       #IMPLIED  -- the element lost the focus --
+//  onchange    %Script;       #IMPLIED  -- the element value was changed --
+
+class MultipleSelectCombobox extends FormElement {
+    //var $mMultiple	= false;
+    var $mOptions	= array();
+    var $mOptionsEmpty	= array();
+    var $mCompareOn = "key"; // or "value"
+    var $mDataDeep = 1;
+    var $mDataKeys = array();
+
+  function __construct($name) {
+    $this->class = 'MultipleSelectCombobox';
+    $this->css_class = 'dropdown-field';
+    $this->name = $name;
+  }
+
+	//function setMultiple($value)	{ $this->mMultiple = $value; }
+	//function isMultiple() { return $this->mMultiple;
+
+	function setData($value)	{ $this->mOptions = $value; }
+	function getData() { return $this->mOptions; }
+
+	function setDataDefault($value)	{ $this->mOptionsEmpty = $value; }
+	function getDataDefault() { return $this->mOptionsEmpty; }
+
+	function setDataKeys($keys)	{ $this->mDataKeys = $keys; $this->mDataDeep = 2; }
+	function getDataKeys() { return $this->mDataKeys; }
+
+	function getHtml() {
+
+	    if ($this->id=="") $this->id = $this->name;
+
+		$html = "\n\t<select";
+                $html .= " class=\"$this->css_class\"";
+		$html .= " name=\"$this->name\" id=\"$this->id\"";
+
+		if ($this->size!="")
+		  $html .= " size=\"$this->size\"";
+
+                $html .= " multiple";
+
+		if ($this->on_change!="")
+		   $html .= " onchange=\"$this->on_change\"";
+
+		if ($this->style!="")
+		   $html .= " style=\"$this->style\"";
+
+                if (!$this->isEnabled())
+		   $html .= " disabled";
+
+		$html .= ">\n";
+		if (is_array($this->mOptionsEmpty) && (count($this->mOptionsEmpty) > 0))
+		foreach ($this->mOptionsEmpty as $key=>$value) {
+			$html .= "<option value=\"".$key."\"";
+			if (($this->value == $value) && ($this->value != '')) $html .= " selected";
+			$html .= ">".$value."</option>\n";
+		}
+		if (is_array($this->mOptions) && (count($this->mOptions) > 0))
+                  $selectedProjects = is_array($this->value) ? $this->value : array();
+		  foreach ($this->mOptions as $key=>$value) {
+
+			if ($this->mDataDeep>1) {
+				$key = $value[$this->mDataKeys[0]];
+				$value = $value[$this->mDataKeys[1]];
+			}
+			$html .= "<option value=\"".$key."\"";
+                        if (in_array($key, $selectedProjects)) $html .= " selected";
+			$html .= ">".htmlspecialchars($value)."</option>\n";
+		  }
+
+		$html .= "</select>";
+
+		return $html;
+	}
+}
diff --git a/WEB-INF/lib/ttChartHelper.class.php b/WEB-INF/lib/ttChartHelper.class.php
index eaa5a4c0..6550f5fa 100644
--- a/WEB-INF/lib/ttChartHelper.class.php
+++ b/WEB-INF/lib/ttChartHelper.class.php
@@ -137,7 +137,7 @@ static function getTotalsForFavReport($fav_report_id, $chart_type) {
 
     // Use custom fields plugin if it is enabled.
     if ($user->isPluginEnabled('cf')) {
-      require_once('plugins/CustomFields.class.php');
+      require_once(APP_DIR.'/plugins/CustomFields.class.php');
       $custom_fields = new CustomFields();
     }
 
diff --git a/WEB-INF/lib/ttFavReportHelper.class.php b/WEB-INF/lib/ttFavReportHelper.class.php
index 00a1bd5b..2b247043 100644
--- a/WEB-INF/lib/ttFavReportHelper.class.php
+++ b/WEB-INF/lib/ttFavReportHelper.class.php
@@ -97,7 +97,7 @@ static function insertReport($fields) {
     $org_id = $user->org_id;
 
     $sql = "insert into tt_fav_reports".
-      " (name, user_id, group_id, org_id, report_spec, client_id, project_id, task_id,".
+      " (name, user_id, group_id, org_id, report_spec, client_id, task_id,".
       " billable, approved, invoice, timesheet, paid_status, note_containing, users, period, period_start,".
       " period_end, show_client, show_invoice, show_paid, show_ip,".
       " show_project, show_timesheet, show_start, show_duration, show_cost,".
@@ -107,7 +107,7 @@ static function insertReport($fields) {
       $mdb2->quote($fields['name']).", $user_id, $group_id, $org_id, ".
       $mdb2->quote($fields['report_spec']).", ".
       $mdb2->quote($fields['client']).", ".
-      $mdb2->quote($fields['project']).", ".$mdb2->quote($fields['task']).", ".
+      $mdb2->quote($fields['task']).", ".
       $mdb2->quote($fields['billable']).", ".$mdb2->quote($fields['approved']).", ".
       $mdb2->quote($fields['invoice']).", ".$mdb2->quote($fields['timesheet']).", ".
       $mdb2->quote($fields['paid_status']).", ".$mdb2->quote($fields['note_containing']).",".
@@ -139,7 +139,7 @@ static function updateReport($fields) {
       "name = ".$mdb2->quote($fields['name']).", ".
       "report_spec = ".$mdb2->quote($fields['report_spec']).", ".
       "client_id = ".$mdb2->quote($fields['client']).", ".
-      "project_id = ".$mdb2->quote($fields['project']).", ".
+      //"project_id = ".$mdb2->quote($fields['project']).", ".
       "task_id = ".$mdb2->quote($fields['task']).", ".
       "billable = ".$mdb2->quote($fields['billable']).", ".
       "approved = ".$mdb2->quote($fields['approved']).", ".
@@ -227,7 +227,7 @@ static function saveReport($bean) {
       'report_spec'=>ttFavReportHelper::makeReportSpec($bean),
       'client'=>$bean->getAttribute('client'),
       'option'=>$bean->getAttribute('option'),
-      'project'=>$bean->getAttribute('project'),
+      //'project'=>$bean->getAttribute('project'),
       'task'=>$bean->getAttribute('task'),
       'billable'=>$bean->getAttribute('include_records'),
       'approved'=>$bean->getAttribute('approved'),
@@ -339,10 +339,17 @@ static function loadReport(&$bean) {
             $bean->setAttribute($checkbox_field_name, $checkbox_value);
           }
         }
+
+        // Project ids.
+        $project_ids = ttFavReportHelper::getFieldSettingFromReportSpec('project_ids', $report_spec);
+        if (isset($project_ids)) {
+          $projects = explode('&', $project_ids);
+          $bean->setAttribute('project', $projects);
+        }
       }
 
       $bean->setAttribute('client', $val['client_id']);
-      $bean->setAttribute('project', $val['project_id']);
+      // $bean->setAttribute('project', $val['project_id']);
       $bean->setAttribute('task', $val['task_id']);
       $bean->setAttribute('include_records', $val['billable']);
       $bean->setAttribute('approved', $val['approved']);
@@ -454,6 +461,47 @@ static function getReportOptions($id) {
     unset($options['id']);
     unset($options['status']);
 
+    // Cast to int some values similar to ttReportHelper::getReportOptions
+    // where we do it for extra protection against SQL injections.
+    // This step is redundant, though, as data validation is supposed to work.
+    // However, in case we missed something, casting to int reduces our risks.
+    $options['client_id'] = isset($options['client_id']) ? (int)$options['client_id'] : 0;
+
+    // Obtain project ids from report_spec.
+    $project_ids = ttFavReportHelper::getFieldSettingFromReportSpec('project_ids', $options['report_spec']);
+    if (isset($project_ids)) {
+       $projects = explode('&', $project_ids);
+       $options['project_ids'] = join(',', $projects);
+    }
+
+    $options['task_id'] = isset($options['task_id']) ? (int)$options['task_id'] : 0;
+    $options['billable'] = isset($options['billable']) ? (int)$options['billable'] : 0;
+    $options['invoice'] = isset($options['invoice']) ? (int)$options['invoice'] : 0;
+    $options['paid_status'] = isset($options['paid_status']) ? (int)$options['paid_status'] : 0;
+    $options['approved'] = isset($options['approved']) ? (int)$options['approved'] : 0;
+    $options['timesheet'] = isset($options['timesheet']) ? (int)$options['timesheet'] : 0;
+    $options['period'] = isset($options['period']) ? (int)$options['period'] : 0;
+
+    $options['show_client'] = isset($options['show_client']) ? (int)$options['show_client'] : 0;
+    $options['show_invoice'] = isset($options['show_invoice']) ? (int)$options['show_invoice'] : 0;
+    $options['show_approved'] = isset($options['show_approved']) ? (int)$options['show_approved'] : 0;
+    $options['show_paid'] = isset($options['show_paid']) ? (int)$options['show_paid'] : 0;
+    $options['show_ip'] = isset($options['show_ip']) ? (int)$options['show_ip'] : 0;
+    $options['show_project'] = isset($options['show_project']) ? (int)$options['show_project'] : 0;
+    $options['show_start'] = isset($options['show_start']) ? (int)$options['show_start'] : 0;
+    $options['show_duration'] = isset($options['show_duration']) ? (int)$options['show_duration'] : 0;
+    $options['show_cost'] = isset($options['show_cost']) ? (int)$options['show_cost'] : 0;
+    $options['show_task'] = isset($options['show_task']) ? (int)$options['show_task'] : 0;
+    $options['show_end'] = isset($options['show_end']) ? (int)$options['show_end'] : 0;
+    $options['show_note'] = isset($options['show_note']) ? (int)$options['show_note'] : 0;
+    $options['show_work_units'] = isset($options['show_work_units']) ? (int)$options['show_work_units'] : 0;
+    $options['show_timesheet'] = isset($options['show_timesheet']) ? (int)$options['show_timesheet'] : 0;
+    $options['show_files'] = isset($options['show_files']) ? (int)$options['show_files'] : 0;
+    $options['show_totals_only'] = isset($options['show_totals_only']) ? (int)$options['show_totals_only'] : 0;
+
+    // Note: We can't cast anything to int for custom fields because global $user object is not recycled
+    // yet for user id. See cron.php. Because of this we do it in adjustOptions instead.
+
     // Note: special handling for NULL users field is done in cron.php
 
     // $options now is a subset of db fields from tt_fav_reports table.
@@ -525,9 +573,15 @@ static function adjustOptions($options) {
           $field_name = 'time_field_'.$timeField['id'];
           $checkbox_field_name = 'show_'.$field_name;
           $field_value = ttFavReportHelper::getFieldSettingFromReportSpec($field_name, $report_spec);
-          $options[$field_name] = $field_value;
+          if ($timeField['type'] == CustomFields::TYPE_DROPDOWN) {
+            // Cast to int for a dropdown for extra security.
+            $options[$field_name] = (int)$field_value;
+          } elseif ($timeField['type'] == CustomFields::TYPE_TEXT) {
+            // No need to cast to int for a text field.
+            $options[$field_name] = $field_value;
+          }
           $checkbox_value = ttFavReportHelper::getFieldSettingFromReportSpec($checkbox_field_name, $report_spec);
-          $options[$checkbox_field_name] = $checkbox_value;
+          $options[$checkbox_field_name] = (int)$checkbox_value;
         }
       }
       // User fields.
@@ -536,9 +590,15 @@ static function adjustOptions($options) {
           $field_name = 'user_field_'.$userField['id'];
           $checkbox_field_name = 'show_'.$field_name;
           $field_value = ttFavReportHelper::getFieldSettingFromReportSpec($field_name, $report_spec);
-          $options[$field_name] = $field_value;
+          if ($userField['type'] == CustomFields::TYPE_DROPDOWN) {
+            // Cast to int for a dropdown for extra security.
+            $options[$field_name] = (int)$field_value;
+          } elseif ($userField['type'] == CustomFields::TYPE_TEXT) {
+            // No need to cast to int for a text field.
+            $options[$field_name] = $field_value;
+          }
           $checkbox_value = ttFavReportHelper::getFieldSettingFromReportSpec($checkbox_field_name, $report_spec);
-          $options[$checkbox_field_name] = $checkbox_value;
+          $options[$checkbox_field_name] = (int)$checkbox_value;
         }
       }
       // Project fields.
@@ -547,9 +607,15 @@ static function adjustOptions($options) {
           $field_name = 'project_field_'.$projectField['id'];
           $checkbox_field_name = 'show_'.$field_name;
           $field_value = ttFavReportHelper::getFieldSettingFromReportSpec($field_name, $report_spec);
-          $options[$field_name] = $field_value;
+          if ($projectField['type'] == CustomFields::TYPE_DROPDOWN) {
+            // Cast to int for a dropdown for extra security.
+            $options[$field_name] = (int)$field_value;
+          } elseif ($projectField['type'] == CustomFields::TYPE_TEXT) {
+            // No need to cast to int for a text field.
+            $options[$field_name] = $field_value;
+          }
           $checkbox_value = ttFavReportHelper::getFieldSettingFromReportSpec($checkbox_field_name, $report_spec);
-          $options[$checkbox_field_name] = $checkbox_value;
+          $options[$checkbox_field_name] = (int)$checkbox_value;
         }
       }
     }
@@ -612,6 +678,16 @@ static function makeReportSpec($bean) {
       }
     }
 
+    // Add projects ids. Format: project_ids:25&756&567&1023. Use the & sign to join multiple project ids.
+    $selected_projects_in_bean = $bean->getAttribute('project');
+    if (!is_array($selected_projects_in_bean)) {
+      $selectedProjects = $bean->getAttribute('project[]');
+    }
+    if (is_array($selected_projects_in_bean) && !empty($selected_projects_in_bean[0])) {
+      $selectedProjectsSpec = join('&', $selected_projects_in_bean);
+    }
+    if (isset($selectedProjectsSpec)) $reportSpecArray[] = 'project_ids:'.$selectedProjectsSpec;
+
     $reportSpec = null;
     if (isset($reportSpecArray))
       $reportSpec = implode(',', $reportSpecArray);
diff --git a/WEB-INF/lib/ttProjectHelper.class.php b/WEB-INF/lib/ttProjectHelper.class.php
index bd166e86..30328968 100644
--- a/WEB-INF/lib/ttProjectHelper.class.php
+++ b/WEB-INF/lib/ttProjectHelper.class.php
@@ -220,8 +220,8 @@ static function delete($id) {
     if (!ttClientHelper::deleteProject($id))
       return false;
 
-    // Mark project custom fields as deleted,
-    require_once('plugins/CustomFields.class.php');
+    // Mark project custom fields as deleted.
+    require_once(APP_DIR.'/plugins/CustomFields.class.php');
     $entity_type = CustomFields::ENTITY_PROJECT;
     $modified_part = ', modified = now(), modified_ip = '.$mdb2->quote($_SERVER['REMOTE_ADDR']).', modified_by = '.$mdb2->quote($user->id);
     $sql = "update tt_entity_custom_fields set status = null $modified_part".
diff --git a/WEB-INF/lib/ttRegistrator.class.php b/WEB-INF/lib/ttRegistrator.class.php
index ae499a9d..8afbf665 100644
--- a/WEB-INF/lib/ttRegistrator.class.php
+++ b/WEB-INF/lib/ttRegistrator.class.php
@@ -41,13 +41,13 @@ function __construct($fields, &$err) {
   function validate() {
     global $i18n;
 
-    if (!ttValidString($this->group_name))
+    if (!ttValidString($this->group_name, false, MAX_NAME_CHARS))
       $this->err->add($i18n->get('error.field'), $i18n->get('label.group_name'));
-    if (!ttValidString($this->currency, true))
+    if (!ttValidString($this->currency, true, MAX_CURRENCY_CHARS))
       $this->err->add($i18n->get('error.field'), $i18n->get('label.currency'));
-    if (!ttValidString($this->user_name))
+    if (!ttValidString($this->user_name, false, MAX_NAME_CHARS))
       $this->err->add($i18n->get('error.field'), $i18n->get('label.manager_name'));
-    if (!ttValidString($this->login))
+    if (!ttValidString($this->login, false, MAX_NAME_CHARS))
       $this->err->add($i18n->get('error.field'), $i18n->get('label.manager_login'));
     if (!ttValidString($this->password1))
       $this->err->add($i18n->get('error.field'), $i18n->get('label.password'));
diff --git a/WEB-INF/lib/ttReportHelper.class.php b/WEB-INF/lib/ttReportHelper.class.php
index a3f89449..fb802f95 100644
--- a/WEB-INF/lib/ttReportHelper.class.php
+++ b/WEB-INF/lib/ttReportHelper.class.php
@@ -8,7 +8,7 @@
 import('ttTimeHelper');
 import('ttConfigHelper');
 
-require_once(dirname(__FILE__).'/../../plugins/CustomFields.class.php');
+require_once(APP_DIR.'/plugins/CustomFields.class.php');
 
 // Definitions of types for timesheet dropdown.
 define('TIMESHEET_ALL', 0); // Include all records.
@@ -46,18 +46,22 @@ static function getWhere($options) {
       $dropdown_parts .= ' and l.client_id = '.$options['client_id'];
     elseif ($user->isClient() && $user->client_id)
       $dropdown_parts .= ' and l.client_id = '.$user->client_id;
-    if ($options['project_id']) $dropdown_parts .= ' and l.project_id = '.$options['project_id'];
+
+    if (isset($options['project_ids']))
+      $dropdown_parts .= ' and l.project_id in ('.$options['project_ids'].')';
+    // if ($options['project_id']) $dropdown_parts .= ' and l.project_id = '.$options['project_id']; // This was here for a single select.
+
     if ($options['task_id']) $dropdown_parts .= ' and l.task_id = '.$options['task_id'];
-    if ($options['billable']=='1') $dropdown_parts .= ' and l.billable = 1';
-    if ($options['billable']=='2') $dropdown_parts .= ' and l.billable = 0';
-    if ($options['invoice']=='1') $dropdown_parts .= ' and l.invoice_id is not null';
-    if ($options['invoice']=='2') $dropdown_parts .= ' and l.invoice_id is null';
+    if ($options['billable']==1) $dropdown_parts .= ' and l.billable = 1';
+    if ($options['billable']==2) $dropdown_parts .= ' and l.billable = 0';
+    if ($options['invoice']==1) $dropdown_parts .= ' and l.invoice_id is not null';
+    if ($options['invoice']==2) $dropdown_parts .= ' and l.invoice_id is null';
     if ($options['timesheet']==TIMESHEET_NOT_ASSIGNED) $dropdown_parts .= ' and l.timesheet_id is null';
     if ($options['timesheet']==TIMESHEET_ASSIGNED) $dropdown_parts .= ' and l.timesheet_id is not null';
-    if ($options['approved']=='1') $dropdown_parts .= ' and l.approved = 1';
-    if ($options['approved']=='2') $dropdown_parts .= ' and l.approved = 0';
-    if ($options['paid_status']=='1') $dropdown_parts .= ' and l.paid = 1';
-    if ($options['paid_status']=='2') $dropdown_parts .= ' and l.paid = 0';
+    if ($options['approved']==1) $dropdown_parts .= ' and l.approved = 1';
+    if ($options['approved']==2) $dropdown_parts .= ' and l.approved = 0';
+    if ($options['paid_status']==1) $dropdown_parts .= ' and l.paid = 1';
+    if ($options['paid_status']==2) $dropdown_parts .= ' and l.paid = 0';
 
     // Add time custom fields.
     if (isset($custom_fields) && $custom_fields->timeFields) {
@@ -180,16 +184,20 @@ static function getExpenseWhere($options) {
       $dropdown_parts .= ' and ei.client_id = '.$options['client_id'];
     elseif ($user->isClient() && $user->client_id)
       $dropdown_parts .= ' and ei.client_id = '.$user->client_id;
-    if ($options['project_id']) $dropdown_parts .= ' and ei.project_id = '.$options['project_id'];
-    if ($options['invoice']=='1') $dropdown_parts .= ' and ei.invoice_id is not null';
-    if ($options['invoice']=='2') $dropdown_parts .= ' and ei.invoice_id is null';
+
+    if (isset($options['project_ids']))
+      $dropdown_parts .= ' and ei.project_id in ('.$options['project_ids'].')';
+    // if ($options['project_id']) $dropdown_parts .= ' and l.project_id = '.$options['project_id']; // This was here for a single select.
+
+    if ($options['invoice']==1) $dropdown_parts .= ' and ei.invoice_id is not null';
+    if ($options['invoice']==2) $dropdown_parts .= ' and ei.invoice_id is null';
     if (isset($options['timesheet']) && ($options['timesheet']!=TIMESHEET_ALL && $options['timesheet']!=TIMESHEET_NOT_ASSIGNED)) {
         $dropdown_parts .= ' and 0 = 1'; // Expense items do not have a timesheet_id.
     }
-    if ($options['approved']=='1') $dropdown_parts .= ' and ei.approved = 1';
-    if ($options['approved']=='2') $dropdown_parts .= ' and ei.approved = 0';
-    if ($options['paid_status']=='1') $dropdown_parts .= ' and ei.paid = 1';
-    if ($options['paid_status']=='2') $dropdown_parts .= ' and ei.paid = 0';
+    if ($options['approved']==1) $dropdown_parts .= ' and ei.approved = 1';
+    if ($options['approved']==2) $dropdown_parts .= ' and ei.approved = 0';
+    if ($options['paid_status']==1) $dropdown_parts .= ' and ei.paid = 1';
+    if ($options['paid_status']==2) $dropdown_parts .= ' and ei.paid = 0';
 
     // Not adding conditions for time custom fields by design because expenses are not associated with them.
     // Whether or not this is proper, we'll know eventually if users complain.
@@ -1536,7 +1544,7 @@ static function prepareReportBody($options, $comment = null)
           if ($options['show_invoice'])
             $body .= '<td style="'.$cellRightAligned.'">'.htmlspecialchars($record['invoice']).'</td>';
           if ($options['show_timesheet'])
-            $body .= '<td style="'.$cellRightAligned.'">'.htmlspecialchars($record['timesheet']).'</td>';
+            $body .= '<td style="'.$cellLeftAligned.'">'.htmlspecialchars($record['timesheet_name']).'</td>';
           $body .= '</tr>';
           if ($show_note_row && $record['note']) {
             $body .= '<tr style="'.$row_style.'">';
@@ -1755,17 +1763,28 @@ static function getReportOptions($bean) {
 
     // Construct one by one.
     $options['name'] = null; // No name required.
-    $options['user_id'] = $user->id; // Not sure if we need user_id here. Fav reports use it to recycle $user object in cron.php.
-    $options['client_id'] = $bean->getAttribute('client');
-    $options['project_id'] = $bean->getAttribute('project');
-    $options['task_id'] = $bean->getAttribute('task');
-    $options['billable'] = $bean->getAttribute('include_records');
-    $options['invoice'] = $bean->getAttribute('invoice');
-    $options['paid_status'] = $bean->getAttribute('paid_status');
-    $options['approved'] = $bean->getAttribute('approved');
+    // $options['user_id'] = $user->id; // We don't use user_id in regular reports. But fav reports use it to recycle $user object in cron.php.
+    $options['client_id'] = (int)$bean->getAttribute('client');
+
+    // Handle selected projects. Just in case check both "project[]" and "project".
+    $selected_projects_in_bean = $bean->getAttribute('project[]');
+    if (is_array($selected_projects_in_bean) && !empty($selected_projects_in_bean[0])) {
+      $options['project_ids'] = join(',', $selected_projects_in_bean);
+    }
+    $selected_projects_in_bean = $bean->getAttribute('project');
+    if (is_array($selected_projects_in_bean) && !empty($selected_projects_in_bean[0])) {
+      $options['project_ids'] = join(',', $selected_projects_in_bean);
+    }
+    // $options['project_id'] = (int)$bean->getAttribute('project'); // This was here for a single project select.
+
+    $options['task_id'] = (int)$bean->getAttribute('task');
+    $options['billable'] = (int)$bean->getAttribute('include_records');
+    $options['invoice'] = (int)$bean->getAttribute('invoice');
+    $options['paid_status'] = (int)$bean->getAttribute('paid_status');
+    $options['approved'] = (int)$bean->getAttribute('approved');
     if ($user->isPluginEnabled('ap') && $user->isClient() && !$user->can('view_client_unapproved'))
       $options['approved'] = 1; // Restrict clients to approved records only.
-    $options['timesheet'] = $bean->getAttribute('timesheet');
+    $options['timesheet'] = (int)$bean->getAttribute('timesheet');
 
     $active_users_in_bean = $bean->getAttribute('users_active');
     $users = '';
@@ -1779,25 +1798,25 @@ static function getReportOptions($bean) {
     }
     if ($users) $options['users'] = $users;
 
-    $options['period'] = $bean->getAttribute('period');
+    $options['period'] = (int)$bean->getAttribute('period');
     $options['period_start'] = $bean->getAttribute('start_date');
     $options['period_end'] = $bean->getAttribute('end_date');
     $options['note_containing'] = $bean->getAttribute('note_containing');
-    $options['show_client'] = $bean->getAttribute('chclient');
-    $options['show_invoice'] = $bean->getAttribute('chinvoice');
-    $options['show_approved'] = $bean->getAttribute('chapproved');
-    $options['show_paid'] = $bean->getAttribute('chpaid');
-    $options['show_ip'] = $bean->getAttribute('chip');
-    $options['show_project'] = $bean->getAttribute('chproject');
-    $options['show_start'] = $bean->getAttribute('chstart');
-    $options['show_duration'] = $bean->getAttribute('chduration');
-    $options['show_cost'] = $bean->getAttribute('chcost');
-    $options['show_task'] = $bean->getAttribute('chtask');
-    $options['show_end'] = $bean->getAttribute('chfinish');
-    $options['show_note'] = $bean->getAttribute('chnote');
-    $options['show_work_units'] = $bean->getAttribute('chunits');
-    $options['show_timesheet'] = $bean->getAttribute('chtimesheet');
-    $options['show_files'] = $bean->getAttribute('chfiles');
+    $options['show_client'] = (int)$bean->getAttribute('chclient');
+    $options['show_invoice'] = (int)$bean->getAttribute('chinvoice');
+    $options['show_approved'] = (int)$bean->getAttribute('chapproved');
+    $options['show_paid'] = (int)$bean->getAttribute('chpaid');
+    $options['show_ip'] = (int)$bean->getAttribute('chip');
+    $options['show_project'] = (int)$bean->getAttribute('chproject');
+    $options['show_start'] = (int)$bean->getAttribute('chstart');
+    $options['show_duration'] = (int)$bean->getAttribute('chduration');
+    $options['show_cost'] = (int)$bean->getAttribute('chcost');
+    $options['show_task'] = (int)$bean->getAttribute('chtask');
+    $options['show_end'] = (int)$bean->getAttribute('chfinish');
+    $options['show_note'] = (int)$bean->getAttribute('chnote');
+    $options['show_work_units'] = (int)$bean->getAttribute('chunits');
+    $options['show_timesheet'] = (int)$bean->getAttribute('chtimesheet');
+    $options['show_files'] = (int)$bean->getAttribute('chfiles');
 
     // Prepare custom field options.
     if ($user->isPluginEnabled('cf')) {
@@ -1809,8 +1828,14 @@ static function getReportOptions($bean) {
         foreach ($custom_fields->timeFields as $timeField) {
           $control_name = 'time_field_'.$timeField['id'];
           $checkbox_control_name = 'show_'.$control_name;
-          $options[$control_name] =  $bean->getAttribute($control_name);
-          $options[$checkbox_control_name] =  $bean->getAttribute($checkbox_control_name);
+          if ($timeField['type'] == CustomFields::TYPE_DROPDOWN) {
+            // Cast to int for a dropdown for extra security.
+            $options[$control_name] = (int)$bean->getAttribute($control_name);
+          } elseif ($timeField['type'] == CustomFields::TYPE_TEXT) {
+            // No need to cast to int for a text field.
+            $options[$control_name] = $bean->getAttribute($control_name);
+          }
+          $options[$checkbox_control_name] = (int)$bean->getAttribute($checkbox_control_name);
         }
       }
 
@@ -1819,8 +1844,14 @@ static function getReportOptions($bean) {
         foreach ($custom_fields->userFields as $userField) {
           $control_name = 'user_field_'.$userField['id'];
           $checkbox_control_name = 'show_'.$control_name;
-          $options[$control_name] =  $bean->getAttribute($control_name);
-          $options[$checkbox_control_name] =  $bean->getAttribute($checkbox_control_name);
+          if ($userField['type'] == CustomFields::TYPE_DROPDOWN) {
+            // Cast to int for a dropdown for extra security.
+            $options[$control_name] = (int)$bean->getAttribute($control_name);
+          } elseif ($userField['type'] == CustomFields::TYPE_TEXT) {
+            // No need to cast to int for a text field.
+            $options[$control_name] = $bean->getAttribute($control_name);
+          }
+          $options[$checkbox_control_name] = (int)$bean->getAttribute($checkbox_control_name);
         }
       }
 
@@ -1829,8 +1860,14 @@ static function getReportOptions($bean) {
         foreach ($custom_fields->projectFields as $projectField) {
           $control_name = 'project_field_'.$projectField['id'];
           $checkbox_control_name = 'show_'.$control_name;
-          $options[$control_name] =  $bean->getAttribute($control_name);
-          $options[$checkbox_control_name] =  $bean->getAttribute($checkbox_control_name);
+          if ($projectField['type'] == CustomFields::TYPE_DROPDOWN) {
+            // Cast to int for a dropdown for extra security.
+            $options[$control_name] = (int)$bean->getAttribute($control_name);
+          } elseif ($projectField['type'] == CustomFields::TYPE_TEXT) {
+            // No need to cast to int for a text field.
+            $options[$control_name] = $bean->getAttribute($control_name);
+          }
+          $options[$checkbox_control_name] = (int)$bean->getAttribute($checkbox_control_name);
         }
       }
     }
@@ -1838,7 +1875,7 @@ static function getReportOptions($bean) {
     $options['group_by1'] = $bean->getAttribute('group_by1');
     $options['group_by2'] = $bean->getAttribute('group_by2');
     $options['group_by3'] = $bean->getAttribute('group_by3');
-    $options['show_totals_only'] = $bean->getAttribute('chtotalsonly');
+    $options['show_totals_only'] = (int)$bean->getAttribute('chtotalsonly');
     return $options;
   }
 
@@ -1846,6 +1883,9 @@ static function getReportOptions($bean) {
   static function verifyBean($bean) {
     global $user;
 
+    // Check period control.
+    if (!ttValidInteger($bean->getAttribute('period'), true)) return false;
+
     // Check users.
     $active_users_in_bean = (array) $bean->getAttribute('users_active');
     $inactive_users_in_bean = (array) $bean->getAttribute('users_inactive');
@@ -1866,10 +1906,162 @@ static function verifyBean($bean) {
       }
     }
 
-    // TODO: add additional checks here. Perhaps do it before saving the bean for consistency.
+    // Check fav report id.
+    $fav_report_id = $bean->getAttribute('favorite_report');
+    if (!($fav_report_id == -1 || (ttValidInteger($fav_report_id) && ttFavReportHelper::get($fav_report_id)))) return false;
+
+    // Check client id.
+    if (!ttValidInteger($bean->getAttribute('client'), true)) return false;
+
+    // Check billable control.
+    if (!ttValidInteger($bean->getAttribute('include_records'), true)) return false;
+
+    // Check invoiced / not invoiced control.
+    if (!ttValidInteger($bean->getAttribute('invoice'), true)) return false;
+
+    // Check selected project ids. Just in case check both project[] and project.
+    $selectedProjects = $bean->getAttribute('project');
+    if (is_array($selectedProjects)) {
+      foreach ($selectedProjects as $singleProjectId) {
+        if (!ttValidInteger($singleProjectId, true)) return false;
+      }
+    }
+    $selectedProjects = $bean->getAttribute('project[]');
+    if (is_array($selectedProjects)) {
+      foreach ($selectedProjects as $singleProjectId) {
+        if (!ttValidInteger($singleProjectId, true)) return false;
+      }
+    }
+
+    // Check task id.
+    if (!ttValidInteger($bean->getAttribute('task'), true)) return false;
+
+    // Check paid status control.
+    if (!ttValidInteger($bean->getAttribute('paid_status'), true)) return false;
+
+    // Check approved status control.
+    if (!ttValidInteger($bean->getAttribute('approved'), true)) return false;
+
+    // Check timesheet status control.
+    if (!ttValidInteger($bean->getAttribute('timesheet'), true)) return false;
+
+    // Validate checkboxes.
+    if (!ttValidCheckbox($bean->getAttribute('chclient'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chproject'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chtask'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chstart'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chfinish'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chduration'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chnote'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chunits'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chcost'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chapproved'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chpaid'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chip'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chinvoice'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chtimesheet'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chfiles'))) return false;
+    if (!ttValidCheckbox($bean->getAttribute('chtotalsonly'))) return false;
+
+    // Verify custom field controls.
+    if ($user->isPluginEnabled('cf')) {
+      global $custom_fields;
+      if (!$custom_fields) $custom_fields = new CustomFields();
+
+      // Time fields.
+      if ($custom_fields->timeFields) {
+        foreach ($custom_fields->timeFields as $timeField) {
+          $control_name = 'time_field_'.$timeField['id'];
+          $checkbox_control_name = 'show_'.$control_name;
+          if ($timeField['type'] == CustomFields::TYPE_DROPDOWN) {
+            if (!ttValidInteger($bean->getAttribute($control_name), true))
+              return false;
+          }
+          if (!ttValidCheckbox($bean->getAttribute($checkbox_control_name), true))
+              return false;
+        }
+      }
+
+      // User fields.
+      if ($custom_fields->userFields) {
+        foreach ($custom_fields->userFields as $userField) {
+          $control_name = 'user_field_'.$userField['id'];
+          $checkbox_control_name = 'show_'.$control_name;
+          if ($userField['type'] == CustomFields::TYPE_DROPDOWN) {
+            if (!ttValidInteger($bean->getAttribute($control_name), true))
+              return false;
+          }
+          if (!ttValidCheckbox($bean->getAttribute($checkbox_control_name), true))
+              return false;
+        }
+      }
+
+      // Project fields.
+      if ($custom_fields->projectFields) {
+        foreach ($custom_fields->projectFields as $projectField) {
+          $control_name = 'project_field_'.$projectField['id'];
+          $checkbox_control_name = 'show_'.$control_name;
+          if ($projectField['type'] == CustomFields::TYPE_DROPDOWN) {
+            if (!ttValidInteger($bean->getAttribute($control_name), true))
+              return false;
+          }
+          if (!ttValidCheckbox($bean->getAttribute($checkbox_control_name), true))
+              return false;
+        }
+      }
+    }
+
+    if (!ttReportHelper::validGroupByOption($bean->getAttribute('group_by1'))) return false;
+    if (!ttReportHelper::validGroupByOption($bean->getAttribute('group_by2'))) return false;
+    if (!ttReportHelper::validGroupByOption($bean->getAttribute('group_by3'))) return false;
+
     return true;
   }
 
+  // validGroupByOption is a security function to verify selection options for group by controls.
+  static function validGroupByOption($groupByOption) {
+
+    global $user;
+
+    if ($groupByOption == 'no_grouping' || $groupByOption == 'date' || $groupByOption == 'user' || $groupByOption == 'client' || $groupByOption == 'project' || $groupByOption == 'task' || $groupByOption == null)
+      return true;
+
+    // Verify custom field group by options.
+    if ($user->isPluginEnabled('cf')) {
+      global $custom_fields;
+      if (!$custom_fields) $custom_fields = new CustomFields();
+
+      // Time fields.
+      if ($custom_fields->timeFields) {
+        foreach ($custom_fields->timeFields as $timeField) {
+          $control_name = 'time_field_'.$timeField['id'];
+          if ($groupByOption == $control_name)
+            return true;
+        }
+      }
+
+      // User fields.
+      if ($custom_fields->userFields) {
+        foreach ($custom_fields->userFields as $userField) {
+          $control_name = 'user_field_'.$userField['id'];
+          if ($groupByOption == $control_name)
+            return true;
+        }
+      }
+
+      // Project fields.
+      if ($custom_fields->projectFields) {
+        foreach ($custom_fields->projectFields as $projectField) {
+          $control_name = 'project_field_'.$projectField['id'];
+          if ($groupByOption == $control_name)
+            return true;
+        }
+      }
+    } // if ($user->isPluginEnabled('cf')) {
+
+    return false;
+  }
+
   // makeGroupByKey builds a combined group by key from group_by1, group_by2 and group_by3 values
   // (passed in $options) and a row of data ($row obtained from a db query).
   static function makeGroupByKey($options, $row) {
diff --git a/WEB-INF/lib/ttTimeHelper.class.php b/WEB-INF/lib/ttTimeHelper.class.php
index 2e9eddbb..6019b2f1 100644
--- a/WEB-INF/lib/ttTimeHelper.class.php
+++ b/WEB-INF/lib/ttTimeHelper.class.php
@@ -440,8 +440,7 @@ static function insert($fields)
 
     if (!$billable) $billable = 0;
     if (!$paid) $paid = 0;
-
-    if ($duration) {
+    if (!is_null($duration)) {
       $sql = "insert into tt_log (user_id, group_id, org_id, date, duration, client_id, project_id, task_id, invoice_id, comment, billable, paid, created, created_ip, created_by) ".
         "values ($user_id, $group_id, $org_id, ".$mdb2->quote($date).", '$duration', ".$mdb2->quote($client).", ".$mdb2->quote($project).", ".$mdb2->quote($task).", ".$mdb2->quote($invoice).", ".$mdb2->quote($note).", $billable, $paid $created_v)";
       $affected = $mdb2->exec($sql);
@@ -500,9 +499,9 @@ static function update($fields)
     $finish = ttTimeHelper::to24HourFormat($finish);
     if ('00:00' == $finish) $finish = '24:00';
     
-    if ($start) $duration = '';
+    if ($start) $duration = null;
 
-    if ($duration) {
+    if (!is_null($duration)) {
       $sql = "UPDATE tt_log set start = NULL, duration = '$duration', client_id = ".$mdb2->quote($client).", project_id = ".$mdb2->quote($project).", task_id = ".$mdb2->quote($task).", ".
         "comment = ".$mdb2->quote($note)."$billable_part $paid_part $modified_part, date = '$date' WHERE id = $id and user_id = $user_id and group_id = $group_id and org_id = $org_id";
       $affected = $mdb2->exec($sql);
diff --git a/WEB-INF/lib/ttUser.class.php b/WEB-INF/lib/ttUser.class.php
index 2e86eacb..fedf3daf 100644
--- a/WEB-INF/lib/ttUser.class.php
+++ b/WEB-INF/lib/ttUser.class.php
@@ -359,7 +359,7 @@ function getAssignedProjects($options = null)
     // Do a query with inner join to get assigned projects.
     $sql = "select p.id, p.name, p.description, p.tasks, upb.rate $filePart from tt_projects p $fileJoin".
       " inner join tt_user_project_binds upb on (upb.user_id = $user_id and upb.project_id = p.id and upb.status = 1)".
-      " where p.group_id = $group_id and p.org_id = $org_id and p.status = 1 order by p.name";
+      " where p.group_id = $group_id and p.org_id = $org_id and p.status = 1 order by upper(p.name)";
     $res = $mdb2->query($sql);
     if (!is_a($res, 'PEAR_Error')) {
       $bindTemplatesWithProjects = isset($options['include_templates']) && $options['include_templates'];
@@ -771,8 +771,8 @@ function markUserDeleted($user_id) {
     if (is_a($affected, 'PEAR_Error'))
       return false;
 
-    // Mark user custom fields as deleted,
-    require_once('plugins/CustomFields.class.php');
+    // Mark user custom fields as deleted.
+    require_once(APP_DIR.'/plugins/CustomFields.class.php');
     $entity_type = CustomFields::ENTITY_USER;
     $modified_part = ', modified = now(), modified_ip = '.$mdb2->quote($_SERVER['REMOTE_ADDR']).', modified_by = '.$mdb2->quote($this->id);
     $sql = "update tt_entity_custom_fields set status = null $modified_part".
diff --git a/WEB-INF/lib/ttWeekViewHelper.class.php b/WEB-INF/lib/ttWeekViewHelper.class.php
index 4ee5346a..cd1e4a95 100644
--- a/WEB-INF/lib/ttWeekViewHelper.class.php
+++ b/WEB-INF/lib/ttWeekViewHelper.class.php
@@ -179,7 +179,7 @@ static function getDataForWeekView($records, $dayHeaders) {
         $dataArray[0][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
       }
     } else {
-      for ($i = 1; $i < 6; $i++) {
+      for ($i = 0; $i < 5; $i++) {
         $control_id = '0_'. $dayHeaders[$i];
         $dataArray[0][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
       }
@@ -194,7 +194,7 @@ static function getDataForWeekView($records, $dayHeaders) {
           $dataArray[1][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
         }
       } else {
-        for ($i = 1; $i < 6; $i++) {
+        for ($i = 0; $i < 5; $i++) {
           $control_id = '1_'. $dayHeaders[$i];
           $dataArray[1][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
         }
@@ -226,7 +226,7 @@ static function getDataForWeekView($records, $dayHeaders) {
             $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
           }
         } else {
-          for ($i = 1; $i < 6; $i++) {
+          for ($i = 0; $i < 5; $i++) {
             $control_id = $pos.'_'. $dayHeaders[$i];
             $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
           }
@@ -242,7 +242,7 @@ static function getDataForWeekView($records, $dayHeaders) {
               $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
             }
           } else {
-            for ($i = 1; $i < 6; $i++) {
+            for ($i = 0; $i < 5; $i++) {
               $control_id = $pos.'_'. $dayHeaders[$i];
               $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
             }
@@ -308,7 +308,7 @@ static function prePopulateFromPastWeeks($startDate, $dayHeaders) {
         $dataArray[0][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
       }
     } else {
-      for ($i = 1; $i < 6; $i++) {
+      for ($i = 0; $i < 5; $i++) {
         $control_id = '0_'. $dayHeaders[$i];
         $dataArray[0][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
       }
@@ -324,7 +324,7 @@ static function prePopulateFromPastWeeks($startDate, $dayHeaders) {
           $dataArray[1][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
         }
       } else {
-        for ($i = 1; $i < 6; $i++) {
+        for ($i = 0; $i < 5; $i++) {
           $control_id = '1_'. $dayHeaders[$i];
           $dataArray[1][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
         }
@@ -348,7 +348,7 @@ static function prePopulateFromPastWeeks($startDate, $dayHeaders) {
             $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
           }
         } else {
-          for ($i = 1; $i < 6; $i++) {
+          for ($i = 0; $i < 5; $i++) {
             $control_id = $pos.'_'. $dayHeaders[$i];
             $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'duration' => null);
           }
@@ -364,7 +364,7 @@ static function prePopulateFromPastWeeks($startDate, $dayHeaders) {
               $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
             }
           } else {
-            for ($i = 1; $i < 6; $i++) {
+            for ($i = 0; $i < 5; $i++) {
               $control_id = $pos.'_'. $dayHeaders[$i];
               $dataArray[$pos][$dayHeaders[$i]] = array('control_id' => $control_id, 'tt_log_id' => null,'note' => null);
             }
@@ -443,7 +443,6 @@ static function getLockedDaysForWeek($start_date) {
       $lockedDays[] = $user->isDateLocked($objDate);
       $objDate->incrementDay();
     }
-    unset($objDate);
     return $lockedDays;
   }
 
diff --git a/WEB-INF/resources/de.lang.php b/WEB-INF/resources/de.lang.php
index 40c3bde9..9e9ad0a3 100644
--- a/WEB-INF/resources/de.lang.php
+++ b/WEB-INF/resources/de.lang.php
@@ -72,12 +72,12 @@
 'error.no_login' => 'Benutzer mit diesen Anmeldedaten nicht vorhanden.',
 'error.no_groups' => 'Die Datenbank ist leer. Als Administrator anmelden und ein neues Gruppe erzeugen.',
 'error.upload' => 'Fehler beim hochladen einer Datei.',
-'error.range_locked' => 'Zeitinterval ist gesperrt.',
+'error.range_locked' => 'Zeitintervall ist gesperrt.',
 'error.mail_send' => 'Fehler beim versenden einer E-Mail. Verwenden Sie MAIL_SMTP_DEBUG für die Diagnose.',
 'error.no_email' => 'Dieser Benutzer besitzt keine e-Mail Adresse.',
 'error.uncompleted_exists' => 'Unvollständiger Eintrag bereits vorhanden. Schließen oder Löschen.',
 'error.goto_uncompleted' => 'Zum unvollständigen Eintrag gehen.',
-'error.overlap' => 'Der Zeitinterval überschneidet sich mit vorhandenen Einträgen.',
+'error.overlap' => 'Der Zeitintervall überschneidet sich mit vorhandenen Einträgen.',
 'error.future_date' => 'Datum ist in der Zukunft.',
 'error.xml' => 'Fehler in der XML-Datei in der Zeile %d: %s.',
 'error.cannot_import' => 'Kann nicht importiert werden: %s.',
@@ -238,7 +238,7 @@
 
 // Form titles.
 'title.error' => 'Fehler',
-'title.success' => 'Erfol',
+'title.success' => 'Erfolg',
 'title.login' => 'Anmelden',
 'title.2fa' => 'Zwei-Faktor-Authentifizierung',
 'title.groups' => 'Gruppen',
@@ -408,7 +408,7 @@
 'form.reports.include_pending' => 'Ausstehend',
 'form.reports.select_period' => 'Zeitraum auswählen',
 'form.reports.set_period' => 'oder Datum eingeben',
-'form.reports.note_containing' => 'Notitz enthält',
+'form.reports.note_containing' => 'Notiz enthält',
 'form.reports.show_fields' => 'Felder anzeigen',
 'form.reports.time_fields' => 'Zeitfelder',
 'form.reports.user_fields' => 'Benutzerfelder',
@@ -540,10 +540,10 @@
 'form.quota.year' => 'Jahr',
 'form.quota.month' => 'Monat',
 'form.quota.workday_hours' => 'Arbeitsstunden pro Tag',
-'form.quota.hint' => 'Wenn leergelassen wird die Quote automatisch berechnet (Basierend auf Arbeitsstunden pro Tag und Feiertagen)',
+'form.quota.hint' => 'Wenn leer gelassen wird die Quote automatisch berechnet (Basierend auf Arbeitsstunden pro Tag und Feiertagen)',
 
 // Swap roles form. See example at https://timetracker.anuko.com/swap_roles.php.
-'form.swap.hint' => 'Stufen Sie ihre Rolle auf eine niedrigere indem Sie mit jemadem die Rollen tauschen. Dies kann nicht rückgängig gemacht werden.',  
+'form.swap.hint' => 'Stufen Sie ihre Rolle auf eine niedrigere indem Sie mit jemandem die Rollen tauschen. Dies kann nicht rückgängig gemacht werden.',  
 'form.swap.swap_with' => 'Tausche Rolle mit',
 
 // Work Units configuration form. See example at https://timetracker.anuko.com/work_units.php after enabling Work units plugin.
@@ -571,7 +571,7 @@
 'role.top_manager.description' => 'Top Gruppen-Manager. Kann alles innerhalb eines Gruppenbaums administrieren',
 'role.admin.label' => 'Administrator',
 'role.admin.low_case_label' => 'Administrator',
-'role.admin.description' => 'Aadminsitrator der Seite.',
+'role.admin.description' => 'Administrator der Seite.',
 
 // Timesheet View form. See example at https://timetracker.anuko.com/timesheet_view.php.
 'form.timesheet_view.submit_subject' => 'Antrag auf Genehmigung der Arbeitszeittabelle',
diff --git a/WEB-INF/templates/reports.tpl b/WEB-INF/templates/reports.tpl
index 42cdd661..485cfc12 100644
--- a/WEB-INF/templates/reports.tpl
+++ b/WEB-INF/templates/reports.tpl
@@ -70,26 +70,39 @@ function inArray(needle, haystack) {
 // projects associated with a selected client (client id is passed here as id).
 function fillProjectDropdown(id) {
   var str_ids = project_ids[id];
-  var dropdown = document.getElementById("project");
+  var projectDropdown = document.getElementById("project[]");
 
-  // Determine previously selected item.
-  var selected_item = dropdown.options[dropdown.selectedIndex].value;
+  // Collect selected options from the project dropdown.
+  var selectedProjects = [];
+  var options = projectDropdown && projectDropdown.options;
+  var optionsLength = options ? options.length : 0;
+  var opt;
+  var allSelected = options[0].selected;
+  if (!allSelected) {
+    for (var i = 1; i < optionsLength; i++) {
+      opt = options[i];
+      if (opt.selected) {
+        selectedProjects.push(opt.value);
+      }
+    }
+  }
 
   // Remove existing content.
-  dropdown.length = 0;
-  var project_reset = true;
+  projectDropdown.length = 0;
+
   // Add mandatory top option.
-  dropdown.options[0] = new Option(empty_label, '', true);
+  projectDropdown.options[0] = new Option(empty_label, '', true);
 
   // Populate project dropdown.
   if (!id) {
     // If we are here, client is not selected.
     var len = projects.length;
     for (var i = 0; i < len; i++) {
-      dropdown.options[i+1] = new Option(projects[i][1], projects[i][0]);
-      if (dropdown.options[i+1].value == selected_item)  {
-        dropdown.options[i+1].selected = true;
-        project_reset = false;
+      projectDropdown.options[i+1] = new Option(projects[i][1], projects[i][0]);
+      if (selectedProjects.length > 0) {
+        if (inArray(projects[i][0], selectedProjects)) {
+            projectDropdown.options[i+1].selected = true;
+        }
       }
     }
   } else if (str_ids) {
@@ -99,57 +112,83 @@ function fillProjectDropdown(id) {
 
     for (var i = 0; i < len; i++) {
       var p_id = ids[i];
-      dropdown.options[i+1] = new Option(project_names[p_id], p_id);
-      if (dropdown.options[i+1].value == selected_item)  {
-        dropdown.options[i+1].selected = true;
-        project_reset = false;
+      projectDropdown.options[i+1] = new Option(project_names[p_id], p_id);
+      if (selectedProjects.length > 0) {
+        if (inArray(projects[i][0], selectedProjects)) {
+            projectDropdown.options[i+1].selected = true;
+        }
       }
     }
   }
 
-  // If project selection was reset - clear the tasks dropdown.
-  if (project_reset) {
-    dropdown = document.getElementById("task");
-    dropdown.length = 0;
-    dropdown.options[0] = new Option(empty_label, '', true);
-  }
+  // Refill task dropdown.
+  fillTaskDropdown();
 }
 
 
 // The fillTaskDropdown function populates the task combo box with
 // tasks associated with a selected project_id.
-function fillTaskDropdown(project_id) {
-  var str_task_ids;
-  // Get a string of comma-separated task ids.
-  if (project_id) {
-    var property = "p" + project_id;
-    str_task_ids = obj_tasks[property];
+function fillTaskDropdown() {
+
+  // Collect selected options from the project dropdown.
+  var projectDropdown = document.getElementById("project[]");
+  var selectedProjects = [];
+  var options = projectDropdown && projectDropdown.options;
+  var optionsLength = options ? options.length : 0;
+  var opt;
+  var allSelected = options[0].selected;
+  if (!allSelected) {
+    for (var i = 1; i < optionsLength; i++) {
+      opt = options[i];
+      if (opt.selected) {
+        selectedProjects.push(opt.value);
+      }
+    }
   }
-  if (str_task_ids) {
-    var task_ids = new Array(); // Array of task ids.
-    task_ids = str_task_ids.split(",");
+
+  // Iterate through all selected projects and build up an array of all relevant task ids.
+  var task_ids_for_selected_projects = [];
+  if (selectedProjects.length > 0) {
+    for (var i = 0; i < selectedProjects.length; i++) {
+      var project_id =  selectedProjects[i];
+
+      var property = "p" + project_id;
+      str_task_ids = obj_tasks[property]; // Task ids for a single selected project.
+
+      if (str_task_ids) {
+        var task_ids = new Array(); // Array of task ids for a single selected project.
+        task_ids = str_task_ids.split(",");
+
+        for (var j = 0; j < task_ids.length; j++) {
+          var single_task_id = task_ids[j];
+          if (task_ids_for_selected_projects.indexOf(single_task_id) === -1)
+            task_ids_for_selected_projects.push(single_task_id);
+        }
+      }
+    }
   }
+  // By now task_ids_for_selected_projects contains all relevenat tasks for all selected projects.
+  var taskIdsLen = task_ids_for_selected_projects.length;
 
   var dropdown = document.getElementById("task");
   // Determine previously selected item.
   var selected_item = dropdown.options[dropdown.selectedIndex].value;
-
   // Remove existing content.
   dropdown.length = 0;
   // Add mandatory top option.
   dropdown.options[0] = new Option(empty_label, '', true);
 
-  // Populate the dropdown with associated tasks.
+  // Populate the task dropdown with associated tasks.
   len = task_names.length;
   var dropdown_idx = 0;
   for (var i = 0; i < len; i++) {
-    if (!project_id) {
-      // No project is selected. Fill in all tasks.
+    if (taskIdsLen == 0) {
+      // No project, or --- all --- projects are selected. Fill in all tasks.
       dropdown.options[dropdown_idx+1] = new Option(task_names[i][1], task_names[i][0]);
       dropdown_idx++;
-    } else if (str_task_ids) {
-      // Project is selected and has associated tasks. Fill them in.
-      if (inArray(task_names[i][0], task_ids)) {
+    } else {
+      // Some projects are selected and has associated tasks. Fill them in.
+      if (inArray(task_names[i][0], task_ids_for_selected_projects)) {
         dropdown.options[dropdown_idx+1] = new Option(task_names[i][1], task_names[i][0]);
         dropdown_idx++;
       }
@@ -190,30 +229,60 @@ var assigned_projects = new Array();
 
 // selectAssignedUsers is called when a project is changed in project dropdown.
 // It selects users on the form who are assigned to this project.
-function selectAssignedUsers(project_id) {
+function selectAssignedUsers() {
+
+  // Collect selected options from the project dropdown.
+  var projectDropdown = document.getElementById("project[]");
+  var selectedProjects = [];
+  var options = projectDropdown && projectDropdown.options;
+  var optionsLength = options ? options.length : 0;
+  var opt;
+  var allSelected = options[0].selected;
+  if (!allSelected) {
+    for (var i = 1; i < optionsLength; i++) {
+      opt = options[i];
+      if (opt.selected) {
+        selectedProjects.push(opt.value);
+      }
+    }
+  }
+
   var user_id;
   var len;
 
+  // Iterate through document elements.
   for (var i = 0; i < document.reportForm.elements.length; i++) {
-    if ((document.reportForm.elements[i].type == 'checkbox') && (document.reportForm.elements[i].name == 'users[]')) {
-      user_id = document.reportForm.elements[i].value;
-      if (project_id)
-        document.reportForm.elements[i].checked = false;
-      else
+    // Iterate through 'active_users[]' checkboxes on the form.
+    if ((document.reportForm.elements[i].type == 'checkbox') && (document.reportForm.elements[i].name == 'users_active[]')) {
+      // If we have -- all --- projects or none selected, check all active user checkboxes.
+      if (allSelected || selectedProjects.length == 0)
         document.reportForm.elements[i].checked = true;
+      else
+        document.reportForm.elements[i].checked = false;
 
-      if(assigned_projects[user_id] != undefined)
+      // Obtain database user id from the checkbox value.
+      user_id = document.reportForm.elements[i].value;
+
+      if (assigned_projects[user_id] != undefined)
         len = assigned_projects[user_id].length;
       else
         len = 0;
 
-      if (project_id != '')
-        for (var j = 0; j < len; j++) {
-          if (project_id == assigned_projects[user_id][j]) {
-            document.reportForm.elements[i].checked = true;
-            break;
+      if (!allSelected && selectedProjects.length > 0) {
+        // Iterate through selected projects.
+        for (var j = 0; j < selectedProjects.length; j++) {
+          var selectedProjectId = selectedProjects[j];
+
+          // Iterate through assigned_projects array for user.
+          for (var k = 0; k < len; k++) {
+            if (selectedProjectId == assigned_projects[user_id][k]) {
+              // A selected project is assigned to user. Tick the checkbox fpr user.
+              document.reportForm.elements[i].checked = true;
+              break;
+            }
           }
         }
+      }
     }
   }
 }
diff --git a/WEB-INF/templates/time_script.tpl b/WEB-INF/templates/time_script.tpl
index 141df7ea..0dafae8c 100644
--- a/WEB-INF/templates/time_script.tpl
+++ b/WEB-INF/templates/time_script.tpl
@@ -12,7 +12,6 @@
 // project_ids[143] = "325,370,390,400";  // Comma-separated list of project ids for client.
 // project_names[325] = "Time Tracker";   // Project name.
 // task_ids[325] = "100,101,302,303,304"; // Comma-separated list ot task ids for project.
-// task_names[100] = "Coding";            // Task name.
 // template_ids[325] = "17,21";           // Comma-separated list ot template ids for project. NOT YET IMPLEMENTED.
 
 // Prepare an array of project ids for clients.
@@ -38,11 +37,6 @@ var task_ids = new Array();
 {foreach $project_list as $project}
   task_ids[{$project.id}] = "{$project.tasks}";
 {/foreach}
-// Prepare an array of task names.
-var task_names = new Array();
-{foreach $task_list as $task}
-  task_names[{$task.id}] = "{$task.name|escape:'javascript'}";
-{/foreach}
 
 // Prepare an array of template ids for projects.
 var template_ids = new Array();
@@ -143,7 +137,6 @@ function fillProjectDropdown(id) {
 // tasks associated with a selected project (project id is passed here as id).
 function fillTaskDropdown(id) {
   var str_ids = task_ids[id];
-
   var dropdown = document.getElementById("task");
   if (dropdown == null) return; // Nothing to do.
 
@@ -155,20 +148,20 @@ function fillTaskDropdown(id) {
   // Add mandatory top option.
   dropdown.options[0] = new Option(empty_label_task, '', true);
 
-  // Populate the dropdown from the task_names array.
+  // Populate the Task dropdown.
   if (str_ids) {
     var ids = new Array();
     ids = str_ids.split(",");
     var len = ids.length;
 
+    // Iterate through $task_list because it is sorted by upper(name).
     var idx = 1;
-    for (var i = 0; i < len; i++) {
-      var t_id = ids[i];
-      if (task_names[t_id]) {
-        dropdown.options[idx] = new Option(task_names[t_id], t_id);
+    {foreach $task_list as $task}
+      if (ids.includes("{$task.id}")) {
+        dropdown.options[idx] = new Option("{$task.name|escape:'javascript'}", {$task.id});
         idx++;
       }
-    }
+    {/foreach}
 
     // If a previously selected item is still in dropdown - select it.
     if (dropdown.options.length > 0) {
diff --git a/charts.php b/charts.php
index a4c24f0a..9dbb95c7 100644
--- a/charts.php
+++ b/charts.php
@@ -37,7 +37,7 @@
   header('Location: access_denied.php'); // Trying as self, but no right for self, and noone to view on behalf.
   exit();
 }
-$userDropdownSelectionId = (int) $request->getParameter('user'); // Resused below access checks.
+$userDropdownSelectionId = (int)$request->getParameter('user'); // Reused below access checks.
 if ($request->isPost() && $request->getParameter('user')) {
   if ($userDropdownSelectionId == constant('ALL_USERS_OPTION_ID') && !ttAccessAllowed('view_all_charts')) {
     header('Location: access_denied.php'); // All users option is only for users with view_all_charts access right.
@@ -56,7 +56,7 @@
 // End of access checks.
 
 // Determine user for whom we display this page.
-$userChanged = (int) $request->getParameter('user_changed');
+$userChanged = (int)$request->getParameter('user_changed');
 if ($request->isPost() && $userChanged ) {
   if ($userDropdownSelectionId != constant('ALL_USERS_OPTION_ID')) {
     $user->setOnBehalfUser($userDropdownSelectionId);
diff --git a/expenses.php b/expenses.php
index ba091a63..3cbbd8be 100644
--- a/expenses.php
+++ b/expenses.php
@@ -33,7 +33,8 @@
   exit();
 }
 if ($request->isPost() && $request->getParameter('user')) {
-  if (!$user->isUserValid((int)$request->getParameter('user'))) {
+  $posted_user_id = $request->getParameter('user');
+  if (!ttValidInteger($posted_user_id) && !$user->isUserValid($posted_user_id)) {
     header('Location: access_denied.php'); // Wrong user id on post.
     exit();
   }
diff --git a/initialize.php b/initialize.php
index 1a032a75..18946798 100644
--- a/initialize.php
+++ b/initialize.php
@@ -21,7 +21,7 @@
     die("mysqli_report function is not available."); // No point to continue as mysqli will not work.
 }
 
-define("APP_VERSION", "1.22.10.5776");
+define("APP_VERSION", "1.22.22.5818");
 define("APP_DIR", dirname(__FILE__));
 define("LIBRARY_DIR", APP_DIR."/WEB-INF/lib");
 define("TEMPLATE_DIR", APP_DIR."/WEB-INF/templates");
@@ -117,6 +117,11 @@
 
 define('CHARSET', 'utf-8');
 
+// Definitions of max counts of utf8mb4 characters for various varchar database fields.
+define('MAX_NAME_CHARS', 80);
+define('MAX_DESCR_CHARS', 255);
+define('MAX_CURRENCY_CHARS', 7);
+
 date_default_timezone_set(@date_default_timezone_get());
 
 // Initialize global objects that are needed for the application.
diff --git a/invoices.php b/invoices.php
index 3f6438b9..d34e1220 100644
--- a/invoices.php
+++ b/invoices.php
@@ -76,7 +76,7 @@
   if (!ttInvoiceHelper::validSortOrder($sort_order_2)) $err->add($i18n->get('error.field'),  $i18n->get('label.sort'));
   if ($sort_option_1 == $sort_option_2) $err->add($i18n->get('error.field'),  $i18n->get('label.sort'));
 
-  if($request->getParameter('sorting_changed')) {
+  if ($err->no() && $request->getParameter('sorting_changed')) {
     // User changed sorting. Get invoices sorted accordingly.
     $sort_options = array('sort_option_1'=>$sort_option_1,
       'sort_order_1'=>$sort_order_1,
diff --git a/mysql.sql b/mysql.sql
index d50b6c46..f614d0ac 100644
--- a/mysql.sql
+++ b/mysql.sql
@@ -87,9 +87,9 @@ INSERT INTO `tt_roles` (`group_id`, `name`, `rank`, `rights`) VALUES (0, 'Top ma
 #
 CREATE TABLE `tt_users` (
   `id` int(11) NOT NULL auto_increment,            # user id
-  `login` varchar(50) COLLATE utf8mb4_bin NOT NULL,# user login
+  `login` varchar(80) COLLATE utf8mb4_bin NOT NULL,# user login
   `password` varchar(50) default NULL,             # password hash
-  `name` varchar(100) default NULL,                # user name
+  `name` varchar(80) default NULL,                 # user name
   `group_id` int(11) NOT NULL,                     # group id
   `org_id` int(11) default NULL,                   # organization id
   `role_id` int(11) default NULL,                  # role id
diff --git a/plugins/MonthlyQuota.class.php b/plugins/MonthlyQuota.class.php
index b291d373..f37cd788 100644
--- a/plugins/MonthlyQuota.class.php
+++ b/plugins/MonthlyQuota.class.php
@@ -1,30 +1,6 @@
 <?php
-// +----------------------------------------------------------------------+
-// | Anuko Time Tracker
-// +----------------------------------------------------------------------+
-// | Copyright (c) Anuko International Ltd. (https://www.anuko.com)
-// +----------------------------------------------------------------------+
-// | LIBERAL FREEWARE LICENSE: This source code document may be used
-// | by anyone for any purpose, and freely redistributed alone or in
-// | combination with other software, provided that the license is obeyed.
-// |
-// | There are only two ways to violate the license:
-// |
-// | 1. To redistribute this code in source form, with the copyright
-// |    notice or license removed or altered. (Distributing in compiled
-// |    forms without embedded copyright notices is permitted).
-// |
-// | 2. To redistribute modified versions of this code in *any* form
-// |    that bears insufficient indications that the modifications are
-// |    not the work of the original author(s).
-// |
-// | This license applies to this document only, not any other software
-// | that it may be combined with.
-// |
-// +----------------------------------------------------------------------+
-// | Contributors:
-// | https://www.anuko.com/time-tracker/credits.htm
-// +----------------------------------------------------------------------+
+/* Copyright (c) Anuko International Ltd. https://www.anuko.com
+License: See license.txt */
 
 import('ttTimeHelper');
 
diff --git a/register.php b/register.php
index 35fbee9c..6f54ccf5 100644
--- a/register.php
+++ b/register.php
@@ -36,8 +36,8 @@
 }
 
 $form = new Form('groupForm');
-$form->addInput(array('type'=>'text','maxlength'=>'200','name'=>'group_name','value'=>$cl_group_name));
-$form->addInput(array('type'=>'text','maxlength'=>'7','name'=>'currency','value'=>$cl_currency));
+$form->addInput(array('type'=>'text','name'=>'group_name','value'=>$cl_group_name));
+$form->addInput(array('type'=>'text','name'=>'currency','value'=>$cl_currency));
 
 // Prepare an array of available languages.
 $lang_files = I18n::getLangFileList();
@@ -57,14 +57,16 @@
 $longname_lang = mu_sort($longname_lang, 'name');
 $form->addInput(array('type'=>'combobox','name'=>'lang','data'=>$longname_lang,'datakeys'=>array('id','name'),'value'=>$cl_lang));
 
-$form->addInput(array('type'=>'text','maxlength'=>'100','name'=>'manager_name','value'=>$cl_manager_name));
-$form->addInput(array('type'=>'text','maxlength'=>'100','name'=>'manager_login','value'=>$cl_manager_login));
+$form->addInput(array('type'=>'text','name'=>'manager_name','value'=>$cl_manager_name));
+$form->addInput(array('type'=>'text','name'=>'manager_login','value'=>$cl_manager_login));
 $form->addInput(array('type'=>'password','maxlength'=>'30','name'=>'password1','value'=>$cl_password1));
 $form->addInput(array('type'=>'password','maxlength'=>'30','name'=>'password2','value'=>$cl_password2));
 $form->addInput(array('type'=>'text','maxlength'=>'100','name'=>'manager_email','value'=>$cl_manager_email));
 $form->addInput(array('type'=>'submit','name'=>'btn_submit','value'=>$i18n->get('button.submit')));
 
 if ($request->isPost()) {
+  // Note: user input validation is done in ttRegistrator constructor.
+
   // Create fields array for ttRegistrator instance.
   $fields = array(
     'user_name' => $cl_manager_name,
diff --git a/report.php b/report.php
index 4945ac17..b8a549b6 100644
--- a/report.php
+++ b/report.php
@@ -59,7 +59,7 @@
 // If we are in post, load the bean from session, as the constructor does it only in get.
 if ($request->isPost()) $bean->loadBean();
 
-$client_id = $bean->getAttribute('client');
+$client_id = (int)$bean->getAttribute('client');
 $options = ttReportHelper::getReportOptions($bean);
 
 // Do we need to show checkboxes? We show them in the following 4 situations:
diff --git a/reports.php b/reports.php
index fd4ca156..aabeec08 100644
--- a/reports.php
+++ b/reports.php
@@ -84,9 +84,16 @@
   if (count($project_list) == 0) $showProject = false;
 }
 if ($showProject) {
-  $form->addInput(array('type'=>'combobox',
-    'onchange'=>'fillTaskDropdown(this.value);selectAssignedUsers(this.value);',
-    'name'=>'project',
+  $form->addInput(array('type'=>'multipleselectcombobox',
+    'onchange'=>'fillTaskDropdown();selectAssignedUsers();',
+    'name'=>'project', // Multiple select now, but the name without "[]" in the end because we can't use it in reports.tpl.
+                       // Example: {$forms.reportForm.project.control}, we can't use {$forms.reportForm.project[].control}.
+                       // This creates an ugly complication:
+                       // Form.class.php addInput adds "[]" to a multiple select combobox element name.
+                       // When we verify bean in a form post, the name is "project".
+                       // But if bean is loaded from session, the name is "project[]".
+                       // It is unclear how to deal with this properly.
+    //'multiple'=>true,
     'data'=>$project_list,
     'datakeys'=>array('id','name'),
     'empty'=>array(''=>$i18n->get('dropdown.all'))));
@@ -417,84 +424,90 @@
   $form->getElement('btn_delete')->setEnabled(false);
 
 if ($request->isPost()) {
-  if((!$bean->getAttribute('btn_generate') && ($request->getParameter('fav_report_changed')))) {
-    // User changed favorite report. We need to load new values into the form.
-    if ($bean->getAttribute('favorite_report')) {
-      // This loads new favorite report options into the bean (into our form).
-      ttFavReportHelper::loadReport($bean);
-
-      // If user selected no favorite report - mark all user checkboxes (most probable scenario).
-      if ($bean->getAttribute('favorite_report') == -1) {
-        $form->setValueByElement('users_active', array_keys($user_list_active));
-        $form->setValueByElement('users_inactive', false);
+  // Verify bean. Do not proceed with bogus post data.
+  if (!ttReportHelper::verifyBean($bean)) $err->add($i18n->get('error.sys'));
+
+  if($err->no()) {
+    if (!$bean->getAttribute('btn_generate') && $request->getParameter('fav_report_changed')) {
+      // User changed favorite report. We need to load new values into the form.
+      if ($bean->getAttribute('favorite_report')) {
+        // This loads new favorite report options into the bean (into our form).
+        ttFavReportHelper::loadReport($bean);
+
+        // If user selected no favorite report - mark all user checkboxes (most probable scenario).
+        if ($bean->getAttribute('favorite_report') == -1) {
+          $form->setValueByElement('users_active', array_keys($user_list_active));
+          $form->setValueByElement('users_inactive', false);
+        }
+
+        // Save form data in session for future use.
+        $bean->saveBean();
+        header('Location: reports.php');
+        exit();
       }
+    } elseif ($bean->getAttribute('btn_save')) {
+      // User clicked the Save button. We need to save form options as new favorite report.
+
+      // We check new_fav_report here, rather than in ttReportHelper::verifyBean to display a specific error, instead of 'error.sys'.
+      if (!ttValidString($bean->getAttribute('new_fav_report'))) $err->add($i18n->get('error.field'), $i18n->get('form.reports.save_as_favorite'));
 
-      // Save form data in session for future use.
-      $bean->saveBean();
-      header('Location: reports.php');
-      exit();
-    }
-  } elseif ($bean->getAttribute('btn_save')) {
-    // User clicked the Save button. We need to save form options as new favorite report.
-    if (!ttValidString($bean->getAttribute('new_fav_report'))) $err->add($i18n->get('error.field'), $i18n->get('form.reports.save_as_favorite'));
-
-    if ($err->no()) {
-      $id = ttFavReportHelper::saveReport($bean);
-      if (!$id)
-        $err->add($i18n->get('error.db'));
       if ($err->no()) {
-        $bean->setAttribute('favorite_report', $id);
+        $id = ttFavReportHelper::saveReport($bean);
+        if (!$id)
+          $err->add($i18n->get('error.db'));
+        if ($err->no()) {
+          $bean->setAttribute('favorite_report', $id);
+          $bean->saveBean();
+          header('Location: reports.php');
+          exit();
+        }
+      }
+    } elseif($bean->getAttribute('btn_delete')) {
+      // Delete button pressed. User wants to delete a favorite report.
+      if ($bean->getAttribute('favorite_report')) {
+        ttFavReportHelper::deleteReport($bean->getAttribute('favorite_report'));
+      // Load default report.
+        $bean->setAttribute('favorite_report','');
+        $bean->setAttribute('new_fav_report', $report_list[0]['name']);
+        ttFavReportHelper::loadReport($bean);
+        $form->setValueByElement('users', array_keys($user_list));
         $bean->saveBean();
         header('Location: reports.php');
         exit();
       }
-    }
-  } elseif($bean->getAttribute('btn_delete')) {
-    // Delete button pressed. User wants to delete a favorite report.
-    if ($bean->getAttribute('favorite_report')) {
-      ttFavReportHelper::deleteReport($bean->getAttribute('favorite_report'));
-      // Load default report.
-      $bean->setAttribute('favorite_report','');
-      $bean->setAttribute('new_fav_report', $report_list[0]['name']);
-      ttFavReportHelper::loadReport($bean);
-      $form->setValueByElement('users', array_keys($user_list));
-      $bean->saveBean();
-      header('Location: reports.php');
-      exit();
-    }
-  } else {
-    // Generate button pressed. Check some values.
-    if (!$bean->getAttribute('period')) {
-      // Validate start date.
-      if (!ttValidDate($bean->getAttribute('start_date'))) $err->add($i18n->get('error.field'), $i18n->get('label.start_date'));
-      // Validate end date.
-      if (!ttValidDate($bean->getAttribute('end_date'))) $err->add($i18n->get('error.field'), $i18n->get('label.end_date'));
-      // Make sure that the end date is equal or after the start date.
-      if ($err->no()) {
-        $startDate = new ttDate($bean->getAttribute('start_date'), $user->getDateFormat());
-        $endDate = new ttDate($bean->getAttribute('end_date'), $user->getDateFormat());
-        if ($startDate->compare($endDate) > 0) {
-          $err->add($i18n->get('error.interval'), $i18n->get('label.end_date'), $i18n->get('label.start_date'));
+    } else {
+      // Generate button pressed. Check some values.
+      if (!$bean->getAttribute('period')) {
+        // Validate start date.
+        if (!ttValidDate($bean->getAttribute('start_date'))) $err->add($i18n->get('error.field'), $i18n->get('label.start_date'));
+        // Validate end date.
+        if (!ttValidDate($bean->getAttribute('end_date'))) $err->add($i18n->get('error.field'), $i18n->get('label.end_date'));
+        // Make sure that the end date is equal or after the start date.
+        if ($err->no()) {
+          $startDate = new ttDate($bean->getAttribute('start_date'), $user->getDateFormat());
+          $endDate = new ttDate($bean->getAttribute('end_date'), $user->getDateFormat());
+          if ($startDate->compare($endDate) > 0) {
+            $err->add($i18n->get('error.interval'), $i18n->get('label.end_date'), $i18n->get('label.start_date'));
+          }
         }
       }
+      $group_by1 = $bean->getAttribute('group_by1');
+      $group_by2 = $bean->getAttribute('group_by2');
+      $group_by3 = $bean->getAttribute('group_by3');
+      if (($group_by3 != null && $group_by3 != 'no_grouping') && ($group_by3 == $group_by1 || $group_by3 == $group_by2))
+        $err->add($i18n->get('error.field'), $i18n->get('form.reports.group_by'));
+      if (($group_by2 != null && $group_by2 != 'no_grouping') && ($group_by2 == $group_by1 || $group_by3 == $group_by2))
+        $err->add($i18n->get('error.field'), $i18n->get('form.reports.group_by'));
+      // TODO: review the above checks and possibly move some of them to verifyBean that we call when entering isPost above.
+
+      if ($err->no()) {
+        $bean->saveBean();
+        // Now we can go ahead and create a report.
+        header('Location: report.php');
+        exit();
+      }
     }
-    $group_by1 = $bean->getAttribute('group_by1');
-    $group_by2 = $bean->getAttribute('group_by2');
-    $group_by3 = $bean->getAttribute('group_by3');
-    if (($group_by3 != null && $group_by3 != 'no_grouping') && ($group_by3 == $group_by1 || $group_by3 == $group_by2))
-      $err->add($i18n->get('error.field'), $i18n->get('form.reports.group_by'));
-    if (($group_by2 != null && $group_by2 != 'no_grouping') && ($group_by2 == $group_by1 || $group_by3 == $group_by2))
-      $err->add($i18n->get('error.field'), $i18n->get('form.reports.group_by'));
-    // Check remaining values.
-    if (!ttReportHelper::verifyBean($bean)) $err->add($i18n->get('error.sys'));
-
-    if ($err->no()) {
-      $bean->saveBean();
-      // Now we can go ahead and create a report.
-      header('Location: report.php');
-      exit();
-    }
-  }
+  } // if($err->no())
 } // isPost
 
 $smarty->assign('client_list', $client_list);
diff --git a/task_add.php b/task_add.php
index 3d8dcc1c..4a335370 100644
--- a/task_add.php
+++ b/task_add.php
@@ -32,15 +32,15 @@
 }
 
 $form = new Form('taskForm');
-$form->addInput(array('type'=>'text','maxlength'=>'100','name'=>'name','value'=>$cl_name));
+$form->addInput(array('type'=>'text','name'=>'name','value'=>$cl_name));
 $form->addInput(array('type'=>'textarea','name'=>'description','value'=>$cl_description));
 $form->addInput(array('type'=>'checkboxgroup','name'=>'projects','layout'=>'H','data'=>$projects,'datakeys'=>array('id','name'),'value'=>$cl_projects));
 $form->addInput(array('type'=>'submit','name'=>'btn_submit','value'=>$i18n->get('button.add')));
 
 if ($request->isPost()) {
   // Validate user input.
-  if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
-  if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
+  if (!ttValidString($cl_name, false, MAX_NAME_CHARS)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
+  if (!ttValidString($cl_description, true, MAX_DESCR_CHARS)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
 
   if ($err->no()) {
     if (!ttTaskHelper::getTaskByName($cl_name)) {
diff --git a/task_edit.php b/task_edit.php
index 9761e31d..1eb8c7f5 100644
--- a/task_edit.php
+++ b/task_edit.php
@@ -44,7 +44,7 @@
 
 $form = new Form('taskForm');
 $form->addInput(array('type'=>'hidden','name'=>'id','value'=>$cl_task_id));
-$form->addInput(array('type'=>'text','maxlength'=>'100','name'=>'name','value'=>$cl_name));
+$form->addInput(array('type'=>'text','name'=>'name','value'=>$cl_name));
 $form->addInput(array('type'=>'textarea','name'=>'description','value'=>$cl_description));
 $form->addInput(array('type'=>'combobox','name'=>'status','value'=>$cl_status,
   'data'=>array(ACTIVE=>$i18n->get('dropdown.status_active'),INACTIVE=>$i18n->get('dropdown.status_inactive'))));
@@ -54,8 +54,8 @@
 
 if ($request->isPost()) {
   // Validate user input.
-  if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
-  if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
+  if (!ttValidString($cl_name, false, MAX_NAME_CHARS)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
+  if (!ttValidString($cl_description, true, MAX_DESCR_CHARS)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
   if (!ttValidStatus($cl_status)) $err->add($i18n->get('error.field'), $i18n->get('label.status'));
 
   if ($err->no()) {
diff --git a/time.php b/time.php
index 931436fa..ee90770b 100644
--- a/time.php
+++ b/time.php
@@ -386,7 +386,7 @@
     if ($showTask && $taskRequired) {
       if (!$cl_task) $err->add($i18n->get('error.task'));
     }
-    if ($cl_duration == null || strlen($cl_duration) == 0) {
+    if ($cl_duration == null) {
       if ($cl_start || $cl_finish) {
         if (!ttTimeHelper::isValidTime($cl_start))
           $err->add($i18n->get('error.field'), $i18n->get('label.start'));
diff --git a/time_edit.php b/time_edit.php
index 7c3491ea..35037dca 100644
--- a/time_edit.php
+++ b/time_edit.php
@@ -63,9 +63,9 @@
 // Initialize variables.
 $cl_start = $cl_finish = $cl_duration = $cl_date = $cl_note = $cl_project = $cl_task = $cl_billable = null;
 if ($request->isPost()) {
-  $cl_start = trim($request->getParameter('start'));
-  $cl_finish = trim($request->getParameter('finish'));
-  $cl_duration = trim($request->getParameter('duration'));
+  $cl_start = is_null($request->getParameter('start')) ? null : trim($request->getParameter('start'));
+  $cl_finish = is_null($request->getParameter('finish')) ? null : trim($request->getParameter('finish'));
+  $cl_duration = is_null($request->getParameter('duration')) ? null : trim($request->getParameter('duration'));
   $cl_date = $request->getParameter('date');
   $cl_note = trim($request->getParameter('note'));
   // If we have time custom fields - collect input.
@@ -117,8 +117,8 @@
 
   // Add an info message to the form if we are editing an uncompleted record.
   if (strlen($cl_start) > 0 && $cl_start == $cl_finish && $cl_duration == '0:00') {
-    $cl_finish = '';
-    $cl_duration = '';
+    $cl_finish = null;
+    $cl_duration = null;
     $msg->add($i18n->get('form.time_edit.uncompleted'));
   }
 }
@@ -292,10 +292,8 @@
   if ($showTask &&  $taskRequired) {
     if (!$cl_task) $err->add($i18n->get('error.task'));
   }
-  if (!$cl_duration) {
-    if ('0' == $cl_duration)
-      $err->add($i18n->get('error.field'), $i18n->get('label.duration'));
-    elseif ($cl_start || $cl_finish) {
+  if ($cl_duration == null) {
+    if ($cl_start || $cl_finish) {
       if (!ttTimeHelper::isValidTime($cl_start))
         $err->add($i18n->get('error.field'), $i18n->get('label.start'));
       if ($cl_finish) {
@@ -356,7 +354,7 @@
         $err->add($i18n->get('error.range_locked'));
 
       // 3) Prohibit saving uncompleted unlocked entries when another uncompleted entry exists.
-      $uncompleted = ($cl_finish == '' && $cl_duration == '');
+      $uncompleted = ($cl_finish == null && $cl_duration == null);
       if ($uncompleted && $oneUncompleted) {
         $not_completed_rec = ttTimeHelper::getUncompleted($user_id);
         if ($not_completed_rec && ($time_rec['id'] <> $not_completed_rec['id'])) {
diff --git a/week.php b/week.php
index 9d96abfb..3c2384b9 100644
--- a/week.php
+++ b/week.php
@@ -169,10 +169,15 @@
     $weekend_start_idx = 6 - $weekStartDay;
     $weekend_end_idx = (7 - $weekStartDay) % 7;
   }
-  unset($dayHeaders[$weekend_start_idx]);
-  unset($dayHeaders[$weekend_end_idx]);
-  unset($lockedDays[$weekend_start_idx]);
-  unset($lockedDays[$weekend_end_idx]);
+  if ($weekend_end_idx > $weekend_start_idx) {
+    array_splice($dayHeaders, $weekend_start_idx, 2);
+    array_splice($lockedDays, $weekend_start_idx, 2);
+  } else {
+    array_splice($dayHeaders, $weekend_start_idx, 1);
+    array_splice($dayHeaders, $weekend_end_idx, 1);
+    array_splice($lockedDays, $weekend_start_idx, 1);
+    array_splice($lockedDays, $weekend_end_idx, 1);
+  }
 }
 
 // Get already existing records.
@@ -242,7 +247,7 @@ function render(&$table, $value, $row, $column, $selected = false) {
         $field->setValue($table->getValueAt($row,$column)['duration']); // Duration for even rows.
       } else {
         $field->setValue($table->getValueAt($row,$column)['note']);     // Comment for odd rows.
-        $field->setTitle($table->getValueAt($row,$column)['note']);     // Tooltip to help view the entire comment.
+        $field->setTitle(htmlspecialchars($table->getValueAt($row,$column)['note'])); // Tooltip to help view the entire comment.
       }
     } else {
       $field->setValue($table->getValueAt($row,$column)['duration']);
@@ -291,14 +296,14 @@ function render(&$table, $value, $row, $column, $selected = false) {
 // Add columns to table.
 $table->addColumn(new TableColumn('label', '', new LabelCellRenderer(), $dayTotals['label']));
 
-
-
-for ($i = 0; $i < 7; $i++) {
-  if ($showWeekends)
+if ($showWeekends) {
+  for ($i = 0; $i < 7; $i++) {
+    $table->addColumn(new TableColumn($dayHeaders[$i], $dayHeaders[$i], new WeekViewCellRenderer(), $dayTotals[$dayHeaders[$i]]));
+  }
+}
+else {
+  for ($i = 0; $i < 5; $i++) {
     $table->addColumn(new TableColumn($dayHeaders[$i], $dayHeaders[$i], new WeekViewCellRenderer(), $dayTotals[$dayHeaders[$i]]));
-  else {
-    if ($i <> $weekend_start_idx && $i <> $weekend_end_idx)
-      $table->addColumn(new TableColumn($dayHeaders[$i], $dayHeaders[$i], new WeekViewCellRenderer(), $dayTotals[$dayHeaders[$i]]));
   }
 }
 $table->setInteractive(false);
@@ -406,7 +411,7 @@ function render(&$table, $value, $row, $column, $selected = false) {
 $form->addInput(array('type'=>'calendar','name'=>'date','value'=>$cl_date));
 
 // A hidden control for today's date from user's browser.
-$form->addInput(array('type'=>'hidden','name'=>'browser_today','value'=>'get_date()')); // User current date, which gets filled in on btn_submit click.
+$form->addInput(array('type'=>'hidden','name'=>'browser_today','value'=>'')); // User current date, which gets filled in on btn_submit click.
 
 // Submit button.
 $form->addInput(array('type'=>'submit','name'=>'btn_submit','onclick'=>'browser_today.value=get_date()','value'=>$i18n->get('button.submit')));
@@ -481,9 +486,6 @@ function render(&$table, $value, $row, $column, $selected = false) {
               continue;
             // Posted value is different.
             if ($existingDuration == null) {
-              // Skip inserting 0 duration values.
-              if (0 == ttTimeHelper::toMinutes($postedDuration))
-                continue;
               // Insert a new record.
               $fields = array();
               $fields['row_id'] = $dataArray[$rowNumber]['row_id'];
@@ -524,7 +526,7 @@ function render(&$table, $value, $row, $column, $selected = false) {
                 }
               }
               $result = ttWeekViewHelper::insertDurationFromWeekView($fields, $custom_fields, $err);
-            } elseif ($postedDuration == null || 0 == ttTimeHelper::toMinutes($postedDuration)) {
+            } elseif ($postedDuration == null) {
               // Delete an already existing record here.
               $result = ttTimeHelper::delete($dataArray[$rowNumber][$dayHeader]['tt_log_id']);
             } else {