diff --git a/include/Webservices/LineItem/VtigerInventoryMeta.php b/include/Webservices/LineItem/VtigerInventoryMeta.php
index fec436d7fe836754b48b6dbe7e07462a10c753d1..351dc9fe7564bb386d95aa10088ac742305041fe 100644
--- a/include/Webservices/LineItem/VtigerInventoryMeta.php
+++ b/include/Webservices/LineItem/VtigerInventoryMeta.php
@@ -51,7 +51,7 @@ class VtigerInventoryMeta extends VtigerCRMObjectMeta {
 		$field['displaytype'] = 1;
 		$field['uitype'] = 1;
 		$fieldDataType = 'V';
-		$typeOfData = $fieldType.'~O';
+		$typeOfData = $fieldDataType.'~O';
 
 		$field['typeofdata'] = $typeOfData;
 		$field['tabid'] = null;
@@ -61,4 +61,4 @@ class VtigerInventoryMeta extends VtigerCRMObjectMeta {
 	}
 	
 }
-?>
\ No newline at end of file
+?>
diff --git a/include/database/PearDatabase.php b/include/database/PearDatabase.php
index 9a6cd7377f70439dfdaf36d63a497c6de45b9614..254fe9abc2974f6cef876173743c847296b63beb 100644
--- a/include/database/PearDatabase.php
+++ b/include/database/PearDatabase.php
@@ -818,7 +818,7 @@ class PearDatabase{
 
 		// Backward compatible mode for adodb library.
 		if ($this->dbType == 'mysqli') {
-			mysqli_report(MYSQLI_REPORT_ALL ^ MYSQLI_REPORT_STRICT);
+			mysqli_report(MYSQLI_REPORT_ALL ^ MYSQLI_REPORT_STRICT ^ MYSQLI_REPORT_INDEX);
 		}
 
 		$this->database = ADONewConnection($this->dbType);
diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php
index 7b464031981011f4652d9487d69e34616b0e8ddf..0922f46f9a56adafe36bd11422775b42efa16053 100644
--- a/include/utils/VtlibUtils.php
+++ b/include/utils/VtlibUtils.php
@@ -744,6 +744,38 @@ function str_replace_json($search, $replace, $subject){
     return json_decode(str_replace($search, $replace,  json_encode($subject)), true);
 }
 
+/**
+ * Case-insensitive comparision of string ignore accents.
+ * @param string $lv - left
+ * @param string $rv - right
+ * @return stcasecmp ascii comparision
+ */
+function strcasecmp_accents($lv, $rv) {
+    $lvenc = mb_detect_encoding($lv);
+    $rvenc = mb_detect_encoding($rv);
+    if ($lvenc != $rvenc) {
+        if ($lvenc != "ASCII") $lv = iconv($lvenc, "ASCII//TRANSLIT", $lv);
+        if ($rvenc != "ASCII") $rv = iconv($rvenc, "ASCII//TRANSLIT", $rv);
+    }
+    return strcasecmp($lv, $rv);
+}
+
+/**
+ * Callback function to use based on available environment support.
+ */
+function strcasecmp_accents_callback() {
+    // when mb & iconv is available - set the locale and return accents netural comparision
+    // otherwise return standard strcasecmp
+    if (function_exists('mb_detect_encoding') && function_exists('iconv')) {
+        setlocale(LC_CTYPE, "en_US.utf8"); // required to make iconv (UTF-8 to ASCII/TRANSLIT)
+        $callback = "strcasecmp_accents";
+    } else {
+        $callback = "strcasecmp";
+    }
+    return $callback;
+}
+
+
 /**
  * To purify malicious html event attributes
  * @param <String> $value
diff --git a/layouts/v7/modules/Calendar/resources/Calendar.js b/layouts/v7/modules/Calendar/resources/Calendar.js
index 98c1147371910dff8c156a86f914639503063558..90e03217d0096979d471ab2d9c6d6b9e3c3c5589 100644
--- a/layouts/v7/modules/Calendar/resources/Calendar.js
+++ b/layouts/v7/modules/Calendar/resources/Calendar.js
@@ -561,7 +561,7 @@ Vtiger.Class("Calendar_Calendar_Js", {
 					//replacing module name prefix with translated module name and concatinating with field name
 					var feedIndicatorModuleEndIndex = feedIndicatorTitle.indexOf('('); // Events (ActivityType) - title...
 					if (feedIndicatorModuleEndIndex == -1) { // ModuleName - title...
-							feedIndicatorModuleEndIndex = feedInicatorTitle.indexOf('-');
+							feedIndicatorModuleEndIndex = feedIndicatorTitle.indexOf('-');
 					}
 					feedIndicatorTitle = translatedModuleName + feedIndicatorTitle.substr(feedIndicatorModuleEndIndex);
 					newFeedIndicator.find('span:first').text(feedIndicatorTitle);
diff --git a/layouts/v7/skins/contact/style.css b/layouts/v7/skins/contact/style.css
index a28b9641094ba832f21d772723342bde62937280..ca0cbb8447e0a68becf3eda155b41f5b2ae603c3 100644
--- a/layouts/v7/skins/contact/style.css
+++ b/layouts/v7/skins/contact/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/inventory/style.css b/layouts/v7/skins/inventory/style.css
index cb673dd683a46bddbf658ce5d0371ff0c88cd666..76503dffb208ee44511a2bf564dc9633b8fbe600 100644
--- a/layouts/v7/skins/inventory/style.css
+++ b/layouts/v7/skins/inventory/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/marketing/style.css b/layouts/v7/skins/marketing/style.css
index 6ea9bf97958843f33ac6e0ec69c3a9ab130ea3ce..377f469fc9ac43b8486d1f394cf66e307c3dcf18 100644
--- a/layouts/v7/skins/marketing/style.css
+++ b/layouts/v7/skins/marketing/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/marketing_and_sales/style.css b/layouts/v7/skins/marketing_and_sales/style.css
index 0271494f1de6d0f1795a048c32de350363f2184a..711a897f58218b5163c4ca8224db63d09a2f6ee6 100644
--- a/layouts/v7/skins/marketing_and_sales/style.css
+++ b/layouts/v7/skins/marketing_and_sales/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/project/style.css b/layouts/v7/skins/project/style.css
index c837291e6e79aaa5f6a46cf9057d45ba1b9a98b9..bce7d465aa57b661f8b9da0a03d4bd2a47c7f331 100644
--- a/layouts/v7/skins/project/style.css
+++ b/layouts/v7/skins/project/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/sales/style.css b/layouts/v7/skins/sales/style.css
index 0271494f1de6d0f1795a048c32de350363f2184a..711a897f58218b5163c4ca8224db63d09a2f6ee6 100644
--- a/layouts/v7/skins/sales/style.css
+++ b/layouts/v7/skins/sales/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/support/style.css b/layouts/v7/skins/support/style.css
index aa735ce15a26dcd1bb6cf9a33a467123377c629c..098ff00a1ab91c3c3eb786b0db7906cb4de3e1c7 100644
--- a/layouts/v7/skins/support/style.css
+++ b/layouts/v7/skins/support/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/tools/style.css b/layouts/v7/skins/tools/style.css
index a5a3b7ba7fe33545016c358dbc74fd5191a790c1..245b099e2074c37e220cc83c33986a2ab2cccca4 100644
--- a/layouts/v7/skins/tools/style.css
+++ b/layouts/v7/skins/tools/style.css
@@ -6229,6 +6229,20 @@ div.tooltip-inner {
   float: left;
   margin-right: 5px;
 }
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width: 90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr > :nth-child(1) {
+  width: 5%;
+}
+table#lineItemTab tbody tr > :nth-child(3),
+table#lineItemTab tbody tr > :nth-child(4) {
+  width: 10%;
+}
 /***** Oursites Changes *****/
 .portal-table .table-actions {
   width: inherit ! important;
diff --git a/layouts/v7/skins/vtiger/style.less b/layouts/v7/skins/vtiger/style.less
index 66ee042487c7c024d55bf769362b149dcad00545..fd0678baf5ba6bf854d753ce0b582655ac27956c 100644
--- a/layouts/v7/skins/vtiger/style.less
+++ b/layouts/v7/skins/vtiger/style.less
@@ -6983,6 +6983,21 @@ float:left;
 margin-right: 5px;
 }
 
+/* Fix Text area in Line Items */
+table#lineItemTab textarea.lineItemCommentBox {
+  width:90%;
+  /* Line-height is 1.4 so this is an approximation of 4 lines high */
+  min-height: 5.6em;
+}
+/* Change width of columns in LineItems (1) drag-handler (3) quanity (4) price */
+table#lineItemTab tbody tr>:nth-child(1) {
+  width:5%;
+}
+table#lineItemTab tbody tr>:nth-child(3),
+table#lineItemTab tbody tr>:nth-child(4) {
+  width:10%;
+}
+
 /***** Oursites Changes *****/
 .portal-table .table-actions{
     width:inherit ! important;
diff --git a/modules/CustomView/models/Record.php b/modules/CustomView/models/Record.php
index bbba789e809c2b5e0e8051e0d99006d9704d216e..d2999f367cbb68f4299648a2c335de923174da95 100644
--- a/modules/CustomView/models/Record.php
+++ b/modules/CustomView/models/Record.php
@@ -227,6 +227,8 @@ class CustomView_Record_Model extends Vtiger_Base_Model {
 		$queryGenerator->parseAdvFilterList($transformedSearchParams, $glue);
 
 		$listQuery = $queryGenerator->getQuery();
+		$params = array();
+
 		if($module == 'RecycleBin'){
 			$listQuery = preg_replace("/vtiger_crmentity.deleted\s*=\s*0/i", 'vtiger_crmentity.deleted = 1', $listQuery);
 		}
diff --git a/modules/Install/models/Utils.php b/modules/Install/models/Utils.php
index afc9326de57ed4d692ee7a7bb436290490b5c126..617c907d94c6b0df13d3461bb88dc6924e2e31cd 100644
--- a/modules/Install/models/Utils.php
+++ b/modules/Install/models/Utils.php
@@ -73,19 +73,6 @@ class Install_Utils_Model {
 			$directiveValues['max_execution_time'] = ini_get('max_execution_time');
 		if (ini_get('memory_limit') < 32)
 			$directiveValues['memory_limit'] = ini_get('memory_limit');
-			$errorReportingValue = E_WARNING & ~E_NOTICE;
-                if(version_compare(PHP_VERSION, '5.5.0') >= 0){
-                    $errorReportingValue = E_WARNING & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT;
-                }
-                else if(version_compare(PHP_VERSION, '5.3.0') >= 0) {
-			$errorReportingValue = E_WARNING & ~E_NOTICE & ~E_DEPRECATED;
-		}
-		if (ini_get('error_reporting') != $errorReportingValue)
-			$directiveValues['error_reporting'] = 'NOT RECOMMENDED';
-		if (ini_get('log_errors') == '1' || stripos(ini_get('log_errors'), 'On') > -1)
-			$directiveValues['log_errors'] = 'On';
-		if (ini_get('short_open_tag') == '1' || stripos(ini_get('short_open_tag'), 'On') > -1)
-			$directiveValues['short_open_tag'] = 'On';
 
 		return $directiveValues;
 	}
@@ -101,10 +88,7 @@ class Install_Utils_Model {
 		'register_globals' => 'On',
 		'output_buffering' => 'On',
 		'max_execution_time' => '0',
-		'memory_limit' => '32',
-		'error_reporting' => 'E_WARNING & ~E_NOTICE',
-		'log_errors' => 'Off',
-		'short_open_tag' => 'Off'
+		'memory_limit' => '32'
 	);
 
 	/**
@@ -112,12 +96,6 @@ class Install_Utils_Model {
 	 * @return type
 	 */
 	public static function getRecommendedDirectives(){
-            if(version_compare(PHP_VERSION, '5.5.0') >= 0){
-                self::$recommendedDirectives['error_reporting'] = 'E_WARNING & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT';
-            }
-	    else if(version_compare(PHP_VERSION, '5.3.0') >= 0) {
-			self::$recommendedDirectives['error_reporting'] = 'E_WARNING & ~E_NOTICE & ~E_DEPRECATED';
-		}
 		return self::$recommendedDirectives;
 	}
 
@@ -380,7 +358,7 @@ class Install_Utils_Model {
 		if($db_type) {
 			// Backward compatible mode for adodb library.
 			if ($db_type == 'mysqli') {
-				mysqli_report(MYSQLI_REPORT_ALL ^ MYSQLI_REPORT_STRICT);
+				mysqli_report(MYSQLI_REPORT_ALL ^ MYSQLI_REPORT_STRICT ^ MYSQLI_REPORT_INDEX);
 			}
 			
 			$conn = NewADOConnection($db_type);
diff --git a/modules/Install/views/Index.php b/modules/Install/views/Index.php
index ce517e9c637e76a1c4222b52c68f882fbbbfb0f6..dc6157e49a119cffadce326d01525ebbde96b44d 100644
--- a/modules/Install/views/Index.php
+++ b/modules/Install/views/Index.php
@@ -30,7 +30,7 @@ class Install_Index_view extends Vtiger_View_Controller {
 	protected function applyInstallFriendlyEnv() {
 		// config.inc.php - will not be ready to control this yet.
 		version_compare(PHP_VERSION, '5.5.0') <= 0 ? error_reporting(E_ERROR & ~E_NOTICE & ~E_DEPRECATED) : error_reporting(E_ERROR & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT);  // Production
-		version_compare(PHP_VERSION, '7.0.0') >= 0 ? error_reporting(E_WARNING & ~E_NOTICE) : error_reporting(E_WARNING & ~E_NOTICE & ~E_DEPRECATED  & E_ERROR & ~E_STRICT); // Debug
+		//version_compare(PHP_VERSION, '7.0.0') >= 0 ? error_reporting(E_WARNING & ~E_NOTICE) : error_reporting(E_WARNING & ~E_NOTICE & ~E_DEPRECATED  & E_ERROR & ~E_STRICT); // Debug
 		set_time_limit(0); // override limits on execution time to allow install to finish
 	}
 
diff --git a/modules/Users/actions/Save.php b/modules/Users/actions/Save.php
index bbe106565344b8870df76dac3b3a789fbfc1592b..378a09d58eaf8923993576419f9493ce076380fd 100644
--- a/modules/Users/actions/Save.php
+++ b/modules/Users/actions/Save.php
@@ -122,7 +122,13 @@ class Users_Save_Action extends Vtiger_Save_Action {
 			if ($status == true) {
 				throw new AppException(vtranslate('LBL_DUPLICATE_USER_EXISTS', $module));
 			}
+		} else {
+			if ($request->has('user_name') || $request->has('user_password') || $request->has('accesskey') ) {
+				// should use separate actions.
+				throw new AppException(vtranslate('LBL_PERMISSION_DENIED', $module));
+			}
 		}
+
 		$recordModel = $this->saveRecord($request);
 
 		if ($request->get('relationOperation')) {
diff --git a/modules/Users/models/Record.php b/modules/Users/models/Record.php
index ecaf1385fe705f348b2a4ae7426b63bca016f418..06fc11f1d9f6f949b04adb8d509f6fe295f8fee1 100644
--- a/modules/Users/models/Record.php
+++ b/modules/Users/models/Record.php
@@ -882,8 +882,9 @@ class Users_Record_Model extends Vtiger_Record_Model {
 		$response = array('success'=> false,'message' => 'error');
 		$record = self::getInstanceFromPreferenceFile($forUserId);
 		$moduleName = $record->getModuleName();
+		$currentUserModel = static::getCurrentUserModel();
 		
-		if(!Users_Privileges_Model::isPermittedToChangeUsername($forUserId)) {
+		if($currentUserModel->getId() == $forUserId || !Users_Privileges_Model::isPermittedToChangeUsername($forUserId)) {
 			$response['message'] = vtranslate('LBL_PERMISSION_DENIED', $moduleName);
 			return $response;
 		}
diff --git a/modules/Vtiger/models/FindDuplicate.php b/modules/Vtiger/models/FindDuplicate.php
index a916c72db6cb14bf899edb42e43735cc35d60bb6..892cb538d6da2c94d9a98662344f2a8ab62de21a 100644
--- a/modules/Vtiger/models/FindDuplicate.php
+++ b/modules/Vtiger/models/FindDuplicate.php
@@ -69,7 +69,7 @@ class Vtiger_FindDuplicate_Model extends Vtiger_Base_Model {
         $entries = array();
         for($i=0; $i<$rows; $i++) {
             // row will have value with (index and column names)
-            $row = $db->query_result_rowdata($result, $i);
+            $row = $db->raw_query_result_rowdata($result, $i); // retrieve UTF-8 values.
             // we should discard values with index for comparisions
 			$entries[] = array_filter($row, function($k) { return !is_numeric($k); }, ARRAY_FILTER_USE_KEY);
 		}
@@ -91,15 +91,13 @@ class Vtiger_FindDuplicate_Model extends Vtiger_Base_Model {
                 // make copy of current row
                 $slicedArray = array_slice($row, 0);
 
-                // prepare for map comparisions
-                array_walk($temp, 'lower_array');
-                array_walk($slicedArray, 'lower_array');
                 unset($temp["recordid"]); // remove id which will obviously vary.
                 unset($slicedArray["recordid"]);
 
                 // if there is any value difference between (temp = prev) and (slicedArray = current) 
                 // group them separately.
-                $arrDiff = array_diff($temp, $slicedArray);
+				$arrDiff = array_udiff($temp, $slicedArray, strcasecmp_accents_callback()); // use case-less accent-less comparision.
+				
                 if(php7_count($arrDiff) > 0) {
                     $groupCount++;
                     $temp = $slicedArray;
diff --git a/pkg/vtiger/modules/MailManager/modules/MailManager/MailManager.php b/pkg/vtiger/modules/MailManager/modules/MailManager/MailManager.php
index 6c59266f46f3d0edb8c081e30aadcbc0f00b0bab..857b0224fcf119e6673dd827539072c1cb86a814 100644
--- a/pkg/vtiger/modules/MailManager/modules/MailManager/MailManager.php
+++ b/pkg/vtiger/modules/MailManager/modules/MailManager/MailManager.php
@@ -35,21 +35,24 @@ class MailManager {
 			$searchFieldList = array_merge($referenceModuleEmailFields, $referenceModuleEntityFieldsArray);
 			if(!empty($searchFieldList) && !empty($referenceModuleEmailFields)) {
 				$searchFieldListString = implode(',', $referenceModuleEmailFields);
-				$where = null;
+				$where = "";
+				$params = array();
 				for($i=0; $i<php7_count($searchFieldList); $i++) {
 					if($i == php7_count($searchFieldList) - 1) {
-						$where .= sprintf($searchFieldList[$i]." like '%s'", $searchTerm);
+						$where .= ($searchFieldList[$i]." like '%s'");
+						$params[] = $searchTerm;
 					} else {
-						$where .= sprintf($searchFieldList[$i]." like '%s' or ", $searchTerm);
+						$where .= ($searchFieldList[$i]." like '%s' or ");
+						$params[] = $searchTerm;
 					}
 				}
-				if(!empty($where)) $where = "WHERE $where";
 				if($referenceModule == 'Users' && !is_admin($user)){
 					//Have to do seperate query since webservices will throw permission denied for users module for non admin users
 					global $adb;
+					if(!empty($where)) $where = "WHERE " . (str_replace("'%s'", '?', $where)); // query placeholders
 					$where .= " AND vtiger_users.status='Active'";
 					$query = "select $searchFieldListString,id from vtiger_users $where";
-					$dbResult = $adb->pquery($query,array());
+					$dbResult = $adb->pquery($query, $params);
 					$num_rows = $adb->num_rows($dbResult);
 					$result = array();
 					for($i=0;$i<$num_rows;$i++) {
@@ -60,6 +63,10 @@ class MailManager {
 						$result[] = $row;
 					}
 				}else{
+					if(!empty($where)) {
+						array_unshift($params, $where);
+						$where = "WHERE " . call_user_func_array("sprintf", $params); // webservice query strings
+					}
 					$result = vtws_query("select $searchFieldListString from $referenceModule $where;", $user);
 				}