diff --git a/webroot/channel.shs b/webroot/channel.shs
index 5c0c541..3904017 100644
--- a/webroot/channel.shs
+++ b/webroot/channel.shs
@@ -21,7 +21,7 @@ IFS=$'\n'
 video_title=($(jq -r '.entries[].title' <<< $data))
 video_id=($(jq -r '.entries[].id' <<< $data))
 
-echo "<h1>$title</h1><a href='subscribe.shs?id=${get_data[id]}'>Subscribe!</a><br>"
+echo "<h1>$title</h1><a href='subscribe.shs?id=$(html_encode "${get_data[id]}")'>Subscribe!</a><br>"
 
 for (( i=0; i<${#video_id[@]}; i++ )); do
 	echo "<a href='watch.shs?v=${video_id[$i]}'><img src='http://i.ytimg.com/vi/${video_id[$i]}/mqdefault.jpg'><br>${video_title[$i]}</a><br>"
diff --git a/webroot/fav.shs b/webroot/fav.shs
index 48539d7..312f923 100644
--- a/webroot/fav.shs
+++ b/webroot/fav.shs
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-if session_verify ${cookies[sh_session]} && [[ ${get_data[v]} != '' ]]; then
+if session_verify "${cookies[sh_session]}" && [[ "${get_data[v]}" != '' ]]; then
 	title=$(haruhi-dl $([[ ${cfg[_cookies]} != "" ]] && echo -n -- "-c ${cfg[_cookies]}") -e "https://youtube.com/watch?v=${get_data[v]}")
 	if [[ $(grep -F "$title" storage/faves | grep "$(echo ${cookies[username]} | sed -E "s/\r//")") == '' ]]; then
 		echo "$(session_get_username ${cookies[sh_session]}):${get_data[v]}:$title" >> storage/faves
diff --git a/webroot/login.shs b/webroot/login.shs
index 63e818b..d8b879d 100755
--- a/webroot/login.shs
+++ b/webroot/login.shs
@@ -1,10 +1,9 @@
 #!/bin/bash
 
 if [[ ${post_data[login]} != '' && ${post_data[password]} != '' ]]; then
-	login ${post_data[login]} ${post_data[password]}
+	login "${post_data[login]}" "${post_data[password]}"
 	status=$?
 	if [[ $status == 0 ]]; then
-		echo ${get_data[r]} > /dev/stderr
 		if [[ ${get_data[r]} == '' ]]; then
 			meta[redirect]='/'
 		else
@@ -16,7 +15,7 @@ fi
 source templates/head.sh
 
 if [[ $status == 1 && $reason != '' ]]; then
-	echo $reason
+	echo "$reason"
 fi
 
 echo "<h1>Log in...</h1>
@@ -26,5 +25,4 @@ echo "<h1>Log in...</h1>
 <label for='password'>Password:</label>
 <input type='password' name='password'><br>
 <input type='submit' value='Login'>
-</form>
-(please make sure that you're connecting over SSL)"
+</form>"
diff --git a/webroot/unsubscribe.shs b/webroot/unsubscribe.shs
index b7c31b6..ae2bf4f 100644
--- a/webroot/unsubscribe.shs
+++ b/webroot/unsubscribe.shs
@@ -1,8 +1,8 @@
 #!/bin/bash
 
-if session_verify ${cookies[sh_session]} && [[ ${get_data[id]} != '' ]]; then
-	name=$(session_get_username ${cookies[sh_session]})
-	channel=$(echo -n ${get_data[id]} | sed -E 's/\r//g')
+if session_verify "${cookies[sh_session]}" && [[ "${get_data[id]}" != '' ]]; then
+	name=$(session_get_username "${cookies[sh_session]}")
+	channel=$(sed -E 's/\r//g' <<< "${get_data[id]}")
 	sed -i "/^$name:$channel/d" storage/subscribed
 fi
 meta[redirect]='subscribe.shs'
diff --git a/webroot/watch.shs b/webroot/watch.shs
index 139b7e3..ad67f01 100755
--- a/webroot/watch.shs
+++ b/webroot/watch.shs
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-if [[ ${get_data[v]} ]]; then
-	if [[ ${get_data[v]} == '18l' || ${get_data[v]} == '5eFdt6Y_34E' ]]; then
+if [[ "${get_data[v]}" ]]; then
+	if [[ "${get_data[v]}" == '18l' || "${get_data[v]}" == '5eFdt6Y_34E' ]]; then
 		uploader='MyMusicGroup'
 		title='█▬█ █ ▀█▀ Jeden Osiem L - Jak Zapomnieć (Oficjalny Teledysk)'
 		url='http://sakamoto.pl/tmp/videoplayback_.webm'
@@ -48,12 +48,12 @@ if [[ ${get_data[v]} ]]; then
 			<b>$(echo $video | jq -r '.view_count')</b> views<br>
 			<b>$(echo $video | jq -r '.like_count')</b> likes, <b>$(echo $video | jq -r '.dislike_count')</b> dislikes.<br>"
 			if [[ ${cookies[sh_session]} ]]; then
-				if [[ $(grep $(session_get_username ${cookies[sh_session]}) storage/faves | grep ${get_data[v]}) == '' ]]; then
-					echo "<a href='fav.shs?v=$(echo ${get_data[v]} | sed -s 's/<//g;')' target='_blank'>Add to favourites</a><br>"
+				if [[ $(grep $(session_get_username "${cookies[sh_session]}") storage/faves | grep "${get_data[v]}") == '' ]]; then
+					echo "<a href='fav.shs?v=$(sed -s 's/<//g;' <<< "${get_data[v]}")' target='_blank'>Add to favourites</a><br>"
 				else
-					echo "<a href='unfav.shs?v=$(echo ${get_data[v]} | sed -s 's/<//g;')' target='_blank'>Remove from favourites</a><br>"
+					echo "<a href='unfav.shs?v=$(sed -s 's/<//g;' <<< "${get_data[v]}")' target='_blank'>Remove from favourites</a><br>"
 				fi
-				if [[ $(grep $(session_get_username ${cookies[sh_session]}) storage/subscribed | grep $channel_id) == '' ]]; then
+				if [[ $(grep $(session_get_username "${cookies[sh_session]}") storage/subscribed | grep "$channel_id") == '' ]]; then
 					echo "<a href='subscribe.shs?id=$channel_id' target='_blank'>Subscribe to $uploader!</a><br>"
 				else
 					echo "<a href='unsubscribe.shs?id=$channel_id' target='_blank'>Unsubscribe from $uploader</a><br>"
@@ -71,7 +71,7 @@ if [[ ${get_data[v]} ]]; then
 
 	echo "<h1>Recommended</h1>"
 	for i in $(echo "$vid" | grep -ohE "watch\?v\=[A-zaz0-9]{11}" | uniq | cut -c 9-19); do
-		echo "<div><img src='http://i.ytimg.com/vi/$i/hqdefault.jpg'><br></div>";
+		echo "<div><img src='http://i.ytimg.com/vi/$i/mqdefault.jpg'><br></div>";
 	done
 
 	echo "<h1>Comments</h1>"