diff --git a/app/fifo_list/fifo_list_inc.php b/app/fifo_list/fifo_list_inc.php
index 3a5235570b..19306c5286 100644
--- a/app/fifo_list/fifo_list_inc.php
+++ b/app/fifo_list/fifo_list_inc.php
@@ -17,22 +17,26 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Copyright (C) 2010
+	Copyright (C) 2010 - 2019
 	All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
-include "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
-if (permission_exists('active_queue_view')) {
-	//access granted
-}
-else {
-	echo "access denied";
-	exit;
-}
+
+//includes
+	include "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (permission_exists('active_queue_view')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -41,90 +45,91 @@ else {
 //include theme config for button images
 	include_once("themes/".$_SESSION['domain']['template']['name']."/config.php");
 
-$switch_cmd = 'fifo list';
-$fp = event_socket_create($_SESSION['event_socket_ip_address'], $_SESSION['event_socket_port'], $_SESSION['event_socket_password']);
-if ($fp) {
-	$xml_str = trim(event_socket_request($fp, 'api '.$switch_cmd));
-	try {
-		$xml = new SimpleXMLElement($xml_str);
-	}
-	catch(Exception $e) {
-		//echo $e->getMessage();
-	}
-
-	/*
-	<fifo_report>
-	  <fifo name="5900@voip.fusionpbx.com" consumer_count="0" caller_count="1" waiting_count="1" importance="0">
-		<callers>
-		  <caller uuid="73a9324f-2a87-df11-bedf-0019dbe93b1f" status="WAITING" timestamp="2010-07-04 05:09:23">
-			<caller_profile></caller_profile>
-		  </caller>
-		</callers>
-		<consumers></consumers>
-	  </fifo>
-	  <fifo name="cool_fifo@voip.fusionpbx.com" consumer_count="0" caller_count="0" waiting_count="0" importance="0">
-		<callers></callers>
-		<consumers></consumers>
-	  </fifo>
-	</fifo_report>
-	*/
-
-	$c = 0;
-	$row_style["0"] = "row_style0";
-	$row_style["1"] = "row_style1";
-
-	echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
-	echo "<tr>\n";
-	echo "<th>".$text['label-name']."</th>\n";
-	echo "<th>".$text['label-consumer_count']."</th>\n";
-	echo "<th>".$text['label-caller_count']."</th>\n";
-	echo "<th>".$text['label-waiting_count']."</th>\n";
-	echo "<th>".$text['label-importance']."</th>\n";
-	echo "<td class='list_control_icon'></td>\n";
-	echo "</tr>\n";
-
-	foreach ($xml->fifo as $row) {
-
-		foreach($row->attributes() as $tmp_name => $tmp_value) {
-			$$tmp_name = $tmp_value;
+//show the list
+	$switch_cmd = 'fifo list';
+	$fp = event_socket_create($_SESSION['event_socket_ip_address'], $_SESSION['event_socket_port'], $_SESSION['event_socket_password']);
+	if ($fp) {
+		$xml_str = trim(event_socket_request($fp, 'api '.$switch_cmd));
+		try {
+			$xml = new SimpleXMLElement($xml_str);
 		}
-		unset($tmp_name, $tmp_value);
-
-		//remove the domain from name
-			$tmp_name = str_replace('_', ' ', $name);
-			$tmp_name_array = explode('@', $name);
-			$tmp_name = $tmp_name_array[0];
-
-		$td_onclick = "onclick=\"document.location.href='fifo_interactive.php?c=".$name."';\"";
-
-		if (if_group("superadmin")) {
-			//show all fifo queues
-				echo "<tr >\n";
-				echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick."><a href='fifo_interactive.php?c=".$name."'>".$tmp_name."</a></td>\n";
-				echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$consumer_count."</td>\n";
-				echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$caller_count."</td>\n";
-				echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$waiting_count."</td>\n";
-				echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$importance."</td>\n";
-				echo "<td class='list_control_icon'><a href='fifo_interactive.php?c=".$name."' alt='".$text['button-view']."'>$v_link_label_view</a></td>\n";
-				echo "</tr>\n";
+		catch(Exception $e) {
+			//echo $e->getMessage();
 		}
-		else {
-			//show only the fifo queues that match the domain_name
-				if (stripos($name, $_SESSION['domain_name']) !== false) {
+
+		/*
+		<fifo_report>
+		  <fifo name="5900@voip.fusionpbx.com" consumer_count="0" caller_count="1" waiting_count="1" importance="0">
+			<callers>
+			  <caller uuid="73a9324f-2a87-df11-bedf-0019dbe93b1f" status="WAITING" timestamp="2010-07-04 05:09:23">
+				<caller_profile></caller_profile>
+			  </caller>
+			</callers>
+			<consumers></consumers>
+		  </fifo>
+		  <fifo name="cool_fifo@voip.fusionpbx.com" consumer_count="0" caller_count="0" waiting_count="0" importance="0">
+			<callers></callers>
+			<consumers></consumers>
+		  </fifo>
+		</fifo_report>
+		*/
+
+		$c = 0;
+		$row_style["0"] = "row_style0";
+		$row_style["1"] = "row_style1";
+
+		echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
+		echo "<tr>\n";
+		echo "<th>".$text['label-name']."</th>\n";
+		echo "<th>".$text['label-consumer_count']."</th>\n";
+		echo "<th>".$text['label-caller_count']."</th>\n";
+		echo "<th>".$text['label-waiting_count']."</th>\n";
+		echo "<th>".$text['label-importance']."</th>\n";
+		echo "<td class='list_control_icon'></td>\n";
+		echo "</tr>\n";
+
+		foreach ($xml->fifo as $row) {
+
+			foreach($row->attributes() as $tmp_name => $tmp_value) {
+				$$tmp_name = $tmp_value;
+			}
+			unset($tmp_name, $tmp_value);
+
+			//remove the domain from name
+				$tmp_name = str_replace('_', ' ', $name);
+				$tmp_name_array = explode('@', $name);
+				$tmp_name = $tmp_name_array[0];
+
+			$td_onclick = "onclick=\"document.location.href='fifo_interactive.php?c=".escape($name)."';\"";
+
+			if (if_group("superadmin")) {
+				//show all fifo queues
 					echo "<tr >\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick."><a href='fifo_interactive.php?c=".$name."'>".$tmp_name."</a></td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$consumer_count."</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$caller_count."</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$waiting_count."</td>\n";
-					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".$importance."</td>\n";
-					echo "<td class='list_control_icon'><a href='fifo_interactive.php?c=".$name."' alt='".$text['button-view']."'>$v_link_label_view</a></td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick."><a href='fifo_interactive.php?c=".escape($name)."'>".escape($tmp_name)."</a></td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($consumer_count)."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($caller_count)."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($waiting_count)."</td>\n";
+					echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($importance)."</td>\n";
+					echo "<td class='list_control_icon'><a href='fifo_interactive.php?c=".escape($name)."' alt='".$text['button-view']."'>$v_link_label_view</a></td>\n";
 					echo "</tr>\n";
-				}
+			}
+			else {
+				//show only the fifo queues that match the domain_name
+					if (stripos($name, $_SESSION['domain_name']) !== false) {
+						echo "<tr >\n";
+						echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick."><a href='fifo_interactive.php?c=".$name."'>".escape($tmp_name)."</a></td>\n";
+						echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($consumer_count)."</td>\n";
+						echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($caller_count)."</td>\n";
+						echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($waiting_count)."</td>\n";
+						echo "<td valign='top' class='".$row_style[$c]."' ".$td_onclick.">".escape($importance)."</td>\n";
+						echo "<td class='list_control_icon'><a href='fifo_interactive.php?c=".escape($name)."' alt='".$text['button-view']."'>$v_link_label_view</a></td>\n";
+						echo "</tr>\n";
+					}
+			}
+
+			if ($c==0) { $c=1; } else { $c=0; }
 		}
-
-		if ($c==0) { $c=1; } else { $c=0; }
+		echo "</table>\n";
 	}
-	echo "</table>\n";
-}
 
-?>
\ No newline at end of file
+?>