Index: /branches/version-2_5-dev/data/class/pages/admin/total/LC_Page_Admin_Total.php
===================================================================
--- /branches/version-2_5-dev/data/class/pages/admin/total/LC_Page_Admin_Total.php	(revision 20721)
+++ /branches/version-2_5-dev/data/class/pages/admin/total/LC_Page_Admin_Total.php	(revision 20741)
@@ -171,16 +171,46 @@
     }
 
+    /* デフォルト値の取得 */
+    function lfGetDateDefault() {
+        $year = date("Y");
+        $month = date("m");
+        $day = date("d");
+
+        $list = isset($_SESSION['total']) ? $_SESSION['total'] : "";
+
+        // セッション情報に開始月度が保存されていない。
+        if(empty($_SESSION['total']['startyear_m'])) {
+            $list['startyear_m'] = $year;
+            $list['startmonth_m'] = $month;
+        }
+
+        // セッション情報に開始日付、終了日付が保存されていない。
+        if(empty($_SESSION['total']['startyear']) && empty($_SESSION['total']['endyear'])) {
+            $list['startyear'] = $year;
+            $list['startmonth'] = $month;
+            $list['startday'] = $day;
+            $list['endyear'] = $year;
+            $list['endmonth'] = $month;
+            $list['endday'] = $day;
+        }
+
+        return $list;
+    }
+
     /* パラメータ情報の初期化 */
     function lfInitParam(&$objFormParam) {
+        // デフォルト値の取得
+        $arrList = $this->lfGetDateDefault();
+
         // 月度集計
-        $objFormParam->addParam("月度", "search_startyear_m", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
-        $objFormParam->addParam("月度", "search_startmonth_m", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
+        $objFormParam->addParam("月度", "search_startyear_m", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['startyear_m']);
+        $objFormParam->addParam("月度", "search_startmonth_m", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['startmonth_m']);
         // 期間集計
-        $objFormParam->addParam("開始日", "search_startyear", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
-        $objFormParam->addParam("開始日", "search_startmonth", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
-        $objFormParam->addParam("開始日", "search_startday", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
-        $objFormParam->addParam("終了日", "search_endyear", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
-        $objFormParam->addParam("終了日", "search_endmonth", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
-        $objFormParam->addParam("終了日", "search_endday", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"));
+        $objFormParam->addParam("開始日", "search_startyear", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['startyear']);
+        $objFormParam->addParam("開始日", "search_startmonth", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['startmonth']);
+        $objFormParam->addParam("開始日", "search_startday", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['startday']);
+        $objFormParam->addParam("終了日", "search_endyear", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['endyear']);
+        $objFormParam->addParam("終了日", "search_endmonth", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['endmonth']);
+        $objFormParam->addParam("終了日", "search_endday", INT_LEN, 'n', array("MAX_LENGTH_CHECK", "NUM_CHECK"), $arrList['endday']);
 
         // hiddenデータの取得用
Index: /branches/version-2_5-dev/data/class/pages/admin/design/LC_Page_Admin_Design_Bloc.php
===================================================================
--- /branches/version-2_5-dev/data/class/pages/admin/design/LC_Page_Admin_Design_Bloc.php	(revision 20693)
+++ /branches/version-2_5-dev/data/class/pages/admin/design/LC_Page_Admin_Design_Bloc.php	(revision 20741)
@@ -82,10 +82,4 @@
         // 端末種別IDを取得
         $device_type_id = $objFormParam->getValue('device_type_id');
-//        if (isset($_REQUEST['device_type_id'])
-//            && is_numeric($_REQUEST['device_type_id'])) {
-//            $device_type_id = $_REQUEST['device_type_id'];
-//        } else {
-//            $device_type_id = DEVICE_TYPE_PC;
-//        }
 
         $this->objLayout = new SC_Helper_PageLayout_Ex();
Index: /branches/version-2_5-dev/data/class/pages/admin/design/LC_Page_Admin_Design_CSS.php
===================================================================
--- /branches/version-2_5-dev/data/class/pages/admin/design/LC_Page_Admin_Design_CSS.php	(revision 20560)
+++ /branches/version-2_5-dev/data/class/pages/admin/design/LC_Page_Admin_Design_CSS.php	(revision 20741)
@@ -76,30 +76,15 @@
         $this->objLayout = new SC_Helper_PageLayout_Ex();
 
+        $objFormParam = new SC_FormParam_Ex();
+        $this->lfInitParam($objFormParam, $_REQUEST);
+
         // CSSファイル名を取得
-        if (isset($_POST['css_name'])) {
-            $css_name = $_POST['css_name'];
-        }else if (isset($_GET['css_name'])){
-            $css_name = $_GET['css_name'];
-        }else{
-            $css_name = '';
-        }
+        $css_name = $objFormParam->getValue('css_name');
         $this->css_name = $css_name;
-
-        if (isset($_POST['old_css_name'])) {
-            $old_css_name = $_POST['old_css_name'];
-        }else if (isset($_GET['css_name'])) {
-            $old_css_name = $_GET['css_name'];
-        }else{
-            $old_css_name = '';
-        }
+        $old_css_name = $objFormParam->getValue('old_css_name');
         $this->old_css_name = $old_css_name;
 
         // 端末種別IDを取得
-        if (isset($_REQUEST['device_type_id'])
-            && is_numeric($_REQUEST['device_type_id'])) {
-            $device_type_id = $_REQUEST['device_type_id'];
-        } else {
-            $device_type_id = DEVICE_TYPE_PC;
-        }
+        $device_type_id = $objFormParam->getValue('device_type_id');
 
         //サブタイトルの追加
@@ -122,8 +107,7 @@
                 break;
             case 'delete':
-                $this->lfExecuteDelete($css_path);
+                $this->lfExecuteDelete($css_path, $device_type_id);
                 break;
             default:
-                GC_Utils_Ex::gfPrintLog("MODEエラー：".$this->getMode());
                 break;
         }
@@ -141,4 +125,20 @@
     function destroy() {
         parent::destroy();
+    }
+
+
+    /**
+     * パラメータ情報の初期化
+     *
+     * @param object $objFormParam SC_FormParamインスタンス
+     * @param array $arrPost $_POSTデータ
+     * @return void
+     */
+    function lfInitParam(&$objFormParam, $arrPost) {
+        $objFormParam->addParam("端末種別ID", "device_type_id", INT_LEN, 'n', array("NUM_CHECK", "MAX_LENGTH_CHECK"), DEVICE_TYPE_PC);
+        $objFormParam->addParam("CSSファイル名", "css_name", MTEXT_LEN, 'a', array("MAX_LENGTH_CHECK"));
+        $objFormParam->addParam("旧CSSファイル名", "old_css_name", MTEXT_LEN, 'a', array("MAX_LENGTH_CHECK"));
+        $objFormParam->setParam($arrPost);
+        $objFormParam->convParam();
     }
 
@@ -164,5 +164,5 @@
     }
 
-    function lfExecuteDelete($css_path) {
+    function lfExecuteDelete($css_path, $device_type_id) {
         $objFileManager = new SC_Helper_FileManager_Ex();
 
@@ -171,5 +171,5 @@
             $objFileManager->sfDeleteDir($css_path);
         }
-        $this->objDisplay->reload(array(), true);
+        $this->objDisplay->reload(array('device_type_id' => $device_type_id), true);
     }
 
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/total/index.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/total/index.tpl	(revision 20515)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/total/index.tpl	(revision 20741)
@@ -115,5 +115,5 @@
                 <div id="graph-image">
                     <!--{* <img src="<!--{$tpl_image}-->?<!--{$cashtime}-->" alt="グラフ"> *}-->
-                    <img src="?draw_image=true&amp;type=<!--{$smarty.post.type}-->&amp;mode=search&amp;page=<!--{$smarty.post.page}-->&amp;search_startyear_m=<!--{$smarty.post.search_startyear_m}-->&amp;search_startmonth_m=<!--{$smarty.post.search_startmonth_m}-->&amp;search_startyear=<!--{$smarty.post.search_startyear}-->&amp;search_startmonth=<!--{$smarty.post.search_startmonth}-->&amp;search_startday=<!--{$smarty.post.search_startday}-->&amp;search_endyear=<!--{$smarty.post.search_endyear}-->&amp;search_endmonth=<!--{$smarty.post.search_endmonth}-->&amp;search_endday=<!--{$smarty.post.search_endday}-->" alt="グラフ" />
+                    <img src="?draw_image=true&amp;type=<!--{$smarty.post.type|h}-->&amp;mode=search&amp;page=<!--{$smarty.post.page|h}-->&amp;search_startyear_m=<!--{$smarty.post.search_startyear_m}-->&amp;search_startmonth_m=<!--{$smarty.post.search_startmonth_m}-->&amp;search_startyear=<!--{$smarty.post.search_startyear}-->&amp;search_startmonth=<!--{$smarty.post.search_startmonth}-->&amp;search_startday=<!--{$smarty.post.search_startday}-->&amp;search_endyear=<!--{$smarty.post.search_endyear}-->&amp;search_endmonth=<!--{$smarty.post.search_endmonth}-->&amp;search_endday=<!--{$smarty.post.search_endday}-->" alt="グラフ" />
                 </div>
                 <!--{/if}-->
@@ -130,6 +130,6 @@
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
             <input type="hidden" name="mode" value="search" />
-            <input type="hidden" name="type" value="<!--{$arrForm.type.value}-->" />
-            <input type="hidden" name="page" value="<!--{$arrForm.page.value}-->" />
+            <input type="hidden" name="type" value="<!--{$arrForm.type.value|h}-->" />
+            <input type="hidden" name="page" value="<!--{$arrForm.page.value|h}-->" />
             <!--{foreach key=key item=item from=$arrHidden}-->
                 <input type="hidden" name="<!--{$key}-->" value="<!--{$item|h}-->" />
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/contents/recommend.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/contents/recommend.tpl	(revision 20713)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/contents/recommend.tpl	(revision 20741)
@@ -49,8 +49,8 @@
 function lfnCheckSetItem( rank ){
     var flag = true;
-    var checkRank = '<!--{$checkRank}-->';
+    var checkRank = '<!--{$checkRank|h}-->';
     if ( checkRank ){
         if ( rank != checkRank ){
-            if( ! window.confirm('さきほど選択した<!--{$checkRank}-->位の情報は破棄されます。宜しいでしょうか')){
+            if( ! window.confirm('さきほど選択した<!--{$checkRank|h}-->位の情報は破棄されます。宜しいでしょうか')){
                 flag = false;
             }
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/customer/search_customer.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/customer/search_customer.tpl	(revision 20516)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/customer/search_customer.tpl	(revision 20741)
@@ -103,5 +103,5 @@
             <td><!--{$arrCustomer[cnt].name01|h}--><!--{$arrCustomer[cnt].name02|h}-->(<!--{$arrCustomer[cnt].kana01|h}--><!--{$arrCustomer[cnt].kana02|h}-->)</td>
             <td><!--{$arrCustomer[cnt].tel01|h}-->-<!--{$arrCustomer[cnt].tel02|h}-->-<!--{$arrCustomer[cnt].tel03|h}--></td>
-            <td align="center"><a href="" onClick="return func_submit(<!--{$arrCustomer[cnt].customer_id}-->)">決定</a></td>
+            <td align="center"><a href="" onClick="return func_submit(<!--{$arrCustomer[cnt].customer_id|h}-->)">決定</a></td>
         </tr>
         <!--▲商品<!--{$smarty.section.cnt.iteration}-->-->
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/basis/index.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/basis/index.tpl	(revision 20685)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/basis/index.tpl	(revision 20741)
@@ -192,7 +192,7 @@
             <td>
                 <span class="attention"><!--{$arrErr.tel01}--></span>
-                <input type="text" name="tel01" value="<!--{$arrForm.tel01}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.tel01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
-                <input type="text" name="tel02" value="<!--{$arrForm.tel02}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.tel01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
-                <input type="text" name="tel03" value="<!--{$arrForm.tel03}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.tel01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" />
+                <input type="text" name="tel01" value="<!--{$arrForm.tel01|h}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.tel01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
+                <input type="text" name="tel02" value="<!--{$arrForm.tel02|h}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.tel01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
+                <input type="text" name="tel03" value="<!--{$arrForm.tel03|h}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.tel01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" />
             </td>
         </tr>
@@ -201,7 +201,7 @@
             <td>
                 <span class="attention"><!--{$arrErr.fax01}--></span>
-                <input type="text" name="fax01" value="<!--{$arrForm.fax01}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.fax01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
-                <input type="text" name="fax02" value="<!--{$arrForm.fax02}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.fax02 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
-                <input type="text" name="fax03" value="<!--{$arrForm.fax03}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.fax03 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" />
+                <input type="text" name="fax01" value="<!--{$arrForm.fax01|h}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.fax01 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
+                <input type="text" name="fax02" value="<!--{$arrForm.fax02|h}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.fax02 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" /> -
+                <input type="text" name="fax03" value="<!--{$arrForm.fax03|h}-->" maxlength="6" size="6" class="box6" style="<!--{if $arrErr.fax03 != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" />
             </td>
         </tr>
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/adminparts/form_customer_search.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/adminparts/form_customer_search.tpl	(revision 20516)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/adminparts/form_customer_search.tpl	(revision 20741)
@@ -221,5 +221,5 @@
         <!--{assign var=key value="search_buy_product_code"}-->
         <!--{if $arrErr[$key]}--><span class="attention"><!--{$arrErr[$key]}--></span><!--{/if}-->
-        <input type="text" name="<!--{$key}-->" value="<!--{$arrForm[$key].value}-->" maxlength="<!--{$arrForm[$key].length}-->" size="30" class="box30" style="<!--{$arrErr[$key]|sfGetErrorColor}-->" >
+        <input type="text" name="<!--{$key}-->" value="<!--{$arrForm[$key].value|h}-->" maxlength="<!--{$arrForm[$key].length}-->" size="30" class="box30" style="<!--{$arrErr[$key]|sfGetErrorColor}-->" >
     </td>
 </tr>
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/products/review.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/products/review.tpl	(revision 20514)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/products/review.tpl	(revision 20741)
@@ -34,5 +34,5 @@
             <td><input type="text" name="search_reviewer_name" value="<!--{$arrForm.search_reviewer_name|h}-->" size="30" class="box30" /></td>
             <th>投稿者URL</th>
-            <td><input type="text" name="search_reviewer_url" value="<!--{$arrForm.search_reviewer_url}-->" size="30" class="box30" /></td>
+            <td><input type="text" name="search_reviewer_url" value="<!--{$arrForm.search_reviewer_url|h}-->" size="30" class="box30" /></td>
         </tr>
         <tr>
@@ -51,5 +51,5 @@
                 <select name="<!--{$key}-->">
                     <option value="" selected="selected">選択してください</option>
-                    <!--{html_options options=$arrRECOMMEND selected=$arrForm[$key].value}-->
+                    <!--{html_options options=$arrRECOMMEND selected=$arrForm[$key].value|h}-->
                 </select>
             </td>
@@ -64,25 +64,25 @@
                 <select name="search_startyear" style="<!--{$arrErr.search_startyear|sfGetErrorColor}-->">
                     <option value="">----</option>
-                    <!--{html_options options=$arrStartYear selected=$arrForm.search_startyear}-->
+                    <!--{html_options options=$arrStartYear selected=$arrForm.search_startyear|h}-->
                 </select>年
                 <select name="search_startmonth" style="<!--{$arrErr.search_startyear|sfGetErrorColor}-->">
                     <option value="">--</option>
-                    <!--{html_options options=$arrStartMonth selected=$arrForm.search_startmonth}-->
+                    <!--{html_options options=$arrStartMonth selected=$arrForm.search_startmonth|h}-->
                 </select>月
                 <select name="search_startday" style="<!--{$arrErr.search_startyear|sfGetErrorColor}-->">
                     <option value="">--</option>
-                    <!--{html_options options=$arrStartDay selected=$arrForm.search_startday}-->
+                    <!--{html_options options=$arrStartDay selected=$arrForm.search_startday|h}-->
                 </select>日～
                 <select name="search_endyear" style="<!--{$arrErr.search_endyear|sfGetErrorColor}-->">
                     <option value="">----</option>
-                    <!--{html_options options=$arrEndYear selected=$arrForm.search_endyear}-->
+                    <!--{html_options options=$arrEndYear selected=$arrForm.search_endyear|h}-->
                 </select>年
                 <select name="search_endmonth" style="<!--{$arrErr.search_endyear|sfGetErrorColor}-->">
                     <option value="">--</option>
-                    <!--{html_options options=$arrEndMonth selected=$arrForm.search_endmonth}-->
+                    <!--{html_options options=$arrEndMonth selected=$arrForm.search_endmonth|h}-->
                 </select>月
                 <select name="search_endday" style="<!--{$arrErr.search_endyear|sfGetErrorColor}-->">
                     <option value="">--</option>
-                    <!--{html_options options=$arrEndDay selected=$arrForm.search_endday}-->
+                    <!--{html_options options=$arrEndDay selected=$arrForm.search_endday|h}-->
                 </select>日
             </td>
@@ -97,5 +97,5 @@
         <!--{/if}-->
         <select name="<!--{$key}-->" style="<!--{$arrErr[$key]|sfGetErrorColor}-->">
-        <!--{html_options options=$arrPageMax selected=$arrForm.search_page_max}-->
+        <!--{html_options options=$arrPageMax selected=$arrForm.search_page_max|h}-->
         </select> 件</p>
         <div class="btn-area">
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/products/product_select.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/products/product_select.tpl	(revision 20514)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/products/product_select.tpl	(revision 20741)
@@ -30,5 +30,5 @@
 function func_submit( id ){
     var fm = window.opener.document.form1;
-    fm.recommend_id<!--{$smarty.get.no}-->.value = id;
+    fm.recommend_id<!--{$smarty.get.no|h}-->.value = id;
     fm.mode.value = 'recommend_select';
     fm.anchor_key.value = 'recommend_no<!--{$smarty.get.no}-->';
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/products/product.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/products/product.tpl	(revision 20638)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/products/product.tpl	(revision 20741)
@@ -72,7 +72,7 @@
 <input type="hidden" name="image_key" value="" />
 <input type="hidden" name="down_key" value="">
-<input type="hidden" name="product_id" value="<!--{$arrForm.product_id}-->" />
-<input type="hidden" name="product_class_id" value="<!--{$arrForm.product_class_id}-->" />
-<input type="hidden" name="copy_product_id" value="<!--{$arrForm.copy_product_id}-->" />
+<input type="hidden" name="product_id" value="<!--{$arrForm.product_id|h}-->" />
+<input type="hidden" name="product_class_id" value="<!--{$arrForm.product_class_id|h}-->" />
+<input type="hidden" name="copy_product_id" value="<!--{$arrForm.copy_product_id|h}-->" />
 <input type="hidden" name="anchor_key" value="" />
 <input type="hidden" name="select_recommend_no" value="" />
@@ -87,5 +87,5 @@
         <tr>
             <th>商品ID</th>
-            <td><!--{$arrForm.product_id}--></td>
+            <td><!--{$arrForm.product_id|h}--></td>
         </tr>
         <tr>
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/design/css.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/design/css.tpl	(revision 20645)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/design/css.tpl	(revision 20741)
@@ -25,6 +25,6 @@
 <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
 <input type="hidden" name="mode" value="" />
-<input type="hidden" name="area_row" value="<!--{$area_row}-->" />
-<input type="hidden" name="old_css_name" value="<!--{$old_css_name}-->" />
+<input type="hidden" name="area_row" value="<!--{$area_row|h}-->" />
+<input type="hidden" name="old_css_name" value="<!--{$old_css_name|h}-->" />
 <input type="hidden" name="device_type_id" value="<!--{$device_type_id|h}-->" />
 <div id="design" class="contents-main">
@@ -36,5 +36,5 @@
             <td>
                 <!--{if $arrErr.css_name != ""}--><span class="attention"><!--{$arrErr.css_name}--></span><br /><!--{/if}-->
-                <input type="text" name="css_name" value="<!--{$css_name}-->" maxlength="<!--{$smarty.const.STEXT_LEN}-->" style="<!--{if $arrErr.css_name != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" size="60" class="box60" />.css<span class="attention"> (上限<!--{$smarty.const.STEXT_LEN}-->文字)</span>
+                <input type="text" name="css_name" value="<!--{$css_name|h}-->" maxlength="<!--{$smarty.const.STEXT_LEN}-->" style="<!--{if $arrErr.css_name != ""}-->background-color: <!--{$smarty.const.ERR_COLOR}-->;<!--{/if}-->" size="60" class="box60" />.css<span class="attention"> (上限<!--{$smarty.const.STEXT_LEN}-->文字)</span>
             </td>
         </tr>
@@ -60,5 +60,5 @@
     <h2>編集可能CSSファイル</h2>
     <div class="btn addnew">
-        <a class="btn-normal" href="?" onclick="fnFormModeSubmit('form_css','','',''); return false;"><span>CSSを新規入力</span></a>
+        <a class="btn-normal" href="?device_type_id=<!--{$device_type_id|h}-->"><span>CSSを新規入力</span></a>
     </div>
     <table class="list" id="design-css-list">
@@ -71,10 +71,10 @@
         <!--{foreach key=key item=item from=$arrCSSList}-->
         <tr>
-            <td style="background:<!--{if $item.css_name == $css_name}--><!--{$smarty.const.SELECT_RGB}--><!--{else}-->#ffffff<!--{/if}-->;"><!--{$item.file_name}--></td>
+            <td style="background:<!--{if $item.css_name == $css_name}--><!--{$smarty.const.SELECT_RGB}--><!--{else}-->#ffffff<!--{/if}-->;"><!--{$item.file_name|h}--></td>
             <td class="center" style="background:<!--{if $item.css_name == $css_name}--><!--{$smarty.const.SELECT_RGB}--><!--{else}-->#ffffff<!--{/if}-->;">
-                <a href="?css_name=<!--{$item.css_name}-->&amp;device_type_id=<!--{$device_type_id}-->">編集</a>
+                <a href="?css_name=<!--{$item.css_name|h}-->&amp;device_type_id=<!--{$device_type_id|h}-->">編集</a>
             </td>
             <td class="center" style="background:<!--{if $item.css_name == $css_name}--><!--{$smarty.const.SELECT_RGB}--><!--{else}-->#ffffff<!--{/if}-->;">
-                <a href="javascript:;" onclick="fnFormModeSubmit('form_css','delete','css_name','<!--{$item.css_name}-->'); return false;">削除</a>
+                <a href="javascript:;" onclick="fnFormModeSubmit('form_css','delete','css_name','<!--{$item.css_name|h}-->'); return false;">削除</a>
             </td>
         </tr>
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/order/product_select.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/order/product_select.tpl	(revision 20516)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/order/product_select.tpl	(revision 20741)
@@ -42,5 +42,5 @@
     var opner_product_id = 'edit_product_id';
     var opner_product_class_id = 'edit_product_class_id';
-    fm1.getElementById("no").value = <!--{$tpl_no}-->;
+    fm1.getElementById("no").value = <!--{$tpl_no|h}-->;
     <!--{else}-->
     var opner_product_id = 'add_product_id';
@@ -130,5 +130,5 @@
 <input name="anchor_key" type="hidden" value="" />
 <input name="search_pageno" type="hidden" value="" />
-<input name="no" type="hidden" value="<!--{$tpl_no}-->" />
+<input name="no" type="hidden" value="<!--{$tpl_no|h}-->" />
 <table class="form">
     <colgroup width="20%">
@@ -145,9 +145,9 @@
     <tr>
         <th>商品名</th>
-        <td><input type="text" name="search_name" value="<!--{$arrForm.search_name}-->" size="35" class="box35" /></td>
+        <td><input type="text" name="search_name" value="<!--{$arrForm.search_name|h}-->" size="35" class="box35" /></td>
     </tr>
     <tr>
         <th>商品コード</th>
-        <td><input type="text" name="search_product_code" value="<!--{$arrForm.search_product_code}-->" size="35" class="box35" /></td>
+        <td><input type="text" name="search_product_code" value="<!--{$arrForm.search_product_code|h}-->" size="35" class="box35" /></td>
     </tr>
 </table>
Index: /branches/version-2_5-dev/data/Smarty/templates/admin/order/pdf_input.tpl
===================================================================
--- /branches/version-2_5-dev/data/Smarty/templates/admin/order/pdf_input.tpl	(revision 20513)
+++ /branches/version-2_5-dev/data/Smarty/templates/admin/order/pdf_input.tpl	(revision 20741)
@@ -93,9 +93,9 @@
         <th>帳票メッセージ</th>
         <td><!--{if $arrErr.msg1}--><span class="attention"><!--{$arrErr.msg1}--></span><!--{/if}-->
-            1行目：<input type="text" name="msg1" size="40" value="<!--{$arrForm.msg1}-->" maxlength="<!--{$smarty.const.STEXT_LEN*3/5}-->"/><br />
+            1行目：<input type="text" name="msg1" size="40" value="<!--{$arrForm.msg1|h}-->" maxlength="<!--{$smarty.const.STEXT_LEN*3/5}-->"/><br />
             <!--{if $arrErr.msg2}--><span class="attention"><!--{$arrErr.msg1}--></span><!--{/if}-->
-            2行目：<input type="text" name="msg2" size="40" value="<!--{$arrForm.msg2}-->" maxlength="<!--{$smarty.const.STEXT_LEN*3/5}-->"/><br />
+            2行目：<input type="text" name="msg2" size="40" value="<!--{$arrForm.msg2|h}-->" maxlength="<!--{$smarty.const.STEXT_LEN*3/5}-->"/><br />
             <!--{if $arrErr.msg3}--><span class="attention"><!--{$arrErr.msg3}--></span><!--{/if}-->
-            3行目：<input type="text" name="msg3" size="40" value="<!--{$arrForm.msg3}-->" maxlength="<!--{$smarty.const.STEXT_LEN*3/5}-->"/><br />
+            3行目：<input type="text" name="msg3" size="40" value="<!--{$arrForm.msg3|h}-->" maxlength="<!--{$smarty.const.STEXT_LEN*3/5}-->"/><br />
             <span style="font-size: 80%;">※未入力時はデフォルトのメッセージが表示されます。</span><br />
         </td>
