diff --git a/src/octoprint/server/views.py b/src/octoprint/server/views.py
index 0f1b8c70..6ec2337f 100644
--- a/src/octoprint/server/views.py
+++ b/src/octoprint/server/views.py
@@ -17,6 +17,8 @@ from octoprint.server import app, userManager, pluginManager, gettext, \
 	debug, LOCALES, VERSION, DISPLAY_VERSION, UI_API_KEY, BRANCH
 from octoprint.settings import settings
 
+import re
+
 from . import util
 
 import logging
@@ -26,6 +28,9 @@ _templates = None
 _plugin_names = None
 _plugin_vars = None
 
+_valid_id_re = re.compile("[a-z_]+")
+_valid_div_re = re.compile("[a-zA-Z_-]+")
+
 @app.route("/")
 def index():
 	force_refresh = util.flask.cache_check_headers() or "_refresh" in request.values
@@ -466,6 +471,9 @@ def _process_template_config(name, implementation, rule, config=None, counter=1)
 		data["_div"] = rule["div"](name)
 		if "suffix" in data:
 			data["_div"] = data["_div"] + data["suffix"]
+		if not _valid_div_re.match(data["_div"]):
+			_logger.warn("Template config {} contains invalid div identifier {}, skipping it".format(name, data["_div"]))
+			return None
 
 	if not "template" in data:
 		data["template"] = rule["template"](name)
@@ -477,6 +485,7 @@ def _process_template_config(name, implementation, rule, config=None, counter=1)
 		data_bind = "allowBindings: true"
 		if "data_bind" in data:
 			data_bind = data_bind + ", " + data["data_bind"]
+		data_bind = data_bind.replace("\"", "\\\"")
 		data["data_bind"] = data_bind
 
 	data["_key"] = "plugin_" + name
diff --git a/src/octoprint/templates/dialogs/settings.jinja2 b/src/octoprint/templates/dialogs/settings.jinja2
index b8e79a5c..02ce5c48 100644
--- a/src/octoprint/templates/dialogs/settings.jinja2
+++ b/src/octoprint/templates/dialogs/settings.jinja2
@@ -20,7 +20,7 @@
                                     class="{% if mark_active %}active{% set mark_active = False %}{% endif %} {% if "classes_link" in data %}{{ data.classes_link|join(' ') }}{% elif "classes" in data %}{{ data.classes|join(' ') }}{% endif %}"
                                     {% if "styles_link" in data %} style="{{ data.styles_link|join(', ') }}" {% elif "styles" in data %} style="{{ data.styles|join(', ') }}" {% endif %}
                                         >
-                                    <a href="#{{ data._div }}" data-toggle="tab">{{ entry }}</a>
+                                    <a href="#{{ data._div }}" data-toggle="tab">{{ entry|e }}</a>
                                 </li>
                                 {% if "custom_bindings" not in data or data["custom_bindings"] %}<!-- /ko -->{% endif %}
                             {% endif %}
diff --git a/src/octoprint/templates/dialogs/usersettings.jinja2 b/src/octoprint/templates/dialogs/usersettings.jinja2
index 00cbcc6c..be405c15 100644
--- a/src/octoprint/templates/dialogs/usersettings.jinja2
+++ b/src/octoprint/templates/dialogs/usersettings.jinja2
@@ -17,7 +17,7 @@
                         class="{% if mark_active %}active{% set mark_active = False %}{% endif %} {% if "classes_link" in data %}{{ data.classes_link|join(' ') }}{% elif "classes" in data %}{{ data.classes|join(' ') }}{% endif %}"
                             {% if "styles_link" in data %} style="{{ data.styles_link|join(', ') }}" {% elif "styles" in data %} style="{{ data.styles|join(', ') }}" {% endif %}
                             >
-                        <a href="#{{ data._div }}" data-toggle="tab">{{ entry }}</a>
+                        <a href="#{{ data._div }}" data-toggle="tab">{{ entry|e }}</a>
                     </li>
                     {% if "custom_bindings" not in data or data["custom_bindings"] %}<!-- /ko -->{% endif %}
                 {% endif %}
diff --git a/src/octoprint/templates/index.jinja2 b/src/octoprint/templates/index.jinja2
index 5196d969..2a316380 100644
--- a/src/octoprint/templates/index.jinja2
+++ b/src/octoprint/templates/index.jinja2
@@ -55,7 +55,7 @@
                                     >
                                 <div class="accordion-heading">
                                     <a class="accordion-toggle" data-toggle="collapse" data-target="#{{ data._div }}">
-                                        {% if "icon" in data %}<i class="icon-{{ data.icon }}"></i> {% endif %}{{ entry }}
+                                        {% if "icon" in data %}<i class="icon-{{ data.icon }}"></i> {% endif %}{{ entry|e }}
                                     </a>
                                     {% if "template_header" in data %}
                                         {% include data.template_header ignore missing %}
@@ -87,7 +87,7 @@
                                     {% if "data_bind" in data %}data-bind="{{ data.data_bind }}"{% endif %}
                                     {% if "styles_link" in data %} style="{{ data.styles_link|join(', ') }}" {% elif "styles" in data %} style="{{ data.styles|join(', ') }}" {% endif %}
                                         >
-                                        <a href="#{{ data._div }}" data-toggle="tab">{{ entry }}</a>
+                                        <a href="#{{ data._div }}" data-toggle="tab">{{ entry|e }}</a>
                                 </li>
                                 {% if "custom_bindings" not in data or data["custom_bindings"] %}<!-- /ko -->{% endif %}
                             {% endfor %}
@@ -112,7 +112,7 @@
                 </div>
                 <div class="footer">
                     <ul class="pull-left muted">
-                        <li><small>{{ _('Version') }}: <span class="version">{{ display_version }}</span></small></li>
+                        <li><small>{{ _('Version') }}: <span class="version">{{ display_version|e }}</span></small></li>
                     </ul>
                     <ul class="pull-right">
                         <li><a href="http://octoprint.org"><i class="icon-home"></i> {{ _('Homepage') }}</a></li>
diff --git a/src/octoprint/templates/initscript.jinja2 b/src/octoprint/templates/initscript.jinja2
index e239de95..5866008c 100644
--- a/src/octoprint/templates/initscript.jinja2
+++ b/src/octoprint/templates/initscript.jinja2
@@ -10,13 +10,13 @@
     var CONFIG_TIMELAPSEFILESPERPAGE = 10;
     var CONFIG_LOGFILESPERPAGE = 10;
     var CONFIG_USERSPERPAGE = 10;
-    var CONFIG_WEBCAM_STREAM = "{{ webcamStream }}";
+    var CONFIG_WEBCAM_STREAM = "{{ webcamStream|e }}";
     var CONFIG_ACCESS_CONTROL = {% if enableAccessControl -%} true; {% else %} false; {%- endif %}
     var CONFIG_SD_SUPPORT = {% if enableSdSupport -%} true; {% else %} false; {%- endif %}
     var CONFIG_FIRST_RUN = {%  if firstRun -%} true; {% else %} false; {%- endif %}
     var CONFIG_TEMPERATURE_GRAPH = {%  if enableTemperatureGraph -%} true; {% else %} false; {%- endif %}
-    var CONFIG_GCODE_SIZE_THRESHOLD = {{ gcodeThreshold }};
-    var CONFIG_GCODE_MOBILE_SIZE_THRESHOLD = {{ gcodeMobileThreshold }};
+    var CONFIG_GCODE_SIZE_THRESHOLD = {{ gcodeThreshold|e }};
+    var CONFIG_GCODE_MOBILE_SIZE_THRESHOLD = {{ gcodeMobileThreshold|e }};
     var CONFIG_WIZARD = {% if wizard -%} true; {% else %} false; {%- endif %}
 
     var SOCKJS_URI = "{{ url_for('index') }}" + "sockjs";
@@ -24,11 +24,11 @@
     // sockjs should define CLOSE_NORMAL for us, but they don't (from ws spec)
     var SOCKJS_CLOSE_NORMAL = 1000;
 
-    var UI_API_KEY = "{{ uiApiKey }}";
-    var VERSION = "{{ version.number }}";
-    var DISPLAY_VERSION = "{{ version.display }}";
-    var BRANCH = "{{ version.branch }}";
-    var LOCALE = "{{ g.locale }}";
+    var UI_API_KEY = "{{ uiApiKey|e }}";
+    var VERSION = "{{ version.number|e }}";
+    var DISPLAY_VERSION = "{{ version.display|e }}";
+    var BRANCH = "{{ version.branch|e }}";
+    var LOCALE = "{{ g.locale|e }}";
     var AVAILABLE_LOCALES = {{ locales|tojson }};
 
     var OCTOPRINT_VIEWMODELS = [];
diff --git a/src/octoprint/templates/tabs/timelapse.jinja2 b/src/octoprint/templates/tabs/timelapse.jinja2
index 5fda40a9..acea78ad 100644
--- a/src/octoprint/templates/tabs/timelapse.jinja2
+++ b/src/octoprint/templates/tabs/timelapse.jinja2
@@ -7,10 +7,11 @@
     <label for="webcam_timelapse_mode">{{ _('Timelapse Mode') }}</label>
     <select id="webcam_timelapse_mode" data-bind="value: timelapseType, enable: isOperational() && !isPrinting() && loginState.isUser()">
         <option value="off">{{ _('Off') }}</option>
-        <option value="zchange">{{ _('On Z Change') }}</option>
         <option value="timed">{{ _('Timed') }}</option>
+        <option value="zchange">{{ _('On Z Change') }}</option>
     </select>
     <span class="help-block" data-bind="visible: timelapseType() == 'zchange'"><span class="label label-warning">{{ _('Warning') }}</span> {{ _('Do not use with spiralized ("Joris") vases or similar continuous Z models.') }}</span>
+    <span class="help-block" data-bind="visible: timelapseType() == 'zchange'"><span class="label label-info">{{ _('Note') }}</span> {% trans %}Does not work when printing from the printer's SD Card (no way to detect the change in Z reliably). Use "Timed" mode for those prints instead.{% endtrans %}</span>
 
     <label for="webcam_timelapse_fps">{{ _('Timelapse frame rate (in frames per second)') }}</label>
     <div class="input-append">