diff --git a/code/modules/karma/karma.dm b/code/modules/karma/karma.dm
index 3d9d2fa56de..2935cd394be 100644
--- a/code/modules/karma/karma.dm
+++ b/code/modules/karma/karma.dm
@@ -4,9 +4,9 @@
 
 proc/sql_report_karma(var/mob/spender, var/mob/receiver)
 	var/sqlspendername = sanitizeSQL(spender.name)
-	var/sqlspenderkey = spender.ckey
+	var/sqlspenderkey = sanitizeSQL(spender.ckey)
 	var/sqlreceivername = sanitizeSQL(receiver.name)
-	var/sqlreceiverkey = receiver.ckey
+	var/sqlreceiverkey = sanitizeSQL(receiver.ckey)
 	var/sqlreceiverrole = "None"
 	var/sqlreceiverspecial = "None"
 
@@ -28,7 +28,7 @@ proc/sql_report_karma(var/mob/spender, var/mob/receiver)
 			log_game("SQL ERROR during karma logging. Error : \[[err]\]\n")
 
 
-		query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[receiver.ckey]'")
+		query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[sqlreceiverkey]'")
 		query.Execute()
 
 		var/karma
@@ -38,7 +38,7 @@ proc/sql_report_karma(var/mob/spender, var/mob/receiver)
 			karma = text2num(query.item[3])
 		if(karma == null)
 			karma = 1
-			query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("karmatotals")] (byondkey, karma) VALUES ('[receiver.ckey]', [karma])")
+			query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("karmatotals")] (byondkey, karma) VALUES ('[sqlreceiverkey]', [karma])")
 			if(!query.Execute())
 				var/err = query.ErrorMsg()
 				log_game("SQL ERROR during karmatotal logging (adding new key). Error : \[[err]\]\n")
@@ -168,11 +168,12 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 
 /client/proc/verify_karma()
 	var/currentkarma = 0
+	var/sanitzedkey = sanitizeSQL(src.ckey)
 	if(!GLOB.dbcon.IsConnected())
 		to_chat(usr, "<span class='warning'>Unable to connect to karma database. Please try again later.<br></span>")
 		return
 	else
-		var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT karma, karmaspent FROM [format_table_name("karmatotals")] WHERE byondkey='[src.ckey]'")
+		var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT karma, karmaspent FROM [format_table_name("karmatotals")] WHERE byondkey='[sanitzedkey]'")
 		query.Execute()
 
 		var/totalkarma
@@ -195,7 +196,8 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 	karmashopmenu()
 
 /client/proc/karmashopmenu()
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'")
+	var/sanitzedkey = sanitizeSQL(usr.ckey)
+	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[sanitzedkey]'")
 	query.Execute()
 
 	var/list/joblist
@@ -318,7 +320,7 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 				dat += "You do not have any refundable karma purchases.<br>"
 
 	var/currentkarma = verify_karma()
-	dat += "<br>You have <b>[currentkarma]</b> available."
+	dat += "<br>You have <b>[currentkarma]</b> available.<br>"
 
 	dat += "<br><B>PLEASE NOTE THAT PEOPLE WHO TRY TO GAME THE KARMA SYSTEM WILL END UP ON THE WALL OF SHAME. THIS INCLUDES BUT IS NOT LIMITED TO TRADES, OOC KARMA BEGGING, CODE EXPLOITS, ETC.</B>"
 	dat += "</center></body></html>"
@@ -347,7 +349,8 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 		karmashopmenu()
 
 /client/proc/DB_job_unlock(var/job,var/cost)
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'")
+	var/sanitzedkey = sanitizeSQL(usr.ckey)
+	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[sanitzedkey]'")
 	query.Execute()
 
 	var/dbjob
@@ -356,7 +359,7 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 		dbckey = query.item[2]
 		dbjob = query.item[3]
 	if(!dbckey)
-		query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, job) VALUES ('[usr.ckey]','[job]')")
+		query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, job) VALUES ('[sanitzedkey]','[job]')")
 		if(!query.Execute())
 			queryErrorLog(query.ErrorMsg(),"adding new key")
 			return
@@ -383,7 +386,8 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 			return
 
 /client/proc/DB_species_unlock(var/species,var/cost)
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'")
+	var/sanitzedkey = sanitizeSQL(usr.ckey)
+	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[sanitzedkey]'")
 	query.Execute()
 
 	var/dbspecies
@@ -392,7 +396,7 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 		dbckey = query.item[2]
 		dbspecies = query.item[4]
 	if(!dbckey)
-		query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, species) VALUES ('[usr.ckey]','[species]')")
+		query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, species) VALUES ('[sanitzedkey]','[species]')")
 		if(!query.Execute())
 			queryErrorLog(query.ErrorMsg(),"adding new key")
 			return
@@ -419,7 +423,8 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 			return
 
 /client/proc/karmacharge(var/cost,var/refund = FALSE)
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[usr.ckey]'")
+	var/sanitzedkey = sanitizeSQL(usr.ckey)
+	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[sanitizeSQL]'")
 	query.Execute()
 
 	while(query.NextRow())
@@ -428,7 +433,7 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 			spent -= cost
 		else
 			spent += cost
-		query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("karmatotals")] SET karmaspent=[spent] WHERE byondkey='[usr.ckey]'")
+		query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("karmatotals")] SET karmaspent=[spent] WHERE byondkey='[sanitizeSQL]'")
 		if(!query.Execute())
 			queryErrorLog(query.ErrorMsg(),"updating existing entry")
 			return
@@ -438,6 +443,7 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 			return
 
 /client/proc/karmarefund(var/type,var/name,var/cost)
+	var/sanitzedkey = sanitizeSQL(usr.ckey)
 	switch(name)
 		if("Tajaran Ambassador","Unathi Ambassador","Skrell Ambassador","Diona Ambassador","Kidan Ambassador",
 		"Slime People Ambassador","Grey Ambassador","Vox Ambassador","Customs Officer")
@@ -448,7 +454,7 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 			to_chat(usr, "<span class='warning'>That job is not refundable.</span>")
 			return
 
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'")
+	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[sanitzedkey]'")
 	query.Execute()
 
 	var/dbjob
@@ -491,7 +497,8 @@ GLOBAL_LIST_EMPTY(karma_spenders)
 	message_admins("SQL ERROR during whitelist logging ([errType]]). Error : \[[err]\]\n")
 
 /client/proc/checkpurchased(var/name = null) // If the first parameter is null, return a full list of purchases
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'")
+	var/sanitzedkey = sanitizeSQL(usr.ckey)
+	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[sanitzedkey]'")
 	query.Execute()
 
 	var/dbjob