Sanitize all inputs

code/modules/admin/admin_verbs.dm

@@ -475,7 +475,7 @@ var/list/admin_verbs_ticket = list(
 		if(holder.fakekey)
 			holder.fakekey = null
 		else
-			var/new_key = ckeyEx(input("Enter your desired display name.", "Fake Key", key) as text|null)
+			var/new_key = ckeyEx(clean_input("Enter your desired display name.", "Fake Key", key))
 			if(!new_key)	return
 			if(length(new_key) >= 26)
 				new_key = copytext(new_key, 1, 26)
@@ -497,7 +497,7 @@ var/list/admin_verbs_ticket = list(
 			holder.fakekey = null
 			holder.big_brother = 0
 		else
-			var/new_key = ckeyEx(input("Enter your desired display name. Unlike normal stealth mode, this will not appear in Who at all, except for other heads.", "Fake Key", key) as text|null)
+			var/new_key = ckeyEx(clean_input("Enter your desired display name. Unlike normal stealth mode, this will not appear in Who at all, except for other heads.", "Fake Key", key))
 			if(!new_key)
 				return
 			if(length(new_key) >= 26)
@@ -638,7 +638,7 @@ var/list/admin_verbs_ticket = list(
 		return
 
 	if(O)
-		var/message = input("What do you want the message to be?", "Make Sound") as text|null
+		var/message = clean_input("What do you want the message to be?", "Make Sound")
 		if(!message)
 			return
 		for(var/mob/V in hearers(O))

code/modules/admin/sql_notes.dm

@@ -5,7 +5,7 @@
 		to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
 		return
 	if(!target_ckey)
-		var/new_ckey = ckey(input(usr,"Who would you like to add a note for?","Enter a ckey",null) as text|null)
+		var/new_ckey = ckey(clean_input("Who would you like to add a note for?","Enter a ckey",null))
 		if(!new_ckey)
 			return
 		new_ckey = ckey(new_ckey)

code/modules/admin/stickyban.dm

@@ -16,7 +16,7 @@
 			if(data["ckey"])
 				ckey = ckey(data["ckey"])
 			else
-				ckey = input(usr,"Ckey","Ckey","") as text|null
+				ckey = clean_input("Ckey","Ckey","")
 				if(!ckey)
 					return
 				ckey = ckey(ckey)
@@ -26,7 +26,7 @@
 			if(data["reason"])
 				ban["message"] = data["reason"]
 			else
-				var/reason = input(usr,"Reason","Reason","Ban Evasion") as text|null
+				var/reason = clean_input("Reason","Reason","Ban Evasion")
 				if(!reason)
 					return
 				ban["message"] = "[reason]"
@@ -112,7 +112,7 @@
 				to_chat(usr, "<span class='adminnotice'>Error: No sticky ban for [ckey] found!")
 				return
 			var/oldreason = ban["message"]
-			var/reason = input(usr,"Reason","Reason","[ban["message"]]") as text|null
+			var/reason = clean_input("Reason","Reason","[ban["message"]]")
 			if(!reason || reason == oldreason)
 				return
 			//we have to do this again incase something changed while we waited for input

code/modules/admin/topic.dm

@@ -189,7 +189,7 @@
 
 		var/task = href_list["editrights"]
 		if(task == "add")
-			var/new_ckey = ckey(input(usr,"New admin's ckey","Admin ckey", null) as text|null)
+			var/new_ckey = ckey(clean_input("New admin's ckey","Admin ckey", null))
 			if(!new_ckey)	return
 			if(new_ckey in admin_datums)
 				to_chat(usr, "<font color='red'>Error: Topic 'editrights': [new_ckey] is already an admin</font>")
@@ -1700,7 +1700,7 @@
 		var/eviltype = input(src.owner, "Which type of evil fax do you wish to send [H]?","Its good to be baaaad...", "") as null|anything in etypes
 		if(!(eviltype in etypes))
 			return
-		var/customname = input(src.owner, "Pick a title for the evil fax.", "Fax Title") as text|null
+		var/customname = clean_input("Pick a title for the evil fax.", "Fax Title", , owner)
 		if(!customname)
 			customname = "paper"
 		var/obj/item/paper/evilfax/P = new /obj/item/paper/evilfax(null)
@@ -2183,7 +2183,7 @@
 			return
 		input = P.parsepencode(input) // Encode everything from pencode to html
 
-		var/customname = input(src.owner, "Pick a title for the fax.", "Fax Title") as text|null
+		var/customname = clean_input("Pick a title for the fax.", "Fax Title", , owner)
 		if(!customname)
 			customname = "paper"
 
@@ -2216,14 +2216,14 @@
 						if("clown")
 							stampvalue = "clown"
 				else if(stamptype == "text")
-					stampvalue = input(src.owner, "What should the stamp say?", "Stamp Text") as text|null
+					stampvalue = clean_input("What should the stamp say?", "Stamp Text", , owner)
 				else if(stamptype == "none")
 					stamptype = ""
 				else
 					qdel(P)
 					return
 
-				sendername = input(src.owner, "What organization does the fax come from? This determines the prefix of the paper (i.e. Central Command- Title). This is optional.", "Organization") as text|null
+				sendername = clean_input("What organization does the fax come from? This determines the prefix of the paper (i.e. Central Command- Title). This is optional.", "Organization", , owner)
 
 		if(sender)
 			notify = alert(src.owner, "Would you like to inform the original sender that a fax has arrived?","Notify Sender","Yes","No")
@@ -3283,7 +3283,7 @@
 			return
 		var/datum/station_goal/G = new picked()
 		if(picked == /datum/station_goal)
-			var/newname = input("Enter goal name:") as text|null
+			var/newname = clean_input("Enter goal name:")
 			if(!newname)
 				return
 			G.name = newname

code/modules/admin/verbs/adminhelp.dm

@@ -18,7 +18,7 @@ var/list/adminhelp_ignored_words = list("unknown","the","a","an","of","monkey","
 	var/list/type = list("Mentorhelp","Adminhelp")
 	var/selected_type = input("Pick a category.", "Admin Help", null, null) as null|anything in type
 	if(selected_type)
-		msg = input("Please enter your message.", "Admin Help", null, null) as text|null
+		msg = clean_input("Please enter your message.", "Admin Help", null)
 
 	//clean the input msg
 	if(!msg)

code/modules/admin/verbs/adminpm.dm

@@ -89,7 +89,7 @@
 	//get message text, limit it's length.and clean/escape html
 	if(!msg)
 		set_typing(C, TRUE)
-		msg = input(src,"Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]") as text|null
+		msg = clean_input("Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]", , src)
 		set_typing(C, FALSE)
 
 		if(!msg)
@@ -109,6 +109,8 @@
 		msg = sanitize(copytext(msg,1,MAX_MESSAGE_LEN))
 		if(!msg)
 			return
+	else
+		msg = pencode_to_html(msg)
 
 	var/recieve_span = "playerreply"
 	var/send_pm_type = " "
@@ -147,7 +149,7 @@
 			spawn(0)	//so we don't hold the caller proc up
 				var/sender = src
 				var/sendername = key
-				var/reply = input(C, msg,"[recieve_pm_type] [type] from-[sendername]", "") as text|null		//show message and await a reply
+				var/reply = clean_input(msg,"[recieve_pm_type] [type] from-[sendername]", "", C)		//show message and await a reply
 				if(C && reply)
 					if(sender)
 						C.cmd_admin_pm(sender,reply)										//sender is still about, let's reply to them
@@ -216,7 +218,7 @@
 		to_chat(src, "<font color='red'>Error: Private-Message: You are unable to use PM-s (muted).</font>")
 		return
 
-	var/msg = input(src,"Message:", "Private message to admins on IRC / 400 character limit") as text|null
+	var/msg = clean_input("Message:", "Private message to admins on IRC / 400 character limit", , src) as text|null
 
 	if(!msg)
 		return

code/modules/admin/verbs/debug.dm

@@ -68,7 +68,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 				target = null
 				targetselected = 0
 
-		var/procname = input("Proc path, eg: /proc/fake_blood","Path:", null) as text|null
+		var/procname = clean_input("Proc path, eg: /proc/fake_blood","Path:", null)
 		if(!procname)	return
 
 		if(targetselected && !hascall(target,procname))
@@ -102,7 +102,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 	if(!check_rights(R_PROCCALL))
 		return
 
-	var/procname = input("Proc name, eg: fake_blood","Proc:", null) as text|null
+	var/procname = clean_input("Proc name, eg: fake_blood","Proc:", null)
 	if(!procname)
 		return
 
@@ -149,7 +149,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 				return null
 
 			if("text")
-				lst += input("Enter new text:","Text",null) as text
+				lst += clean_input("Enter new text:","Text",null)
 
 			if("num")
 				lst += input("Enter new number:","Num",0) as num
@@ -271,7 +271,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 			return 0
 	var/obj/item/paicard/card = new(T)
 	var/mob/living/silicon/pai/pai = new(card)
-	var/raw_name = input(choice, "Enter your pAI name:", "pAI Name", "Personal AI") as text
+	var/raw_name = clean_input("Enter your pAI name:", "pAI Name", "Personal AI", choice)
 	var/new_name = reject_bad_name(raw_name, 1)
 	if(new_name)
 		pai.name = new_name

code/modules/admin/verbs/diagnostics.dm

@@ -145,7 +145,7 @@
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/filter = input("Contains what?","Filter") as text|null
+	var/filter = clean_input("Contains what?","Filter")
 	if(!filter)
 		return
 
@@ -166,7 +166,7 @@
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/refstring = input("Which reference?","Ref") as text|null
+	var/refstring = clean_input("Which reference?","Ref")
 	if(!refstring)
 		return
 

code/modules/admin/verbs/mapping.dm

@@ -132,13 +132,13 @@ var/intercom_range_display_status = 0
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/level = input("Which z-level?","Level?") as text
+	var/level = clean_input("Which z-level?","Level?")
 	if(!level) return
 	var/num_level = text2num(level)
 	if(!num_level) return
 	if(!isnum(num_level)) return
 
-	var/type_text = input("Which type path?","Path?") as text
+	var/type_text = clean_input("Which type path?","Path?")
 	if(!type_text) return
 	var/type_path = text2path(type_text)
 	if(!type_path) return
@@ -170,7 +170,7 @@ var/intercom_range_display_status = 0
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/type_text = input("Which type path?","") as text
+	var/type_text = clean_input("Which type path?","")
 	if(!type_text) return
 	var/type_path = text2path(type_text)
 	if(!type_path) return

code/modules/admin/verbs/randomverbs.dm

@@ -54,7 +54,7 @@
 	if(!check_rights(R_SERVER|R_EVENT))
 		return
 
-	var/msg = input("Message:", text("Subtle PM to [M.key]")) as text
+	var/msg = clean_input("Message:", text("Subtle PM to [M.key]"))
 
 	if(!msg)
 		return
@@ -109,10 +109,11 @@
 	if(!check_rights(R_SERVER|R_EVENT))
 		return
 
-	var/msg = input("Message:", text("Enter the text you wish to appear to everyone:")) as text
+	var/msg = clean_input("Message:", text("Enter the text you wish to appear to everyone:"))
 
 	if(!msg)
 		return
+	msg = pencode_to_html(msg)
 	to_chat(world, "[msg]")
 	log_admin("GlobalNarrate: [key_name(usr)] : [msg]")
 	message_admins("<span class='boldnotice'>GlobalNarrate: [key_name_admin(usr)]: [msg]<BR></span>", 1)
@@ -131,10 +132,11 @@
 	if(!M)
 		return
 
-	var/msg = input("Message:", text("Enter the text you wish to appear to your target:")) as text
+	var/msg = clean_input("Message:", text("Enter the text you wish to appear to your target:"))
 
 	if( !msg )
 		return
+	msg = pencode_to_html(msg)
 
 	to_chat(M, msg)
 	log_admin("DirectNarrate: [key_name(usr)] to ([key_name(M)]): [msg]")
@@ -169,7 +171,7 @@
 			return
 
 	message_admins("[key_name_admin(src)] has started answering [key_name_admin(H)]'s [sender] request.")
-	var/input = input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "") as text|null
+	var/input = clean_input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "")
 	if(!input)
 		message_admins("[key_name_admin(src)] decided not to answer [key_name_admin(H)]'s [sender] request.")
 		return
@@ -550,7 +552,7 @@ Traitors and the like can also be revived with the previous role mostly intact.
 	if(!check_rights(R_EVENT))
 		return
 
-	var/input = input(usr, "Please enter anything you want the AI to do. Anything. Serious.", "What?", "") as text|null
+	var/input = clean_input("Please enter anything you want the AI to do. Anything. Serious.", "What?", "")
 	if(!input)
 		return
 
@@ -603,14 +605,15 @@ Traitors and the like can also be revived with the previous role mostly intact.
 	var/type = input(usr, "Pick a type of report to send", "Report Type", "") as anything in MsgType
 
 	if(type == "Custom")
-		type = input(usr, "What would you like the report type to be?", "Report Type", "Encrypted Transmission") as text|null
+		type = clean_input("What would you like the report type to be?", "Report Type", "Encrypted Transmission")
 
-	var/customname = input(usr, "Pick a title for the report.", "Title", MsgType[type]) as text|null
+	var/customname = clean_input("Pick a title for the report.", "Title", MsgType[type])
 	if(!customname)
 		return
 	var/input = input(usr, "Please enter anything you want. Anything. Serious.", "What's the message?") as message|null
 	if(!input)
 		return
+	input = pencode_to_html(html_encode(input))
 
 	switch(alert("Should this be announced to the general population?",,"Yes","No", "Cancel"))
 		if("Yes")

code/modules/admin/watchlist.dm

@@ -2,7 +2,7 @@
 	if(!check_rights(R_ADMIN))
 		return
 	if(!target_ckey)
-		var/new_ckey = ckey(input(usr,"Who would you like to add to the watchlist?","Enter a ckey",null) as text)
+		var/new_ckey = ckey(clean_input("Who would you like to add to the watchlist?","Enter a ckey",null))
 		if(!new_ckey)
 			return
 		new_ckey = sanitizeSQL(new_ckey)

code/modules/client/preference/preferences.dm

@@ -1261,7 +1261,7 @@ var/global/list/special_role_times = list( //minimum age (in days) for accounts
 		if("input")
 			switch(href_list["preference"])
 				if("name")
-					var/raw_name = input(user, "Choose your character's name:", "Character Preference") as text|null
+					var/raw_name = clean_input("Choose your character's name:", "Character Preference", , user)
 					if(!isnull(raw_name)) // Check to ensure that the user entered text (rather than cancel.)
 						var/new_name = reject_bad_name(raw_name, 1)
 						if(new_name)

code/modules/economy/EFTPOS.dm

@@ -116,7 +116,7 @@
 				else
 					to_chat(usr, "[bicon(src)]<span class='warning'>Unable to connect to accounts database.</span>")
 			if("trans_purpose")
-				var/purpose = input("Enter reason for EFTPOS transaction", "Transaction purpose", transaction_purpose) as text|null
+				var/purpose = clean_input("Enter reason for EFTPOS transaction", "Transaction purpose", transaction_purpose)
 				if(purpose)
 					transaction_purpose = purpose
 			if("trans_value")

code/modules/food_and_drinks/food/foods/pizza.dm

@@ -224,7 +224,7 @@
 	if(istype(I, /obj/item/pen/))
 		if(open)
 			return
-		var/t = input("Enter what you want to add to the tag:", "Write", null, null) as text
+		var/t = clean_input("Enter what you want to add to the tag:", "Write", null)
 		var/obj/item/pizzabox/boxtotagto = src
 		if(boxes.len > 0)
 			boxtotagto = boxes[boxes.len]

code/modules/mining/abandonedcrates.dm

@@ -151,7 +151,7 @@
 /obj/structure/closet/crate/secure/loot/attack_hand(mob/user)
 	if(locked)
 		to_chat(user, "<span class='notice'>The crate is locked with a Deca-code lock.</span>")
-		var/input = input(usr, "Enter [codelen] digits.", "Deca-Code Lock", "") as text
+		var/input = clean_input("Enter [codelen] digits.", "Deca-Code Lock", "")
 		if(in_range(src, user))
 			if(input == code)
 				to_chat(user, "<span class='notice'>The crate unlocks!</span>")

code/modules/mob/living/silicon/ai/ai.dm

@@ -498,7 +498,7 @@ var/list/ai_verbs_default = list(
 	if(check_unable(AI_CHECK_WIRELESS))
 		return
 
-	var/input = input(usr, "Please enter the reason for calling the shuttle.", "Shuttle Call Reason.","") as text|null
+	var/input = clean_input("Please enter the reason for calling the shuttle.", "Shuttle Call Reason.","")
 	if(!input || stat)
 		return
 
@@ -1074,7 +1074,7 @@ var/list/ai_verbs_default = list(
 	set desc = "Change the message that's transmitted when a new crew member arrives on station."
 	set category = "AI Commands"
 
-	var/newmsg = input("What would you like the arrival message to be? List of options: $name, $rank, $species, $gender, $age", "Change Arrival Message", arrivalmsg) as text
+	var/newmsg = clean_input("What would you like the arrival message to be? List of options: $name, $rank, $species, $gender, $age", "Change Arrival Message", arrivalmsg)
 	if(newmsg != arrivalmsg)
 		arrivalmsg = newmsg
 		to_chat(usr, "The arrival message has been successfully changed.")

code/modules/mob/living/silicon/ai/say.dm

@@ -99,7 +99,7 @@ var/const/VOX_PATH = "sound/vox_fem/"
 		to_chat(src, "<span class='warning'>Please wait [round((announcing_vox - world.time) / 10)] seconds.</span>")
 		return
 
-	var/message = input(src, "WARNING: Misuse of this verb can result in you being job banned. More help is available in 'Announcement Help'", "Announcement", last_announcement) as text|null
+	var/message = clean_input("WARNING: Misuse of this verb can result in you being job banned. More help is available in 'Announcement Help'", "Announcement", last_announcement, src)
 
 	last_announcement = message
 

code/modules/mob/mob_helpers.dm

@@ -565,9 +565,9 @@ var/list/intents = list(INTENT_HELP,INTENT_DISARM,INTENT_GRAB,INTENT_HARM)
 
 		for(var/i=1,i<=3,i++)	//we get 3 attempts to pick a suitable name.
 			if(force)
-				newname = input(src, "Pick a new name.", "Name Change", oldname) as text
+				newname = clean_input("Pick a new name.", "Name Change", oldname, src)
 			else
-				newname = input(src, "You are a [role]. Would you like to change your name to something else? (You have 3 minutes to select a new name.)", "Name Change", oldname) as text
+				newname = input("You are a [role]. Would you like to change your name to something else? (You have 3 minutes to select a new name.)", "Name Change", oldname, src)
 			if(((world.time - time_passed) > 1800) && !force)
 				alert(src, "Unfortunately, more than 3 minutes have passed for selecting your name. If you are a robot, use the Namepick verb; otherwise, adminhelp.", "Name Change")
 				return	//took too long

code/modules/mob/mob_transformation_simple.dm

@@ -9,7 +9,7 @@
 		return
 
 	if(!new_type)
-		new_type = input("Mob type path:", "Mob type") as text|null
+		new_type = clean_input("Mob type path:", "Mob type")
 
 	if(istext(new_type))
 		new_type = text2path(new_type)

code/modules/modular_computers/file_system/programs/command/comms.dm

@@ -245,7 +245,7 @@
 						message_cooldown = 0
 
 			if("callshuttle")
-				var/input = input(usr, "Please enter the reason for calling the shuttle.", "Shuttle Call Reason.","") as text|null
+				var/input = clean_input("Please enter the reason for calling the shuttle.", "Shuttle Call Reason.","")
 				if(!input || ..() || !is_authenticated(usr))
 					SSnanoui.update_uis(src)
 					return 1
@@ -306,11 +306,11 @@
 				setMenuState(usr, COMM_SCREEN_STAT)
 
 			if("setmsg1")
-				stat_msg1 = input("Line 1", "Enter Message Text", stat_msg1) as text|null
+				stat_msg1 = clean_input("Line 1", "Enter Message Text", stat_msg1)
 				setMenuState(usr, COMM_SCREEN_STAT)
 
 			if("setmsg2")
-				stat_msg2 = input("Line 2", "Enter Message Text", stat_msg2) as text|null
+				stat_msg2 = clean_input("Line 2", "Enter Message Text", stat_msg2)
 				setMenuState(usr, COMM_SCREEN_STAT)
 
 			if("nukerequest")

code/modules/ninja/suit/SpiderOS.dm

@@ -211,7 +211,7 @@
 
 		if("Message")
 			var/obj/item/pda/P = locate(href_list["target"])
-			var/t = input(U, "Please enter untraceable message.") as text
+			var/t = clean_input("Please enter untraceable message.", user=U)
 			t = copytext(sanitize(t), 1, MAX_MESSAGE_LEN)
 			if(!t||U.stat||U.wear_suit!=src||!s_initialized)//Wow, another one of these. Man...
 				display_to << browse(null, "window=spideros")

code/modules/paperwork/folders.dm

@@ -36,7 +36,7 @@
 		to_chat(user, "<span class='notice'>You put the [W] into \the [src].</span>")
 		update_icon()
 	else if(istype(W, /obj/item/pen))
-		var/n_name = input(usr, "What would you like to label the folder?", "Folder Labelling", null) as text|null
+		var/n_name = clean_input("What would you like to label the folder?", "Folder Labelling", null)
 		if(!n_name)
 			return
 		n_name = sanitize(copytext(n_name, 1, MAX_NAME_LEN))

code/modules/paperwork/paper.dm

@@ -215,7 +215,7 @@
 
 
 /obj/item/paper/proc/parsepencode(var/t, var/obj/item/pen/P, mob/user as mob)
-	t = pencode_to_html(t, usr, P, TRUE, TRUE, TRUE, deffont, signfont, crayonfont)
+	t = pencode_to_html(html_encode(t), usr, P, TRUE, TRUE, TRUE, deffont, signfont, crayonfont)
 	return t
 
 /obj/item/paper/proc/populatefields()
@@ -285,7 +285,6 @@
 				message_admins("PAPER: [key_name_admin(usr)] tried to use forbidden word in [src]: [bad].")
 				return
 */
-		t = html_encode(t)
 		t = parsepencode(t, i, usr) // Encode everything from pencode to html
 
 		if(id!="end")

code/modules/pda/cart_apps.dm

@@ -21,9 +21,9 @@
 				if("alert")
 					post_status("alert", href_list["alert"])
 				if("setmsg1")
-					message1 = input("Line 1", "Enter Message Text", message1) as text|null
+					message1 = clean_input("Line 1", "Enter Message Text", message1)
 				if("setmsg2")
-					message2 = input("Line 2", "Enter Message Text", message2) as text|null
+					message2 = clean_input("Line 2", "Enter Message Text", message2)
 				else
 					post_status(href_list["statdisp"])
 

code/modules/procedural_mapping/mapGenerator.dm

@@ -149,8 +149,8 @@
 	set category = "Debug"
 
 	var/datum/mapGenerator/nature/N = new()
-	var/startInput = input(usr,"Start turf of Map, (X;Y;Z)", "Map Gen Settings", "1;1;1") as text
-	var/endInput = input(usr,"End turf of Map (X;Y;Z)", "Map Gen Settings", "[world.maxx];[world.maxy];[mob ? mob.z : 1]") as text
+	var/startInput = clean_input("Start turf of Map, (X;Y;Z)", "Map Gen Settings", "1;1;1")
+	var/endInput = clean_input("End turf of Map (X;Y;Z)", "Map Gen Settings", "[world.maxx];[world.maxy];[mob ? mob.z : 1]")
 	//maxx maxy and current z so that if you fuck up, you only fuck up one entire z level instead of the entire universe
 	if(!startInput || !endInput)
 		to_chat(src, "Missing Input")

code/modules/reagents/chemistry/machinery/chem_master.dm

@@ -249,7 +249,7 @@
 				var/amount_per_pill = reagents.total_volume / count
 				if(amount_per_pill > 100)
 					amount_per_pill = 100
-				var/name = input(usr,"Name:","Name your pill!","[reagents.get_master_reagent_name()] ([amount_per_pill]u)") as text|null
+				var/name = clean_input("Name:","Name your pill!","[reagents.get_master_reagent_name()] ([amount_per_pill]u)")
 				if(!name)
 					return
 				name = reject_bad_text(name)
@@ -270,7 +270,7 @@
 							P.forceMove(loaded_pill_bottle)
 							updateUsrDialog()
 			else
-				var/name = input(usr, "Name:", "Name your bag!", reagents.get_master_reagent_name()) as text|null
+				var/name = clean_input("Name:", "Name your bag!", reagents.get_master_reagent_name())
 				if(!name)
 					return
 				name = reject_bad_text(name)
@@ -295,7 +295,7 @@
 				var/amount_per_patch = reagents.total_volume/count
 				if(amount_per_patch > 40)
 					amount_per_patch = 40
-				var/name = input(usr, "Name:", "Name your patch!", "[reagents.get_master_reagent_name()] ([amount_per_patch]u)") as text|null
+				var/name = clean_input("Name:", "Name your patch!", "[reagents.get_master_reagent_name()] ([amount_per_patch]u)")
 				if(!name)
 					return
 				name = reject_bad_text(name)
@@ -317,7 +317,7 @@
 
 		else if(href_list["createbottle"])
 			if(!condi)
-				var/name = input(usr, "Name:", "Name your bottle!", reagents.get_master_reagent_name()) as text|null
+				var/name = clean_input("Name:", "Name your bottle!", reagents.get_master_reagent_name())
 				if(!name)
 					return
 				name = reject_bad_text(name)