From 39ef5899f2671e1006037e330da2caf38c3147e2 Mon Sep 17 00:00:00 2001
From: "C.L" <killer65311@gmail.com>
Date: Thu, 29 Sep 2022 21:14:39 -0400
Subject: [PATCH 1/4] RCON Sanitization

- Makes RCON tags less exploitable.
---
 code/modules/power/breaker_box.dm       | 5 +++--
 code/modules/power/smes_construction.dm | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/code/modules/power/breaker_box.dm b/code/modules/power/breaker_box.dm
index e666ba6f578..2dffe3c228f 100644
--- a/code/modules/power/breaker_box.dm
+++ b/code/modules/power/breaker_box.dm
@@ -40,7 +40,7 @@
 /obj/machinery/power/breakerbox/activated/Initialize()
 	. = ..()
 	return INITIALIZE_HINT_LATELOAD
-		
+
 /obj/machinery/power/breakerbox/activated/LateInitialize()
 	set_state(1)
 
@@ -96,7 +96,8 @@
 
 /obj/machinery/power/breakerbox/attackby(var/obj/item/weapon/W as obj, var/mob/user as mob)
 	if(istype(W, /obj/item/device/multitool))
-		var/newtag = tgui_input_text(user, "Enter new RCON tag. Use \"NO_TAG\" to disable RCON or leave empty to cancel.", "SMES RCON system")
+		var/newtag = tgui_input_text(user, "Enter new RCON tag. Use \"NO_TAG\" to disable RCON or leave empty to cancel.", "SMES RCON system", "", MAX_NAME_LEN)
+		newtag = sanitize(newtag,MAX_NAME_LEN)
 		if(newtag)
 			RCon_tag = newtag
 			to_chat(user, "<span class='notice'>You changed the RCON tag to: [newtag]</span>")
diff --git a/code/modules/power/smes_construction.dm b/code/modules/power/smes_construction.dm
index 381f6b09f69..15c2f61f0da 100644
--- a/code/modules/power/smes_construction.dm
+++ b/code/modules/power/smes_construction.dm
@@ -312,7 +312,8 @@
 
 		// Multitool - change RCON tag
 		if(istype(W, /obj/item/device/multitool))
-			var/newtag = tgui_input_text(user, "Enter new RCON tag. Use \"NO_TAG\" to disable RCON or leave empty to cancel.", "SMES RCON system")
+			var/newtag = tgui_input_text(user, "Enter new RCON tag. Use \"NO_TAG\" to disable RCON or leave empty to cancel.", "SMES RCON system", "", MAX_NAME_LEN)
+			newtag = sanitize(newtag,MAX_NAME_LEN)
 			if(newtag)
 				RCon_tag = newtag
 				to_chat(user, "<span class='notice'>You changed the RCON tag to: [newtag]</span>")

From 01bee93e1ec43ec40bb63d99741e54226b1d0a20 Mon Sep 17 00:00:00 2001
From: "C.L" <killer65311@gmail.com>
Date: Thu, 29 Sep 2022 21:31:24 -0400
Subject: [PATCH 2/4] Navbeacon sanitization

---
 code/game/machinery/navbeacon.dm | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/code/game/machinery/navbeacon.dm b/code/game/machinery/navbeacon.dm
index 1e1fff180ed..be37e988b86 100644
--- a/code/game/machinery/navbeacon.dm
+++ b/code/game/machinery/navbeacon.dm
@@ -150,7 +150,7 @@ Transponder Codes:<UL>"}
 			usr.set_machine(src)
 
 			if(href_list["locedit"])
-				var/newloc = sanitize(tgui_input_text(usr, "Enter New Location", "Navigation Beacon", location))
+				var/newloc = sanitize(tgui_input_text(usr, "Enter New Location", "Navigation Beacon", location, MAX_NAME_LEN))
 				if(newloc)
 					location = newloc
 					updateDialog()
@@ -158,12 +158,14 @@ Transponder Codes:<UL>"}
 			else if(href_list["edit"])
 				var/codekey = href_list["code"]
 
-				var/newkey = tgui_input_text(usr, "Enter Transponder Code Key", "Navigation Beacon", codekey)
+				var/newkey = tgui_input_text(usr, "Enter Transponder Code Key", "Navigation Beacon", codekey, MAX_NAME_LEN)
+				newkey = sanitize(newkey,MAX_NAME_LEN)
 				if(!newkey)
 					return
 
 				var/codeval = codes[codekey]
-				var/newval = tgui_input_text(usr, "Enter Transponder Code Value", "Navigation Beacon", codeval)
+				var/newval = tgui_input_text(usr, "Enter Transponder Code Value", "Navigation Beacon", codeval, MAX_NAME_LEN)
+				newval = sanitize(newval,MAX_NAME_LEN)
 				if(!newval)
 					newval = codekey
 					return
@@ -180,11 +182,13 @@ Transponder Codes:<UL>"}
 
 			else if(href_list["add"])
 
-				var/newkey = tgui_input_text(usr, "Enter New Transponder Code Key", "Navigation Beacon")
+				var/newkey = tgui_input_text(usr, "Enter New Transponder Code Key", "Navigation Beacon", null, MAX_NAME_LEN)
+				newkey = sanitize(newkey,MAX_NAME_LEN)
 				if(!newkey)
 					return
 
-				var/newval = tgui_input_text(usr, "Enter New Transponder Code Value", "Navigation Beacon")
+				var/newval = tgui_input_text(usr, "Enter New Transponder Code Value", "Navigation Beacon", null, MAX_NAME_LEN)
+				newval = sanitize(newval,MAX_NAME_LEN)
 				if(!newval)
 					newval = "1"
 					return

From 9f7e4f0d7c59b078eee6e0f6fbdb0e7f7244e013 Mon Sep 17 00:00:00 2001
From: "C.L" <killer65311@gmail.com>
Date: Thu, 29 Sep 2022 22:06:29 -0400
Subject: [PATCH 3/4] Gyrotron sanitization

---
 code/modules/power/fusion/gyrotron/gyrotron.dm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/code/modules/power/fusion/gyrotron/gyrotron.dm b/code/modules/power/fusion/gyrotron/gyrotron.dm
index b2b33ef96bd..b84d04871e4 100644
--- a/code/modules/power/fusion/gyrotron/gyrotron.dm
+++ b/code/modules/power/fusion/gyrotron/gyrotron.dm
@@ -53,7 +53,8 @@ GLOBAL_LIST_EMPTY(gyrotrons)
 
 /obj/machinery/power/emitter/gyrotron/attackby(var/obj/item/W, var/mob/user)
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Gyrotron", id_tag)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Gyrotron", id_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			id_tag = new_ident
 		return

From 6236a1319497dc36d77c86eb044859325cb5395b Mon Sep 17 00:00:00 2001
From: "C.L" <killer65311@gmail.com>
Date: Thu, 29 Sep 2022 23:02:23 -0400
Subject: [PATCH 4/4] Sanitization and better TGUI utilization

- Sanitizes some more things so you can't put HTML into it.
- Utilizes TGUI better to show the user the max they can post.
- Limits some things like circuits so you can't insert 50000 characters.
---
 code/game/machinery/pointdefense.dm                  | 12 +++++++-----
 code/game/machinery/telecomms/logbrowser.dm          |  9 +++++----
 .../game/machinery/telecomms/machine_interactions.dm |  9 +++++----
 code/game/machinery/telecomms/telemonitor.dm         |  5 +++--
 code/game/machinery/telecomms/traffic_control.dm     |  3 ++-
 code/game/objects/items/bodybag.dm                   |  2 +-
 code/game/objects/items/devices/gps.dm               |  8 ++++----
 code/game/objects/items/devices/tvcamera.dm          |  3 ++-
 .../objects/items/weapons/implants/implantcase.dm    |  2 +-
 code/modules/admin/verbs/randomverbs.dm              |  6 +++++-
 code/modules/integrated_electronics/core/pins.dm     |  5 +++--
 code/modules/integrated_electronics/core/tools.dm    |  2 +-
 .../modules/integrated_electronics/subtypes/input.dm |  3 ++-
 .../integrated_electronics/subtypes/memory.dm        |  5 +++--
 code/modules/mob/living/carbon/human/human_powers.dm |  6 +++---
 code/modules/overmap/ships/computers/helm.dm         |  5 +++--
 code/modules/power/fusion/core/_core.dm              |  3 ++-
 .../power/fusion/fuel_assembly/fuel_control.dm       |  3 ++-
 .../power/fusion/fuel_assembly/fuel_injector.dm      |  3 ++-
 .../power/fusion/gyrotron/gyrotron_control.dm        |  3 ++-
 code/modules/power/turbine.dm                        |  6 ++++--
 code/modules/shuttles/shuttle_console.dm             |  3 ++-
 code/modules/tgui/modules/overmap.dm                 |  5 +++--
 23 files changed, 67 insertions(+), 44 deletions(-)

diff --git a/code/game/machinery/pointdefense.dm b/code/game/machinery/pointdefense.dm
index f19b80befc7..33c485a36e6 100644
--- a/code/game/machinery/pointdefense.dm
+++ b/code/game/machinery/pointdefense.dm
@@ -94,7 +94,8 @@ GLOBAL_LIST_BOILERPLATE(pointdefense_turrets, /obj/machinery/power/pointdefense)
 
 /obj/machinery/pointdefense_control/attackby(var/obj/item/W, var/mob/user)
 	if(W?.is_multitool())
-		var/new_ident = tgui_input_text(user, "Enter a new ident tag.", "[src]", id_tag)
+		var/new_ident = tgui_input_text(user, "Enter a new ident tag.", "[src]", id_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && new_ident != id_tag && user.Adjacent(src) && CanInteract(user, GLOB.tgui_physical_state))
 			// Check for duplicate controllers with this ID
 			for(var/obj/machinery/pointdefense_control/PC as anything in pointdefense_controllers)
@@ -211,7 +212,8 @@ GLOBAL_LIST_BOILERPLATE(pointdefense_turrets, /obj/machinery/power/pointdefense)
 
 /obj/machinery/power/pointdefense/attackby(var/obj/item/W, var/mob/user)
 	if(W?.is_multitool())
-		var/new_ident = tgui_input_text(user, "Enter a new ident tag.", "[src]", id_tag)
+		var/new_ident = tgui_input_text(user, "Enter a new ident tag.", "[src]", id_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && new_ident != id_tag && user.Adjacent(src) && CanInteract(user, GLOB.tgui_physical_state))
 			to_chat(user, "<span class='notice'>You register [src] with the [new_ident] network.</span>")
 			id_tag = new_ident
@@ -295,7 +297,7 @@ GLOBAL_LIST_BOILERPLATE(pointdefense_turrets, /obj/machinery/power/pointdefense)
 	var/obj/machinery/pointdefense_control/PC = get_controller()
 	if(!istype(PC))
 		return
-	
+
 	// Compile list of known targets
 	var/list/existing_targets = list()
 	for(var/weakref/WR in PC.targets)
@@ -319,7 +321,7 @@ GLOBAL_LIST_BOILERPLATE(pointdefense_turrets, /obj/machinery/power/pointdefense)
 			engaging = target
 			Shoot(target)
 			return
-		
+
 /obj/machinery/power/pointdefense/proc/targeting_check(var/obj/effect/meteor/M)
 	// Target in range
 	var/list/connected_z_levels = GetConnectedZlevels(get_z(src))
@@ -330,7 +332,7 @@ GLOBAL_LIST_BOILERPLATE(pointdefense_turrets, /obj/machinery/power/pointdefense)
 	// If we can shoot it, then shoot
 	if(emagged || !space_los(M))
 		return FALSE
-	
+
 	return TRUE
 
 /obj/machinery/power/pointdefense/RefreshParts()
diff --git a/code/game/machinery/telecomms/logbrowser.dm b/code/game/machinery/telecomms/logbrowser.dm
index 461a2004817..2de8d04a492 100644
--- a/code/game/machinery/telecomms/logbrowser.dm
+++ b/code/game/machinery/telecomms/logbrowser.dm
@@ -46,7 +46,7 @@
 		for(var/c in SelectedServer.log_entries)
 			i++
 			var/datum/comm_log_entry/C = c
-			
+
 			// This is necessary to prevent leaking information to the clientside
 			var/static/list/acceptable_params = list("uspeech", "intelligible", "message", "name", "race", "job", "timecode")
 			var/list/parameters = list()
@@ -74,7 +74,7 @@
 	if(!ui)
 		ui = new(user, src, "TelecommsLogBrowser", name)
 		ui.open()
-	
+
 /obj/machinery/computer/telecomms/server/tgui_act(action, params)
 	if(..())
 		return TRUE
@@ -128,7 +128,8 @@
 			. = TRUE
 
 		if("network")
-			var/newnet = tgui_input_text(usr, "Which network do you want to view?", "Comm Monitor", network)
+			var/newnet = tgui_input_text(usr, "Which network do you want to view?", "Comm Monitor", network, 15)
+			newnet = sanitize(newnet,15)
 
 			if(newnet && ((usr in range(1, src) || issilicon(usr))))
 				if(length(newnet) > 15)
@@ -139,7 +140,7 @@
 				set_temp("NEW NETWORK TAG SET IN ADDRESS \[[network]\]", "good")
 
 			. = TRUE
-		
+
 		if("cleartemp")
 			temp = null
 			. = TRUE
diff --git a/code/game/machinery/telecomms/machine_interactions.dm b/code/game/machinery/telecomms/machine_interactions.dm
index 1a9fc2246e1..ca8a74312aa 100644
--- a/code/game/machinery/telecomms/machine_interactions.dm
+++ b/code/game/machinery/telecomms/machine_interactions.dm
@@ -41,7 +41,7 @@
 
 /obj/machinery/telecomms/tgui_data(mob/user)
 	var/list/data = list()
-	
+
 	data["temp"] = temp
 	data["on"] = on
 
@@ -81,7 +81,7 @@
 				"index" = i,
 			)))
 		data["linked"] = linked
-		
+
 		var/list/filter = list()
 		for(var/x in freq_listening)
 			filter.Add(list(list(
@@ -213,7 +213,7 @@
 /obj/machinery/telecomms/bus/Options_Act(action, params)
 	if(..())
 		return TRUE
-	
+
 	switch(action)
 		if("change_freq")
 			. = TRUE
@@ -267,7 +267,7 @@
 /obj/machinery/telecomms/receiver/Options_Act(action, params)
 	if(..())
 		return TRUE
-	
+
 	switch(action)
 		if("range")
 			var/new_range = params["range"]
@@ -296,6 +296,7 @@
 
 		if("network")
 			var/newnet = tgui_input_text(usr, "Specify the new network for this machine. This will break all current links.", src, network)
+			newnet = sanitize(newnet,15)
 			if(newnet && canAccess(usr))
 
 				if(length(newnet) > 15)
diff --git a/code/game/machinery/telecomms/telemonitor.dm b/code/game/machinery/telecomms/telemonitor.dm
index 3014474b8ea..cf9ab2096dc 100644
--- a/code/game/machinery/telecomms/telemonitor.dm
+++ b/code/game/machinery/telecomms/telemonitor.dm
@@ -100,7 +100,8 @@
 			. = TRUE
 
 		if("network")
-			var/newnet = tgui_input_text(usr, "Which network do you want to view?", "Comm Monitor", network)
+			var/newnet = tgui_input_text(usr, "Which network do you want to view?", "Comm Monitor", network, 15)
+			newnet = sanitize(newnet,15) //Honestly, I'd be amazed if someone managed to do HTML in 15 chars.
 			if(newnet && ((usr in range(1, src) || issilicon(usr))))
 				if(length(newnet) > 15)
 					set_temp("FAILED: NETWORK TAG STRING TOO LENGTHY", "bad")
@@ -108,7 +109,7 @@
 				network = newnet
 				machinelist = list()
 				set_temp("NEW NETWORK TAG SET IN ADDRESS \[[network]\]", "good")
-			
+
 			. = TRUE
 
 		if("cleartemp")
diff --git a/code/game/machinery/telecomms/traffic_control.dm b/code/game/machinery/telecomms/traffic_control.dm
index cf7f9946aae..17dbed4e2cc 100644
--- a/code/game/machinery/telecomms/traffic_control.dm
+++ b/code/game/machinery/telecomms/traffic_control.dm
@@ -192,7 +192,8 @@
 
 	if(href_list["network"])
 
-		var/newnet = tgui_input_text(usr, "Which network do you want to view?", "Comm Monitor", network)
+		var/newnet = tgui_input_text(usr, "Which network do you want to view?", "Comm Monitor", network, 15)
+		newnet = sanitize(newnet,15)
 
 		if(newnet && ((usr in range(1, src) || issilicon(usr))))
 			if(length(newnet) > 15)
diff --git a/code/game/objects/items/bodybag.dm b/code/game/objects/items/bodybag.dm
index 862d4e6cdaf..94a24c9ee8b 100644
--- a/code/game/objects/items/bodybag.dm
+++ b/code/game/objects/items/bodybag.dm
@@ -33,7 +33,7 @@
 
 /obj/structure/closet/body_bag/attackby(var/obj/item/W as obj, mob/user as mob)
 	if (istype(W, /obj/item/weapon/pen))
-		var/t = tgui_input_text(user, "What would you like the label to be?", text("[]", src.name), null)
+		var/t = tgui_input_text(user, "What would you like the label to be?", text("[]", src.name), null, MAX_NAME_LEN	)
 		if (user.get_active_hand() != W)
 			return
 		if (!in_range(src, user) && src.loc != user)
diff --git a/code/game/objects/items/devices/gps.dm b/code/game/objects/items/devices/gps.dm
index 21ec2ea3b66..980685f1241 100644
--- a/code/game/objects/items/devices/gps.dm
+++ b/code/game/objects/items/devices/gps.dm
@@ -137,7 +137,7 @@ var/list/GPS_list = list()
 	if(emped)
 		to_chat(user, "It's busted!")
 		return
-	
+
 	toggle_tracking()
 	if(tracking)
 		to_chat(user, "[src] is no longer tracking, or visible to other GPS devices.")
@@ -194,7 +194,7 @@ var/list/GPS_list = list()
 	dat["curr_z"] = curr.z
 	dat["curr_z_name"] = strip_improper(using_map.get_zlevel_name(curr.z))
 	dat["z_level_detection"] = using_map.get_map_levels(curr.z, long_range)
-	
+
 	var/list/gps_list = list()
 	for(var/obj/item/device/gps/G in GPS_list - src)
 
@@ -250,7 +250,7 @@ var/list/GPS_list = list()
 				dat += "<tr>"
 				var/gps_ref = "\ref[gps["ref"]]"
 				dat += "<td>[gps["gps_tag"]]</td><td>[gps["area_name"]]</td>"
-				
+
 				if(istype(gps_data["ref"], /obj/item/device/gps/internal/poi))
 					dat += "<td>[gps["local"] ? "[gps["direction"]] Dist: [round(gps["distance"], 10)]m" : "[gps["z_name"]]"]</td>"
 				else
@@ -323,7 +323,7 @@ var/list/GPS_list = list()
 				. = TRUE
 
 	if(href_list["tag"])
-		var/a = tgui_input_text(usr, "Please enter desired tag.", name, gps_tag)
+		var/a = tgui_input_text(usr, "Please enter desired tag.", name, gps_tag, 10)
 		a = uppertext(copytext(sanitize(a), 1, 11))
 		if(in_range(src, usr))
 			gps_tag = a
diff --git a/code/game/objects/items/devices/tvcamera.dm b/code/game/objects/items/devices/tvcamera.dm
index 849a649894f..a9e5613a926 100644
--- a/code/game/objects/items/devices/tvcamera.dm
+++ b/code/game/objects/items/devices/tvcamera.dm
@@ -65,7 +65,8 @@
 	if(..())
 		return 1
 	if(href_list["channel"])
-		var/nc = tgui_input_text(usr, "Channel name", "Select new channel name", channel)
+		var/nc = tgui_input_text(usr, "Channel name", "Select new channel name", channel, MAX_NAME_LEN)
+		nc = sanitize(nc,MAX_NAME_LEN)
 		if(nc)
 			channel = nc
 			camera.c_tag = channel
diff --git a/code/game/objects/items/weapons/implants/implantcase.dm b/code/game/objects/items/weapons/implants/implantcase.dm
index 1517e2ada31..5e81318ac6b 100644
--- a/code/game/objects/items/weapons/implants/implantcase.dm
+++ b/code/game/objects/items/weapons/implants/implantcase.dm
@@ -21,7 +21,7 @@
 /obj/item/weapon/implantcase/attackby(obj/item/weapon/I as obj, mob/user as mob)
 	..()
 	if (istype(I, /obj/item/weapon/pen))
-		var/t = tgui_input_text(user, "What would you like the label to be?", text("[]", src.name), null)
+		var/t = tgui_input_text(user, "What would you like the label to be?", text("[]", src.name), null, MAX_NAME_LEN)
 		if (user.get_active_hand() != I)
 			return
 		if((!in_range(src, usr) && src.loc != user))
diff --git a/code/modules/admin/verbs/randomverbs.dm b/code/modules/admin/verbs/randomverbs.dm
index 4ae6532daf6..5133728ac0c 100644
--- a/code/modules/admin/verbs/randomverbs.dm
+++ b/code/modules/admin/verbs/randomverbs.dm
@@ -86,10 +86,14 @@
 	if (!holder)
 		return
 
-	var/msg = sanitize(tgui_input_text(usr, "Message:", text("Subtle PM to [M.key]")))
+	var/msg = tgui_input_text(usr, "Message:", text("Subtle PM to [M.key]"))
 
 	if (!msg)
 		return
+
+	if(!(msg[1] == "<" && msg[length(msg)] == ">")) //You can use HTML but only if the whole thing is HTML. Tries to prevent admin 'accidents'.
+		msg = sanitize(msg)
+
 	if(usr)
 		if (usr.client)
 			if(usr.client.holder)
diff --git a/code/modules/integrated_electronics/core/pins.dm b/code/modules/integrated_electronics/core/pins.dm
index c402cf022d2..1d972fa0d72 100644
--- a/code/modules/integrated_electronics/core/pins.dm
+++ b/code/modules/integrated_electronics/core/pins.dm
@@ -154,12 +154,13 @@ list[](
 	var/new_data = null
 	switch(type_to_use)
 		if("string")
-			new_data = tgui_input_text(usr, "Now type in a string.","[src] string writing", istext(default) ? default : null)
+			new_data = tgui_input_text(usr, "Now type in a string.","[src] string writing", istext(default) ? default : null, MAX_NAME_LEN)
+			new_data = sanitize(new_data,MAX_NAME_LEN)
 			if(istext(new_data) && holder.check_interactivity(user) )
 				to_chat(user, "<span class='notice'>You input [new_data] into the pin.</span>")
 				return new_data
 		if("number")
-			new_data = tgui_input_number(usr, "Now type in a number.","[src] number writing", isnum(default) ? default : null)
+			new_data = tgui_input_number(usr, "Now type in a number.","[src] number writing", isnum(default) ? default : null, MAX_NAME_LEN)
 			if(isnum(new_data) && holder.check_interactivity(user) )
 				to_chat(user, "<span class='notice'>You input [new_data] into the pin.</span>")
 				return new_data
diff --git a/code/modules/integrated_electronics/core/tools.dm b/code/modules/integrated_electronics/core/tools.dm
index dcaaf58057a..bc3b9493e26 100644
--- a/code/modules/integrated_electronics/core/tools.dm
+++ b/code/modules/integrated_electronics/core/tools.dm
@@ -122,7 +122,7 @@
 	switch(type_to_use)
 		if("string")
 			accepting_refs = 0
-			new_data = tgui_input_text(usr, "Now type in a string.","[src] string writing")
+			new_data = tgui_input_text(usr, "Now type in a string.","[src] string writing", null, MAX_MESSAGE_LEN)
 			new_data = sanitizeSafe(new_data, MAX_MESSAGE_LEN, 0, 0)
 			if(istext(new_data) && CanInteract(user, GLOB.tgui_physical_state))
 				data_to_write = new_data
diff --git a/code/modules/integrated_electronics/subtypes/input.dm b/code/modules/integrated_electronics/subtypes/input.dm
index 332b7bb580c..914a20a70d2 100644
--- a/code/modules/integrated_electronics/subtypes/input.dm
+++ b/code/modules/integrated_electronics/subtypes/input.dm
@@ -72,7 +72,8 @@
 	power_draw_per_use = 4
 
 /obj/item/integrated_circuit/input/textpad/ask_for_input(mob/user)
-	var/new_input = tgui_input_text(user, "Enter some words, please.","Number pad", get_pin_data(IC_OUTPUT, 1))
+	var/new_input = tgui_input_text(user, "Enter some words, please.","Number pad", get_pin_data(IC_OUTPUT, 1),MAX_NAME_LEN)
+	new_input = sanitize(new_input,MAX_NAME_LEN)
 	if(istext(new_input) && CanInteract(user, GLOB.tgui_physical_state))
 		set_pin_data(IC_OUTPUT, 1, new_input)
 		push_data()
diff --git a/code/modules/integrated_electronics/subtypes/memory.dm b/code/modules/integrated_electronics/subtypes/memory.dm
index 0148c01c05e..022eeb3da95 100644
--- a/code/modules/integrated_electronics/subtypes/memory.dm
+++ b/code/modules/integrated_electronics/subtypes/memory.dm
@@ -96,13 +96,14 @@
 	switch(type_to_use)
 		if("string")
 			accepting_refs = 0
-			new_data = tgui_input_text(usr, "Now type in a string.","[src] string writing")
+			new_data = tgui_input_text(usr, "Now type in a string.","[src] string writing", MAX_NAME_LEN)
+			new_data = sanitize(new_data,MAX_NAME_LEN)
 			if(istext(new_data) && CanInteract(user, GLOB.tgui_physical_state))
 				O.data = new_data
 				to_chat(user, "<span class='notice'>You set \the [src]'s memory to [O.display_data(O.data)].</span>")
 		if("number")
 			accepting_refs = 0
-			new_data = tgui_input_number(usr, "Now type in a number.","[src] number writing")
+			new_data = tgui_input_number(usr, "Now type in a number.","[src] number writing", MAX_NAME_LEN)
 			if(isnum(new_data) && CanInteract(user, GLOB.tgui_physical_state))
 				O.data = new_data
 				to_chat(user, "<span class='notice'>You set \the [src]'s memory to [O.display_data(O.data)].</span>")
diff --git a/code/modules/mob/living/carbon/human/human_powers.dm b/code/modules/mob/living/carbon/human/human_powers.dm
index f8d49b046ad..39ecfba3878 100644
--- a/code/modules/mob/living/carbon/human/human_powers.dm
+++ b/code/modules/mob/living/carbon/human/human_powers.dm
@@ -94,9 +94,9 @@
 
 	if(!target) return
 
-	text = tgui_input_text(usr, "What would you like to say?", "Speak to creature", null, null)
+	text = tgui_input_text(usr, "What would you like to say?", "Speak to creature", null, MAX_MESSAGE_LEN)
 
-	text = sanitize(text)
+	text = sanitize(text, MAX_MESSAGE_LEN)
 
 	if(!text) return
 
@@ -217,7 +217,7 @@
 
 		if(isSynthetic())
 			output += "Current Battery Charge: [nutrition]\n"
-			
+
 			var/toxDam = getToxLoss()
 			if(toxDam)
 				output += "System Instability: <span class='warning'>[toxDam > 25 ? "Severe" : "Moderate"]</span>. Seek charging station for cleanup.\n"
diff --git a/code/modules/overmap/ships/computers/helm.dm b/code/modules/overmap/ships/computers/helm.dm
index 64212fd3601..37c625dc895 100644
--- a/code/modules/overmap/ships/computers/helm.dm
+++ b/code/modules/overmap/ships/computers/helm.dm
@@ -157,7 +157,8 @@ GLOBAL_LIST_EMPTY(all_waypoints)
 	switch(action)
 		if("add")
 			var/datum/computer_file/data/waypoint/R = new()
-			var/sec_name = tgui_input_text(usr, "Input navigation entry name", "New navigation entry", "Sector #[known_sectors.len]")
+			var/sec_name = tgui_input_text(usr, "Input navigation entry name", "New navigation entry", "Sector #[known_sectors.len]", MAX_NAME_LEN)
+			sec_name = sanitize(sec_name,MAX_NAME_LEN)
 			if(tgui_status(usr, state) != STATUS_INTERACTIVE)
 				return FALSE
 			if(!sec_name)
@@ -244,7 +245,7 @@ GLOBAL_LIST_EMPTY(all_waypoints)
 			else
 				autopilot = !autopilot
 			. = TRUE
-		
+
 		if("apilot_lock")
 			autopilot_disabled = !autopilot_disabled
 			autopilot = FALSE
diff --git a/code/modules/power/fusion/core/_core.dm b/code/modules/power/fusion/core/_core.dm
index 308c9307839..dfcf908107a 100644
--- a/code/modules/power/fusion/core/_core.dm
+++ b/code/modules/power/fusion/core/_core.dm
@@ -149,7 +149,8 @@ GLOBAL_LIST_EMPTY(fusion_cores)
 		return
 
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Fusion Core", id_tag)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Fusion Core", id_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			id_tag = new_ident
 		return
diff --git a/code/modules/power/fusion/fuel_assembly/fuel_control.dm b/code/modules/power/fusion/fuel_assembly/fuel_control.dm
index 24394b79733..621847f79b6 100644
--- a/code/modules/power/fusion/fuel_assembly/fuel_control.dm
+++ b/code/modules/power/fusion/fuel_assembly/fuel_control.dm
@@ -117,7 +117,8 @@
 /obj/machinery/computer/fusion_fuel_control/attackby(var/obj/item/W, var/mob/user)
 	..()
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Fuel Control", monitor.fuel_tag)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Fuel Control", monitor.fuel_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			monitor.fuel_tag = new_ident
 		return
diff --git a/code/modules/power/fusion/fuel_assembly/fuel_injector.dm b/code/modules/power/fusion/fuel_assembly/fuel_injector.dm
index 77b703e85e7..08c413cd021 100644
--- a/code/modules/power/fusion/fuel_assembly/fuel_injector.dm
+++ b/code/modules/power/fusion/fuel_assembly/fuel_injector.dm
@@ -43,7 +43,8 @@ GLOBAL_LIST_EMPTY(fuel_injectors)
 /obj/machinery/fusion_fuel_injector/attackby(obj/item/W, mob/user)
 
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Fuel Injector", id_tag)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Fuel Injector", id_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			id_tag = new_ident
 		return
diff --git a/code/modules/power/fusion/gyrotron/gyrotron_control.dm b/code/modules/power/fusion/gyrotron/gyrotron_control.dm
index 9ff359fd290..1979e091ad8 100644
--- a/code/modules/power/fusion/gyrotron/gyrotron_control.dm
+++ b/code/modules/power/fusion/gyrotron/gyrotron_control.dm
@@ -119,7 +119,8 @@
 /obj/machinery/computer/gyrotron_control/attackby(var/obj/item/W, var/mob/user)
 	..()
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Gyrotron Control", monitor.gyro_tag)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", "Gyrotron Control", monitor.gyro_tag, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			monitor.gyro_tag = new_ident
 		return
diff --git a/code/modules/power/turbine.dm b/code/modules/power/turbine.dm
index 77a5659cdda..9f542db4cc7 100644
--- a/code/modules/power/turbine.dm
+++ b/code/modules/power/turbine.dm
@@ -124,7 +124,8 @@
 	if(default_deconstruction_crowbar(user, W))
 		return
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", name, comp_id)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", name, comp_id, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			comp_id = new_ident
 		return
@@ -337,7 +338,8 @@
 
 /obj/machinery/computer/turbine_computer/attackby(obj/item/W, mob/user)
 	if(istype(W, /obj/item/device/multitool))
-		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", name, id)
+		var/new_ident = tgui_input_text(usr, "Enter a new ident tag.", name, id, MAX_NAME_LEN)
+		new_ident = sanitize(new_ident,MAX_NAME_LEN)
 		if(new_ident && user.Adjacent(src))
 			id = new_ident
 		return
diff --git a/code/modules/shuttles/shuttle_console.dm b/code/modules/shuttles/shuttle_console.dm
index ce64593b9da..f3731ba2eb3 100644
--- a/code/modules/shuttles/shuttle_console.dm
+++ b/code/modules/shuttles/shuttle_console.dm
@@ -111,7 +111,8 @@
 			return TRUE
 
 		if("set_codes")
-			var/newcode = tgui_input_text(usr, "Input new docking codes", "Docking codes", shuttle.docking_codes)
+			var/newcode = tgui_input_text(usr, "Input new docking codes", "Docking codes", shuttle.docking_codes, MAX_NAME_LEN)
+			newcode = sanitize(newcode,MAX_NAME_LEN)
 			if(newcode && !..())
 				shuttle.set_docking_codes(uppertext(newcode))
 			return TRUE
diff --git a/code/modules/tgui/modules/overmap.dm b/code/modules/tgui/modules/overmap.dm
index a9fff0e6d40..13d80d9f93a 100644
--- a/code/modules/tgui/modules/overmap.dm
+++ b/code/modules/tgui/modules/overmap.dm
@@ -307,7 +307,8 @@
 		/* HELM */
 		if("add")
 			var/datum/computer_file/data/waypoint/R = new()
-			var/sec_name = tgui_input_text(usr, "Input navigation entry name", "New navigation entry", "Sector #[known_sectors.len]")
+			var/sec_name = tgui_input_text(usr, "Input navigation entry name", "New navigation entry", "Sector #[known_sectors.len]", MAX_NAME_LEN)
+			sec_name = sanitize(sec_name,MAX_NAME_LEN)
 			if(!sec_name)
 				sec_name = "Sector #[known_sectors.len]"
 			R.fields["name"] = sec_name
@@ -383,7 +384,7 @@
 			else
 				autopilot = !autopilot
 			. = TRUE
-		
+
 		if("apilot_lock")
 			autopilot_disabled = !autopilot_disabled
 			autopilot = FALSE