diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php
index 7f909cd2f13..d3556135972 100644
--- a/htdocs/accountancy/admin/account.php
+++ b/htdocs/accountancy/admin/account.php
@@ -37,7 +37,7 @@ $langs->load("accountancy");
 $langs->load("salaries");
 
 $mesg = '';
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $cancel = GETPOST('cancel');
 $id = GETPOST('id', 'int');
 $rowid = GETPOST('rowid', 'int');
diff --git a/htdocs/accountancy/admin/card.php b/htdocs/accountancy/admin/card.php
index 8e77c4a5dab..3522460e07b 100644
--- a/htdocs/accountancy/admin/card.php
+++ b/htdocs/accountancy/admin/card.php
@@ -37,7 +37,7 @@ $langs->load("bills");
 $langs->load("accountancy");
 
 $mesg = '';
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $backtopage = GETPOST('backtopage');
 $id = GETPOST('id', 'int');
 $rowid = GETPOST('rowid', 'int');
diff --git a/htdocs/accountancy/admin/categories.php b/htdocs/accountancy/admin/categories.php
index 19c33d848c8..fd8c67246f4 100644
--- a/htdocs/accountancy/admin/categories.php
+++ b/htdocs/accountancy/admin/categories.php
@@ -36,7 +36,7 @@ $mesg = '';
 $id = GETPOST('id', 'int');
 $rowid = GETPOST('rowid', 'int');
 $cancel = GETPOST('cancel');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $cat_id = GETPOST('account_category');
 $selectcpt = GETPOST('cpt_bk', 'array');
 $cpt_id = GETPOST('cptid');
diff --git a/htdocs/accountancy/admin/fiscalyear.php b/htdocs/accountancy/admin/fiscalyear.php
index 507a68a3c01..16e11225d49 100644
--- a/htdocs/accountancy/admin/fiscalyear.php
+++ b/htdocs/accountancy/admin/fiscalyear.php
@@ -25,7 +25,7 @@ require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT . '/core/lib/date.lib.php';
 require_once DOL_DOCUMENT_ROOT . '/core/class/fiscalyear.class.php';
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 // Load variable for pagination
 $limit = GETPOST("limit")?GETPOST("limit","int"):$conf->liste_limit;
diff --git a/htdocs/accountancy/bookkeeping/card.php b/htdocs/accountancy/bookkeeping/card.php
index 055451016e9..7ee3e6bb4fe 100644
--- a/htdocs/accountancy/bookkeeping/card.php
+++ b/htdocs/accountancy/bookkeeping/card.php
@@ -43,7 +43,7 @@ if ($user->societe_id > 0) {
 	accessforbidden();
 }
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $piece_num = GETPOST("piece_num");
 
 $mesg = '';
diff --git a/htdocs/accountancy/expensereport/index.php b/htdocs/accountancy/expensereport/index.php
index 4bfeb630b02..a38194356bd 100644
--- a/htdocs/accountancy/expensereport/index.php
+++ b/htdocs/accountancy/expensereport/index.php
@@ -55,7 +55,7 @@ if ($year == 0) {
 }
 
 // Validate History
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php
index a68798869a2..d1602bedf00 100644
--- a/htdocs/accountancy/journal/bankjournal.php
+++ b/htdocs/accountancy/journal/bankjournal.php
@@ -71,7 +71,7 @@ $date_startyear = GETPOST('date_startyear');
 $date_endmonth = GETPOST('date_endmonth');
 $date_endday = GETPOST('date_endday');
 $date_endyear = GETPOST('date_endyear');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 $now = dol_now();
 
diff --git a/htdocs/accountancy/journal/expensereportsjournal.php b/htdocs/accountancy/journal/expensereportsjournal.php
index 8e343bcbb08..f67224e3996 100644
--- a/htdocs/accountancy/journal/expensereportsjournal.php
+++ b/htdocs/accountancy/journal/expensereportsjournal.php
@@ -58,7 +58,7 @@ $now = dol_now();
 if ($user->societe_id > 0)
 	accessforbidden();
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/accountancy/journal/purchasesjournal.php b/htdocs/accountancy/journal/purchasesjournal.php
index 232a6d7611c..f9cd162b6a0 100644
--- a/htdocs/accountancy/journal/purchasesjournal.php
+++ b/htdocs/accountancy/journal/purchasesjournal.php
@@ -57,7 +57,7 @@ $now = dol_now();
 if ($user->societe_id > 0)
 	accessforbidden();
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/accountancy/journal/sellsjournal.php b/htdocs/accountancy/journal/sellsjournal.php
index 9af2bd2d135..85ce7361394 100644
--- a/htdocs/accountancy/journal/sellsjournal.php
+++ b/htdocs/accountancy/journal/sellsjournal.php
@@ -60,7 +60,7 @@ $now = dol_now();
 if ($user->societe_id > 0)
 	accessforbidden();
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/accountancy/report/result.php b/htdocs/accountancy/report/result.php
index a487cb641ff..aa31185604a 100644
--- a/htdocs/accountancy/report/result.php
+++ b/htdocs/accountancy/report/result.php
@@ -35,7 +35,7 @@ $langs->load("accountancy");
 $langs->load("compta");
 
 $mesg = '';
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $cat_id = GETPOST('account_category');
 $selectcpt = GETPOST('cpt_bk');
 $id = GETPOST('id', 'int');
diff --git a/htdocs/adherents/ldap.php b/htdocs/adherents/ldap.php
index a5f61a45642..38e90663c0f 100644
--- a/htdocs/adherents/ldap.php
+++ b/htdocs/adherents/ldap.php
@@ -35,7 +35,7 @@ $langs->load("ldap");
 $langs->load("admin");
 
 $rowid = GETPOST('id','int');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 // Protection
 $socid=0;
diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php
index 7a6013b9b78..33d175e6350 100644
--- a/htdocs/adherents/list.php
+++ b/htdocs/adherents/list.php
@@ -37,7 +37,7 @@ $langs->load("companies");
 // Security check
 $result=restrictedArea($user,'adherent');
 
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $filter=GETPOST("filter");
 $statut=GETPOST("statut");
 $search=GETPOST("search");
diff --git a/htdocs/admin/clicktodial.php b/htdocs/admin/clicktodial.php
index 86b94d8ecf0..df3c54f758c 100644
--- a/htdocs/admin/clicktodial.php
+++ b/htdocs/admin/clicktodial.php
@@ -30,7 +30,7 @@ $langs->load("admin");
 
 if (!$user->admin) accessforbidden();
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/admin/company.php b/htdocs/admin/company.php
index ef22d8ecb4a..4487f81c2fe 100644
--- a/htdocs/admin/company.php
+++ b/htdocs/admin/company.php
@@ -36,7 +36,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $langs->load("admin");
 $langs->load("companies");
diff --git a/htdocs/admin/events.php b/htdocs/admin/events.php
index 74525a6855b..7a8c71c0130 100644
--- a/htdocs/admin/events.php
+++ b/htdocs/admin/events.php
@@ -35,7 +35,7 @@ $langs->load("users");
 $langs->load("admin");
 $langs->load("other");
 
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 
 $securityevent=new Events($db);
diff --git a/htdocs/admin/external_rss.php b/htdocs/admin/external_rss.php
index 30646b749fa..1d9621ad378 100644
--- a/htdocs/admin/external_rss.php
+++ b/htdocs/admin/external_rss.php
@@ -38,7 +38,7 @@ if (!$user->admin) accessforbidden();
 
 $def = array();
 $lastexternalrss=0;
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/admin/geoipmaxmind.php b/htdocs/admin/geoipmaxmind.php
index 5a69a356777..5ae1a04e2ea 100644
--- a/htdocs/admin/geoipmaxmind.php
+++ b/htdocs/admin/geoipmaxmind.php
@@ -33,7 +33,7 @@ accessforbidden();
 $langs->load("admin");
 $langs->load("errors");
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 /*
  * Actions
diff --git a/htdocs/admin/ihm.php b/htdocs/admin/ihm.php
index 6e5c814639b..7c23b62f230 100644
--- a/htdocs/admin/ihm.php
+++ b/htdocs/admin/ihm.php
@@ -45,7 +45,7 @@ $langs->load("agenda");
 
 if (! $user->admin) accessforbidden();
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 
 if (! defined("MAIN_MOTD")) define("MAIN_MOTD","");
diff --git a/htdocs/admin/ldap.php b/htdocs/admin/ldap.php
index 770d91d1d11..4d8dab035ca 100644
--- a/htdocs/admin/ldap.php
+++ b/htdocs/admin/ldap.php
@@ -36,7 +36,7 @@ $langs->load("admin");
 if (!$user->admin)
   accessforbidden();
 
-  $action = GETPOST("action");
+  $action = GETPOST('action','aZ09');
 
 /*
  * Actions
diff --git a/htdocs/admin/ldap_contacts.php b/htdocs/admin/ldap_contacts.php
index 27e32f8cd7c..d5ca994c258 100644
--- a/htdocs/admin/ldap_contacts.php
+++ b/htdocs/admin/ldap_contacts.php
@@ -38,7 +38,7 @@ $langs->load("errors");
 if (!$user->admin)
   accessforbidden();
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
   
 /*
  * Actions
diff --git a/htdocs/admin/ldap_groups.php b/htdocs/admin/ldap_groups.php
index 192b11bfd8d..3f8869de70f 100644
--- a/htdocs/admin/ldap_groups.php
+++ b/htdocs/admin/ldap_groups.php
@@ -39,7 +39,7 @@ $langs->load("errors");
 if (!$user->admin)
   accessforbidden();
   
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/admin/ldap_members.php b/htdocs/admin/ldap_members.php
index 8c7291c3dc4..afbf8da375a 100644
--- a/htdocs/admin/ldap_members.php
+++ b/htdocs/admin/ldap_members.php
@@ -39,7 +39,7 @@ $langs->load("errors");
 if (!$user->admin)
   accessforbidden();
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 /*
  * Actions
diff --git a/htdocs/admin/ldap_users.php b/htdocs/admin/ldap_users.php
index 79f34001a63..43a6720a448 100644
--- a/htdocs/admin/ldap_users.php
+++ b/htdocs/admin/ldap_users.php
@@ -39,7 +39,7 @@ $langs->load("errors");
 if (!$user->admin)
   accessforbidden();
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 /*
  * Actions
diff --git a/htdocs/admin/mailman.php b/htdocs/admin/mailman.php
index 27d7b59553a..3048f519a86 100644
--- a/htdocs/admin/mailman.php
+++ b/htdocs/admin/mailman.php
@@ -41,7 +41,7 @@ if (! $user->admin) accessforbidden();
 
 $type=array('yesno','texte','chaine');
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 $testsubscribeemail = GETPOST("testsubscribeemail");
 $testunsubscribeemail = GETPOST("testunsubscribeemail");
 
diff --git a/htdocs/admin/menus.php b/htdocs/admin/menus.php
index ddfb4d0cd62..888045f3297 100644
--- a/htdocs/admin/menus.php
+++ b/htdocs/admin/menus.php
@@ -27,7 +27,7 @@ require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $langs->load("companies");
 $langs->load("products");
diff --git a/htdocs/admin/menus/edit.php b/htdocs/admin/menus/edit.php
index 0a2669e960d..db03407fed1 100644
--- a/htdocs/admin/menus/edit.php
+++ b/htdocs/admin/menus/edit.php
@@ -43,7 +43,7 @@ foreach($dirmenus as $dirmenu)
     $dirsmartphone[]=$dirmenu.'smartphone';
 }
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $menu_handler_top=$conf->global->MAIN_MENU_STANDARD;
 $menu_handler_smartphone=$conf->global->MAIN_MENU_SMARTPHONE;
diff --git a/htdocs/admin/notification.php b/htdocs/admin/notification.php
index c82e64d48ea..73fb3d91587 100644
--- a/htdocs/admin/notification.php
+++ b/htdocs/admin/notification.php
@@ -41,7 +41,7 @@ $langs->load("mails");
 if (!$user->admin)
   accessforbidden();
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/admin/perms.php b/htdocs/admin/perms.php
index 5acbeb2e627..0c7ed656d9f 100644
--- a/htdocs/admin/perms.php
+++ b/htdocs/admin/perms.php
@@ -32,7 +32,7 @@ $langs->load("admin");
 $langs->load("users");
 $langs->load("other");
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 if (!$user->admin) accessforbidden();
 
diff --git a/htdocs/admin/proxy.php b/htdocs/admin/proxy.php
index 224fac14ce7..ee22f377200 100644
--- a/htdocs/admin/proxy.php
+++ b/htdocs/admin/proxy.php
@@ -40,7 +40,7 @@ $upload_dir=$conf->admin->dir_temp;
  * Actions
  */
 
-if (GETPOST("action") == 'set_proxy')
+if (GETPOST('action','aZ09') == 'set_proxy')
 {
     if (GETPOST("MAIN_USE_CONNECT_TIMEOUT") && ! is_numeric(GETPOST("MAIN_USE_CONNECT_TIMEOUT")))
     {
diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php
index 4d0415dbd01..9627164f534 100644
--- a/htdocs/admin/security.php
+++ b/htdocs/admin/security.php
@@ -27,7 +27,7 @@ require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $langs->load("users");
 $langs->load("admin");
diff --git a/htdocs/admin/sms.php b/htdocs/admin/sms.php
index faf05b7fb0f..0027f2e834d 100644
--- a/htdocs/admin/sms.php
+++ b/htdocs/admin/sms.php
@@ -43,7 +43,7 @@ $substitutionarrayfortest=array(
 '__FIRSTNAME__' => 'TESTFirstname'
 );
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/admin/spip.php b/htdocs/admin/spip.php
index 241062732a4..12fc15823bd 100644
--- a/htdocs/admin/spip.php
+++ b/htdocs/admin/spip.php
@@ -41,7 +41,7 @@ if (! $user->admin) accessforbidden();
 
 $type=array('yesno','texte','chaine');
 
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/admin/syslog.php b/htdocs/admin/syslog.php
index 03a1872c90c..65933c25639 100644
--- a/htdocs/admin/syslog.php
+++ b/htdocs/admin/syslog.php
@@ -35,7 +35,7 @@ $langs->load("admin");
 $langs->load("other");
 
 $error=0;
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 
 $syslogModules = array();
 $activeModules = array();
diff --git a/htdocs/admin/system/perf.php b/htdocs/admin/system/perf.php
index 9b23dc74089..25079d8f185 100644
--- a/htdocs/admin/system/perf.php
+++ b/htdocs/admin/system/perf.php
@@ -33,7 +33,7 @@ $langs->load("other");
 if (! $user->admin)
 	accessforbidden();
 
-if (GETPOST('action') == 'donothing')
+if (GETPOST('action','aZ09') == 'donothing')
 {
 	exit;
 }
diff --git a/htdocs/admin/system/xcache.php b/htdocs/admin/system/xcache.php
index 361be2b461a..53eaeec085f 100644
--- a/htdocs/admin/system/xcache.php
+++ b/htdocs/admin/system/xcache.php
@@ -26,7 +26,7 @@ $langs->load("admin");
 
 if (!$user->admin) accessforbidden();
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/api/admin/index.php b/htdocs/api/admin/index.php
index 8142b564c1e..d7f002d02aa 100644
--- a/htdocs/api/admin/index.php
+++ b/htdocs/api/admin/index.php
@@ -34,7 +34,7 @@ $langs->load("admin");
 if (! $user->admin)
 	accessforbidden();
 
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 //Activate ProfId
 if ($action == 'setproductionmode')
diff --git a/htdocs/barcode/codeinit.php b/htdocs/barcode/codeinit.php
index ebe121301b7..1ebd512e772 100644
--- a/htdocs/barcode/codeinit.php
+++ b/htdocs/barcode/codeinit.php
@@ -38,7 +38,7 @@ $forbarcode=GETPOST('forbarcode');
 $fk_barcode_type=GETPOST('fk_barcode_type');
 $eraseallbarcode=GETPOST('eraseallbarcode');
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $producttmp=new Product($db);
 $thirdpartytmp=new Societe($db);
diff --git a/htdocs/barcode/printsheet.php b/htdocs/barcode/printsheet.php
index a60ac19d0af..a4857c94e87 100644
--- a/htdocs/barcode/printsheet.php
+++ b/htdocs/barcode/printsheet.php
@@ -45,7 +45,7 @@ $numberofsticker=GETPOST('numberofsticker','int');
 
 $mesg='';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $producttmp=new Product($db);
 $thirdpartytmp=new Societe($db);
diff --git a/htdocs/cashdesk/validation_verif.php b/htdocs/cashdesk/validation_verif.php
index 0722b3fb92e..5e4ed9b028e 100644
--- a/htdocs/cashdesk/validation_verif.php
+++ b/htdocs/cashdesk/validation_verif.php
@@ -34,7 +34,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
 $obj_facturation = unserialize($_SESSION['serObjFacturation']);
 unset ($_SESSION['serObjFacturation']);
 
-$action =GETPOST('action');
+$action =GETPOST('action','aZ09');
 $bankaccountid=GETPOST('cashdeskbank');
 
 switch ($action)
diff --git a/htdocs/categories/admin/categorie.php b/htdocs/categories/admin/categorie.php
index bc27be9bb12..d16b081e6ae 100644
--- a/htdocs/categories/admin/categorie.php
+++ b/htdocs/categories/admin/categorie.php
@@ -32,7 +32,7 @@ accessforbidden();
 
 $langs->load("categories");
 
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 /*
  *	Actions
diff --git a/htdocs/categories/edit.php b/htdocs/categories/edit.php
index b96042d7a8e..9981d09cda0 100644
--- a/htdocs/categories/edit.php
+++ b/htdocs/categories/edit.php
@@ -34,7 +34,7 @@ $langs->load("categories");
 $id=GETPOST('id','int');
 $ref=GETPOST('ref');
 $type=GETPOST('type');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 $cancel=GETPOST('cancel');
 
diff --git a/htdocs/categories/photos.php b/htdocs/categories/photos.php
index 100d2d0d48e..e99e081e015 100644
--- a/htdocs/categories/photos.php
+++ b/htdocs/categories/photos.php
@@ -39,7 +39,7 @@ $langs->load("bills");
 $id=GETPOST('id','int');
 $ref=GETPOST('ref');
 $type=GETPOST('type');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 
 if ($id == "")
diff --git a/htdocs/categories/viewcat.php b/htdocs/categories/viewcat.php
index d04d0baebd2..665b033936e 100644
--- a/htdocs/categories/viewcat.php
+++ b/htdocs/categories/viewcat.php
@@ -37,7 +37,7 @@ $langs->load("categories");
 $id=GETPOST('id','int');
 $ref=GETPOST('ref');
 $type=GETPOST('type');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 $removeelem = GETPOST('removeelem','int');
 $elemid=GETPOST('elemid');
diff --git a/htdocs/collab/index.php b/htdocs/collab/index.php
index 0c892c4e776..ea7abde4151 100644
--- a/htdocs/collab/index.php
+++ b/htdocs/collab/index.php
@@ -77,7 +77,7 @@ $langs->load("website");
 
 if (! $user->admin) accessforbidden();
 
-if (! ((GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)))
+if (! ((GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)))
 {
     $conf->dol_hide_leftmenu = 1;   // Force hide of left menu.
 }
diff --git a/htdocs/comm/card.php b/htdocs/comm/card.php
index b933289be4f..b26ce4fa7ac 100644
--- a/htdocs/comm/card.php
+++ b/htdocs/comm/card.php
@@ -60,7 +60,7 @@ $id = (GETPOST('socid','int') ? GETPOST('socid','int') : GETPOST('id','int'));
 if ($user->societe_id > 0) $id=$user->societe_id;
 $result = restrictedArea($user,'societe',$id,'&societe');
 
-$action		= GETPOST('action');
+$action		= GETPOST('action','aZ09');
 $mode		= GETPOST("mode");
 
 $sortfield = GETPOST("sortfield",'alpha');
diff --git a/htdocs/comm/mailing/advtargetemailing.php b/htdocs/comm/mailing/advtargetemailing.php
index 362bec914b6..0a9cdca7abc 100644
--- a/htdocs/comm/mailing/advtargetemailing.php
+++ b/htdocs/comm/mailing/advtargetemailing.php
@@ -59,7 +59,7 @@ if (! $sortfield)
 
 $id = GETPOST('id', 'int');
 $rowid = GETPOST('rowid', 'int');
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 $search_nom = GETPOST("search_nom");
 $search_prenom = GETPOST("search_prenom");
 $search_email = GETPOST("search_email");
diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php
index 118cc336fb7..0020a8fd771 100644
--- a/htdocs/comm/mailing/cibles.php
+++ b/htdocs/comm/mailing/cibles.php
@@ -52,7 +52,7 @@ if (! $sortorder) $sortorder="ASC";
 
 $id=GETPOST('id','int');
 $rowid=GETPOST('rowid','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $search_lastname=GETPOST("search_lastname");
 $search_firstname=GETPOST("search_firstname");
 $search_email=GETPOST("search_email");
diff --git a/htdocs/comm/remise.php b/htdocs/comm/remise.php
index 2be1981c5ae..bca371977a7 100644
--- a/htdocs/comm/remise.php
+++ b/htdocs/comm/remise.php
@@ -52,7 +52,7 @@ if (GETPOST('cancel') && ! empty($backtopage))
      exit;
 }
 
-if (GETPOST("action") == 'setremise')
+if (GETPOST('action','aZ09') == 'setremise')
 {
 	$object = new Societe($db);
 	$object->fetch($id);
diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php
index 375b4d0ecb8..9964db9ecde 100644
--- a/htdocs/comm/remx.php
+++ b/htdocs/comm/remx.php
@@ -185,7 +185,7 @@ if ($action == 'setremise' && $user->rights->societe->creer)
 	}
 }
 
-if (GETPOST("action") == 'confirm_remove' && GETPOST("confirm")=='yes')
+if (GETPOST('action','aZ09') == 'confirm_remove' && GETPOST("confirm")=='yes')
 {
 	//if ($user->rights->societe->creer)
 	//if ($user->rights->facture->creer)
diff --git a/htdocs/commande/customer.php b/htdocs/commande/customer.php
index b5672f276e7..431a54b9f76 100644
--- a/htdocs/commande/customer.php
+++ b/htdocs/commande/customer.php
@@ -30,7 +30,7 @@ require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
 require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 // Secrutiy check
 if ($user->societe_id > 0)
diff --git a/htdocs/commande/document.php b/htdocs/commande/document.php
index ef4f220f3e4..0b6cb908ef3 100644
--- a/htdocs/commande/document.php
+++ b/htdocs/commande/document.php
@@ -36,7 +36,7 @@ require_once DOL_DOCUMENT_ROOT .'/commande/class/commande.class.php';
 $langs->load('companies');
 $langs->load('other');
 
-$action		= GETPOST('action');
+$action		= GETPOST('action','aZ09');
 $confirm	= GETPOST('confirm');
 $id			= GETPOST('id','int');
 $ref		= GETPOST('ref');
diff --git a/htdocs/compta/bank/card.php b/htdocs/compta/bank/card.php
index 804d2c5511d..be16e1f8bd6 100644
--- a/htdocs/compta/bank/card.php
+++ b/htdocs/compta/bank/card.php
@@ -46,7 +46,7 @@ $langs->load("categories");
 $langs->load("companies");
 $langs->load("compta");
 
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $cancel = GETPOST('cancel', 'alpha');
 
 // Security check
diff --git a/htdocs/compta/bank/categ.php b/htdocs/compta/bank/categ.php
index 0cf88224e63..83e1f15ef36 100644
--- a/htdocs/compta/bank/categ.php
+++ b/htdocs/compta/bank/categ.php
@@ -33,7 +33,7 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/bankcateg.class.php';
 $langs->load("banks");
 $langs->load("categories");
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 if (!$user->rights->banque->configurer)
   accessforbidden();
@@ -108,7 +108,7 @@ if ($result)
 		
 		print '<tr class="oddeven">';
 		print '<td><a href="'.DOL_URL_ROOT.'/compta/bank/budget.php?bid='.$objp->rowid.'">'.$objp->rowid.'</a></td>';
-		if (GETPOST("action") == 'edit' && GETPOST("categid")== $objp->rowid)
+		if (GETPOST('action','aZ09') == 'edit' && GETPOST("categid")== $objp->rowid)
 		{
 			print "<td colspan=2>";
 			print '<input type="hidden" name="categid" value="'.$objp->rowid.'">';
diff --git a/htdocs/compta/bank/various_payment/info.php b/htdocs/compta/bank/various_payment/info.php
index 73c1baa5c02..cda6b4ce137 100644
--- a/htdocs/compta/bank/various_payment/info.php
+++ b/htdocs/compta/bank/various_payment/info.php
@@ -31,7 +31,7 @@ $langs->load("bills");
 $langs->load("salaries");
 
 $id=GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 // Security check
 $socid = GETPOST('socid','int');
diff --git a/htdocs/compta/clients.php b/htdocs/compta/clients.php
index 28eaa0a7c9b..59fb3af2f00 100644
--- a/htdocs/compta/clients.php
+++ b/htdocs/compta/clients.php
@@ -27,7 +27,7 @@ require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
 require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 // Secrutiy check
 if ($user->societe_id > 0)
diff --git a/htdocs/compta/paiement.php b/htdocs/compta/paiement.php
index 8cd924a0df8..0881ce061dc 100644
--- a/htdocs/compta/paiement.php
+++ b/htdocs/compta/paiement.php
@@ -817,7 +817,7 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie
 /**
  *  Show list of payments
  */
-if (! GETPOST('action'))
+if (! GETPOST('action','aZ09'))
 {
     if ($page == -1) $page = 0 ;
     $limit = GETPOST('limit')?GETPOST('limit','int'):$conf->liste_limit;
diff --git a/htdocs/compta/paiement/rapport.php b/htdocs/compta/paiement/rapport.php
index c73f79c60a4..a185f0aba6e 100644
--- a/htdocs/compta/paiement/rapport.php
+++ b/htdocs/compta/paiement/rapport.php
@@ -31,7 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
 // Security check
 if (! $user->rights->facture->lire) accessforbidden();
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $socid=0;
 if ($user->societe_id > 0)
diff --git a/htdocs/compta/payment_sc/card.php b/htdocs/compta/payment_sc/card.php
index 2d653f2ba05..45762ed95bb 100644
--- a/htdocs/compta/payment_sc/card.php
+++ b/htdocs/compta/payment_sc/card.php
@@ -38,7 +38,7 @@ $langs->load('companies');
 
 // Security check
 $id=GETPOST("id",'int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 if ($user->societe_id) $socid=$user->societe_id;
 // TODO ajouter regle pour restreindre acces paiement
diff --git a/htdocs/compta/salaries/card.php b/htdocs/compta/salaries/card.php
index 569aa81629e..0ea91dc2857 100644
--- a/htdocs/compta/salaries/card.php
+++ b/htdocs/compta/salaries/card.php
@@ -39,7 +39,7 @@ $langs->load("salaries");
 $langs->load('hrm');
 
 $id=GETPOST("id",'int');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 // Security check
 $socid = GETPOST("socid","int");
diff --git a/htdocs/compta/salaries/info.php b/htdocs/compta/salaries/info.php
index 429efc27a33..f15aac021ec 100644
--- a/htdocs/compta/salaries/info.php
+++ b/htdocs/compta/salaries/info.php
@@ -32,7 +32,7 @@ $langs->load("bills");
 $langs->load("salaries");
 
 $id=GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 // Security check
 $socid = GETPOST('socid','int');
diff --git a/htdocs/compta/sociales/card.php b/htdocs/compta/sociales/card.php
index aa479ec4369..f34ff9b1a31 100644
--- a/htdocs/compta/sociales/card.php
+++ b/htdocs/compta/sociales/card.php
@@ -38,7 +38,7 @@ $langs->load("compta");
 $langs->load("bills");
 
 $id=GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 $projectid = (GETPOST('projectid') ? GETPOST('projectid', 'int') : 0);
 
diff --git a/htdocs/compta/sociales/document.php b/htdocs/compta/sociales/document.php
index cf42a11b515..95c72cbedb2 100644
--- a/htdocs/compta/sociales/document.php
+++ b/htdocs/compta/sociales/document.php
@@ -40,7 +40,7 @@ $langs->load("compta");
 $langs->load("bills");
 
 $id = GETPOST('id','int');
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 $confirm = GETPOST('confirm', 'alpha');
 
 // Security check
diff --git a/htdocs/compta/sociales/info.php b/htdocs/compta/sociales/info.php
index 7caa212be9e..bbacfafd430 100644
--- a/htdocs/compta/sociales/info.php
+++ b/htdocs/compta/sociales/info.php
@@ -30,7 +30,7 @@ $langs->load("compta");
 $langs->load("bills");
 
 $id=GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 // Security check
 $socid = GETPOST('socid','int');
diff --git a/htdocs/compta/tva/info.php b/htdocs/compta/tva/info.php
index f85ab9fc2b0..0c6ce29475a 100644
--- a/htdocs/compta/tva/info.php
+++ b/htdocs/compta/tva/info.php
@@ -30,7 +30,7 @@ $langs->load("compta");
 $langs->load("bills");
 
 $id=GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 // Security check
 $socid = GETPOST('socid','int');
diff --git a/htdocs/contact/document.php b/htdocs/contact/document.php
index b0067d81ec1..5d70ba7b4e1 100644
--- a/htdocs/contact/document.php
+++ b/htdocs/contact/document.php
@@ -34,7 +34,7 @@ $langs->load("companies");
 $langs->load("contact");
 
 $id = GETPOST('id','int');
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 $confirm = GETPOST('confirm', 'alpha');
 
 $object = new Contact($db);
diff --git a/htdocs/contact/ldap.php b/htdocs/contact/ldap.php
index af8fccfd7b9..3e998b43ec5 100644
--- a/htdocs/contact/ldap.php
+++ b/htdocs/contact/ldap.php
@@ -32,7 +32,7 @@ $langs->load("companies");
 $langs->load("ldap");
 $langs->load("admin");
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 // Security check
 $id = GETPOST('id', 'int');
diff --git a/htdocs/contact/note.php b/htdocs/contact/note.php
index eed044cdadf..c49dbc9f787 100644
--- a/htdocs/contact/note.php
+++ b/htdocs/contact/note.php
@@ -29,7 +29,7 @@ require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/contact.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 $langs->load("companies");
 
diff --git a/htdocs/core/ajax/ajaxdirpreview.php b/htdocs/core/ajax/ajaxdirpreview.php
index 3fec57091cb..8d8f48ec141 100644
--- a/htdocs/core/ajax/ajaxdirpreview.php
+++ b/htdocs/core/ajax/ajaxdirpreview.php
@@ -40,7 +40,7 @@ if (! isset($mode) || $mode != 'noajax')    // For ajax call
     require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
     require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
 
-	$action=GETPOST("action");
+	$action=GETPOST('action','aZ09');
     $file=urldecode(GETPOST('file'));
     $section=GETPOST("section");
     $module=GETPOST("module");
diff --git a/htdocs/core/ajax/bankconciliate.php b/htdocs/core/ajax/bankconciliate.php
index 3a8a3e30687..24318be6cf8 100644
--- a/htdocs/core/ajax/bankconciliate.php
+++ b/htdocs/core/ajax/bankconciliate.php
@@ -31,7 +31,7 @@ require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 
 /*
diff --git a/htdocs/core/boxes/box_graph_invoices_permonth.php b/htdocs/core/boxes/box_graph_invoices_permonth.php
index d313d10b310..8d8fea71411 100644
--- a/htdocs/core/boxes/box_graph_invoices_permonth.php
+++ b/htdocs/core/boxes/box_graph_invoices_permonth.php
@@ -122,7 +122,7 @@ class box_graph_invoices_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($shownb)
 			{
-				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."invoicesnbinyear-".$endyear.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesnbinyear-'.$endyear.'.png';
@@ -162,7 +162,7 @@ class box_graph_invoices_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($showtot)
 			{
-				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."invoicesamountinyear-".$endyear.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesamountinyear-'.$endyear.'.png';
diff --git a/htdocs/core/boxes/box_graph_invoices_supplier_permonth.php b/htdocs/core/boxes/box_graph_invoices_supplier_permonth.php
index 7c3d6ab4e7f..e7ece7a2a53 100644
--- a/htdocs/core/boxes/box_graph_invoices_supplier_permonth.php
+++ b/htdocs/core/boxes/box_graph_invoices_supplier_permonth.php
@@ -121,7 +121,7 @@ class box_graph_invoices_supplier_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($shownb)
 			{
-				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."invoicessuppliernbinyear-".$year.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesnbinyear-'.$year.'.png';
@@ -161,7 +161,7 @@ class box_graph_invoices_supplier_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($showtot)
 			{
-				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."invoicessupplieramountinyear-".$year.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=billstats&amp;file=invoicesamountinyear-'.$year.'.png';
diff --git a/htdocs/core/boxes/box_graph_orders_permonth.php b/htdocs/core/boxes/box_graph_orders_permonth.php
index 0d3077a82ce..ec45cc3dde7 100644
--- a/htdocs/core/boxes/box_graph_orders_permonth.php
+++ b/htdocs/core/boxes/box_graph_orders_permonth.php
@@ -124,7 +124,7 @@ class box_graph_orders_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($shownb)
 			{
-				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."ordersnbinyear-".$endyear.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersnbinyear-'.$endyear.'.png';
@@ -162,7 +162,7 @@ class box_graph_orders_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($showtot)
 			{
-				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."ordersamountinyear-".$endyear.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersamountinyear-'.$endyear.'.png';
diff --git a/htdocs/core/boxes/box_graph_orders_supplier_permonth.php b/htdocs/core/boxes/box_graph_orders_supplier_permonth.php
index d16bfbc0f90..28335c79b62 100644
--- a/htdocs/core/boxes/box_graph_orders_supplier_permonth.php
+++ b/htdocs/core/boxes/box_graph_orders_supplier_permonth.php
@@ -123,7 +123,7 @@ class box_graph_orders_supplier_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($shownb)
 			{
-				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."orderssuppliernbinyear-".$endyear.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersnbinyear-'.$endyear.'.png';
@@ -161,7 +161,7 @@ class box_graph_orders_supplier_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($showtot)
 			{
-				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 
 				$filenamenb = $dir."/".$prefix."orderssupplieramountinyear-".$endyear.".png";
 				if ($mode == 'customer') $fileurlnb = DOL_URL_ROOT.'/viewimage.php?modulepart=orderstats&amp;file=ordersamountinyear-'.$endyear.'.png';
diff --git a/htdocs/core/boxes/box_graph_product_distribution.php b/htdocs/core/boxes/box_graph_product_distribution.php
index 2b3c69a9e15..44d5d0b0c15 100644
--- a/htdocs/core/boxes/box_graph_product_distribution.php
+++ b/htdocs/core/boxes/box_graph_product_distribution.php
@@ -139,7 +139,7 @@ class box_graph_product_distribution extends ModeleBoxes
 				$showpointvalue = 1; $nocolor = 0;
 				$mode='customer';
 				$stats_invoice = new FactureStats($this->db, $socid, $mode, ($userid>0?$userid:0));
-				$data1 = $stats_invoice->getAllByProductEntry($year,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data1 = $stats_invoice->getAllByProductEntry($year,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 				if (empty($data1))
 				{
 					$showpointvalue=0;
@@ -197,7 +197,7 @@ class box_graph_product_distribution extends ModeleBoxes
 
 				$showpointvalue = 1; $nocolor = 0;
 				$stats_proposal = new PropaleStats($this->db, $socid, ($userid>0?$userid:0));
-				$data2 = $stats_proposal->getAllByProductEntry($year,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data2 = $stats_proposal->getAllByProductEntry($year,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 				if (empty($data2))
 				{
 					$showpointvalue = 0;
@@ -259,7 +259,7 @@ class box_graph_product_distribution extends ModeleBoxes
 				$showpointvalue = 1; $nocolor = 0;
 				$mode='customer';
 				$stats_order = new CommandeStats($this->db, $socid, $mode, ($userid>0?$userid:0));
-				$data3 = $stats_order->getAllByProductEntry($year,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data3 = $stats_order->getAllByProductEntry($year,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 				if (empty($data3))
 				{
 					$showpointvalue = 0;
diff --git a/htdocs/core/boxes/box_graph_propales_permonth.php b/htdocs/core/boxes/box_graph_propales_permonth.php
index 2a29cf27314..ccce8372d1f 100644
--- a/htdocs/core/boxes/box_graph_propales_permonth.php
+++ b/htdocs/core/boxes/box_graph_propales_permonth.php
@@ -121,7 +121,7 @@ class box_graph_propales_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($shownb)
 			{
-				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data1 = $stats->getNbByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 				$datatype1 = array_pad(array(), ($endyear-$startyear+1), 'bars');
 
 				$filenamenb = $dir."/".$prefix."propalsnbinyear-".$endyear.".png";
@@ -160,7 +160,7 @@ class box_graph_propales_permonth extends ModeleBoxes
 			// Build graphic number of object. $data = array(array('Lib',val1,val2,val3),...)
 			if ($showtot)
 			{
-				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action')==$refreshaction?-1:(3600*24)));
+				$data2 = $stats->getAmountByMonthWithPrevYear($endyear,$startyear,(GETPOST('action','aZ09')==$refreshaction?-1:(3600*24)));
 				$datatype2 = array_pad(array(), ($endyear-$startyear+1), 'bars');
 				//$datatype2 = array('lines','bars');
 
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index b12e58fe8f7..afa2006864f 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -110,18 +110,18 @@ class Form
         }
         else
 		{
-            if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='<table class="nobordernopadding" width="100%"><tr><td class="nowrap">';
+            if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='<table class="nobordernopadding" width="100%"><tr><td class="nowrap">';
 	        if ($fieldrequired) $ret.='<span class="fieldrequired">';
             $ret.=$langs->trans($text);
 	        if ($fieldrequired) $ret.='</span>';
 	        if (! empty($notabletag)) $ret.=' ';
-            if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='</td>';
-            if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='<td align="right">';
-            if ($htmlname && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='<a href="'.$_SERVER["PHP_SELF"].'?action=edit'.$htmlname.'&amp;id='.$object->id.$moreparam.'">'.img_edit($langs->trans('Edit'), ($notabletag ? 0 : 1)).'</a>';
+            if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='</td>';
+            if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='<td align="right">';
+            if ($htmlname && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='<a href="'.$_SERVER["PHP_SELF"].'?action=edit'.$htmlname.'&amp;id='.$object->id.$moreparam.'">'.img_edit($langs->trans('Edit'), ($notabletag ? 0 : 1)).'</a>';
 	        if (! empty($notabletag) && $notabletag == 1) $ret.=' : ';
 	        if (! empty($notabletag) && $notabletag == 3) $ret.=' ';
-            if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='</td>';
-            if (empty($notabletag) && GETPOST('action') != 'edit'.$htmlname && $perm) $ret.='</tr></table>';
+            if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='</td>';
+            if (empty($notabletag) && GETPOST('action','aZ09') != 'edit'.$htmlname && $perm) $ret.='</tr></table>';
         }
 
         return $ret;
@@ -159,7 +159,7 @@ class Form
         }
         else
         {
-            if (GETPOST('action') == 'edit'.$htmlname)
+            if (GETPOST('action','aZ09') == 'edit'.$htmlname)
             {
                 $ret.="\n";
                 $ret.='<form method="post" action="'.$_SERVER["PHP_SELF"].($moreparam?'?'.$moreparam:'').'">';
diff --git a/htdocs/core/class/html.formfile.class.php b/htdocs/core/class/html.formfile.class.php
index adacddb2163..225825d6699 100644
--- a/htdocs/core/class/html.formfile.class.php
+++ b/htdocs/core/class/html.formfile.class.php
@@ -994,7 +994,7 @@ class FormFile
 			if (empty($url)) $url=$_SERVER["PHP_SELF"];
 			
 			print '<!-- html.formfile::list_of_documents -->'."\n";
-			if (GETPOST('action') == 'editfile' && $permtoeditline)
+			if (GETPOST('action','aZ09') == 'editfile' && $permtoeditline)
 			{
 			    print '<form action="'.$_SERVER["PHP_SELF"].'?'.$param.'" method="POST">';
 			    print '<input type="hidden" name="action" value="renamefile">';
@@ -1131,7 +1131,7 @@ class FormFile
 					print img_mime($file['name'],$file['name'].' ('.dol_print_size($file['size'],0,0).')').' ';
 					if ($showrelpart == 1) print $relativepath;
 					//print dol_trunc($file['name'],$maxlength,'middle');
-					if (GETPOST('action') == 'editfile' && $file['name'] == basename(GETPOST('urlfile')))
+					if (GETPOST('action','aZ09') == 'editfile' && $file['name'] == basename(GETPOST('urlfile')))
 					{
 					    print '</a>';
 					    print '<input type="hidden" name="renamefilefrom" value="'.dol_escape_htmltag($file['name']).'">';
@@ -1268,7 +1268,7 @@ class FormFile
 				}
 			}				
 			
-			if (GETPOST('action') == 'editfile' && $permtoeditline)
+			if (GETPOST('action','aZ09') == 'editfile' && $permtoeditline)
 			{
 			    print '</form>';
 			}
diff --git a/htdocs/core/datepicker.php b/htdocs/core/datepicker.php
index eeb20ee265c..d2441487231 100644
--- a/htdocs/core/datepicker.php
+++ b/htdocs/core/datepicker.php
@@ -39,7 +39,6 @@ if (! defined('NOREQUIREHTML'))   define('NOREQUIREHTML',1);
 require_once '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
 
-if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang'));	// If language was forced on URL by the main.inc.php
 $langs->load("main");
 $langs->load("agenda");
 $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
diff --git a/htdocs/core/get_menudiv.php b/htdocs/core/get_menudiv.php
index fd80124e7df..0e2f0bcb7c3 100644
--- a/htdocs/core/get_menudiv.php
+++ b/htdocs/core/get_menudiv.php
@@ -47,7 +47,6 @@ if (! defined('DISABLE_SELECT2'))           define('DISABLE_SELECT2',1);
 
 require_once '../main.inc.php';
 
-if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang'));	// If language was forced on URL by the main.inc.php
 $langs->load("main");
 $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
 $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 63990112be5..06ed76c5008 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -240,7 +240,17 @@ function dol_shutdown()
  *  Return value of a param into GET or POST supervariable
  *
  *  @param	string	$paramname   Name of parameter to found
- *  @param	string	$check	     Type of check (''=no check, 'none'=no check, 'int'=check it's numeric, 'alpha'=check it's text and sign, 'aZ'=check it's a-z only, 'array'=check it's array, 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string), 'day', 'month', 'year', 'custom'= custom filter specify $filter and $options)
+ *  @param	string	$check	     Type of check
+ *                                  ''=no check (deprecated)
+ *                                  'none'=no check (only for param that should have very rich content)
+ *                                  'int'=check it's numeric
+ *                                  'alpha'=check it's text and sign
+ *                                  'aZ'=check it's a-z only
+ *                                  'aZ09'=check it's simple alpha string (recommended for keys)
+ *                                  'array'=check it's array
+ *                                  'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string)
+ *                                  'nohtml', 'alphanohtml'=check there is no html content
+ *                                  'custom'= custom filter specify $filter and $options)
  *  @param	int		$method	     Type of method (0 = get then post, 1 = only get, 2 = only post, 3 = post then get, 4 = post then get then cookie)
  *  @param  int     $filter      Filter to apply when $check is set to 'custom'. (See http://php.net/manual/en/filter.filters.php for détails)
  *  @param  mixed   $options     Options to pass to filter_var when $check is set to 'custom'.
@@ -317,9 +327,14 @@ function GETPOST($paramname, $check='', $method=0, $filter=NULL, $options=NULL)
 	    }
 	}	
 	
+	if (empty($check) && $conf->global->MAIN_FEATURES_LEVEL > 0)
+	{
+	   dol_syslog("A GETPOST is called with 1st param = ".$paramname." and 2nd param not defined, when calling page ".$_SERVER["PHP_SELF"], LOG_WARNING);    
+	}
+	
 	if (! empty($check))
 	{
-	    // Replace vars like __DAY__, __MONTH__, __YEAR__, __MYCOUNTRYID__, __USERID__, __ENTITYID__
+	    // Replace vars like __DAY__, __MONTH__, __YEAR__, __MYCOUNTRYID__, __USERID__, __ENTITYID__, ...
 	    if (! is_array($out))
 	    {
 	        $maxloop=20; $loopnb=0;    // Protection against infinite loop
@@ -358,8 +373,11 @@ function GETPOST($paramname, $check='', $method=0, $filter=NULL, $options=NULL)
 	        }
 	    }
 
+	    // Check is done after replacement
 	    switch ($check)
 	    {
+	        case 'none':
+	            break;
 	        case 'int':
 	            if (! is_numeric($out)) { $out=''; }
 	            break;
diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php
index 7870824285a..ccc8a68a5d9 100644
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -98,7 +98,7 @@ function dol_hash($chain,$type=0)
 
 /**
  *	Check permissions of a user to show a page and an object. Check read permission.
- * 	If GETPOST('action') defined, we also check write and delete permission.
+ * 	If GETPOST('action','aZ09') defined, we also check write and delete permission.
  *
  *	@param	User	$user      	  	User to check
  *	@param  string	$features	    Features to check (it must be module name. Examples: 'societe', 'contact', 'produit&service', 'produit|service', ...)
@@ -207,7 +207,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 
     // Check write permission from module
     $createok=1; $nbko=0;
-    if (GETPOST("action")  == 'create')
+    if (GETPOST('action','aZ09')  == 'create')
     {
         foreach ($featuresarray as $feature)
         {
@@ -262,7 +262,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 
     // Check create user permission
     $createuserok=1;
-    if (GETPOST("action") == 'confirm_create_user' && GETPOST("confirm") == 'yes')
+    if (GETPOST('action','aZ09') == 'confirm_create_user' && GETPOST("confirm") == 'yes')
     {
         if (! $user->rights->user->user->creer) $createuserok=0;
 
@@ -272,7 +272,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 
     // Check delete permission from module
     $deleteok=1; $nbko=0;
-    if ((GETPOST("action")  == 'confirm_delete' && GETPOST("confirm") == 'yes') || GETPOST("action")  == 'delete')
+    if ((GETPOST('action','aZ09')  == 'confirm_delete' && GETPOST("confirm") == 'yes') || GETPOST('action','aZ09')  == 'delete')
     {
         foreach ($featuresarray as $feature)
         {
diff --git a/htdocs/core/lib/security2.lib.php b/htdocs/core/lib/security2.lib.php
index a14645a3152..b6b8d4ddd72 100644
--- a/htdocs/core/lib/security2.lib.php
+++ b/htdocs/core/lib/security2.lib.php
@@ -155,7 +155,7 @@ function dol_loginfunction($langs,$conf,$mysoc)
 	$titletruedolibarrversion=constant('DOL_VERSION');	// $title used by login template after the @ to inform of true Dolibarr version
 
 	// Note: $conf->css looks like '/theme/eldy/style.css.php'
-	$conf->css = "/theme/".(GETPOST('theme')?GETPOST('theme','alpha'):$conf->theme)."/style.css.php";
+	$conf->css = "/theme/".(GETPOST('theme','alpha')?GETPOST('theme','alpha'):$conf->theme)."/style.css.php";
 	//$themepath=dol_buildpath((empty($conf->global->MAIN_FORCETHEMEDIR)?'':$conf->global->MAIN_FORCETHEMEDIR).$conf->css,1);
 	$themepath=dol_buildpath($conf->css,1);
 	if (! empty($conf->modules_parts['theme']))		// Using this feature slow down application
diff --git a/htdocs/core/lib/usergroups.lib.php b/htdocs/core/lib/usergroups.lib.php
index 797af488f46..2cea718dcc0 100644
--- a/htdocs/core/lib/usergroups.lib.php
+++ b/htdocs/core/lib/usergroups.lib.php
@@ -417,7 +417,7 @@ function show_theme($fuser,$edit=0,$foruserprofile=false)
     					$file=$dirtheme."/".$subdir."/thumb.png";
     					$url=$urltheme."/".$subdir."/thumb.png";
     					if (! file_exists($file)) $url=DOL_URL_ROOT.'/public/theme/common/nophoto.png';
-    					print '<a href="'.$_SERVER["PHP_SELF"].($edit?'?action=edit&theme=':'?theme=').$subdir.(GETPOST("optioncss")?'&optioncss='.GETPOST("optioncss",'alpha',1):'').($fuser?'&id='.$fuser->id:'').'" style="font-weight: normal;" alt="'.$langs->trans("Preview").'">';
+    					print '<a href="'.$_SERVER["PHP_SELF"].($edit?'?action=edit&theme=':'?theme=').$subdir.(GETPOST('optioncss','alpha',1)?'&optioncss='.GETPOST('optioncss','alpha',1):'').($fuser?'&id='.$fuser->id:'').'" style="font-weight: normal;" alt="'.$langs->trans("Preview").'">';
     					if ($subdir == $conf->global->MAIN_THEME) $title=$langs->trans("ThemeCurrentlyActive");
     					else $title=$langs->trans("ShowPreview");
     					print '<img src="'.$url.'" border="0" width="80" height="60" alt="'.$title.'" title="'.$title.'" style="margin-bottom: 5px;">';
diff --git a/htdocs/core/menus/standard/auguria.lib.php b/htdocs/core/menus/standard/auguria.lib.php
index d2d8e36b8ca..7272eb000d4 100644
--- a/htdocs/core/menus/standard/auguria.lib.php
+++ b/htdocs/core/menus/standard/auguria.lib.php
@@ -53,7 +53,7 @@ function print_auguria_menu($db,$atarget,$type_user,&$tabMenu,&$menu,$noout=0,$m
 
 	if (empty($noout)) print_start_menu_array_auguria();
 
-	$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER));
+	$usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
 	
 	// Show/Hide vertical menu
 	if ($mode != 'jmobile' && $mode != 'topnb' && $usemenuhider && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
@@ -248,7 +248,7 @@ function print_left_auguria_menu($db,$menu_array_before,$menu_array_after,&$tabM
 	$mainmenu=($forcemainmenu?$forcemainmenu:$_SESSION["mainmenu"]);
 	$leftmenu=($forceleftmenu?'':(empty($_SESSION["leftmenu"])?'none':$_SESSION["leftmenu"]));
 
-	$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER));
+	$usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
 	global $usemenuhider;
 	
 	// Show logo company
diff --git a/htdocs/core/menus/standard/eldy.lib.php b/htdocs/core/menus/standard/eldy.lib.php
index b7a372e50bd..4aa5064977d 100644
--- a/htdocs/core/menus/standard/eldy.lib.php
+++ b/htdocs/core/menus/standard/eldy.lib.php
@@ -51,7 +51,7 @@ function print_eldy_menu($db,$atarget,$type_user,&$tabMenu,&$menu,$noout=0,$mode
 
 	if (empty($noout)) print_start_menu_array();
 
-	$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER));
+	$usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
 	
 	// Show/Hide vertical menu
 	if ($mode != 'jmobile' && $mode != 'topnb' && $usemenuhider && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
@@ -458,7 +458,7 @@ function print_left_eldy_menu($db,$menu_array_before,$menu_array_after,&$tabMenu
 	$mainmenu=($forcemainmenu?$forcemainmenu:$_SESSION["mainmenu"]);
 	$leftmenu=($forceleftmenu?'':(empty($_SESSION["leftmenu"])?'none':$_SESSION["leftmenu"]));
 
-	$usemenuhider = (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER));
+	$usemenuhider = (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER));
 	
 	// Show logo company
 	if (empty($conf->global->MAIN_MENU_INVERT) && empty($noout) && ! empty($conf->global->MAIN_SHOW_LOGO) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
diff --git a/htdocs/core/menus/standard/empty.php b/htdocs/core/menus/standard/empty.php
index 9a98fa4ffa4..501216ec860 100644
--- a/htdocs/core/menus/standard/empty.php
+++ b/htdocs/core/menus/standard/empty.php
@@ -93,7 +93,7 @@ class MenuManager
 			$classname='class="tmenusel"';
 
 			// Show/Hide vertical menu
-			if ($mode != 'jmobile' && $mode != 'topnb' && (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
+			if ($mode != 'jmobile' && $mode != 'topnb' && (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))
 			{
 			    $showmode=1;
 			    $classname = 'class="tmenu menuhider"';
diff --git a/htdocs/core/search_page.php b/htdocs/core/search_page.php
index ffbad81a30f..36f1e29e558 100644
--- a/htdocs/core/search_page.php
+++ b/htdocs/core/search_page.php
@@ -35,7 +35,6 @@ if (! defined('NOREQUIREMENU'))  define('NOREQUIREMENU',1);
 
 require_once '../main.inc.php';
 
-if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang'));	// If language was forced on URL by the main.inc.php
 $langs->load("main");
 $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
 $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');
diff --git a/htdocs/core/tpl/ajaxrow.tpl.php b/htdocs/core/tpl/ajaxrow.tpl.php
index 0708ae07a51..96be9b49196 100644
--- a/htdocs/core/tpl/ajaxrow.tpl.php
+++ b/htdocs/core/tpl/ajaxrow.tpl.php
@@ -31,7 +31,7 @@ $forcereloadpage=empty($conf->global->MAIN_FORCE_RELOAD_PAGE)?0:1;
 $tagidfortablednd=(empty($tagidfortablednd)?'tablelines':$tagidfortablednd);
 $filepath=(empty($filepath)?'':$filepath);
 
-if (GETPOST('action') != 'editline' && $nboflines > 1) { ?>
+if (GETPOST('action','aZ09') != 'editline' && $nboflines > 1) { ?>
 <script type="text/javascript">
 $(document).ready(function(){
 	$(".imgupforline").hide();
diff --git a/htdocs/core/tpl/notes.tpl.php b/htdocs/core/tpl/notes.tpl.php
index 01d0ba7b33c..2538e052ae4 100644
--- a/htdocs/core/tpl/notes.tpl.php
+++ b/htdocs/core/tpl/notes.tpl.php
@@ -31,7 +31,7 @@ $value_private=$object->note_private;
 if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PUBLIC_NOTES))
 {
 	$stringtoadd=dol_print_date(dol_now(), 'dayhour').' '.$user->getFullName($langs).' --';
-	if (GETPOST('action') == 'edit'.$note_public)
+	if (GETPOST('action','aZ09') == 'edit'.$note_public)
 	{
 		$value_public=dol_concatdesc($value_public, ($value_public?"\n":"")."-- ".$stringtoadd);
 		if (dol_textishtml($value_public)) $value_public.="<br>\n";
@@ -41,7 +41,7 @@ if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PUBLIC_NOTES))
 if (! empty($conf->global->MAIN_AUTO_TIMESTAMP_IN_PRIVATE_NOTES))
 {
 	$stringtoadd=dol_print_date(dol_now(), 'dayhour').' '.$user->getFullName($langs).' --';
-	if (GETPOST('action') == 'edit'.$note_private)
+	if (GETPOST('action','aZ09') == 'edit'.$note_private)
 	{
 		$value_private=dol_concatdesc($value_private, ($value_private?"\n":"")."-- ".$stringtoadd);
 		if (dol_textishtml($value_private)) $value_private.="<br>\n";
diff --git a/htdocs/document.php b/htdocs/document.php
index 4e4f18826ef..46e27d57a67 100644
--- a/htdocs/document.php
+++ b/htdocs/document.php
@@ -61,7 +61,7 @@ $action=GETPOST('action','alpha');
 $original_file=GETPOST('file','alpha');	// Do not use urldecode here ($_GET are already decoded by PHP).
 $modulepart=GETPOST('modulepart','alpha');
 $urlsource=GETPOST('urlsource','alpha');
-$entity=GETPOST('entity')?GETPOST('entity','int'):$conf->entity;
+$entity=GETPOST('entity','int')?GETPOST('entity','int'):$conf->entity;
 
 // Security check
 if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart');
@@ -95,7 +95,7 @@ else $type=dol_mimetype($original_file);
 // Define attachment (attachment=true to force choice popup 'open'/'save as')
 $attachment = true;
 if (preg_match('/\.(html|htm)$/i',$original_file)) $attachment = false;
-if (isset($_GET["attachment"])) $attachment = GETPOST("attachment")?true:false;
+if (isset($_GET["attachment"])) $attachment = GETPOST("attachment",'alpha')?true:false;
 if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
 
 // Security: Delete string ../ into $original_file
diff --git a/htdocs/don/payment/card.php b/htdocs/don/payment/card.php
index 2e7d2a001fd..436b449b446 100644
--- a/htdocs/don/payment/card.php
+++ b/htdocs/don/payment/card.php
@@ -34,7 +34,7 @@ $langs->load('companies');
 
 // Security check
 $id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 if ($user->societe_id) $socid=$user->societe_id;
 // TODO Add rule to restrict access payment
diff --git a/htdocs/don/payment/payment.php b/htdocs/don/payment/payment.php
index 23526fd926d..fe4197dbc15 100644
--- a/htdocs/don/payment/payment.php
+++ b/htdocs/don/payment/payment.php
@@ -29,7 +29,7 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
 $langs->load("bills");
 
 $chid=GETPOST("rowid");
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $amounts = array();
 
 // Security check
@@ -154,7 +154,7 @@ $form=new Form($db);
 
 
 // Form to create donation payment
-if (GETPOST("action") == 'create')
+if (GETPOST('action','aZ09') == 'create')
 {
 
 	$don = new Don($db);
diff --git a/htdocs/ecm/docfile.php b/htdocs/ecm/docfile.php
index 3b6455fe4a9..5f40d1bb6f3 100644
--- a/htdocs/ecm/docfile.php
+++ b/htdocs/ecm/docfile.php
@@ -62,7 +62,7 @@ if (! $sortorder) $sortorder="ASC";
 if (! $sortfield) $sortfield="label";
 
 $cancel=GETPOST('cancel');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $section=GETPOST("section");
 if (! $section)
 {
@@ -221,7 +221,7 @@ while ($tmpecmdir && $result > 0)
 print img_picto('','object_dir').' <a href="'.DOL_URL_ROOT.'/ecm/index.php">'.$langs->trans("ECMRoot").'</a> -> ';
 print $s;
 print ' -> ';
-if (GETPOST('action') == 'edit') print '<input type="text" name="label" class="quatrevingtpercent" value="'.$urlfile.'">';
+if (GETPOST('action','aZ09') == 'edit') print '<input type="text" name="label" class="quatrevingtpercent" value="'.$urlfile.'">';
 else print $urlfile;
 print '</td></tr>';
 /*print '<tr><td class="tdtop">'.$langs->trans("Description").'</td><td>';
diff --git a/htdocs/ecm/index.php b/htdocs/ecm/index.php
index be0520e9298..edbe7538dfa 100644
--- a/htdocs/ecm/index.php
+++ b/htdocs/ecm/index.php
@@ -49,7 +49,7 @@ $result = restrictedArea($user, 'ecm', 0);
 
 // Get parameters
 $socid=GETPOST('socid','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $section=GETPOST("section")?GETPOST("section","int"):GETPOST("section_id","int");
 $module=GETPOST("module");
 if (! $section) $section=0;
diff --git a/htdocs/ecm/index_auto.php b/htdocs/ecm/index_auto.php
index 065d14b4593..a605440ff61 100644
--- a/htdocs/ecm/index_auto.php
+++ b/htdocs/ecm/index_auto.php
@@ -49,7 +49,7 @@ $result = restrictedArea($user, 'ecm', 0);
 
 // Get parameters
 $socid=GETPOST('socid','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $section=GETPOST("section")?GETPOST("section","int"):GETPOST("section_id","int");
 $module=GETPOST("module");
 if (! $section) $section=0;
diff --git a/htdocs/expensereport/card.php b/htdocs/expensereport/card.php
index 9a2433994bd..fe546cd1064 100644
--- a/htdocs/expensereport/card.php
+++ b/htdocs/expensereport/card.php
@@ -45,7 +45,7 @@ $langs->load("trips");
 $langs->load("bills");
 $langs->load("mails");
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $cancel=GETPOST('cancel');
 $confirm = GETPOST('confirm', 'alpha');
 
diff --git a/htdocs/expensereport/payment/card.php b/htdocs/expensereport/payment/card.php
index 4450f1644bf..bc956955258 100644
--- a/htdocs/expensereport/payment/card.php
+++ b/htdocs/expensereport/payment/card.php
@@ -34,7 +34,7 @@ $langs->load('companies');
 
 // Security check
 $id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 if ($user->societe_id) $socid=$user->societe_id;
 // TODO Add rule to restrict access payment
diff --git a/htdocs/expensereport/payment/payment.php b/htdocs/expensereport/payment/payment.php
index 82c3fc16e30..40c4fad2513 100644
--- a/htdocs/expensereport/payment/payment.php
+++ b/htdocs/expensereport/payment/payment.php
@@ -31,7 +31,7 @@ $langs->load("bills");
 $langs->load("banks");
 
 $chid=GETPOST("id");
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $amounts = array();
 $accountid=GETPOST('accountid','int');
 
@@ -174,7 +174,7 @@ $form=new Form($db);
 
 
 // Form to create expense report payment
-if (GETPOST("action") == 'create')
+if (GETPOST('action','aZ09') == 'create')
 {
 	$expensereport = new ExpenseReport($db);
 	$expensereport->fetch($chid);
diff --git a/htdocs/externalsite/frames.php b/htdocs/externalsite/frames.php
index c0b5cf92e7e..adf9d547073 100644
--- a/htdocs/externalsite/frames.php
+++ b/htdocs/externalsite/frames.php
@@ -38,7 +38,7 @@ $mainmenu=GETPOST('mainmenu', 'alpha');
 $leftmenu=GETPOST('leftmenu', 'alpha');
 $idmenu=GETPOST('idmenu', 'int');
 $theme=GETPOST('theme', 'alpha');
-$codelang=GETPOST('lang', 'alpha');
+$codelang=GETPOST('lang', 'aZ09');
 
 print "
 <html>
diff --git a/htdocs/fourn/card.php b/htdocs/fourn/card.php
index 4c2716e311a..6243a9e3a16 100644
--- a/htdocs/fourn/card.php
+++ b/htdocs/fourn/card.php
@@ -44,7 +44,7 @@ $langs->load('bills');
 $langs->load('orders');
 $langs->load('commercial');
 
-$action	= GETPOST('action');
+$action	= GETPOST('action','aZ09');
 $cancelbutton = GETPOST('cancel');
 
 // Security check
diff --git a/htdocs/fourn/commande/dispatch.php b/htdocs/fourn/commande/dispatch.php
index b7e3830ad5c..e89555a5d50 100644
--- a/htdocs/fourn/commande/dispatch.php
+++ b/htdocs/fourn/commande/dispatch.php
@@ -52,7 +52,7 @@ if (! empty($conf->productbatch->enabled))
 $id = GETPOST("id", 'int');
 $ref = GETPOST('ref');
 $lineid = GETPOST('lineid', 'int');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 if ($user->societe_id)
 	$socid = $user->societe_id;
 $result = restrictedArea($user, 'fournisseur', $id, '', 'commande');
diff --git a/htdocs/fourn/commande/note.php b/htdocs/fourn/commande/note.php
index 35384db0ee5..a3334baa5d9 100644
--- a/htdocs/fourn/commande/note.php
+++ b/htdocs/fourn/commande/note.php
@@ -35,7 +35,7 @@ $langs->load('stocks');
 
 $id = GETPOST('facid','int')?GETPOST('facid','int'):GETPOST('id','int');
 $ref = GETPOST('ref');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 // Security check
 if ($user->societe_id) $socid=$user->societe_id;
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index f930ad87979..c0851a44b6f 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -61,7 +61,7 @@ if (!empty($conf->incoterm->enabled)) $langs->load('incoterm');
 
 $id			= (GETPOST('facid','int') ? GETPOST('facid','int') : GETPOST('id','int'));
 $socid		= GETPOST('socid', 'int');
-$action		= GETPOST("action");
+$action		= GETPOST('action','aZ09');
 $confirm	= GETPOST("confirm");
 $ref		= GETPOST('ref','alpha');
 $cancel		= GETPOST('cancel','alpha');
diff --git a/htdocs/fourn/facture/rapport.php b/htdocs/fourn/facture/rapport.php
index a7241a1ecf4..f2bb499d652 100644
--- a/htdocs/fourn/facture/rapport.php
+++ b/htdocs/fourn/facture/rapport.php
@@ -31,7 +31,7 @@ $socid='';
 if (! empty($user->societe_id)) $socid=$user->societe_id;
 $result = restrictedArea($user, 'fournisseur', $id, 'facture_fourn', 'facture');
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $socid=0;
 if ($user->societe_id > 0)
diff --git a/htdocs/ftp/index.php b/htdocs/ftp/index.php
index c8ba7c6b786..5b9dc94172b 100644
--- a/htdocs/ftp/index.php
+++ b/htdocs/ftp/index.php
@@ -37,7 +37,7 @@ if ($user->societe_id) $socid=$user->societe_id;
 $result = restrictedArea($user, 'ftp','');
 
 // Get parameters
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $section=GETPOST('section');
 if (! $section) $section='/';
 $numero_ftp = GETPOST("numero_ftp");
diff --git a/htdocs/holiday/define_holiday.php b/htdocs/holiday/define_holiday.php
index 804ad55e10a..e1b8b21a7bd 100644
--- a/htdocs/holiday/define_holiday.php
+++ b/htdocs/holiday/define_holiday.php
@@ -36,7 +36,7 @@ if ($user->societe_id > 0) accessforbidden();
 // If the user does not have perm to read the page
 if(!$user->rights->holiday->read) accessforbidden();
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $holiday = new Holiday($db);
 
diff --git a/htdocs/index.php b/htdocs/index.php
index 5ab2fa68cd4..d2da24471d8 100644
--- a/htdocs/index.php
+++ b/htdocs/index.php
@@ -31,7 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
 
 // If not defined, we select menu "home"
 $_GET['mainmenu']=GETPOST('mainmenu', 'aZ09')?GETPOST('mainmenu', 'aZ09'):'home';
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 
 $hookmanager->initHooks(array('index'));
 
diff --git a/htdocs/install/repair.php b/htdocs/install/repair.php
index 93597451f21..a70553cbfb0 100644
--- a/htdocs/install/repair.php
+++ b/htdocs/install/repair.php
@@ -63,7 +63,7 @@ if (! is_object($conf)) dolibarr_install_syslog("repair: conf file not initializ
  * View
 */
 
-pHeader('',"upgrade2",GETPOST('action'));
+pHeader('',"upgrade2",GETPOST('action','aZ09'));
 
 $actiondone=0;
 
diff --git a/htdocs/install/step2.php b/htdocs/install/step2.php
index d5fb1bbfd05..baceee5f7eb 100644
--- a/htdocs/install/step2.php
+++ b/htdocs/install/step2.php
@@ -42,7 +42,7 @@ error_reporting(0);		// Disable all errors
 @set_time_limit(900);	// Need 900 on some OS like Windows 7/64
 error_reporting($err);
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $setuplang=(GETPOST('selectlang','',3)?GETPOST('selectlang','',3):'auto');
 $langs->setDefaultLang($setuplang);
 
diff --git a/htdocs/install/upgrade.php b/htdocs/install/upgrade.php
index ec363646708..96853887f81 100644
--- a/htdocs/install/upgrade.php
+++ b/htdocs/install/upgrade.php
@@ -97,12 +97,12 @@ if (! $versionfrom && ! $versionto)
 }
 
 
-pHeader('',"upgrade2",GETPOST('action'),'versionfrom='.$versionfrom.'&versionto='.$versionto);
+pHeader('',"upgrade2",GETPOST('action','aZ09'),'versionfrom='.$versionfrom.'&versionto='.$versionto);
 
 $actiondone=0;
 
 // Action to launch the migrate script
-if (! GETPOST("action") || preg_match('/upgrade/i',GETPOST('action')))
+if (! GETPOST('action','aZ09') || preg_match('/upgrade/i',GETPOST('action','aZ09')))
 {
     $actiondone=1;
 
diff --git a/htdocs/install/upgrade2.php b/htdocs/install/upgrade2.php
index f535bf27ebd..4646c3b6eb9 100644
--- a/htdocs/install/upgrade2.php
+++ b/htdocs/install/upgrade2.php
@@ -101,10 +101,10 @@ if ((! $versionfrom || preg_match('/version/', $versionfrom)) && (! $versionto |
 	exit;
 }
 
-pHeader('','step5',GETPOST("action")?GETPOST("action"):'upgrade','versionfrom='.$versionfrom.'&versionto='.$versionto);
+pHeader('','step5',GETPOST('action','aZ09')?GETPOST('action','aZ09'):'upgrade','versionfrom='.$versionfrom.'&versionto='.$versionto);
 
 
-if (! GETPOST("action") || preg_match('/upgrade/i',GETPOST('action')))
+if (! GETPOST('action','aZ09') || preg_match('/upgrade/i',GETPOST('action','aZ09')))
 {
     print '<h3>'.$langs->trans('DataMigration').'</h3>';
 
diff --git a/htdocs/loan/card.php b/htdocs/loan/card.php
index 92961b9a7d1..b58bfb929d9 100644
--- a/htdocs/loan/card.php
+++ b/htdocs/loan/card.php
@@ -36,7 +36,7 @@ $langs->load("bills");
 $langs->load("loan");
 
 $id=GETPOST('id','int');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 $cancel=GETPOST('cancel','alpha');
 
diff --git a/htdocs/loan/document.php b/htdocs/loan/document.php
index e6446e366fa..f4f490a146a 100644
--- a/htdocs/loan/document.php
+++ b/htdocs/loan/document.php
@@ -35,7 +35,7 @@ $langs->load("bills");
 $langs->load("loan");
 
 $id = GETPOST('id','int');
-$action = GETPOST("action");
+$action = GETPOST('action','aZ09');
 $confirm = GETPOST('confirm', 'alpha');
 
 // Security check
diff --git a/htdocs/loan/info.php b/htdocs/loan/info.php
index f61b9312432..73bb1c1f984 100644
--- a/htdocs/loan/info.php
+++ b/htdocs/loan/info.php
@@ -31,7 +31,7 @@ $langs->load("bills");
 $langs->load("loan");
 
 $id=GETPOST('id','int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 
 // Security check
 $socid = GETPOST('socid','int');
diff --git a/htdocs/loan/note.php b/htdocs/loan/note.php
index e28320470a2..4b76cad1d6d 100644
--- a/htdocs/loan/note.php
+++ b/htdocs/loan/note.php
@@ -30,7 +30,7 @@ require '../main.inc.php';
 require_once(DOL_DOCUMENT_ROOT.'/loan/class/loan.class.php');
 require_once DOL_DOCUMENT_ROOT.'/core/lib/loan.lib.php';
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 $langs->load('loan');
 
diff --git a/htdocs/loan/payment/card.php b/htdocs/loan/payment/card.php
index 5a9558222dc..206e3e64de7 100644
--- a/htdocs/loan/payment/card.php
+++ b/htdocs/loan/payment/card.php
@@ -33,7 +33,7 @@ $langs->load('loan');
 
 // Security check
 $id=GETPOST("id",'int');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 if ($user->societe_id) $socid=$user->societe_id;
 // TODO ajouter regle pour restreindre acces paiement
diff --git a/htdocs/loan/payment/payment.php b/htdocs/loan/payment/payment.php
index 8c7a0af6cef..dc927035954 100644
--- a/htdocs/loan/payment/payment.php
+++ b/htdocs/loan/payment/payment.php
@@ -31,7 +31,7 @@ $langs->load("bills");
 $langs->load("loan");
 
 $chid=GETPOST('id','int');
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $cancel=GETPOST('cancel','alpha');
 
 // Security check
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index c6bf910a8af..c2b99f22c1f 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -307,7 +307,7 @@ if (! defined('NOTOKENRENEWAL'))
 }
 if (! defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && ! empty($conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN))	// Check validity of token, only if option enabled (this option breaks some features sometimes)
 {
-    if ($_SERVER['REQUEST_METHOD'] == 'POST' && ! GETPOST('token')) // Note, offender can still send request by GET
+    if ($_SERVER['REQUEST_METHOD'] == 'POST' && ! GETPOST('token','alpha')) // Note, offender can still send request by GET
     {
         print "Access refused by CSRF protection in main.inc.php. Token not provided.\n";
         print "If you access your server behind a proxy using url rewriting, you might check that all HTTP header is propagated (or add the line \$dolibarr_nocsrfcheck=1 into your conf.php file).\n";
@@ -317,7 +317,7 @@ if (! defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && ! empty($conf->g
     {
         if (GETPOST('token', 'alpha') != $_SESSION['token'])
         {
-            dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action').", _POST['token']=".GETPOST('token').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);
+            dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action','aZ09').", _POST['token']=".GETPOST('token','alpha').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);
             //print 'Unset POST by CSRF protection in main.inc.php.';	// Do not output anything because this create problems when using the BACK button on browsers.
             unset($_POST);
         }
@@ -325,7 +325,7 @@ if (! defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && ! empty($conf->g
 }
 
 // Disable modules (this must be after session_start and after conf has been loaded)
-if (GETPOST('disablemodules'))  $_SESSION["disablemodules"]=GETPOST('disablemodules');
+if (GETPOST('disablemodules','alpha'))  $_SESSION["disablemodules"]=GETPOST('disablemodules','alpha');
 if (! empty($_SESSION["disablemodules"]))
 {
     $disabled_modules=explode(',',$_SESSION["disablemodules"]);
@@ -448,7 +448,7 @@ if (! defined('NOLOGIN'))
         }
 
         $usertotest		= (! empty($_COOKIE['login_dolibarr']) ? $_COOKIE['login_dolibarr'] : GETPOST("username","alpha",2));
-        $passwordtotest	= GETPOST('password','',2);
+        $passwordtotest	= GETPOST('password','none',2);
         $entitytotest	= (GETPOST('entity','int') ? GETPOST('entity','int') : (!empty($conf->entity) ? $conf->entity : 1));
 
         // Validation of login/pass/entity
@@ -463,7 +463,7 @@ if (! defined('NOLOGIN'))
         {
             include_once DOL_DOCUMENT_ROOT.'/core/class/translate.class.php';
             $langs=new Translate("",$conf);
-    		$langcode=(GETPOST('lang')?GETPOST('lang','alpha',1):(empty($conf->global->MAIN_LANG_DEFAULT)?'auto':$conf->global->MAIN_LANG_DEFAULT));
+    		$langcode=(GETPOST('lang','aZ09',1)?GETPOST('lang','aZ09',1):(empty($conf->global->MAIN_LANG_DEFAULT)?'auto':$conf->global->MAIN_LANG_DEFAULT));
         	$langs->setDefaultLang($langcode);
         }
 
@@ -575,9 +575,9 @@ if (! defined('NOLOGIN'))
 	        if ($reshook < 0) $error++;
 
 	        $paramsurl=array();
-	        if (GETPOST('textbrowser')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int');
-	        if (GETPOST('nojs')) $paramsurl[]='nojs='.GETPOST('nojs','int');
-	        if (GETPOST('lang')) $paramsurl[]='lang='.GETPOST('lang','alpha');
+	        if (GETPOST('textbrowser','int')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int');
+	        if (GETPOST('nojs','int'))        $paramsurl[]='nojs='.GETPOST('nojs','int');
+	        if (GETPOST('lang','aZ09'))       $paramsurl[]='lang='.GETPOST('lang','aZ09');
             header('Location: '.DOL_URL_ROOT.'/index.php'.(count($paramsurl)?'?'.implode('&',$paramsurl):''));
             exit;
         }
@@ -635,9 +635,9 @@ if (! defined('NOLOGIN'))
 	        if ($reshook < 0) $error++;
 
 	        $paramsurl=array();
-	        if (GETPOST('textbrowser')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int');
-	        if (GETPOST('nojs')) $paramsurl[]='nojs='.GETPOST('nojs','int');
-	        if (GETPOST('lang')) $paramsurl[]='lang='.GETPOST('lang','alpha');
+	        if (GETPOST('textbrowser','int')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int');
+	        if (GETPOST('nojs','int'))        $paramsurl[]='nojs='.GETPOST('nojs','int');
+	        if (GETPOST('lang','aZ09'))       $paramsurl[]='lang='.GETPOST('lang','aZ09');
             header('Location: '.DOL_URL_ROOT.'/index.php'.(count($paramsurl)?'?'.implode('&',$paramsurl):''));
             exit;
         }
@@ -761,7 +761,7 @@ if (! defined('NOLOGIN'))
 }
 
 // Case forcing style from url
-if (GETPOST('theme'))
+if (GETPOST('theme','alpha'))
 {
 	$conf->theme=GETPOST('theme','alpha',1);
 	$conf->css  = "/theme/".$conf->theme."/style.css.php";
@@ -769,7 +769,7 @@ if (GETPOST('theme'))
 
 
 // Set javascript option
-if (! GETPOST('nojs'))   // If javascript was not disabled on URL
+if (! GETPOST('nojs','int'))   // If javascript was not disabled on URL
 {
 	if (! empty($user->conf->MAIN_DISABLE_JAVASCRIPT))
 	{
@@ -778,17 +778,17 @@ if (! GETPOST('nojs'))   // If javascript was not disabled on URL
 }
 else $conf->use_javascript_ajax=0;
 // Set MAIN_OPTIMIZEFORTEXTBROWSER
-if (GETPOST('textbrowser') || (! empty($conf->browser->name) && $conf->browser->name == 'lynxlinks') || ! empty($user->conf->MAIN_OPTIMIZEFORTEXTBROWSER))   // If we must enable text browser
+if (GETPOST('textbrowser','int') || (! empty($conf->browser->name) && $conf->browser->name == 'lynxlinks') || ! empty($user->conf->MAIN_OPTIMIZEFORTEXTBROWSER))   // If we must enable text browser
 {
     $conf->global->MAIN_OPTIMIZEFORTEXTBROWSER=1;
 }
 
 // Set terminal output option according to conf->browser.
-if (GETPOST('dol_hide_leftmenu') || ! empty($_SESSION['dol_hide_leftmenu']))               $conf->dol_hide_leftmenu=1;
-if (GETPOST('dol_hide_topmenu') || ! empty($_SESSION['dol_hide_topmenu']))                 $conf->dol_hide_topmenu=1;
-if (GETPOST('dol_optimize_smallscreen') || ! empty($_SESSION['dol_optimize_smallscreen'])) $conf->dol_optimize_smallscreen=1;
-if (GETPOST('dol_no_mouse_hover') || ! empty($_SESSION['dol_no_mouse_hover']))             $conf->dol_no_mouse_hover=1;
-if (GETPOST('dol_use_jmobile') || ! empty($_SESSION['dol_use_jmobile']))                   $conf->dol_use_jmobile=1;
+if (GETPOST('dol_hide_leftmenu','int') || ! empty($_SESSION['dol_hide_leftmenu']))               $conf->dol_hide_leftmenu=1;
+if (GETPOST('dol_hide_topmenu','int') || ! empty($_SESSION['dol_hide_topmenu']))                 $conf->dol_hide_topmenu=1;
+if (GETPOST('dol_optimize_smallscreen','int') || ! empty($_SESSION['dol_optimize_smallscreen'])) $conf->dol_optimize_smallscreen=1;
+if (GETPOST('dol_no_mouse_hover','int') || ! empty($_SESSION['dol_no_mouse_hover']))             $conf->dol_no_mouse_hover=1;
+if (GETPOST('dol_use_jmobile','int') || ! empty($_SESSION['dol_use_jmobile']))                   $conf->dol_use_jmobile=1;
 if (! empty($conf->browser->layout) && $conf->browser->layout != 'classic') $conf->dol_no_mouse_hover=1;
 if ((! empty($conf->browser->layout) && $conf->browser->layout == 'phone')
 	|| (! empty($_SESSION['dol_screenwidth']) && $_SESSION['dol_screenwidth'] < 400)
@@ -809,7 +809,7 @@ if (! empty($conf->dol_use_jmobile) && in_array($conf->theme,array('bureau2crea'
 
 if (! defined('NOREQUIRETRAN'))
 {
-    if (! GETPOST('lang'))	// If language was not forced on URL
+    if (! GETPOST('lang','aZ09'))	// If language was not forced on URL
     {
         // If user has chosen its own language
         if (! empty($user->conf->MAIN_LANG_DEFAULT))
@@ -909,7 +909,7 @@ if (! defined('NOREQUIREMENU'))
 
 	// Load the menu manager (only if not already done)
 	$file_menu=$conf->standard_menu;
-	if (GETPOST('menu')) $file_menu=GETPOST('menu');     // example: menu=eldy_menu.php
+	if (GETPOST('menu','alpha')) $file_menu=GETPOST('menu','alpha');     // example: menu=eldy_menu.php
 	if (! class_exists('MenuManager'))
 	{
 		$menufound=0;
@@ -1034,7 +1034,7 @@ function top_htmlhead($head, $title='', $disablejs=0, $disablehead=0, $arrayofjs
     if (empty($disablehead))
     {
         print "<head>\n";
-		if (GETPOST('dol_basehref')) print '<base href="'.dol_escape_htmltag(GETPOST('dol_basehref')).'">'."\n";
+		if (GETPOST('dol_basehref','alpha')) print '<base href="'.dol_escape_htmltag(GETPOST('dol_basehref','alpha')).'">'."\n";
         // Displays meta
         print '<meta name="robots" content="noindex'.($disablenofollow?'':',nofollow').'">'."\n";      				// Do not index
         print '<meta name="viewport" content="width=device-width, initial-scale=1.0">';	// Scale for mobile device
@@ -1043,9 +1043,9 @@ function top_htmlhead($head, $title='', $disablejs=0, $disablehead=0, $arrayofjs
 		$favicon=dol_buildpath('/theme/'.$conf->theme.'/img/favicon.ico',1);
         if (! empty($conf->global->MAIN_FAVICON_URL)) $favicon=$conf->global->MAIN_FAVICON_URL;
         print '<link rel="shortcut icon" type="image/x-icon" href="'.$favicon.'"/>'."\n";
-        //if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && ! GETPOST('textbrowser')) print '<link rel="top" title="'.$langs->trans("Home").'" href="'.(DOL_URL_ROOT?DOL_URL_ROOT:'/').'">'."\n";
-        if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && ! GETPOST('textbrowser')) print '<link rel="copyright" title="GNU General Public License" href="http://www.gnu.org/copyleft/gpl.html#SEC1">'."\n";
-        if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && ! GETPOST('textbrowser')) print '<link rel="author" title="Dolibarr Development Team" href="https://www.dolibarr.org">'."\n";
+        //if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && ! GETPOST('textbrowser','int')) print '<link rel="top" title="'.$langs->trans("Home").'" href="'.(DOL_URL_ROOT?DOL_URL_ROOT:'/').'">'."\n";
+        if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && ! GETPOST('textbrowser','int')) print '<link rel="copyright" title="GNU General Public License" href="http://www.gnu.org/copyleft/gpl.html#SEC1">'."\n";
+        if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && ! GETPOST('textbrowser','int')) print '<link rel="author" title="Dolibarr Development Team" href="https://www.dolibarr.org">'."\n";
 
         // Displays title
         $appli=constant('DOL_APPLICATION_TITLE');
@@ -1059,17 +1059,17 @@ function top_htmlhead($head, $title='', $disablejs=0, $disablehead=0, $arrayofjs
         //$ext='';
         //if (! empty($conf->dol_use_jmobile)) $ext='version='.urlencode(DOL_VERSION);
         $ext='version='.urlencode(DOL_VERSION);
-        if (GETPOST('version')) $ext='version='.GETPOST('version','int');	// usefull to force no cache on css/js
-        if (GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) $ext.='&testmenuhider='.(GETPOST('testmenuhider')?GETPOST('testmenuhider','int'):$conf->global->MAIN_TESTMENUHIDER);
+        if (GETPOST('version','int')) $ext='version='.GETPOST('version','int');	// usefull to force no cache on css/js
+        if (GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) $ext.='&testmenuhider='.(GETPOST('testmenuhider','int')?GETPOST('testmenuhider','int'):$conf->global->MAIN_TESTMENUHIDER);
         
-        $themeparam='?lang='.$langs->defaultlang.'&amp;theme='.$conf->theme.(GETPOST('optioncss')?'&amp;optioncss='.GETPOST('optioncss','alpha',1):'').'&amp;userid='.$user->id.'&amp;entity='.$conf->entity;
+        $themeparam='?lang='.$langs->defaultlang.'&amp;theme='.$conf->theme.(GETPOST('optioncss','aZ09')?'&amp;optioncss='.GETPOST('optioncss','aZ09',1):'').'&amp;userid='.$user->id.'&amp;entity='.$conf->entity;
         $themeparam.=($ext?'&amp;'.$ext:'');
         if (! empty($_SESSION['dol_resetcache'])) $themeparam.='&amp;dol_resetcache='.$_SESSION['dol_resetcache'];
-        if (GETPOST('dol_hide_topmenu'))           { $themeparam.='&amp;dol_hide_topmenu='.GETPOST('dol_hide_topmenu','int'); }
-        if (GETPOST('dol_hide_leftmenu'))          { $themeparam.='&amp;dol_hide_leftmenu='.GETPOST('dol_hide_leftmenu','int'); }
-        if (GETPOST('dol_optimize_smallscreen'))   { $themeparam.='&amp;dol_optimize_smallscreen='.GETPOST('dol_optimize_smallscreen','int'); }
-        if (GETPOST('dol_no_mouse_hover'))         { $themeparam.='&amp;dol_no_mouse_hover='.GETPOST('dol_no_mouse_hover','int'); }
-        if (GETPOST('dol_use_jmobile'))            { $themeparam.='&amp;dol_use_jmobile='.GETPOST('dol_use_jmobile','int'); $conf->dol_use_jmobile=GETPOST('dol_use_jmobile','int'); }
+        if (GETPOST('dol_hide_topmenu','int'))           { $themeparam.='&amp;dol_hide_topmenu='.GETPOST('dol_hide_topmenu','int'); }
+        if (GETPOST('dol_hide_leftmenu','int'))          { $themeparam.='&amp;dol_hide_leftmenu='.GETPOST('dol_hide_leftmenu','int'); }
+        if (GETPOST('dol_optimize_smallscreen','int'))   { $themeparam.='&amp;dol_optimize_smallscreen='.GETPOST('dol_optimize_smallscreen','int'); }
+        if (GETPOST('dol_no_mouse_hover','int'))         { $themeparam.='&amp;dol_no_mouse_hover='.GETPOST('dol_no_mouse_hover','int'); }
+        if (GETPOST('dol_use_jmobile','int'))            { $themeparam.='&amp;dol_use_jmobile='.GETPOST('dol_use_jmobile','int'); $conf->dol_use_jmobile=GETPOST('dol_use_jmobile','int'); }
         
         if (! defined('DISABLE_JQUERY') && ! $disablejs && $conf->use_javascript_ajax)
         {
diff --git a/htdocs/master.inc.php b/htdocs/master.inc.php
index 61e51999479..90a4cb70611 100644
--- a/htdocs/master.inc.php
+++ b/htdocs/master.inc.php
@@ -246,7 +246,7 @@ if (! defined('NOREQUIREDB') && ! defined('NOREQUIRESOC'))
 // Set default language (must be after the setValues setting global $conf->global->MAIN_LANG_DEFAULT. Page main.inc.php will overwrite langs->defaultlang with user value later)
 if (! defined('NOREQUIRETRAN'))
 {
-    $langcode=(GETPOST('lang')?GETPOST('lang','alpha',1):(empty($conf->global->MAIN_LANG_DEFAULT)?'auto':$conf->global->MAIN_LANG_DEFAULT));
+    $langcode=(GETPOST('lang','aZ09')?GETPOST('lang','aZ09',1):(empty($conf->global->MAIN_LANG_DEFAULT)?'auto':$conf->global->MAIN_LANG_DEFAULT));
 	$langs->setDefaultLang($langcode);
 }
 
diff --git a/htdocs/opensurvey/card.php b/htdocs/opensurvey/card.php
index bb4d4650344..d7a466a5217 100644
--- a/htdocs/opensurvey/card.php
+++ b/htdocs/opensurvey/card.php
@@ -34,7 +34,7 @@ require_once(DOL_DOCUMENT_ROOT."/opensurvey/fonctions.php");
 if (!$user->rights->opensurvey->read) accessforbidden();
 
 // Initialisation des variables
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $cancel=GETPOST('cancel');
 
 $numsondage = '';
diff --git a/htdocs/opensurvey/exportcsv.php b/htdocs/opensurvey/exportcsv.php
index 7096ae7ad99..90fd56cd4d1 100644
--- a/htdocs/opensurvey/exportcsv.php
+++ b/htdocs/opensurvey/exportcsv.php
@@ -28,7 +28,7 @@ require_once(DOL_DOCUMENT_ROOT."/core/lib/admin.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/opensurvey/class/opensurveysondage.class.php");
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $numsondage = '';
 if (GETPOST('id'))
 {
diff --git a/htdocs/opensurvey/list.php b/htdocs/opensurvey/list.php
index 203602bde6e..6f5beaf1277 100644
--- a/htdocs/opensurvey/list.php
+++ b/htdocs/opensurvey/list.php
@@ -30,7 +30,7 @@ require_once(DOL_DOCUMENT_ROOT."/opensurvey/class/opensurveysondage.class.php");
 // Security check
 if (!$user->rights->opensurvey->read) accessforbidden();
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $id=GETPOST('id','alpha');
 $numsondage= $id;
 $search_ref = GETPOST('search_ref', 'alpha');
diff --git a/htdocs/opensurvey/results.php b/htdocs/opensurvey/results.php
index 806609ad7cd..f10e21effe1 100644
--- a/htdocs/opensurvey/results.php
+++ b/htdocs/opensurvey/results.php
@@ -35,7 +35,7 @@ if (!$user->rights->opensurvey->read) accessforbidden();
 
 
 // Init vars
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $numsondage= GETPOST("id");
 
 $object=new Opensurveysondage($db);
diff --git a/htdocs/product/note.php b/htdocs/product/note.php
index 0178635ed10..74e8f9e4f8f 100644
--- a/htdocs/product/note.php
+++ b/htdocs/product/note.php
@@ -34,7 +34,7 @@ $langs->load("companies");
 
 $id = GETPOST('id', 'int');
 $ref = GETPOST('ref', 'alpha');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 // Security check
 $fieldvalue = (! empty($id) ? $id : (! empty($ref) ? $ref : ''));
diff --git a/htdocs/product/stock/card.php b/htdocs/product/stock/card.php
index 95f74352305..665d340f6f9 100644
--- a/htdocs/product/stock/card.php
+++ b/htdocs/product/stock/card.php
@@ -38,7 +38,7 @@ $langs->load("stocks");
 $langs->load("companies");
 $langs->load("categories");
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $cancel=GETPOST('cancel');
 $confirm=GETPOST('confirm');
 
diff --git a/htdocs/product/stock/mouvement.php b/htdocs/product/stock/mouvement.php
index bc4099f66ec..8f512409f03 100644
--- a/htdocs/product/stock/mouvement.php
+++ b/htdocs/product/stock/mouvement.php
@@ -50,7 +50,7 @@ $result=restrictedArea($user,'stock');
 $id=GETPOST('id','int');
 $msid=GETPOST('msid','int');
 $product_id=GETPOST("product_id");
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $cancel=GETPOST('cancel');
 $idproduct = GETPOST('idproduct','int');
 $year = GETPOST("year");
diff --git a/htdocs/product/stock/product.php b/htdocs/product/stock/product.php
index 7c524a167b9..385c4d51ccd 100644
--- a/htdocs/product/stock/product.php
+++ b/htdocs/product/stock/product.php
@@ -51,7 +51,7 @@ $langs->load("sendings");
 if (! empty($conf->productbatch->enabled)) $langs->load("productbatch");
 
 $backtopage=GETPOST('backtopage');
-$action=GETPOST("action");
+$action=GETPOST('action','aZ09');
 $cancel=GETPOST('cancel');
 
 $id=GETPOST('id', 'int');
diff --git a/htdocs/projet/activity/perday.php b/htdocs/projet/activity/perday.php
index c1aa8aaa469..8a3494213cc 100644
--- a/htdocs/projet/activity/perday.php
+++ b/htdocs/projet/activity/perday.php
@@ -35,7 +35,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
 
 $langs->load('projects');
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $mode=GETPOST("mode");
 $id=GETPOST('id','int');
 $taskid=GETPOST('taskid');
diff --git a/htdocs/projet/activity/perweek.php b/htdocs/projet/activity/perweek.php
index 905b93393dd..c6949598ade 100644
--- a/htdocs/projet/activity/perweek.php
+++ b/htdocs/projet/activity/perweek.php
@@ -36,7 +36,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
 $langs->load('projects');
 $langs->load('users');
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $mode=GETPOST("mode");
 $id=GETPOST('id','int');
 $taskid=GETPOST('taskid');
diff --git a/htdocs/projet/note.php b/htdocs/projet/note.php
index a6b6e3c93e2..9a73e481666 100644
--- a/htdocs/projet/note.php
+++ b/htdocs/projet/note.php
@@ -28,7 +28,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/project.lib.php';
 
 $langs->load('projects');
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $id = GETPOST('id','int');
 $ref= GETPOST('ref');
 
diff --git a/htdocs/public/demo/index.php b/htdocs/public/demo/index.php
index 3c3353e5eb6..d5db9866c1f 100644
--- a/htdocs/public/demo/index.php
+++ b/htdocs/public/demo/index.php
@@ -202,7 +202,7 @@ asort($orders);
  * Actions
  */
 
-if (GETPOST("action") == 'gotodemo')
+if (GETPOST('action','aZ09') == 'gotodemo')
 {
 	//print 'ee'.GETPOST("demochoice");
 	$disablestring='';
diff --git a/htdocs/public/opensurvey/studs.php b/htdocs/public/opensurvey/studs.php
index 070c739e85c..98d267fdd72 100644
--- a/htdocs/public/opensurvey/studs.php
+++ b/htdocs/public/opensurvey/studs.php
@@ -32,7 +32,7 @@ require_once(DOL_DOCUMENT_ROOT."/opensurvey/fonctions.php");
 
 
 // Init vars
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $numsondage = '';
 if (GETPOST('sondage'))
 {
diff --git a/htdocs/public/paybox/newpayment.php b/htdocs/public/paybox/newpayment.php
index a52358dab24..c3aff6341cc 100644
--- a/htdocs/public/paybox/newpayment.php
+++ b/htdocs/public/paybox/newpayment.php
@@ -63,7 +63,7 @@ $amount=price2num(GETPOST("amount"));
 if (! GETPOST("currency",'alpha')) $currency=$conf->currency;
 else $currency=GETPOST("currency",'alpha');
 
-if (! GETPOST("action"))
+if (! GETPOST('action','aZ09'))
 {
     if (! GETPOST("amount") && ! GETPOST("source"))
     {
@@ -129,7 +129,7 @@ $valid=true;
  * Actions
  */
 
-if (GETPOST("action") == 'dopayment')
+if (GETPOST('action','aZ09') == 'dopayment')
 {
     $PRICE=price2num(GETPOST("newamount"),'MT');
     $email=GETPOST("email");
diff --git a/htdocs/public/paypal/newpayment.php b/htdocs/public/paypal/newpayment.php
index 5be4e49f232..6de2cb8a441 100644
--- a/htdocs/public/paypal/newpayment.php
+++ b/htdocs/public/paypal/newpayment.php
@@ -67,7 +67,7 @@ $amount=price2num(GETPOST("amount"));
 if (! GETPOST("currency",'alpha')) $currency=$conf->currency;
 else $currency=GETPOST("currency",'alpha');
 
-if (! GETPOST("action"))
+if (! GETPOST('action','aZ09'))
 {
     if (! GETPOST("amount") && ! GETPOST("source"))
     {
@@ -185,7 +185,7 @@ if (! empty($conf->global->PAYPAL_SECURITY_TOKEN))
  * Actions
  */
 
-if (GETPOST("action") == 'dopayment')
+if (GETPOST('action','aZ09') == 'dopayment')
 {
 	$PAYPAL_API_PRICE=price2num(GETPOST("newamount"),'MT');
     $PAYPAL_PAYMENT_TYPE='Sale';
diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php
index ca09825f62a..5a53a2c6ed2 100644
--- a/htdocs/societe/card.php
+++ b/htdocs/societe/card.php
@@ -55,7 +55,7 @@ if (! empty($conf->notification->enabled)) $langs->load("mails");
 
 $mesg=''; $error=0; $errors=array();
 
-$action		= (GETPOST('action') ? GETPOST('action') : 'view');
+$action		= (GETPOST('action','aZ09') ? GETPOST('action','aZ09') : 'view');
 $cancel     = GETPOST('cancel');
 $backtopage = GETPOST('backtopage','alpha');
 $confirm	= GETPOST('confirm');
diff --git a/htdocs/societe/document.php b/htdocs/societe/document.php
index a43db2da318..3802397509b 100644
--- a/htdocs/societe/document.php
+++ b/htdocs/societe/document.php
@@ -36,7 +36,7 @@ $langs->load("companies");
 $langs->load('other');
 
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 $id=(GETPOST('socid','int') ? GETPOST('socid','int') : GETPOST('id','int'));
 $ref = GETPOST('ref', 'alpha');
diff --git a/htdocs/societe/note.php b/htdocs/societe/note.php
index c713250a0e2..bdba82f440e 100644
--- a/htdocs/societe/note.php
+++ b/htdocs/societe/note.php
@@ -29,7 +29,7 @@
 require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
 
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 $langs->load("companies");
 
diff --git a/htdocs/societe/notify/card.php b/htdocs/societe/notify/card.php
index d547d9e57dc..b17ea678853 100644
--- a/htdocs/societe/notify/card.php
+++ b/htdocs/societe/notify/card.php
@@ -36,7 +36,7 @@ $langs->load("admin");
 $langs->load("other");
 
 $socid = GETPOST("socid",'int');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $contactid=GETPOST('contactid');    // May be an int or 'thirdparty'
 $actionid=GETPOST('actionid');
 
diff --git a/htdocs/theme/eldy/style.css.php b/htdocs/theme/eldy/style.css.php
index 80edfc6fea9..2aa33543913 100644
--- a/htdocs/theme/eldy/style.css.php
+++ b/htdocs/theme/eldy/style.css.php
@@ -75,8 +75,7 @@ else header('Cache-Control: no-cache');
 // On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1.
 if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) { ob_start("ob_gzhandler"); }
 
-if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang', 'alpha'));	// If language was forced on URL
-if (GETPOST('theme')) $conf->theme=GETPOST('theme', 'alpha');  // If theme was forced on URL
+if (GETPOST('theme','alpha')) $conf->theme=GETPOST('theme','alpha');  // If theme was forced on URL
 $langs->load("main",0,1);
 $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
 $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');
@@ -231,7 +230,7 @@ print '*/'."\n";
 
 
 body {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	background-color: #FFFFFF;
 <?php } else { ?>
 	background: rgb(<?php print $colorbackbody; ?>);
@@ -867,7 +866,7 @@ div.fiche>form>div.div-table-responsive {
    	}
 }
 .linkobject { cursor: pointer; }
-<?php if (GETPOST("optioncss") == 'print') { ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
 .hideonprint { display: none; }
 <?php } ?>
 
@@ -942,7 +941,7 @@ div.vmenu, td.vmenu {
 
 
 /* For smartphone (testmenuhider is on) */
-<?php if ($conf->browser->layout == 'phone' && ((GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))) { ?>
+<?php if ($conf->browser->layout == 'phone' && ((GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))) { ?>
 #id-container {
 	width: 100%;
 }
@@ -984,8 +983,8 @@ div.fiche {
 
 
 div.fiche {
-	margin-<?php print $left; ?>: <?php print (GETPOST("optioncss") == 'print'?6:($dol_hide_leftmenu?'6':'26')); ?>px;
-	margin-<?php print $right; ?>: <?php print (GETPOST("optioncss") == 'print'?8:(empty($conf->dol_optimize_smallscreen)?'16':'6')); ?>px;
+	margin-<?php print $left; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?6:($dol_hide_leftmenu?'6':'26')); ?>px;
+	margin-<?php print $right; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?8:(empty($conf->dol_optimize_smallscreen)?'16':'6')); ?>px;
 	<?php if (! empty($conf->dol_hide_leftmenu) && ! empty($conf->dol_hide_topmenu)) print 'margin-top: 4px;'."\n"; ?>
 	<?php if (! empty($conf->dol_hide_leftmenu)) print 'margin-bottom: 12px;'."\n"; ?>
 }
@@ -1029,8 +1028,8 @@ div.ficheaddleft {
 @media only screen and (max-width: 1000px)
 {
     div.fiche {
-    	margin-<?php print $left; ?>: <?php print (GETPOST("optioncss") == 'print'?6:($dol_hide_leftmenu?'6':'20')); ?>px;
-    	margin-<?php print $right; ?>: <?php print (GETPOST("optioncss") == 'print'?8:6); ?>px;
+    	margin-<?php print $left; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?6:($dol_hide_leftmenu?'6':'20')); ?>px;
+    	margin-<?php print $right; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?8:6); ?>px;
     	<?php if (! empty($conf->dol_hide_leftmenu) && ! empty($conf->dol_hide_topmenu)) print 'margin-top: 4px;'; ?>
     }
     div.fichecenter {
@@ -1183,7 +1182,7 @@ if (! empty($conf->global->THEME_TOPMENU_DISABLE_IMAGE)) { $disableimages = 1; $
 ?>
 
 div#id-top {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	display:none;
 <?php } else { ?>
 	background: rgb(<?php echo $colorbackhmenu1 ?>);
@@ -1206,7 +1205,7 @@ div#id-top {
 }
 
 div#tmenu_tooltip {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	display:none;
 <?php } else { ?>
 	padding-<?php echo $right; ?>: <?php echo ($maxwidthloginblock - 10); ?>px;
@@ -1220,7 +1219,7 @@ div.tmenusep {
 }
 
 div.tmenudiv {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	display:none;
 <?php } else { ?>
     position: relative;
@@ -1632,7 +1631,7 @@ div.login_block {
 	top: 4px;
 	font-weight: bold;
 	max-width: <?php echo $maxwidthloginblock; ?>px;
-	<?php if (GETPOST("optioncss") == 'print') { ?>
+	<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
 	display: none;
 	<?php } ?>
 }
@@ -1746,7 +1745,7 @@ div.vmenu, td.vmenu {
 .vmenu {
     width: 190px;
 	margin-left: 6px;
-	<?php if (GETPOST("optioncss") == 'print') { ?>
+	<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
     display: none;
 	<?php } ?>
 }
@@ -4600,7 +4599,7 @@ div.tabsElem a.tab {
 	<?php } ?>
 	}
 	div#tmenu_tooltip {
-	<?php if (GETPOST("optioncss") == 'print') {  ?>
+	<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 		display:none;
 	<?php } else { ?>
 		padding-<?php echo $right; ?>: 0;
@@ -4611,7 +4610,7 @@ div.tabsElem a.tab {
 		width: 100%;
 	}
 	div.login_block {
-		<?php if ($conf->browser->layout == 'phone' && ((GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))) { ?>
+		<?php if ($conf->browser->layout == 'phone' && ((GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER))) { ?>
 		display: none;
 		padding-top: 20px;
 		padding-left: 20px;
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index 36e2dc4e6f3..dde2c8c42ad 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -76,8 +76,7 @@ else header('Cache-Control: no-cache');
 // On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1.
 if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) { ob_start("ob_gzhandler"); }
 
-if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang'));	// If language was forced on URL
-if (GETPOST('theme')) $conf->theme=GETPOST('theme');  // If theme was forced on URL
+if (GETPOST('theme','alpha')) $conf->theme=GETPOST('theme','alpha');  // If theme was forced on URL
 $langs->load("main",0,1);
 $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
 $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');
@@ -234,7 +233,7 @@ print '*/'."\n";
 
 
 body {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	background-color: #FFFFFF;
 <?php } else { ?>
 	background: rgb(<?php print $colorbackbody; ?>);
@@ -874,7 +873,7 @@ div.fiche>form>div.div-table-responsive {
    	}    
 }
 .linkobject { cursor: pointer; }
-<?php if (GETPOST("optioncss") == 'print') { ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
 .hideonprint { display: none; }
 <?php } ?>
 
@@ -921,14 +920,14 @@ td.showDragHandle {
 #id-right {	/* This must stay id-right and not be replaced with echo $right */
 	width: 100%;
 	padding-bottom: 10px;
-<?php if (GETPOST("optioncss") != 'print') { ?>
+<?php if (GETPOST('optioncss','aZ09') != 'print') { ?>
 	padding-left: 229px;
 	padding-top: 12px;
 <?php } ?>
 }
 
 .side-nav {
-<?php if (GETPOST("optioncss") == 'print') { ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
 	display: none;
 <?php } else { ?>
 	background: #FFF;
@@ -1027,8 +1026,8 @@ div.fiche {
 <?php } ?>
 
 div.fiche {
-	margin-<?php print $left; ?>: <?php print (GETPOST("optioncss") == 'print'?6:($dol_hide_leftmenu?'4':'20')); ?>px;
-	margin-<?php print $right; ?>: <?php print (GETPOST("optioncss") == 'print'?8:(empty($conf->dol_optimize_smallscreen)?'16':'4')); ?>px;
+	margin-<?php print $left; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?6:($dol_hide_leftmenu?'4':'20')); ?>px;
+	margin-<?php print $right; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?8:(empty($conf->dol_optimize_smallscreen)?'16':'4')); ?>px;
 	<?php if (! empty($conf->dol_hide_leftmenu) && ! empty($conf->dol_hide_topmenu)) print 'margin-top: 4px;'; ?>
 	margin-bottom: 15px;
 }
@@ -1065,8 +1064,8 @@ div.ficheaddleft {
 @media only screen and (max-width: 900px)
 {
     div.fiche {
-    	margin-<?php print $left; ?>: <?php print (GETPOST("optioncss") == 'print'?6:($dol_hide_leftmenu?'4':'20')); ?>px;
-    	margin-<?php print $right; ?>: <?php print (GETPOST("optioncss") == 'print'?8:16); ?>px;
+    	margin-<?php print $left; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?6:($dol_hide_leftmenu?'4':'20')); ?>px;
+    	margin-<?php print $right; ?>: <?php print (GETPOST('optioncss','aZ09') == 'print'?8:16); ?>px;
     	<?php if (! empty($conf->dol_hide_leftmenu) && ! empty($conf->dol_hide_topmenu)) print 'margin-top: 4px;'; ?>
     	margin-bottom: 15px;
     }
@@ -1227,7 +1226,7 @@ if (! empty($conf->global->THEME_TOPMENU_DISABLE_IMAGE)) { $heightmenu = 30; $di
 ?>
 
 div#tmenu_tooltip {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	display:none;
 <?php } else { ?>
 	background: rgb(<?php echo $colorbackhmenu1 ?>);
@@ -1243,7 +1242,7 @@ div#tmenu_tooltip {
 }
 
 div#tmenu_tooltip {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	display:none;
 <?php } else { ?>
 	/* padding-<?php echo $right; ?>: <?php echo ($maxwidthloginblock - 10); ?>px; */
@@ -1257,7 +1256,7 @@ div.tmenusep {
 }
 
 div.tmenudiv {
-<?php if (GETPOST("optioncss") == 'print') {  ?>
+<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 	display:none;
 <?php } else { ?>
     position: relative;
@@ -1673,7 +1672,7 @@ div.login_block {
 	background: #FFF;
 	width: 228px;
 	height: 42px;
-	<?php if (GETPOST("optioncss") == 'print') { ?>
+	<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
 	display: none;
 	<?php } ?>
 }
@@ -1777,7 +1776,7 @@ div.vmenu, td.vmenu {
 
 .vmenu {
 	margin-left: 4px;
-	<?php if (GETPOST("optioncss") == 'print') { ?>
+	<?php if (GETPOST('optioncss','aZ09') == 'print') { ?>
     display: none;
 	<?php } ?>
 }
@@ -4702,7 +4701,7 @@ border-top-right-radius: 6px;
 @media only screen and (max-width: 570px)
 {
 	div#tmenu_tooltip {
-	<?php if (GETPOST("optioncss") == 'print') {  ?>
+	<?php if (GETPOST('optioncss','aZ09') == 'print') {  ?>
 		display:none;
 	<?php } else { ?>
 		/* padding-<?php echo $right; ?>: 78px; */
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index cf6a1096a7b..d98ef682e90 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -1774,7 +1774,7 @@ else
             }
         }
 
-        if (GETPOST('action') != 'presend' && GETPOST('action') != 'send')
+        if (GETPOST('action','aZ09') != 'presend' && GETPOST('action','aZ09') != 'send')
         {
             /*
              * List of groups of user
diff --git a/htdocs/user/document.php b/htdocs/user/document.php
index 8b055979992..b15af46bcd8 100644
--- a/htdocs/user/document.php
+++ b/htdocs/user/document.php
@@ -35,7 +35,7 @@ $langs->load("users");
 $langs->load('other');
 
 
-$action=GETPOST('action');
+$action=GETPOST('action','aZ09');
 $confirm=GETPOST('confirm');
 $id=(GETPOST('userid','int') ? GETPOST('userid','int') : GETPOST('id','int'));
 $ref = GETPOST('ref', 'alpha');
diff --git a/htdocs/user/note.php b/htdocs/user/note.php
index 2844676a465..b9e8cb69869 100644
--- a/htdocs/user/note.php
+++ b/htdocs/user/note.php
@@ -28,7 +28,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/usergroups.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/user/class/user.class.php';
 
 $id = GETPOST('id','int');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 
 $langs->load("companies");
 $langs->load("members");
diff --git a/htdocs/user/notify/card.php b/htdocs/user/notify/card.php
index 2b7c31d75df..3c186ac3cae 100644
--- a/htdocs/user/notify/card.php
+++ b/htdocs/user/notify/card.php
@@ -37,7 +37,7 @@ $langs->load("admin");
 $langs->load("other");
 
 $id = GETPOST("id",'int');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $actionid=GETPOST('actionid');
 
 // Security check
diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php
index e59e26efd0b..6530a4f8536 100644
--- a/htdocs/user/passwordforgotten.php
+++ b/htdocs/user/passwordforgotten.php
@@ -172,7 +172,7 @@ else
 }
 
 // Note: $conf->css looks like '/theme/eldy/style.css.php'
-$conf->css = "/theme/".(GETPOST('theme')?GETPOST('theme','alpha'):$conf->theme)."/style.css.php";
+$conf->css = "/theme/".(GETPOST('theme','alpha')?GETPOST('theme','alpha'):$conf->theme)."/style.css.php";
 //$themepath=dol_buildpath((empty($conf->global->MAIN_FORCETHEMEDIR)?'':$conf->global->MAIN_FORCETHEMEDIR).$conf->css,1);
 $themepath=dol_buildpath($conf->css,1);
 if (! empty($conf->modules_parts['theme']))	// This slow down
diff --git a/htdocs/variants/list.php b/htdocs/variants/list.php
index 7b8855c1c4e..9a141b88200 100644
--- a/htdocs/variants/list.php
+++ b/htdocs/variants/list.php
@@ -19,7 +19,7 @@ require '../main.inc.php';
 require DOL_DOCUMENT_ROOT.'/variants/class/ProductAttribute.class.php';
 
 $id = GETPOST('id');
-$action = GETPOST('action');
+$action = GETPOST('action','aZ09');
 $object = new ProductAttribute($db);
 
 
diff --git a/htdocs/viewimage.php b/htdocs/viewimage.php
index 4f1ef007f1f..bd73f0c0b43 100644
--- a/htdocs/viewimage.php
+++ b/htdocs/viewimage.php
@@ -62,10 +62,10 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
 
 
 $action=GETPOST('action','alpha');
-$original_file=GETPOST("file");
+$original_file=GETPOST("file",'alpha');
 $modulepart=GETPOST('modulepart','alpha');
-$urlsource=GETPOST("urlsource");
-$entity=GETPOST('entity')?GETPOST('entity','int'):$conf->entity;
+$urlsource=GETPOST("urlsource",'alpha');
+$entity=GETPOST('entity','int')?GETPOST('entity','int'):$conf->entity;
 
 // Security check
 if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart');
@@ -84,7 +84,7 @@ if ($modulepart == 'fckeditor') $modulepart='medias';   // For backward compatib
  * View
  */
 
-if (GETPOST("cache"))
+if (GETPOST("cache",'alpha'))
 {
     // Important: Following code is to avoid page request by browser and PHP CPU at
     // each Dolibarr page access.
@@ -137,9 +137,9 @@ if (preg_match('/\.\./',$original_file) || preg_match('/[<>|]/',$original_file))
 if ($modulepart == 'barcode')
 {
     $generator=GETPOST("generator","alpha");
-    $code=GETPOST("code");
+    $code=GETPOST("code",'alpha');
     $encoding=GETPOST("encoding","alpha");
-    $readable=GETPOST("readable")?GETPOST("readable","alpha"):"Y";
+    $readable=GETPOST("readable",'alpha')?GETPOST("readable","alpha"):"Y";
 
     if (empty($generator) || empty($encoding))
     {
diff --git a/htdocs/websites/index.php b/htdocs/websites/index.php
index e7dbb898145..8138100ab77 100644
--- a/htdocs/websites/index.php
+++ b/htdocs/websites/index.php
@@ -79,7 +79,7 @@ $langs->load("website");
 
 if (! $user->admin) accessforbidden();
 
-if (! ((GETPOST('testmenuhider') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)))
+if (! ((GETPOST('testmenuhider','int') || ! empty($conf->global->MAIN_TESTMENUHIDER)) && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)))
 {
     $conf->dol_hide_leftmenu = 1;   // Force hide of left menu.
 }
diff --git a/scripts/accountancy/export-thirdpartyaccount.php b/scripts/accountancy/export-thirdpartyaccount.php
index c84ffdabc0f..cfc43113eda 100755
--- a/scripts/accountancy/export-thirdpartyaccount.php
+++ b/scripts/accountancy/export-thirdpartyaccount.php
@@ -159,7 +159,7 @@ if ($resql) {
 	$i = 0;
 
 	// export csv
-	if (GETPOST('action') == 'export_csv') {
+	if (GETPOST('action','aZ09') == 'export_csv') {
 
 		header('Content-Type: text/csv');
 		header('Content-Disposition: attachment;filename=export_csv.csv');