diff --git a/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java b/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
index 19fb3bd0fe..8a2f9a269b 100644
--- a/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
@@ -1214,7 +1214,9 @@ public class I2PSnarkServlet extends Default {
     /** @since 0.7.14 */
     private static String urlify(String s) {
         StringBuilder buf = new StringBuilder(256);
-        buf.append("<a href=\"").append(s).append("\">").append(s).append("</a>");
+        // browsers seem to work without doing this but let's be strict
+        String link = s.replace("&", "&amp;");
+        buf.append("<a href=\"").append(link).append("\">").append(link).append("</a>");
         return buf.toString();
     }
 
diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/EditBean.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/EditBean.java
index f6c76d7f60..b93b67490b 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/EditBean.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/EditBean.java
@@ -175,7 +175,7 @@ public class EditBean extends IndexBean {
     }
     
     public String getAccessList(int tunnel) {
-        return getProperty(tunnel, "i2cp.accessList", "").replaceAll(",", "\n");
+        return getProperty(tunnel, "i2cp.accessList", "").replace(",", "\n");
     }
     
     public boolean getClose(int tunnel) {
diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/IndexBean.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/IndexBean.java
index d91a7900d7..8559c28148 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/IndexBean.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/web/IndexBean.java
@@ -666,7 +666,7 @@ public class IndexBean {
     }
     public void setAccessList(String val) {
         if (val != null)
-            _otherOptions.put("i2cp.accessList", val.trim().replaceAll("\r\n", ",").replaceAll("\n", ",").replaceAll(" ", ","));
+            _otherOptions.put("i2cp.accessList", val.trim().replace("\r\n", ",").replace("\n", ",").replace(" ", ","));
     }
     public void setCloseTime(String val) {
         if (val != null) {
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHandler.java b/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHandler.java
index b407fe4948..d20524bfb5 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHandler.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHandler.java
@@ -142,7 +142,7 @@ public class ConfigUpdateHandler extends FormHandler {
         }
 
         if ( (_updateURL != null) && (_updateURL.length() > 0) ) {
-            _updateURL = _updateURL.replaceAll("\r\n", ",").replaceAll("\n", ",");
+            _updateURL = _updateURL.replace("\r\n", ",").replace("\n", ",");
             String oldURL = _context.router().getConfigSetting(PROP_UPDATE_URL);
             if ( (oldURL == null) || (!_updateURL.equals(oldURL)) ) {
                 _context.router().setConfigSetting(PROP_UPDATE_URL, _updateURL);
@@ -151,7 +151,7 @@ public class ConfigUpdateHandler extends FormHandler {
         }
 
         if ( (_trustedKeys != null) && (_trustedKeys.length() > 0) ) {
-            _trustedKeys = _trustedKeys.replaceAll("\r\n", ",").replaceAll("\n", ",");
+            _trustedKeys = _trustedKeys.replace("\r\n", ",").replace("\n", ",");
             String oldKeys = new TrustedUpdate(_context).getTrustedKeysString();
             if ( (oldKeys == null) || (!_trustedKeys.equals(oldKeys)) ) {
                 _context.router().setConfigSetting(PROP_TRUSTED_KEYS, _trustedKeys);
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHelper.java
index c9b6b7f43f..520c13104e 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHelper.java
@@ -40,7 +40,7 @@ public class ConfigUpdateHelper extends HelperBase {
     public String getUpdateURL() {
         String url = _context.getProperty(ConfigUpdateHandler.PROP_UPDATE_URL);
         if (url != null)
-            return url.replaceAll(",", "\n");
+            return url.replace(",", "\n");
         else
             return ConfigUpdateHandler.DEFAULT_UPDATE_URL;
     }
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/LogsHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/LogsHelper.java
index f499b2ea43..9955ffeed3 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/LogsHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/LogsHelper.java
@@ -33,7 +33,7 @@ public class LogsHelper extends HelperBase {
         if (str == null) 
             return "";
         else {
-            str = str.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+            str = str.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;");
             return _("File location") + ": <b><code>" + f.getAbsolutePath() + "</code></b> <pre>" + str + "</pre>";
         }
     }
@@ -54,12 +54,14 @@ public class LogsHelper extends HelperBase {
         buf.append("<code>\n");
         for (int i = msgs.size(); i > 0; i--) { 
             String msg = msgs.get(i - 1);
+            msg = msg.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;");
             buf.append("<li>");
             if (colorize) {
                 String color;
                 // Homeland Security Advisory System
                 // http://www.dhs.gov/xinfoshare/programs/Copy_of_press_release_0046.shtm
                 // but pink instead of yellow for WARN
+                // FIXME doesnt work for translated levels
                 if (msg.contains("CRIT"))
                     color = "#cc0000";
                 else if (msg.contains("ERROR"))
@@ -71,7 +73,7 @@ public class LogsHelper extends HelperBase {
                 else
                     color = "#006600";
                 buf.append("<font color=\"").append(color).append("\">");
-                buf.append(msg.replaceAll("<", "&lt;").replaceAll(">", "&gt;"));
+                buf.append(msg);
                 buf.append("</font>");
             } else {
                 buf.append(msg);