diff --git a/utils/test_openroaming.php b/utils/test_openroaming.php
index ec28bc06d..1ec6cad87 100644
--- a/utils/test_openroaming.php
+++ b/utils/test_openroaming.php
@@ -28,7 +28,7 @@
 }
 
 
-while ( $row = mysqli_fetch_object($allOpenRoamingProfiles)) {
+while ( $row = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allOpenRoamingProfiles)) {
     $profileId = $row->profile_id;
     print "$profileId\n";
     $profile = \core\ProfileFactory::instantiate($profileId);
diff --git a/web/admin/edit_profile_result.php b/web/admin/edit_profile_result.php
index 5ce92a4fa..570b63734 100644
--- a/web/admin/edit_profile_result.php
+++ b/web/admin/edit_profile_result.php
@@ -53,7 +53,7 @@
         echo $deco->pageheader(sprintf(_("%s: Edit Profile - Result"), \config\Master::APPEARANCE['productname']), "ADMIN-IDP");
     } else {
         $profile = $my_inst->newProfile(core\AbstractProfile::PROFILETYPE_RADIUS);
-        $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP ". $my_inst->identifier." - Profile created");
+        $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP ".$my_inst->identifier." - Profile created");
         echo $deco->pageheader(sprintf(_("%s: Profile wizard (step 3 completed)"), \config\Master::APPEARANCE['productname']), "ADMIN-IDP");
     }
     if (!$profile instanceof \core\ProfileRADIUS) {
@@ -63,9 +63,9 @@
     $realm = FALSE;
     $anon_support = FALSE;
     $attributes = $profile->getAttributes();
-    $anonLocal =  \core\common\Entity::getAttributeValue($attributes, "internal:anon_local_value", 0) ??  "anonymous";
+    $anonLocal = \core\common\Entity::getAttributeValue($attributes, "internal:anon_local_value", 0) ?? "anonymous";
     $checkuser_support = FALSE;
-    $checkuser_local = \core\common\Entity::getAttributeValue($attributes, "internal:checkuser_value", 0) ??  "anonymous";
+    $checkuser_local = \core\common\Entity::getAttributeValue($attributes, "internal:checkuser_value", 0) ?? "anonymous";
     $verify_support = FALSE;
     $hint_support = FALSE;
     $redirect = FALSE;
@@ -255,21 +255,20 @@
                 switch ($orTest['level']) {
                     case \core\AbstractProfile::OVERALL_OPENROAMING_LEVEL_ERROR:
                         echo $uiElements->boxError($orTest['explanation']);
-                         break;
+                        break;
                     case \core\AbstractProfile::OVERALL_OPENROAMING_LEVEL_WARN:
-                         echo $uiElements->boxWarning($orTest['explanation']);
-                         break;
+                        echo $uiElements->boxWarning($orTest['explanation']);
+                        break;
                     case \core\AbstractProfile::OVERALL_OPENROAMING_LEVEL_NOTE:
-                         echo $uiElements->boxRemark($orTest['explanation']);                    
+                        echo $uiElements->boxRemark($orTest['explanation']);                    
                         break;
                     case \core\diag\AbstractTest::RETVAL_OK:
-                         echo $uiElements->boxOkay($orTest['explanation']);
+                        echo $uiElements->boxOkay($orTest['explanation']);
                         break;
                     default:
                         break;    
-                 }
+                }
             }
-                        
         }
             /*
             $resultLevel = \core\AbstractProfile::OVERALL_OPENROAMING_LEVEL_GOOD; // assume all is well, degrade if we have concrete findings to suggest otherwise
diff --git a/web/admin/overview_federation.php b/web/admin/overview_federation.php
index 84ea21bfe..a479e0f5c 100644
--- a/web/admin/overview_federation.php
+++ b/web/admin/overview_federation.php
@@ -19,7 +19,7 @@
  *          <base_url>/copyright.php after deploying the software
  */
 
-require_once dirname(dirname(dirname(__FILE__))) . "/config/_config.php";
+require_once dirname(dirname(dirname(__FILE__)))."/config/_config.php";
 
 $deco = new \web\lib\admin\PageDecoration();
 $uiElements = new web\lib\admin\UIElements();
@@ -72,16 +72,16 @@
     <div class="infobox">
         <h2><?php $tablecaption = _("Your Personal Information"); echo $tablecaption; ?></h2>
         <table>
-            <caption><?php echo $tablecaption;?></caption>
+            <caption><?php echo $tablecaption; ?></caption>
             <tr>
-                <th class="wai-invisible" scope="col"><?php echo _("Property Type");?></th>
-                <th class="wai-invisible" scope="col"><?php echo _("Language if applicable");?></th>
-                <th class="wai-invisible" scope="col"><?php echo _("Property Value");?></th>
+                <th class="wai-invisible" scope="col"><?php echo _("Property Type"); ?></th>
+                <th class="wai-invisible" scope="col"><?php echo _("Language if applicable"); ?></th>
+                <th class="wai-invisible" scope="col"><?php echo _("Property Value"); ?></th>
             </tr>            
             <?php echo $uiElements->infoblock($user->getAttributes(), "user", "User"); ?>
             <tr>
                 <td>
-                    <?php echo "" . _("Unique Identifier") ?>
+                    <?php echo ""._("Unique Identifier") ?>
                 </td>
                 <td>
                 </td>
@@ -93,7 +93,7 @@
     </div>
 
     <form action='overview_certificates.php' method='GET' accept-charset='UTF-8'>
-        <button type='submit'><?php echo sprintf(_('RADIUS/TLS Certificate management'));?></button>
+        <button type='submit'><?php echo sprintf(_('RADIUS/TLS Certificate management')); ?></button>
     </form>
 
     <?php
@@ -102,14 +102,13 @@
     if ($user->isSuperadmin() && isset($_GET['fed_id'])) {
         $cat = new \core\CAT(); // initialises Entity static members
         $fedIdentifiers = array_keys($cat->knownFederations);
-        if (!in_array(strtoupper($_GET['fed_id']), $fedIdentifiers)) {
+        $fed_id = htmlentities($_GET['fed_id'], ENT_QUOTES);
+        if (!in_array(strtoupper($fed_id), $fedIdentifiers)) {
             throw new Exception($this->inputValidationError(sprintf("This %s does not exist!", \core\common\Entity::$nomenclature_fed)));
-        } else {
-            $fed_id = $_GET['fed_id'];
         }
         $feds = [['name'=>' user:fedadmin', 'value' => $fed_id]];
     } elseif (!$user->isFederationAdmin()) {
-        echo "<p>" . sprintf(_("You are not a %s manager."), $uiElements->nomenclatureFed) . "</p>";
+        echo "<p>".sprintf(_("You are not a %s manager."), $uiElements->nomenclatureFed)."</p>";
         echo $deco->footer();
         exit(0);
     } else {
@@ -123,16 +122,16 @@
                 <?php $tablecaption2 = sprintf(_("%s Properties: %s"), $uiElements->nomenclatureFed, $thefed->name); echo $tablecaption2; ?>
             </h2>
             <table>
-            <caption><?php echo $tablecaption2;?></caption>
+            <caption><?php echo $tablecaption2; ?></caption>
             <tr>
-                <th class="wai-invisible" scope="col"><?php echo _("Property Type");?></th>
-                <th class="wai-invisible" scope="col"><?php echo _("Language if applicable");?></th>
-                <th class="wai-invisible" scope="col"><?php echo _("Property Value");?></th>
+                <th class="wai-invisible" scope="col"><?php echo _("Property Type"); ?></th>
+                <th class="wai-invisible" scope="col"><?php echo _("Language if applicable"); ?></th>
+                <th class="wai-invisible" scope="col"><?php echo _("Property Value"); ?></th>
             </tr>
                 <!-- fed properties -->
                 <tr>
                     <td>
-                        <?php echo "" . _("Country") ?>
+                        <?php echo ""._("Country") ?>
                     </td>
                     <td>
                     </td>
@@ -216,7 +215,7 @@
                     default:
                         throw new Exception("Error: unknown encryption status of invitation!?!");
                 }
-                echo $uiElements->boxRemark(ngettext("The invitation email was sent successfully.", "All invitation emails were sent successfully.", $counter) . " " . $cryptText, _("Sent successfully."));
+                echo $uiElements->boxRemark(ngettext("The invitation email was sent successfully.", "All invitation emails were sent successfully.", $counter)." ".$cryptText, _("Sent successfully."));
                 break;
             case "FAILURE":
                 echo $uiElements->boxError(_("No invitation email could be sent!"), _("Sending failure!"));
@@ -236,7 +235,7 @@
                     default:
                         throw new Exception("Error: unknown encryption status of invitation!?!");
                 }
-                echo $uiElements->boxWarning(sprintf(_("Some invitation emails were sent successfully (%s in total), the others failed."), $counter) . " " . $cryptText, _("Partial success."));
+                echo $uiElements->boxWarning(sprintf(_("Some invitation emails were sent successfully (%s in total), the others failed."), $counter)." ".$cryptText, _("Partial success."));
                 break;
             case "INVALIDSYNTAX":
                 echo $uiElements->boxError(_("The invitation email address was malformed, no invitation was sent!"), _("The invitation email address was malformed, no invitation was sent!"));
@@ -252,27 +251,27 @@
     } else {
         $link = 'http://';
     }
-    $link .= $_SERVER['SERVER_NAME'] . $_SERVER['SCRIPT_NAME'];
+    $link .= $_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME'];
     $link = htmlspecialchars($link);
     if (\config\Master::FUNCTIONALITY_LOCATIONS['CONFASSISTANT_RADIUS'] == 'LOCAL' && \config\Master::FUNCTIONALITY_LOCATIONS['DIAGNOSTICS'] == 'LOCAL') {
         echo "<table><tr>
-                        <td>" . sprintf(_("Diagnose reachability and connection parameters of any %s %s"), \config\ConfAssistant::CONSORTIUM['display_name'], $uiElements->nomenclatureIdP) . "</td>
+                        <td>".sprintf(_("Diagnose reachability and connection parameters of any %s %s"), \config\ConfAssistant::CONSORTIUM['display_name'], $uiElements->nomenclatureIdP)."</td>
                         <td><form method='post' action='../diag/action_realmcheck.php' accept-charset='UTF-8'>
                               <input type='hidden' name='comefrom' id='comefrom' value='$link'/>
-                              <button id='realmcheck' style='cursor:pointer;' type='submit'>" . _("Go!") . "</button>
+                              <button id='realmcheck' style='cursor:pointer;' type='submit'>"._("Go!")."</button>
                             </form>
                         </td>
                     </tr>
                     </table>";
     }
     if (\config\ConfAssistant::CONSORTIUM['name'] == 'eduroam') {
-        $helptext = "<h3>" . sprintf(_("Need help? Refer to the <a href='%s'>%s manual</a>"), "https://wiki.geant.org/x/qJg7Bw", $uiElements->nomenclatureFed) . "</h3>";
+        $helptext = "<h3>".sprintf(_("Need help? Refer to the <a href='%s'>%s manual</a>"), "https://wiki.geant.org/x/qJg7Bw", $uiElements->nomenclatureFed)."</h3>";
     } else {
         $helptext = "";
     }
     ?>
     <table class='user_overview' style='border:0px; width:unset'>
-        <caption><?php echo _("Participant Details");?></caption>
+        <caption><?php echo _("Participant Details"); ?></caption>
         <tr>
             <th scope='col'><?php echo sprintf(_("%s Name"), $uiElements->nomenclatureParticipant); ?></th>
             <th scope='col'><?php echo _("Status") ?></th>
@@ -282,7 +281,7 @@
             $pending_invites = $mgmt->listPendingInvitations();
 
             if (\config\Master::DB['enforce-external-sync']) {
-                echo "<th scope='col'>" . sprintf(_("%s Database Sync Status"), \config\ConfAssistant::CONSORTIUM['display_name']) . "</th>";
+                echo "<th scope='col'>".sprintf(_("%s Database Sync Status"), \config\ConfAssistant::CONSORTIUM['display_name'])."</th>";
             }
             ?>
             <th scope='col'>
@@ -299,9 +298,9 @@
             $fedId = strtoupper($onefed['value']);
             $thefed = new \core\Federation($fedId);
             /// nomenclature for 'federation', federation name, nomenclature for 'inst'
-            echo "<tr><td colspan='9'><strong>" . sprintf(_("The following %s are in your %s %s:"), $uiElements->nomenclatureParticipant, $uiElements->nomenclatureFed, '<span style="color:green">' . $thefed->name . '</span>') . "</strong></td></tr>";
-            echo "<tr><td colspan='4'><strong>". _("Quick search:")." </strong><input style='background:#eeeeee;' type='text' id='qsearch_" . $fedId . "'></td>";
-            echo "<td colspan='6' style='border-bottom-style: dotted;border-bottom-width: 1px;'><input type='checkbox' name='unlinked' id='unlinked_ck_" . $fedId . "'> ". _("Only not linked"). "</td>";
+            echo "<tr><td colspan='9'><strong>".sprintf(_("The following %s are in your %s %s:"), $uiElements->nomenclatureParticipant, $uiElements->nomenclatureFed, '<span style="color:green">'.$thefed->name.'</span>')."</strong></td></tr>";
+            echo "<tr><td colspan='4'><strong>". _("Quick search:")." </strong><input style='background:#eeeeee;' type='text' id='qsearch_".$fedId."'></td>";
+            echo "<td colspan='6' style='border-bottom-style: dotted;border-bottom-width: 1px;'><input type='checkbox' name='unlinked' id='unlinked_ck_".$fedId."'> ". _("Only not linked"). "</td>";
             echo "</tr>";
             // extract only pending invitations for *this* fed
             $display_pendings = FALSE;
@@ -351,17 +350,17 @@
                 }
                 echo "<td style='vertical-align:top;' class='inst_td'>
                          <input type='hidden' name='inst' value='" 
-                        . $index . "'>"
-                        . "<span style='display:none' class='inst_name'>".$my_idp."</span>"
-                        . "<span>". $idp_instance->name . "</span>"
-                        . " (<a href='overview_org.php?inst_id="
-                        . $idp_instance->identifier . "'>" 
-                        . (in_array($index, $userIdps) ? _("manage") : _("view"))
-                        . "</a>)"
-                        . (empty($listOfSilverbulletRealms) ? "" : "<ul><li>" ) 
-                        . implode("</li><li>", $listOfSilverbulletRealms) 
-                        . (empty($listOfSilverbulletRealms) ? "" : "</li><ul>" )
-                        . "</td>";
+                       . $index."'>"
+                       . "<span style='display:none' class='inst_name'>".$my_idp."</span>"
+                       . "<span>". $idp_instance->name."</span>"
+                       . " (<a href='overview_org.php?inst_id="
+                       . $idp_instance->identifier."'>" 
+                       . (in_array($index, $userIdps) ? _("manage") : _("view"))
+                       . "</a>)"
+                       . (empty($listOfSilverbulletRealms) ? "" : "<ul><li>" ) 
+                       . implode("</li><li>", $listOfSilverbulletRealms) 
+                       . (empty($listOfSilverbulletRealms) ? "" : "</li><ul>" )
+                       . "</td>";
                 // deployment status; need to dive into profiles for this
                 // show happy eyeballs if at least one profile is configured/showtime                    
                 echo "<td>";
@@ -376,9 +375,9 @@
                 
 /*                
                 echo ($idp_instance->maxProfileStatus() >= \core\IdP::PROFILES_CONFIGURED ? "C" : "-" ) 
-                        . " " 
-                        . ($idp_instance->maxProfileStatus() >= \core\IdP::PROFILES_SHOWTIME ? "V" : "-" )
-                        . " ";
+                       . " " 
+                       . ($idp_instance->maxProfileStatus() >= \core\IdP::PROFILES_SHOWTIME ? "V" : "-" )
+                       . " ";
  * 
  */
                 echo  "</td><td style='text-align: center'>";
@@ -402,17 +401,17 @@
                 if (\config\Master::DB['enforce-external-sync']) {
                     echo "<td style='display: ruby;'>";
                     if ($readonly === FALSE) {
-                        echo "<form method='post' action='inc/manageDBLink.inc.php?inst_id=" . $idp_instance->identifier . "' onsubmit='popupRedirectWindow(this); return false;' accept-charset='UTF-8'>
-                                    <button type='submit'>" . _("Manage DB Link") . "</button>&nbsp;&nbsp;";
+                        echo "<form method='post' action='inc/manageDBLink.inc.php?inst_id=".$idp_instance->identifier."' onsubmit='popupRedirectWindow(this); return false;' accept-charset='UTF-8'>
+                                    <button type='submit'>"._("Manage DB Link")."</button>&nbsp;&nbsp;";
                     }
                     switch ($idpLinked) {
                         case 'nosync':
                             break;
                         case 'linked':
-//                            echo "<div class='acceptable'>" . _("Linked") . "</div>";
+//                            echo "<div class='acceptable'>"._("Linked")."</div>";
                             break;
                         case 'notlinked':
-                            echo "<span class='notacceptable'>" . _("NOT linked") . "</span>";
+                            echo "<span class='notacceptable'>"._("NOT linked")."</span>";
                             break;
                     }
                     echo "</form>";
@@ -422,9 +421,9 @@
                 echo "<td style='vertical-align: top;'>";
                 if ($readonly === FALSE) {
                     echo "<div style='white-space: nowrap;'>
-                                  <form method='post' action='inc/manageAdmins.inc.php?inst_id=" . $index . "' onsubmit='popupRedirectWindow(this); return false;' accept-charset='UTF-8'>
+                                  <form method='post' action='inc/manageAdmins.inc.php?inst_id=".$index."' onsubmit='popupRedirectWindow(this); return false;' accept-charset='UTF-8'>
                                       <button type='submit'>" .
-                    _("Add/Remove Administrators") . "
+                    _("Add/Remove Administrators")."
                                       </button>
                                   </form>
                                 </div>";
@@ -437,7 +436,7 @@
                 echo "<tr>
                             <td colspan='2'>
                                <strong>" .
-                sprintf(_("Pending invitations in the %s:"), $uiElements->nomenclatureFed) . "
+                sprintf(_("Pending invitations in the %s:"), $uiElements->nomenclatureFed)."
                                </strong>
                             </td>
                          </tr>";
@@ -445,18 +444,18 @@
                     if (strtoupper($oneinvite['country']) == strtoupper($thefed->tld)) {
                         echo "<tr>
                                     <td>" .
-                        $oneinvite['name'] . "
+                        $oneinvite['name']."
                                     </td>
                                     <td>" .
-                        $oneinvite['mail'] . "
+                        $oneinvite['mail']."
                                     </td>
                                     <td colspan=2>";
                         if ($readonly === FALSE) {
                             echo "<form method='post' action='overview_federation.php' accept-charset='UTF-8'>
-                                <input type='hidden' name='invitation_id' value='" . $oneinvite['token'] . "'/>
-                                <button class='delete' type='submit' name='submitbutton' value='" . web\lib\common\FormElements::BUTTON_DELETE . "'>" . _("Revoke Invitation") . "</button> "
-                            . sprintf(_("(expires %s)"), $oneinvite['expiry'])
-                            . "</form>";
+                                <input type='hidden' name='invitation_id' value='".$oneinvite['token']."'/>
+                                <button class='delete' type='submit' name='submitbutton' value='".web\lib\common\FormElements::BUTTON_DELETE."'>"._("Revoke Invitation")."</button> "
+                           . sprintf(_("(expires %s)"), $oneinvite['expiry'])
+                           . "</form>";
                         }
                         echo "      </td>";                          
                         echo "         </tr>";