diff --git a/wp-admin/ms-admin.php b/wp-admin/ms-admin.php
index 17a45c0fb..f6520aad3 100644
--- a/wp-admin/ms-admin.php
+++ b/wp-admin/ms-admin.php
@@ -29,7 +29,7 @@ $title = __( 'Site Admin' );
 ?>
 
 <div class="wrap">
-	<h2><?php echo wp_specialchars( $title ); ?></h2>
+	<h2><?php echo esc_html( $title ); ?></h2>
 
 	<ul class="subsubsub">
 	<li><a href="ms-sites.php#form-add-blog" class="rbutton"><strong><?php _e('Create a New Blog'); ?></strong></a> | </li>
diff --git a/wp-admin/ms-sites.php b/wp-admin/ms-sites.php
index 023099826..b5f6d8d93 100644
--- a/wp-admin/ms-sites.php
+++ b/wp-admin/ms-sites.php
@@ -70,7 +70,7 @@ if ( $_GET['updated'] == 'true' ) {
 	<?php
 }
 
-switch( $_GET['action'] ) {
+switch ( $_GET['action'] ) {
 	// Edit blog
 	case "editblog":
 		$blog_prefix = $wpdb->get_blog_prefix( $id );
@@ -277,7 +277,7 @@ switch( $_GET['action'] ) {
 								<select name="new_role" id="new_role">
 								<?php
 								reset( $editblog_roles );
-								foreach( $editblog_roles as $role => $role_assoc ){
+								foreach ( $editblog_roles as $role => $role_assoc ){
 									$name = translate_with_context($role_assoc['name']);
 									$selected = ( $role == $editblog_default_role ) ? 'selected="selected"' : '';
 									echo "<option {$selected} value=\"" . esc_attr($role) . "\">{$name}</option>";
@@ -373,7 +373,7 @@ switch( $_GET['action'] ) {
 
 		<form action="ms-sites.php" method="get" id="ms-search">
 			<input type="hidden" name="action" value="blogs" />
-			<input type="text" name="s" value="<?php if (isset($_GET['s'])) echo stripslashes( esc_attr( $s, 1 ) ); ?>" size="17" />
+			<input type="text" name="s" value="<?php if (isset($_GET['s'])) echo stripslashes( esc_attr( $s ) ); ?>" size="17" />
 			<input type="submit" class="button" name="blog_name" value="<?php esc_attr_e('Search blogs by name') ?>" />
 			<input type="submit" class="button" name="blog_id" value="<?php esc_attr_e('by blog ID') ?>" />
 			<input type="submit" class="button" name="blog_ip" value="<?php esc_attr_e('by IP address') ?>" />
@@ -442,10 +442,10 @@ switch( $_GET['action'] ) {
 			</thead>
 			<tbody id="the-list">
 			<?php
-			if ($blog_list) {
+			if ( $blog_list ) {
 				$bgcolor = $class = '';
 				$status_list = array( "archived" => "#fee", "spam" => "#faa", "deleted" => "#f55" );
-				foreach ($blog_list as $blog) {
+				foreach ( $blog_list as $blog ) {
 					$class = ('alternate' == $class) ? '' : 'alternate';
 					reset( $status_list );
 
@@ -458,7 +458,7 @@ switch( $_GET['action'] ) {
 					echo "<tr $bgcolour class='$class'>";
 
 					$blogname = ( is_subdomain_install() ) ? str_replace('.'.$current_site->domain, '', $blog['domain']) : $blog['path'];
-					foreach( $posts_columns as $column_name=>$column_display_name ) {
+					foreach ( $posts_columns as $column_name=>$column_display_name ) {
 						switch($column_name) {
 							case 'id': ?>
 								<th scope="row" class="check-column">
diff --git a/wp-admin/ms-users.php b/wp-admin/ms-users.php
index f6388908e..46e8753b0 100644
--- a/wp-admin/ms-users.php
+++ b/wp-admin/ms-users.php
@@ -104,7 +104,7 @@ if ( $_GET['updated'] == 'true' ) {
 	<h2><?php _e( $current_site->site_name ); ?> <?php _e("Users"); ?></h2>
 	<form action="ms-users.php" method="get" class="search-form">
 		<p class="search-box">
-		<input type="text" name="s" value="<?php if (isset($_GET['s'])) esc_attr( stripslashes( $s ) ); ?>" class="search-input" id="user-search-input" />
+		<input type="text" name="s" value="<?php if ( isset($_GET['s']) ) esc_attr( stripslashes( $s ) ); ?>" class="search-input" id="user-search-input" />
 		<input type="submit" id="post-query-submit" value="<?php esc_attr_e('Search Users') ?>" class="button" />
 		</p>
 	</form>
diff --git a/wp-includes/ms-functions.php b/wp-includes/ms-functions.php
index 6b8d045c5..81d36c3c2 100644
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -444,7 +444,7 @@ function get_active_blog_for_user( $user_id ) { // get an active blog for user -
 		$blogs = get_blogs_of_user( $user_id, true ); // if a user's primary blog is shut down, check their other blogs.
 		$ret = false;
 		if ( is_array( $blogs ) && count( $blogs ) > 0 ) {
-			foreach( (array) $blogs as $blog_id => $blog ) {
+			foreach ( (array) $blogs as $blog_id => $blog ) {
 				if ( $blog->site_id != $wpdb->siteid )
 					continue;
 				$details = get_blog_details( $blog_id );
@@ -874,7 +874,7 @@ function is_email_address_unsafe( $user_email ) {
 
 	if ( is_array( $banned_names ) && empty( $banned_names ) == false ) {
 		$email_domain = strtolower( substr( $user_email, 1 + strpos( $user_email, '@' ) ) );
-		foreach( (array) $banned_names as $banned_domain ) {
+		foreach ( (array) $banned_names as $banned_domain ) {
 			if ( $banned_domain == '' )
 				continue;
 			if (
@@ -2127,7 +2127,7 @@ function rss_gc() {
 	// Garbage Collection
 	$rows = $wpdb->get_results( "SELECT meta_key FROM {$wpdb->sitemeta} WHERE meta_key LIKE 'rss\_%\_ts' AND meta_value < unix_timestamp( date_sub( NOW(), interval 7200 second ) )" );
 	if ( is_array( $rows ) ) {
-		foreach( $rows as $row ) {
+		foreach ( $rows as $row ) {
 			$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->sitemeta} WHERE meta_key = %s", $row->meta_key ) );
 			$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->sitemeta} WHERE meta_key = %s", str_replace( '_ts', '', $row->meta_key ) ) );
 		}
diff --git a/wp-includes/ms-settings.php b/wp-includes/ms-settings.php
index a6a9e301b..9c2512b2b 100644
--- a/wp-includes/ms-settings.php
+++ b/wp-includes/ms-settings.php
@@ -14,20 +14,20 @@ function is_subdomain_install() {
 	return false;
 }
 
-if( isset( $current_site ) && isset( $current_blog ) )
+if ( isset( $current_site ) && isset( $current_blog ) )
 	return;
 
 // deprecated
 $wpmuBaseTablePrefix = $table_prefix;
 
 $domain = addslashes( $_SERVER['HTTP_HOST'] );
-if( substr( $domain, 0, 4 ) == 'www.' )
+if ( substr( $domain, 0, 4 ) == 'www.' )
 	$domain = substr( $domain, 4 );
-if( strpos( $domain, ':' ) ) {
-	if( substr( $domain, -3 ) == ':80' ) {
+if ( strpos( $domain, ':' ) ) {
+	if ( substr( $domain, -3 ) == ':80' ) {
 		$domain = substr( $domain, 0, -3 );
 		$_SERVER['HTTP_HOST'] = substr( $_SERVER['HTTP_HOST'], 0, -3 );
-	} elseif( substr( $domain, -4 ) == ':443' ) {
+	} elseif ( substr( $domain, -4 ) == ':443' ) {
 		$domain = substr( $domain, 0, -4 );
 		$_SERVER['HTTP_HOST'] = substr( $_SERVER['HTTP_HOST'], 0, -4 );
 	} else {
@@ -35,7 +35,7 @@ if( strpos( $domain, ':' ) ) {
 	}
 }
 $domain = preg_replace('/:.*$/', '', $domain); // Strip ports
-if( substr( $domain, -1 ) == '.' )
+if ( substr( $domain, -1 ) == '.' )
 	$domain = substr( $domain, 0, -1 );
 
 $path = preg_replace( '|([a-z0-9-]+.php.*)|', '', $_SERVER['REQUEST_URI'] );
@@ -47,7 +47,7 @@ function get_current_site_name( $current_site ) {
 	$current_site->site_name = wp_cache_get( $current_site->id . ':current_site_name', "site-options" );
 	if ( !$current_site->site_name ) {
 		$current_site->site_name = $wpdb->get_var( $wpdb->prepare( "SELECT meta_value FROM $wpdb->sitemeta WHERE site_id = %d AND meta_key = 'site_name'", $current_site->id ) );
-		if( $current_site->site_name == null )
+		if ( $current_site->site_name == null )
 			$current_site->site_name = ucfirst( $current_site->domain );
 		wp_cache_set( $current_site->id . ':current_site_name', $current_site->site_name, 'site-options');
 	}
@@ -56,22 +56,22 @@ function get_current_site_name( $current_site ) {
 
 function wpmu_current_site() {
 	global $wpdb, $current_site, $domain, $path, $sites;
-	if( defined( 'DOMAIN_CURRENT_SITE' ) && defined( 'PATH_CURRENT_SITE' ) ) {
+	if ( defined( 'DOMAIN_CURRENT_SITE' ) && defined( 'PATH_CURRENT_SITE' ) ) {
 		$current_site->id = (defined( 'SITE_ID_CURRENT_SITE' ) ? constant('SITE_ID_CURRENT_SITE') : 1);
 		$current_site->domain = DOMAIN_CURRENT_SITE;
 		$current_site->path   = $path = PATH_CURRENT_SITE;
-		if( defined( 'BLOGID_CURRENT_SITE' ) )
+		if ( defined( 'BLOGID_CURRENT_SITE' ) )
 			$current_site->blog_id = BLOGID_CURRENT_SITE;
 		return $current_site;
 	}
 
 	$current_site = wp_cache_get( "current_site", "site-options" );
-	if( $current_site )
+	if ( $current_site )
 		return $current_site;
 
 	$wpdb->suppress_errors();
 	$sites = $wpdb->get_results( "SELECT * FROM $wpdb->site" ); // usually only one site
-	if( count( $sites ) == 1 ) {
+	if ( count( $sites ) == 1 ) {
 		$current_site = $sites[0];
 		$path = $current_site->path;
 		$current_site->blog_id = $wpdb->get_var( "SELECT blog_id FROM {$wpdb->blogs} WHERE domain='{$current_site->domain}' AND path='{$current_site->path}'" );
@@ -80,23 +80,23 @@ function wpmu_current_site() {
 		return $current_site;
 	}
 	$path = substr( $_SERVER[ 'REQUEST_URI' ], 0, 1 + strpos( $_SERVER[ 'REQUEST_URI' ], '/', 1 ) );
-	if( is_subdomain_install() ) {
+	if ( is_subdomain_install() ) {
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path = %s", $domain, $path) );
-		if( $current_site != null )
+		if ( $current_site != null )
 			return $current_site;
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path='/'", $domain) );
-		if( $current_site != null ) {
+		if ( $current_site != null ) {
 			$path = '/';
 			return $current_site;
 		}
 
 		$sitedomain = substr( $domain, 1 + strpos( $domain, '.' ) );
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path = %s", $sitedomain, $path) );
-		if( $current_site != null )
+		if ( $current_site != null )
 			return $current_site;
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path='/'", $sitedomain) );
-		if( $current_site == null && defined( "WP_INSTALLING" ) == false ) {
-			if( count( $sites ) == 1 ) {
+		if ( $current_site == null && defined( "WP_INSTALLING" ) == false ) {
+			if ( count( $sites ) == 1 ) {
 				$current_site = $sites[0];
 				die( "That blog does not exist. Please try <a href='http://{$current_site->domain}{$current_site->path}'>http://{$current_site->domain}{$current_site->path}</a>" );
 			} else {
@@ -107,11 +107,11 @@ function wpmu_current_site() {
 		}
 	} else {
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path = %s", $domain, $path) );
-		if( $current_site != null )
+		if ( $current_site != null )
 			return $current_site;
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path='/'", $domain) );
-		if( $current_site == null && defined( "WP_INSTALLING" ) == false ) {
-			if( count( $sites ) == 1 ) {
+		if ( $current_site == null && defined( "WP_INSTALLING" ) == false ) {
+			if ( count( $sites ) == 1 ) {
 				$current_site = $sites[0];
 				die( "That blog does not exist. Please try <a href='http://{$current_site->domain}{$current_site->path}'>http://{$current_site->domain}{$current_site->path}</a>" );
 			} else {
@@ -125,41 +125,39 @@ function wpmu_current_site() {
 }
 
 $current_site = wpmu_current_site();
-if( !isset( $current_site->blog_id ) )
+if ( !isset( $current_site->blog_id ) )
 	$current_site->blog_id = $wpdb->get_var( "SELECT blog_id FROM {$wpdb->blogs} WHERE domain='{$current_site->domain}' AND path='{$current_site->path}'" );
 
-if( is_subdomain_install() ) {
+if ( is_subdomain_install() ) {
 	$current_blog = wp_cache_get( 'current_blog_' . $domain, 'site-options' );
-	if( !$current_blog ) {
+	if ( !$current_blog ) {
 		$current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s", $domain) );
-		if( $current_blog )
+		if ( $current_blog )
 			wp_cache_set( 'current_blog_' . $domain, $current_blog, 'site-options' );
 	}
-	if( $current_blog != null && $current_blog->site_id != $current_site->id ) {
+	if ( $current_blog != null && $current_blog->site_id != $current_site->id )
 		$current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE id = %d", $current_blog->site_id) );
-	} else {
+	else
 		$blogname = substr( $domain, 0, strpos( $domain, '.' ) );
-	}
 } else {
 	$blogname = htmlspecialchars( substr( $_SERVER[ 'REQUEST_URI' ], strlen( $path ) ) );
-	if( strpos( $blogname, '/' ) )
+	if ( strpos( $blogname, '/' ) )
 		$blogname = substr( $blogname, 0, strpos( $blogname, '/' ) );
-	if( strpos( " ".$blogname, '?' ) )
+	if ( strpos( " ".$blogname, '?' ) )
 		$blogname = substr( $blogname, 0, strpos( $blogname, '?' ) );
 	$reserved_blognames = array( 'page', 'comments', 'blog', 'wp-admin', 'wp-includes', 'wp-content', 'files', 'feed' );
-	if ( $blogname != '' && !in_array( $blogname, $reserved_blognames ) && !is_file( $blogname ) ) {
+	if ( $blogname != '' && !in_array( $blogname, $reserved_blognames ) && !is_file( $blogname ) )
 		$path = $path . $blogname . '/';
-	}
 	$current_blog = wp_cache_get( 'current_blog_' . $domain . $path, 'site-options' );
-	if( !$current_blog ) {
+	if ( !$current_blog ) {
 		$current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s AND path = %s", $domain, $path) );
-		if( $current_blog )
+		if ( $current_blog )
 			wp_cache_set( 'current_blog_' . $domain . $path, $current_blog, 'site-options' );
 	}
 }
 
-if( defined( "WP_INSTALLING" ) == false && is_subdomain_install() && !is_object( $current_blog ) ) {
-	if( defined( 'NOBLOGREDIRECT' ) ) {
+if ( defined( "WP_INSTALLING" ) == false && is_subdomain_install() && !is_object( $current_blog ) ) {
+	if ( defined( 'NOBLOGREDIRECT' ) ) {
 		$destination = constant( 'NOBLOGREDIRECT' );
 		if ( $destination == '%siteurl%' )
 			$destination = "http://" . $current_site->domain . $current_site->path;
@@ -172,65 +170,64 @@ if( defined( "WP_INSTALLING" ) == false && is_subdomain_install() && !is_object(
 
 }
 
-if( defined( "WP_INSTALLING" ) == false ) {
-	if( $current_site && $current_blog == null ) {
-		if( $current_site->domain != $_SERVER[ 'HTTP_HOST' ] ) {
+if ( defined( "WP_INSTALLING" ) == false ) {
+	if ( $current_site && $current_blog == null ) {
+		if ( $current_site->domain != $_SERVER[ 'HTTP_HOST' ] ) {
 			header( "Location: http://" . $current_site->domain . $current_site->path );
 			exit;
 		}
 		$current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s AND path = %s", $current_site->domain, $current_site->path) );
 	}
-	if( $current_blog == false || $current_site == false )
+	if ( $current_blog == false || $current_site == false )
 		is_installed();
 }
 
 $blog_id = $current_blog->blog_id;
 $public  = $current_blog->public;
 
-if( $current_blog->site_id == 0 || $current_blog->site_id == '' )
+if ( $current_blog->site_id == 0 || $current_blog->site_id == '' )
 	$current_blog->site_id = 1;
 $site_id = $current_blog->site_id;
 
 $current_site = get_current_site_name( $current_site );
 
-if( $blog_id == false ) {
+if ( $blog_id == false ) {
     // no blog found, are we installing? Check if the table exists.
     if ( defined('WP_INSTALLING') ) {
-	$blog_id = $wpdb->get_var( "SELECT blog_id FROM $wpdb->blogs LIMIT 0,1" );
-	if( $blog_id == false ) {
-	    // table doesn't exist. This is the first blog
-	    $blog_id = 1;
-	} else {
-	    // table exists
-	    // don't create record at this stage. we're obviously installing so it doesn't matter what the table vars below are like.
-	    // default to using the "main" blog.
-	    $blog_id = 1;
-	}
-	$current_blog->blog_id = $blog_id;
+		$blog_id = $wpdb->get_var( "SELECT blog_id FROM $wpdb->blogs LIMIT 0,1" );
+		if ( $blog_id == false ) {
+		    // table doesn't exist. This is the first blog
+		    $blog_id = 1;
+		} else {
+		    // table exists
+		    // don't create record at this stage. we're obviously installing so it doesn't matter what the table vars below are like.
+		    // default to using the "main" blog.
+		    $blog_id = 1;
+		}
+		$current_blog->blog_id = $blog_id;
     } else {
-	$check = $wpdb->get_results( "SELECT * FROM $wpdb->site" );
-	if( $check == false ) {
-	    $msg = ': DB Tables Missing';
-	} else {
-	    $msg = '';
-	}
-	die( "No Blog by that name on this system." . $msg );
+		$check = $wpdb->get_results( "SELECT * FROM $wpdb->site" );
+		if ( $check == false )
+		    $msg = ': DB Tables Missing';
+		else
+		    $msg = '';
+		die( "No Blog by that name on this system." . $msg );
     }
 }
 
 $wpdb->suppress_errors( false );
 
-if( '0' == $current_blog->public ) {
+if ( '0' == $current_blog->public ) {
 	// This just means the blog shouldn't show up in google, etc. Only to registered members
 }
 
 function is_installed() {
 	global $wpdb, $domain, $path;
 	$base = stripslashes( $base );
-	if( defined( "WP_INSTALLING" ) == false ) {
+	if ( defined( "WP_INSTALLING" ) == false ) {
 		$check = $wpdb->get_results( "SELECT * FROM $wpdb->site" );
 		$msg = "If your blog does not display, please contact the owner of this site.<br /><br />If you are the owner of this site please check that MySQL is running properly and all tables are error free.<br /><br />";
-		if( $check == false ) {
+		if ( $check == false ) {
 			$msg .= "<strong>Database Tables Missing.</strong><br />Database tables are missing. This means that MySQL is either not running, WPMU was not installed properly, or someone deleted {$wpdb->site}. You really <em>should</em> look at your database now.<br />";
 		} else {
 			$msg .= '<strong>Could Not Find Blog!</strong><br />';
@@ -247,7 +244,7 @@ function is_installed() {
 			<li> $wpdb->sitecategories </li>
 			</ul>";
 		$msg .= "If you suspect a problem please report it to the support forums but you must include the information asked for in the <a href='http://codex.wordpress.org/Debugging_WPMU'>WPMU bug reporting guidelines</a>!<br /><br />";
-		if( is_file( 'release-info.txt' ) ) {
+		if ( is_file( 'release-info.txt' ) ) {
 			$msg .= 'Your bug report must include the following text: "';
 			$info = file( 'release-info.txt' );
 			$msg .= $info[ 4 ] . '"';