diff --git a/web/ajax/log.php b/web/ajax/log.php
index 66dcfc2b5..417bc8dbe 100644
--- a/web/ajax/log.php
+++ b/web/ajax/log.php
@@ -1,5 +1,9 @@
 <?php
 
+# Moved up here because it is used in several spots.
+# These are the valid columns that you can filter on.
+$filterFields = array( 'Component', 'ServerId', 'Pid', 'Level', 'File', 'Line' );
+
 switch ( $_REQUEST['task'] )
 {
     case 'create' :
@@ -31,68 +35,85 @@ switch ( $_REQUEST['task'] )
         if ( !canView( 'System' ) )
             ajaxError( 'Insufficient permissions to view log entries' );
 
-		$servers = Server::find_all();
-		$servers_by_Id = array();
-		# There is probably a better way to do this.
-		foreach ( $servers as $server ) {
-			$servers_by_Id[$server->Id()] = $server;
-		}
+				$servers = Server::find_all();
+				$servers_by_Id = array();
+# There is probably a better way to do this.
+				foreach ( $servers as $server ) {
+					$servers_by_Id[$server->Id()] = $server;
+				}
 
         $minTime = isset($_POST['minTime'])?$_POST['minTime']:NULL;
         $maxTime = isset($_POST['maxTime'])?$_POST['maxTime']:NULL;
-        $limit = isset($_POST['limit'])?$_POST['limit']:100;
-        $filter = isset($_POST['filter'])?$_POST['filter']:array();
-        $sortField = isset($_POST['sortField'])?$_POST['sortField']:'TimeKey';
+        $limit = 100;
+				if ( isset($_POST['limit']) ) {
+					if ( ! is_integer( $_POST['limit'] ) ) {
+						Error("Invalid value for limit " . ?$_POST['limit'] );
+					} else {
+						$limit = $_POST['limit'];
+					}
+				}
+        $sortField = 'TimeKey';
+				if ( isset($_POST['sortField']) ) {
+					if ( ! in_array( $_POST['sortField'], $filterFields ) and ( $_POST['sortField'] != 'TimeKey' ) ) {
+						Error("Invalid sort field " . $_POST['sortField'] );
+					} else {
+						$sortField = $_POST['sortField']
+					}
+				}
         $sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc';
+        $filter = isset($_POST['filter'])?$_POST['filter']:array();
 
-        $filterFields = array( 'Component', 'ServerId', 'Pid', 'Level', 'File', 'Line' );
-
-        $total = dbFetchOne( "SELECT count(*) AS Total FROM Logs", 'Total' );
+        $total = dbFetchOne( 'SELECT count(*) AS Total FROM Logs', 'Total' );
         $sql = 'SELECT * FROM Logs';
         $where = array();
-		$values = array();
+				$values = array();
         if ( $minTime ) {
-            $where[] = "TimeKey > ?";
-			$values[] = $minTime;
-        } elseif ( $maxTime ) {
-            $where[] = "TimeKey < ?";
-			$values[] = $maxTime;
-		}
+					$where[] = "TimeKey > ?";
+					$values[] = $minTime;
+				} elseif ( $maxTime ) {
+					$where[] = "TimeKey < ?";
+					$values[] = $maxTime;
+				}
+
         foreach ( $filter as $field=>$value ) {
-            if ( $field == 'Level' ){
-                $where[] = $field." <= ?";
-				$values[] = $value;
-            } else {
-                $where[] = $field." = ?";
-				$values[] = $value;
-			}
-		}
-        if ( count($where) )
+					if ( ! in_array( $field, $fileFields ) ) {
+						Error("$field is not in valid filter fields");
+						continue;
+					}
+					if ( $field == 'Level' ){
+						$where[] = $field." <= ?";
+						$values[] = $value;
+					} else {
+						$where[] = $field." = ?";
+						$values[] = $value;
+					}
+				}
+				if ( count($where) )
             $sql.= ' WHERE '.join( ' AND ', $where );
         $sql .= " order by ".$sortField." ".$sortOrder." limit ".$limit;
         $logs = array();
         foreach ( dbFetchAll( $sql, NULL, $values ) as $log ) {
             $log['DateTime'] = preg_replace( '/^\d+/', strftime( "%Y-%m-%d %H:%M:%S", intval($log['TimeKey']) ), $log['TimeKey'] );
-			$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
+						$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
             $logs[] = $log;
         }
         $options = array();
         $where = array();
-		$values = array();
+				$values = array();
         foreach( $filter as $field=>$value ) {
             if ( $field == 'Level' ) {
                 $where[$field] = $field." <= ?";
-				$values[$field] = $value;
+								$values[$field] = $value;
             } else {
                 $where[$field] = $field." = ?";
-				$values[$field] = $value;
-			} 
-		}
+								$values[$field] = $value;
+						} 
+				}
         foreach( $filterFields as $field )
         {
             $sql = "SELECT DISTINCT $field FROM Logs WHERE NOT isnull($field)";
             $fieldWhere = array_diff_key( $where, array( $field=>true ) );
-			$fieldValues = array_diff_key( $values, array( $field=>true ) );
+						$fieldValues = array_diff_key( $values, array( $field=>true ) );
             if ( count($fieldWhere) )
                 $sql.= " AND ".join( ' AND ', $fieldWhere );
             $sql.= " ORDER BY $field ASC";
@@ -147,8 +168,15 @@ switch ( $_REQUEST['task'] )
         }
         //$limit = isset($_POST['limit'])?$_POST['limit']:1000;
         $filter = isset($_POST['filter'])?$_POST['filter']:array();
-        $sortField = isset($_POST['sortField'])?$_POST['sortField']:'TimeKey';
-        $sortOrder = isset($_POST['sortOrder'])?$_POST['sortOrder']:'asc';
+        $sortField = 'TimeKey';
+				if ( isset($_POST['sortField']) ) {
+          if ( ! in_array( $_POST['sortField'], $filterFields ) and ( $_POST['sortField'] != 'TimeKey' ) ) {
+            Error("Invalid sort field " . $_POST['sortField'] );
+          } else {
+            $sortField = $_POST['sortField']
+          }
+        }
+        $sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc';
 
 		$servers = Server::find_all();
 		$servers_by_Id = array();
@@ -216,7 +244,7 @@ switch ( $_REQUEST['task'] )
         foreach ( dbFetchAll( $sql, NULL, $values ) as $log )
         {
             $log['DateTime'] = preg_replace( '/^\d+/', strftime( "%Y-%m-%d %H:%M:%S", intval($log['TimeKey']) ), $log['TimeKey'] );
-			$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
+						$log['Server'] = ( $log['ServerId'] and isset($servers_by_Id[$log['ServerId']]) ) ? $servers_by_Id[$log['ServerId']]->Name() : '';
             $logs[] = $log;
         }
         switch( $format )
diff --git a/web/includes/Frame.php b/web/includes/Frame.php
index 676465d56..502691bb8 100644
--- a/web/includes/Frame.php
+++ b/web/includes/Frame.php
@@ -6,7 +6,7 @@ class Frame {
   public function __construct( $IdOrRow ) {
     $row = NULL;
     if ( $IdOrRow ) {
-      if ( is_integer( $IdOrRow ) or is_numeric( $IdOrRow ) ) {
+      if ( is_integer( $IdOrRow ) ) {
         $row = dbFetchOne( 'SELECT * FROM Frames WHERE Id=?', NULL, array( $IdOrRow ) );
         if ( ! $row ) {
           Error("Unable to load Frame record for Id=" . $IdOrRow );
@@ -84,7 +84,15 @@ class Frame {
 			$values = array_values( $parameters );
 		}
 		if ( $limit ) {
-			$sql .= ' LIMIT ' . $limit;
+			if ( is_integer( $limit ) ) {
+				$sql .= ' LIMIT ' . $limit;
+			} else {
+        $backTrace = debug_backtrace();
+        $file = $backTrace[1]['file'];
+        $line = $backTrace[1]['line'];
+				Error("Invalid value for limit($limit) passed to Frame::find from $file:$line");
+				return;
+			}
 		}
 		$results = dbFetchAll( $sql, NULL, $values );
 		if ( $results ) {
diff --git a/web/includes/Server.php b/web/includes/Server.php
index 8d9b22842..0b316061d 100644
--- a/web/includes/Server.php
+++ b/web/includes/Server.php
@@ -63,9 +63,15 @@ class Server {
         ) );
       $values = array_values( $parameters );
     }
-    if ( $limit ) {
-      $sql .= ' LIMIT ' . $limit;
-    }
+		if ( is_integer( $limit ) ) {
+			$sql .= ' LIMIT ' . $limit;
+		} else {
+			$backTrace = debug_backtrace();
+			$file = $backTrace[1]['file'];
+			$line = $backTrace[1]['line'];
+			Error("Invalid value for limit($limit) passed to Server::find from $file:$line");
+			return;
+		}
     $results = dbFetchAll( $sql, NULL, $values );
     if ( $results ) {
       return array_map( function($id){ return new Server($id); }, $results );