diff --git a/ca/manage_certs.php b/ca/manage_certs.php
index 0fb3871..9e3bcd0 100644
--- a/ca/manage_certs.php
+++ b/ca/manage_certs.php
@@ -345,10 +345,10 @@ default:
 
 	print '<tr>';
 	$headings = array(
-		status=>"Status", issued=>"Issued", expires=>"Expires",
-		common_name=>"User's Name", email=>"E-mail", 
-		organization=>"Organization", unit=>"Department", 
-		locality=>"Locality"
+	    'status'=>"Status", 'issued'=>"Issued", 'expires'=>"Expires",
+		'common_name'=>"User's Name", 'email'=>"E-mail", 
+		'organization'=>"Organization", 'unit'=>"Department", 
+		'locality'=>"Locality"
 	);
 
 	foreach($headings as $field=>$head) {
@@ -375,7 +375,7 @@ default:
 
 	$db = csort(CAdb_to_array($x), $sortfield, ($ascdec=='A'?SORT_ASC:SORT_DESC));
 
-	$stcolor = array(Valid=>'green',Revoked=>'red',Expired=>'orange');
+	$stcolor = array('Valid'=>'green','Revoked'=>'red','Expired'=>'orange');
 
 	foreach($db as $rec) {
 		print	'<tr style="font-size: 11px;">
diff --git a/include/openssl_functions.php b/include/openssl_functions.php
index 7bd9a6c..a71dbe8 100644
--- a/include/openssl_functions.php
+++ b/include/openssl_functions.php
@@ -305,9 +305,9 @@ function CAdb_in($email="", $name="") {
 	$email = escshellcmd($email);
 	$name = escshellcmd($name);
 	$regexp = "^[V].*CN=$name/(Email|emailAddress)=$email";
-        $x =exec('egrep '.escshellarg($regexp).' '.$config[index]);
+        $x =exec('egrep '.escshellarg($regexp).' '.$config['index']);
 
-        if ($x) {
+    if ($x) {
 		list($j,$j,$j,$serial,$j,$j) = explode("\t", $x);
 		return "$serial";
 	}
diff --git a/search.php b/search.php
index 2d63bda..6cf0d62 100644
--- a/search.php
+++ b/search.php
@@ -21,7 +21,7 @@ if ($stage == "search" && ! $search) $stage = "";
 if ( !($show_valid.$show_revoked.$show_expired) ) $show_valid = 'V';
 
 switch ($stage) {
-case display:
+case 'display':
 	printHeader('about');
 
 	print '
@@ -44,7 +44,7 @@ case 'download_pem':
     upload("$config[new_certs_dir]/$serial.pem", "$rec[common_name].pem", 'application/pkix-cert');
        break;
 
-case search:
+case 'search':
 	printHeader('public');
 
 	$db = CAdb_to_array("^[${show_valid}${show_revoked}${show_expired}].*$search");
@@ -54,7 +54,7 @@ case search:
 		?>
 		<center>
 		<h2>Nothing Found</h2>
-		<form action="<?php echo $PHP_SELF?>" method="post" name="form">
+		<form action="<?php echo htmlentities($_SERVER['SCRIPT_NAME'])?>" method="post" name="form">
 		<input type=hidden name=search value="<?php echo htvar($search)?>">
 		<input type=hidden name=show_valid value="<?php echo htvar($show_valid)?>">
 		<input type=hidden name=show_revoked value="<?php echo htvar($show_revoked)?>">
@@ -91,18 +91,18 @@ case search:
 		<td style="color: <?php echo $stcolor[$rec['status']]?>; font-weight: bold"><?php echo htvar($rec['status'])?></td>
 		<td style="white-space: nowrap"><?php echo htvar($rec['issued'])?></td>
 		<td style="white-space: nowrap"><?php echo htvar($rec['expires'])?></td>
-		<td><?php echo htvar($rec[common_name])?></td>
+		<td><?php echo htvar($rec['common_name'])?></td>
 		<td style="white-space: nowrap"><a href="mailto: <?php echo htvar($rec['common_name']).'<'.htvar($rec['email']).'>' ?> "> <?php echo htvar($rec['email'])?></a></td>
 		<td><?php echo htvar($rec['organization'])?></td>
 		<td><?php echo htvar($rec['unit'])?></td>
 		<td><?php echo htvar($rec['locality'])?></td>
 		<td><?php echo htvar($rec['province'])?></td>
-		<td><a href="<?php echo $PHP_SELF?> ?stage=display&serial=<?php echo htvar($rec['serial'])?>" target=_certdisp><img src=images/display.png alt="Display" title="Display the certificate in excruciating detail"></a>
+		<td><a href="<?php echo htmlentities($_SERVER['SCRIPT_NAME'])?> ?stage=display&serial=<?php echo htvar($rec['serial'])?>" target=_certdisp><img src=images/display.png alt="Display" title="Display the certificate in excruciating detail"></a>
 		<?php
 		if ($rec['status'] != 'Revoked') {
 			?>
-			<a href="<?php echo $PHP_SELF?>?stage=download&serial=<?php echo htvar($rec['serial'])?>"><img src=images/download.png alt="Download" title="Download the certificate so that you may send encrypted e-mail"></a>
-			<a href="<?php echo $PHP_SELF?>?stage=download_pem&serial=<?=htvar($rec['serial'])?>"><img src=images/download.png alt="Download (in PEM format)" title="Download in PEM format"></a>
+			<a href="<?php echo htmlentities($_SERVER['SCRIPT_NAME'])?>?stage=download&serial=<?php echo htvar($rec['serial'])?>"><img src=images/download.png alt="Download" title="Download the certificate so that you may send encrypted e-mail"></a>
+			<a href="<?php echo htmlentities($_SERVER['SCRIPT_NAME'])?>?stage=download_pem&serial=<?=htvar($rec['serial'])?>"><img src=images/download.png alt="Download (in PEM format)" title="Download in PEM format"></a>
 			<?php
 		}
 		print '</td></tr>';
@@ -111,7 +111,7 @@ case search:
 	?>
 	</table>
 
-	<form action="<?php echo $PHP_SELF?>" method="post" name="form">
+	<form action="<?php echo htmlentities($_SERVER['SCRIPT_NAME'])?>" method="post" name="form">
 	<input type=submit name=submit value="Another Search">
 	<input type=hidden name=search value="<?php echo htvar($search)?>">
 	<input type=hidden name=show_valid value="<?php echo htvar($show_valid)?>">