diff --git a/application/Espo/Jobs/Cleanup.php b/application/Espo/Jobs/Cleanup.php
index 64c94d173f..1e29a3450d 100644
--- a/application/Espo/Jobs/Cleanup.php
+++ b/application/Espo/Jobs/Cleanup.php
@@ -71,7 +71,7 @@ class Cleanup implements Job
 
     protected $entityManager;
 
-    protected $metedata;
+    protected $metadata;
 
     protected $fileManager;
 
diff --git a/client/src/views/fields/attachment-multiple.js b/client/src/views/fields/attachment-multiple.js
index 6cd01b4403..40dc3b543a 100644
--- a/client/src/views/fields/attachment-multiple.js
+++ b/client/src/views/fields/attachment-multiple.js
@@ -293,6 +293,8 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
         },
 
         getDownloadUrl: function (id) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var url = this.getBasePath() + '?entryPoint=download&id=' + id;
 
             if (this.getUser().get('portalId')) {
@@ -354,6 +356,7 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
 
         getEditPreview: function (name, type, id) {
             name = Handlebars.Utils.escapeExpression(name);
+            id = Handlebars.Utils.escapeExpression(id);
 
             var preview = name;
 
@@ -365,6 +368,8 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
         },
 
         addAttachmentBox: function (name, type, id, link) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var $attachments = this.$attachments;
 
             var removeLink = '<a href="javascript:" class="remove-attachment pull-right">'+
@@ -609,6 +614,7 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
 
         getDetailPreview: function (name, type, id) {
             name = Handlebars.Utils.escapeExpression(name);
+            id = Handlebars.Utils.escapeExpression(id);
 
             var preview = name;
 
@@ -648,6 +654,7 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
 
                         continue;
                     }
+
                     var line = '<div class="attachment-block">' +
                         '<span class="fas fa-paperclip text-soft small"></span> ' +
                         '<a href="' + this.getDownloadUrl(id) + '" target="_BLANK">' +
diff --git a/client/src/views/fields/file.js b/client/src/views/fields/file.js
index a0b614a883..f418588048 100644
--- a/client/src/views/fields/file.js
+++ b/client/src/views/fields/file.js
@@ -308,6 +308,8 @@ define('views/fields/file', 'views/fields/link', function (Dep) {
                 }
             }
 
+            id = Handlebars.Utils.escapeExpression(id);
+
             var src = this.getBasePath() + '?entryPoint=image&size=' + previewSize + '&id=' + id;
 
             var img = '<img src="' + src + '" class="image-preview">';
@@ -328,6 +330,8 @@ define('views/fields/file', 'views/fields/link', function (Dep) {
 
         getEditPreview: function (name, type, id) {
             name = Handlebars.Utils.escapeExpression(name);
+            id = Handlebars.Utils.escapeExpression(id);
+
             var preview = name;
 
             if (~this.previewTypeList.indexOf(type)) {
@@ -369,6 +373,8 @@ define('views/fields/file', 'views/fields/link', function (Dep) {
         },
 
         getImageUrl: function (id, size) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var url = this.getBasePath() + '?entryPoint=image&id=' + id;
 
             if (size) {
diff --git a/client/src/views/fields/link-multiple-with-primary.js b/client/src/views/fields/link-multiple-with-primary.js
index e5c5f7045e..ec12341053 100644
--- a/client/src/views/fields/link-multiple-with-primary.js
+++ b/client/src/views/fields/link-multiple-with-primary.js
@@ -125,6 +125,9 @@ Espo.define('views/fields/link-multiple-with-primary', 'views/fields/link-multip
         addLinkHtml: function (id, name) {
             name = name || id;
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             if (this.mode == 'search') {
                 return Dep.prototype.addLinkHtml.call(this, id, name);
             }
@@ -132,7 +135,7 @@ Espo.define('views/fields/link-multiple-with-primary', 'views/fields/link-multip
             var $container = this.$el.find('.link-container');
             var $el = $('<div class="form-inline list-group-item link-with-role clearfix link-group-item-with-primary">').addClass('link-' + id).attr('data-id', id);
 
-            var nameHtml = '<div>' + this.getHelper().escapeString(name) || id + '&nbsp;' + '</div>';
+            var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
             var removeHtml = '<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>';
 
             $left = $('<div>');
diff --git a/client/src/views/fields/link-multiple-with-role.js b/client/src/views/fields/link-multiple-with-role.js
index 09d287888e..0e2b88ce5d 100644
--- a/client/src/views/fields/link-multiple-with-role.js
+++ b/client/src/views/fields/link-multiple-with-role.js
@@ -79,6 +79,9 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
                 name = this.translate(this.foreignScope, 'scopeNames');
             }
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var role = (this.columns[id] || {})[this.columnName] || '';
             var roleHtml = '';
 
@@ -107,7 +110,7 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
             if (this.mode == 'detail') {
                 iconHtml = this.getIconHtml(id);
             }
-            var lineHtml = '<div>' + iconHtml + '<a href="#' + this.foreignScope + '/view/' + id + '">' + this.getHelper().escapeString(name) + '</a> ' + roleHtml + '</div>';
+            var lineHtml = '<div>' + iconHtml + '<a href="#' + this.foreignScope + '/view/' + id + '">' + name + '</a> ' + roleHtml + '</div>';
             return lineHtml;
         },
 
@@ -161,6 +164,8 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
         },
 
         getJQSelect: function (id, roleValue) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var $role = $('<select class="role form-control input-sm pull-right" data-id="'+id+'">');
             this.roleList.forEach(function (role) {
                 var selectedHtml = (role == roleValue) ? 'selected': '';
@@ -178,10 +183,13 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
                 return Dep.prototype.addLinkHtml.call(this, id, name);
             }
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var $container = this.$el.find('.link-container');
             var $el = $('<div class="form-inline list-group-item link-with-role link-group-item-with-columns clearfix">').addClass('link-' + id);
 
-            var nameHtml = '<div>' + this.getHelper().escapeString(name) + '&nbsp;' + '</div>';
+            var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
 
             var removeHtml = '<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>';
 
diff --git a/client/src/views/fields/link-multiple.js b/client/src/views/fields/link-multiple.js
index bd003cbb02..87da043978 100644
--- a/client/src/views/fields/link-multiple.js
+++ b/client/src/views/fields/link-multiple.js
@@ -365,11 +365,14 @@ define('views/fields/link-multiple', 'views/fields/base', function (Dep) {
         addLinkHtml: function (id, name) {
             name = name || id;
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var $container = this.$el.find('.link-container');
 
             var $el = $('<div />').addClass('link-' + id).addClass('list-group-item').attr('data-id', id);
 
-            $el.html(this.getHelper().escapeString(name || id) + '&nbsp');
+            $el.html(name + '&nbsp');
 
             $el.prepend('<a href="javascript:" class="pull-right" data-id="' + id +
                 '" data-action="clearLink"><span class="fas fa-times"></a>');
@@ -386,6 +389,9 @@ define('views/fields/link-multiple', 'views/fields/base', function (Dep) {
         getDetailLinkHtml: function (id) {
             var name = this.nameHash[id] || id;
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             if (!name && id) {
                 name = this.translate(this.foreignScope, 'scopeNames');
             }
@@ -396,7 +402,8 @@ define('views/fields/link-multiple', 'views/fields/base', function (Dep) {
             }
 
             return '<a href="#' + this.foreignScope + '/view/' + id + '">' +
-                iconHtml + this.getHelper().escapeString(name) + '</a>';
+                iconHtml + name + '</a>';
+
         },
 
         getValueForDisplay: function () {
diff --git a/client/src/views/fields/link.js b/client/src/views/fields/link.js
index 750cd34d83..2ede1d8959 100644
--- a/client/src/views/fields/link.js
+++ b/client/src/views/fields/link.js
@@ -453,10 +453,17 @@ define('views/fields/link', 'views/fields/base', function (Dep) {
         },
 
         addLinkOneOfHtml: function (id, name) {
+            id = Handlebars.Utils.escapeExpression(id);
+            name = this.getHelper().escapeString(name);
+
             var $container = this.$el.find('.link-one-of-container');
+
             var $el = $('<div />').addClass('link-' + id).addClass('list-group-item');
-            $el.html(this.getHelper().escapeString(name) + '&nbsp');
+
+            $el.html(name + '&nbsp');
+
             $el.prepend('<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLinkOneOf"><span class="fas fa-times"></a>');
+
             $container.append($el);
 
             return $el;
diff --git a/client/src/views/fields/user.js b/client/src/views/fields/user.js
index f4117de19f..66dcd9a3c6 100644
--- a/client/src/views/fields/user.js
+++ b/client/src/views/fields/user.js
@@ -167,6 +167,9 @@ Espo.define('views/fields/user', 'views/fields/link', function (Dep) {
         },
 
         addLinkTeamsHtml: function (id, name) {
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var $container = this.$el.find('.link-teams-container');
             var $el = $('<div />').addClass('link-' + id).addClass('list-group-item');
             $el.html(name + '&nbsp');