diff -Naur fgallery-2.4.1/fgallery/css/fim_style.css fgallery-2.4.1-1/fgallery/css/fim_style.css
--- fgallery-2.4.1/fgallery/css/fim_style.css	2006-10-18 12:14:17.000000000 +0500
+++ fgallery-2.4.1-1/fgallery/css/fim_style.css	2007-01-28 00:00:00.000000000 +0500
@@ -4,7 +4,6 @@
 	margin: 0px;
 	clear: both;
 	width: 99%;
-	min-width: none;
 }
 h3.fim-nav {
 	padding:0px;
diff -Naur fgallery-2.4.1/fgallery/fim_photos.php fgallery-2.4.1-1/fgallery/fim_photos.php
--- fgallery-2.4.1/fgallery/fim_photos.php	2006-09-01 13:14:46.000000000 +0500
+++ fgallery-2.4.1-1/fgallery/fim_photos.php	2008-09-19 13:10:00.000000000 +0500
@@ -3,6 +3,11 @@
 <?php include("../../../wp-blog-header.php"); ?>
 <?php require_once("functions/fim_functions.php"); ?>
 
+<?php
+header("HTTP/1.1 200 OK");
+header("Status:200 OK");
+?> 
+
 <?php get_header(); ?>
 
 <div id="content" class="narrowcolumn">
diff -Naur fgallery-2.4.1/fgallery/fim_rss.php fgallery-2.4.1-1/fgallery/fim_rss.php
--- fgallery-2.4.1/fgallery/fim_rss.php	2006-09-30 01:31:02.000000000 +0500
+++ fgallery-2.4.1-1/fgallery/fim_rss.php	2008-09-20 08:56:00.000000000 +0500
@@ -5,16 +5,19 @@
 global $wpdb, $table_prefix;
 $cats = $table_prefix."fim_cat";
 $imgs = $table_prefix."fim_images";
+$order_by = get_option('fim_image_order');
+$order_type = get_option('fim_image_order_type');
+$album = mysql_real_escape_string($_GET['album']);
 
-$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = $_GET[album]");
-$images = $wpdb->get_results("SELECT * FROM $imgs WHERE cat = $_GET[album] AND status = 'include'");
+$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = $album");
+$images = $wpdb->get_results("SELECT * FROM $imgs WHERE cat = $album AND status = 'include' ORDER BY `$table_image`.`$order_by` $order_type");
 
 $rss = new UniversalFeedCreator(); 
 $rss->useCached(); 
 $rss->title = get_bloginfo('name')." Image Gallery"; 
-$rss->description = __("Image Gallery feed from", 'fgallery') .get_bloginfo('name'); 
-$rss->link = get_bloginfo('wpurl')."/wp-content/plugins/fgallery/fim_rss.php?album=$_GET[album]"; 
-$rss->syndicationURL = get_bloginfo('wpurl')."/wp-content/plugins/fgallery/fim_rss.php?album=$_GET[album]"; 
+$rss->description = __("Image Gallery feed from ", 'fgallery') .get_bloginfo('name'); 
+$rss->link = get_bloginfo('wpurl')."/wp-content/plugins/fgallery/fim_rss.php?album=$album"; 
+$rss->syndicationURL = get_bloginfo('wpurl')."/wp-content/plugins/fgallery/fim_rss.php?album=$album"; 
 
 
 foreach ($images as $data) { 
@@ -23,9 +26,9 @@
 			$item->title = "$cat->catname - $data->image"; 
 		else
     	$item->title =  "$cat->catname - $data->title"; 
-    $item->link = $url = get_url("album/$_GET[album]/image/$data->id");
+    $item->link = $url = get_url("album/$album/image/$data->id");
     $item->description = "<img src='".get_bloginfo('wpurl')."/wp-content/fgallery/$cat->folder/thumb_$data->image' /><br>$data->description"; 
-    $item->date = $data->date; 
+    $item->date = strtotime($data->date); 
     $item->author = get_bloginfo("admin_email"); 
      
     $rss->addItem($item); 
diff -Naur fgallery-2.4.1/fgallery/functions/fim_functions.php fgallery-2.4.1-1/fgallery/functions/fim_functions.php
--- fgallery-2.4.1/fgallery/functions/fim_functions.php	2006-10-18 12:12:23.000000000 +0500
+++ fgallery-2.4.1-1/fgallery/functions/fim_functions.php	2008-09-19 15:17:00.000000000 +0500
@@ -57,7 +57,7 @@
     			<div class='fim-album'>
     				<div class='fim-tn-border-t' style='width:$th; height:$th;float:left'>
     					<div class='fim-thumbnail'>						
-							<a href='$url'><img src='$plugin_path/fim_thumb.php?album=$f&image=$img' alt='$title'/></a>
+							<a href='$url'><img src='".htmlspecialchars("$plugin_path/fim_thumb.php?album=$f&image=$img")."' alt='".htmlspecialchars($title).".'/></a>
     					</div>
     				</div>
     				<h4 class='fim-title' style='margin-left:$m'>
@@ -138,9 +138,9 @@
 				<div class='fim-tn-border-album' style='width:$tw; height:$th'>
 					<div class='fim-thumbnail'>";
 					if($lightbox == 'false'){
-						$fim .= "<a href='$url'><img src='$plugin_path/fim_thumb.php?album=$f&image=$img' alt='$title' /></a>";
+						$fim .= "<a href='$url'><img src='".htmlspecialchars("$plugin_path/fim_thumb.php?album=$f&image=$img")."' alt='".htmlspecialchars($title).".' /></a>";
 					}else{
-						$fim .= "<a href='".$folder.$img."' rel='lightbox[$albumname]' title='$title: $desc'><img src='$plugin_path/fim_thumb.php?album=$f&image=$img' alt='$title' \></a>";
+						$fim .= "<a href='".$folder.$img."' rel='lightbox[$albumname]' title='$title: $desc'><img src='$plugin_path/fim_thumb.php?album=$f&image=$img' alt='".htmlspecialchars($title).".' \></a>";
 					}
 				$fim .= "</div>";
 				if(get_option('fim_show_caption') == 'true'){
@@ -177,8 +177,11 @@
 			$query_string = $_SERVER['QUERY_STRING'];
 			$image = fim_query_one_image($_GET['image']);
 			$title = ($image->title!="") ? "$title" : "Image";
-			$back_link = get_url("album/$image->cat");
+			// $back_link = get_url("album/$image->cat");
 			$folder = get_bloginfo('wpurl')."/wp-content/fgallery/".fim_get_folder($image->cat);
+			$gdsize = getimagesize($folder.rawurlencode($image->image));
+			$gdwidth = ($gdsize[0] <= 600 ? $gdsize[0] : 600);
+			$gdheight = ($gdsize[0] <= 600 ? $gdsize[1] : $gdsize[1] * 600 / $gdsize[0]);
 
 			$fim .= "<div class='fim'>";
 			$fim .= fim_build_navigation(fim_get_cat_name_($image->cat), $image->image, $image->cat);
@@ -190,9 +193,12 @@
 				$fim .= "<p><a href='$url&action=ecard'>".__("Send this image as eCard", "fgallery").".</a></p>";
 			}
 			$fim .= "</div>";
+			if($gdsize[0] > 600) {
+				$fim .= "<div class='fim'><a href='".$folder.$image->image."'>(Click to enlarge)</a></div>";
+			}
 			$fim .= "<div class='fim-photo-block'>
 			<div class='fim-photo'>
-			<a href='$back_link'><img src='".$folder.$image->image."' alt='$title' /></a>
+			<a href='".$folder.$image->image."'><img width='".$gdwidth."' height='".$gdheight."' src='".$folder.$image->image."' alt='".htmlspecialchars($title).".' /></a>
 			</div> 
 			</div>";
 			$fim .= "<div class='fim_clear'></div>";
@@ -328,7 +334,7 @@
 {
 	
 	$md5sum = md5($email);
-	return "<img src='http://www.gravatar.com/avatar.php?gravatar_id=$md5sum&size=48' />";
+	return "<img src='http://www.gravatar.com/avatar.php?gravatar_id=$md5sum&amp;size=48' alt='Gravatar' />";
 }
 // Get comments for an image
 function fim_get_comments($image_id)
@@ -488,7 +494,7 @@
 	$order_by = get_option('fim_image_order');
 	$order_type = get_option('fim_image_order_type');
 	
-	return $wpdb->get_results("SELECT * FROM $table_image WHERE cat = '$catid' AND status <> 'exclude' ORDER BY '$order_by' $order_type");
+	return $wpdb->get_results("SELECT * FROM $table_image WHERE cat = '$catid' AND status <> 'exclude' ORDER BY `$table_image`.`$order_by` $order_type");
 }
 // Get all galleries
 function fim_query_cats($status = 'public')
@@ -524,11 +530,11 @@
 	$imagetitle = ($t->title == "")?$image:$t->title;
 	$string = "<h4 class='fim-nav'><a href='$baseurl'>".__('Current Albums', 'fgallery')."</a>";
 	if($album && $image)
-		$string .= " &raquo; <a href ='$albumurl'>$album</a>";
+		$string .= " &raquo; <a href='".htmlspecialchars($albumurl)."'>".htmlspecialchars($album)."</a>";
 	else
-		$string .= " &raquo; $album";
+		$string .= " &raquo; ".htmlspecialchars($album);
 	if($image)
-		$string .= " &raquo; $imagetitle";
+		$string .= " &raquo; ".htmlspecialchars($imagetitle);
 	
 	$string .= "</h4>";
 	return $string;
@@ -553,11 +559,11 @@
 		echo "<div class='fim-tn-border-sidebar'>";
 		echo "<div class='fim-thumbnail'>";
 		if(get_option('fim_use_lightbox') == 'true'){
-			echo "<a href='".$folder.$image->image."' rel='lightbox' title='$title: $desc'><img src='$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size' alt='$title' \></a>";
+			echo "<a href='".$folder.$image->image."' rel='lightbox' title='$title: $desc'><img src='".htmlspecialchars("$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size")."' alt='".htmlspecialchars($title).".' \></a>";
 			
 		}
 		else{
-			echo "<a href='$url'><img src='$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size' alt='$title' width='$size'/></a>";
+			echo "<a href='$url'><img src='$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size' alt='".htmlspecialchars($title).".' width='$size'/></a>";
 		}
 		echo "</div></div></div>";
 	}
@@ -585,11 +591,11 @@
 					<div class='fim-thumbnail'>";
 					if(get_option('fim_use_lightbox') == 'true'){
 						echo "<a href='".$folder.$image->image."' rel='lightbox' title='$title: $desc'>
-						<img src='$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size' alt='$title' width='$size'\></a>";
+						<img src='".htmlspecialchars("$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size")."' alt='".htmlspecialchars($title).".' width='$size'\></a>";
 
 					}
 					else{
-						echo "<a href='$url'><img src='$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size' alt='$title' width='$size'/></a>";
+						echo "<a href='$url'><img src='$plugin_path/fim_thumb.php?album=$f&image=$image->image&w=$size' alt='".htmlspecialchars($title).".' width='$size'/></a>";
 					}					
 					echo "</div>
 				</div>
@@ -724,7 +730,7 @@
 				<input type='submit' value='Send eCard' name='send_ecard'/>
 		</form>";
 	
-		$out .= "<h4>$image->title</h4><img src='".$url_folder.$image->image."' alt='$title' />";
+		$out .= "<h4>$image->title</h4><img src='".$url_folder.$image->image."' alt='".htmlspecialchars($title).".' />";
 	}
 	return $out;
 	
diff -Naur fgallery-2.4.1/fgallery/functions/fim_gallery.php fgallery-2.4.1-1/fgallery/functions/fim_gallery.php
--- fgallery-2.4.1/fgallery/functions/fim_gallery.php	2006-10-18 03:33:26.000000000 +0500
+++ fgallery-2.4.1-1/fgallery/functions/fim_gallery.php	2008-09-20 06:04:00.000000000 +0500
@@ -58,8 +58,8 @@
 {
 	global $wpdb, $table_prefix;
 	$table = $table_prefix."fim_cat";
-	$name = escape($_POST['edit_catname']);
-	$desc = escape($_POST['edit_catdesc']);
+	$name = strip_tags(escape($_POST['edit_catname']));
+	$desc = strip_tags(escape($_POST['edit_catdesc']));
 	$catid = $_POST['edit_catid'];
 	$pass = $_POST['pass'];
 	$status = $_POST['fim_cat_status'];
@@ -77,8 +77,8 @@
 // Edit the image
 if(isset($_POST['edit_image']))
 {
-	$title = escape($_POST['name']);
-	$description = escape($_POST['description']);
+	$title = strip_tags(escape($_POST['name']));
+	$description = strip_tags(escape($_POST['description']));
 	$edit_image_id = $_POST['edit_image_id'];
 	$status = $_POST['status'];
 	$gallery = $_POST['gallery'];
@@ -218,8 +218,8 @@
 			__('Directory', 'fgallery').' '.$dirname.' '.__('exists', 'fgallery').'!</strong></p></div>');	
 		}
 
-		$new = escape($new);
-		$description = escape($_POST['description']);
+		$new = strip_tags(escape($new));
+		$description = strip_tags(escape($_POST['description']));
 		$date = gmdate('Y-m-d H:i:s', time());
 		$status = $_POST['fim_cat_status'];
 		$pass = $_POST['pass'];
diff -Naur fgallery-2.4.1/fgallery/functions/fim_main.php fgallery-2.4.1-1/fgallery/functions/fim_main.php
--- fgallery-2.4.1/fgallery/functions/fim_main.php	2006-10-18 03:35:34.000000000 +0500
+++ fgallery-2.4.1-1/fgallery/functions/fim_main.php	2008-09-20 05:58:00.000000000 +0500
@@ -86,7 +86,7 @@
 			?>
 			<table cellpadding="3" cellspacing="3" style="border:solid 1px #ccc">
 				<tr>
-				<td rowspan="2" valign="top"><img src='<?php echo "$plugin_path/fim_thumb.php?album=$f&image=$file";?>' alt='$title'/></td>
+				<td rowspan="2" valign="top"><img src='<?php echo "$plugin_path/fim_thumb.php?album=$f&amp;image=$file";?>' alt='$title'/></td>
 					<td valign="top"><div align="right"><strong><?php _e('Title', 'fgallery')?>:</strong></div></td>
 					<td><input type="text" name="title_<?php echo $i;?>" /></td>
 				</tr>
@@ -207,7 +207,7 @@
 			<table cellpadding="3" cellspacing="3" style="border:solid 1px #ccc">
 				<tr>
 				<!--	<td rowspan="2" valign="top"><img src="<?php echo "$linkpath"."thumb_$filename";?>" /></td> -->
-					<td rowspan="2" valign="top"><img src='<?php echo "$plugin_path/fim_thumb.php?album=$f&image=$file' alt=''";?>/></td>
+					<td rowspan="2" valign="top"><img src='<?php echo "$plugin_path/fim_thumb.php?album=$f&amp;image=$file' alt=''";?>/></td>
 					
 					<td valign="top"><div align="right"><strong><?php _e('Title', 'fgallery')?>:</strong></div></td>
 					<td><input type="text" name="title_<?php echo $i;?>" /></td>
@@ -315,7 +315,7 @@
 					-->
 					
 						<td rowspan="2" valign="top">
-							<img src='<?php echo "$plugin_path/fim_thumb.php?album=$f&image=$file[name]";?>' alt='$title'/>
+							<img src='<?php echo "$plugin_path/fim_thumb.php?album=$f&amp;image=$file[name]";?>' alt='$title'/>
 						</td>
 						
 						<td valign="top"><div align="right"><strong><?php _e('Title', 'fgallery')?>:</strong></div></td>
@@ -349,8 +349,8 @@
 	$d = "desc_".$i;
 	$im = "imagename_".$i;
 	
-		$title =  		escape($_POST["title_".$i]);
-		$description =  escape($_POST["desc_".$i]);
+		$title =  		strip_tags(escape($_POST["title_".$i]));
+		$description =  strip_tags(escape($_POST["desc_".$i]));
 		$image =  		$_POST["imagename_".$i];
 				
 		$editSQL = "UPDATE $table_image SET title = '$title', description = '$description' WHERE image = '$image'";