diff --git a/scripts/advanced.php b/scripts/advanced.php
index e225442..c7081f7 100644
--- a/scripts/advanced.php
+++ b/scripts/advanced.php
@@ -101,7 +101,7 @@ if(isset($_GET['submit'])) {
     }
   }
 
-  if(isset($_GET["freqshift_hi"])) {
+  if(isset($_GET["freqshift_hi"]) && is_numeric($_GET['freqshift_hi'])) {
     $freqshift_hi = $_GET["freqshift_hi"];
     if(strcmp($freqshift_hi,$config['FREQSHIFT_HI']) !== 0) {
       $contents = preg_replace("/FREQSHIFT_HI=.*/", "FREQSHIFT_HI=$freqshift_hi", $contents);
@@ -109,7 +109,7 @@ if(isset($_GET['submit'])) {
     }
   }
 
-  if(isset($_GET["freqshift_lo"])) {
+  if(isset($_GET["freqshift_lo"]) && is_numeric($_GET['freqshift_lo'])) {
     $freqshift_lo = $_GET["freqshift_lo"];
     if(strcmp($freqshift_lo,$config['FREQSHIFT_LO']) !== 0) {
       $contents = preg_replace("/FREQSHIFT_LO=.*/", "FREQSHIFT_LO=$freqshift_lo", $contents);
@@ -117,7 +117,7 @@ if(isset($_GET['submit'])) {
     }
   }
 
-  if(isset($_GET["freqshift_pitch"])) {
+  if(isset($_GET["freqshift_pitch"]) && is_numeric($_GET['freqshift_pitch'])) {
     $freqshift_pitch = $_GET["freqshift_pitch"];
     if(strcmp($freqshift_pitch,$config['FREQSHIFT_PITCH']) !== 0) {
       $contents = preg_replace("/FREQSHIFT_PITCH=.*/", "FREQSHIFT_PITCH=$freqshift_pitch", $contents);
diff --git a/scripts/config.php b/scripts/config.php
index ee92207..f758dbd 100644
--- a/scripts/config.php
+++ b/scripts/config.php
@@ -76,7 +76,7 @@ if(isset($_GET["latitude"])){
     $apprise_weekly_report = 0;
   }
 
-  if(isset($timezone)) {
+  if(isset($timezone) && in_array($timezone, DateTimeZone::listIdentifiers())) {
     shell_exec("sudo timedatectl set-timezone ".$timezone);
     date_default_timezone_set($timezone);
     echo "<script>setTimeout(
@@ -92,7 +92,11 @@ if(isset($_GET["latitude"])){
     // can't set the date manually if it's getting it from the internet, disable ntp
     exec("sudo timedatectl set-ntp false");
 
-    exec("sudo date -s '".$_GET['date']." ".$_GET['time']."'");
+    // check if valid date and time
+    $datetime = DateTime::createFromFormat('Y-m-d H:i', $_GET['date'] . ' ' . $_GET['time']);
+    if ($datetime && $datetime->format('Y-m-d H:i') === $_GET['date'] . ' ' . $_GET['time']) {
+      exec("sudo date -s '".$_GET['date']." ".$_GET['time']."'");
+    }
   } else {
     // user checked 'use time from internet if available,' so make sure that's on
     if(strlen(trim(exec("sudo timedatectl | grep \"NTP service: active\""))) == 0){
@@ -109,20 +113,22 @@ if(isset($_GET["latitude"])){
   }
 
   if ($model != $lang_config['MODEL'] || $language != $lang_config['DATABASE_LANG']){
-    $user = trim(shell_exec("awk -F: '/1000/{print $1}' /etc/passwd"));
-    $home = trim(shell_exec("awk -F: '/1000/{print $6}' /etc/passwd"));
+    if(strlen($language) == 2){
+      $user = trim(shell_exec("awk -F: '/1000/{print $1}' /etc/passwd"));
+      $home = trim(shell_exec("awk -F: '/1000/{print $6}' /etc/passwd"));
 
-    // Archive old language file
-    syslog_shell_exec("cp -f $home/BirdNET-Pi/model/labels.txt $home/BirdNET-Pi/model/labels.txt.old", $user);
+      // Archive old language file
+      syslog_shell_exec("cp -f $home/BirdNET-Pi/model/labels.txt $home/BirdNET-Pi/model/labels.txt.old", $user);
 
-    if($model == "BirdNET_GLOBAL_3K_V2.2_Model_FP16"){
-    // Install new language label file
-      syslog_shell_exec("sudo chmod +x $home/BirdNET-Pi/scripts/install_language_label_nm.sh && $home/BirdNET-Pi/scripts/install_language_label_nm.sh -l $language", $user);
-    } else {
-      syslog_shell_exec("$home/BirdNET-Pi/scripts/install_language_label.sh -l $language", $user);
+      if($model == "BirdNET_GLOBAL_3K_V2.2_Model_FP16"){
+      // Install new language label file
+        syslog_shell_exec("sudo chmod +x $home/BirdNET-Pi/scripts/install_language_label_nm.sh && $home/BirdNET-Pi/scripts/install_language_label_nm.sh -l $language", $user);
+      } else {
+        syslog_shell_exec("$home/BirdNET-Pi/scripts/install_language_label.sh -l $language", $user);
+      }
+
+      syslog(LOG_INFO, "Successfully changed language to '$language' and model to '$model'");
     }
-
-    syslog(LOG_INFO, "Successfully changed language to '$language' and model to '$model'");
   }
 
 
@@ -271,7 +277,7 @@ if(isset($_GET['sendtest']) && $_GET['sendtest'] == "true") {
   $body = str_replace("\$overlap", $overlap, $body);
   $body = str_replace("\$flickrimage", $exampleimage, $body);
 
-  echo "<pre class=\"bash\">".shell_exec($home."/BirdNET-Pi/birdnet/bin/apprise -vv --plugin-path ".$home."/.apprise/plugins "." -t '".$title."' -b '".$body."' ".$attach." ".$cf." ")."</pre>";
+  echo "<pre class=\"bash\">".shell_exec($home."/BirdNET-Pi/birdnet/bin/apprise -vv --plugin-path ".$home."/.apprise/plugins "." -t '".escapeshellcmd($title)."' -b '".escapeshellcmd($body)."' ".$attach." ".$cf." ")."</pre>";
 
   die();
 }