diff --git a/post.php b/post.php
index 2ca8b0e9..2fe355c7 100644
--- a/post.php
+++ b/post.php
@@ -509,7 +509,7 @@ if(isset($_POST['add_company'])){
     mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_locale = '$locale', company_currency = '$currency_code',company_created_at = NOW()");
 
     $company_id = mysqli_insert_id($mysqli);
-    $config_base_url = $_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']);
+    $config_base_url = mysqli_real_escape_string($mysqli,$_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']));
     $config_api_key = keygen();
     
     mkdir("uploads/clients/$company_id");
@@ -6804,6 +6804,7 @@ if(isset($_GET['delete_file'])){
     $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id AND company_id = $session_company_id");
     $row = mysqli_fetch_array($sql_file);
     $client_id = $row['file_client_id'];
+    $file_name = $row['file_name'];
     $file_reference_name = $row['file_reference_name'];
 
     unlink("uploads/clients/$session_company_id/$client_id/$file_reference_name");
diff --git a/setup.php b/setup.php
index 05c4ea03..40fbb2eb 100644
--- a/setup.php
+++ b/setup.php
@@ -923,7 +923,7 @@ if(isset($_POST['add_company_settings'])){
   mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_locale = '$locale', company_currency = '$currency_code', company_created_at = NOW()");
 
   $company_id = mysqli_insert_id($mysqli);
-  $config_base_url = $_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']);
+  $config_base_url = mysqli_real_escape_string($mysqli,$_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']));
 
   mkdir_missing("uploads/clients/$company_id");
   file_put_contents("uploads/clients/$company_id/index.php", "");