diff --git a/mod.cservice/CERTCommand.cc b/mod.cservice/CERTCommand.cc
index 581d467b..f369a5b2 100644
--- a/mod.cservice/CERTCommand.cc
+++ b/mod.cservice/CERTCommand.cc
@@ -160,9 +160,10 @@ bool CERTCommand::Exec([[maybe_unused]] iClient* theClient,
         std::stringstream theQuery;
         theQuery << "INSERT INTO users_fingerprints (user_id, fingerprint, added_ts, added_by, "
                     "note) VALUES ("
-                 << theClient->getAccountID() << ", '" << fingerPrint
+                 << theClient->getAccountID() << ", '" << escapeSQLChars(fingerPrint)
                  << "', date_part('epoch', CURRENT_TIMESTAMP)::int, '"
-                 << theClient->getRealNickUserHost() << "', '" << note << "')" << std::endl;
+                 << escapeSQLChars(theClient->getRealNickUserHost()) << "', '"
+                 << escapeSQLChars(note) << "')" << std::endl;
 
         if (!bot->SQLDb->Exec(theQuery, true)) {
             LOGSQL_ERROR(bot->SQLDb);
diff --git a/mod.cservice/HELLOCommand.cc b/mod.cservice/HELLOCommand.cc
index 801123c7..8e9c5b17 100644
--- a/mod.cservice/HELLOCommand.cc
+++ b/mod.cservice/HELLOCommand.cc
@@ -131,7 +131,8 @@ bool HELLOCommand::Exec(iClient* theClient, const string& Message) {
      * Ensure this e-mail address is not already used
      */
     stringstream theQuery;
-    theQuery << "SELECT id FROM users WHERE lower(email) = '" << st[2] << "'" << ends;
+    theQuery << "SELECT id FROM users WHERE lower(email) = '" << escapeSQLChars(st[2]) << "'"
+             << ends;
     if (!bot->SQLDb->Exec(theQuery, true)) {
         LOG(ERROR, "SQL error on HELLOCommand, matching e-mail address");
         LOGSQL_ERROR(bot->SQLDb);
diff --git a/mod.cservice/STATUSCommand.cc b/mod.cservice/STATUSCommand.cc
index 2138935c..32bfae82 100644
--- a/mod.cservice/STATUSCommand.cc
+++ b/mod.cservice/STATUSCommand.cc
@@ -130,7 +130,8 @@ bool STATUSCommand::Exec(iClient* theClient, const string& Message) {
     }
 
 #ifdef THERETURN_ENABLED
-    if (theChan->hasW()) {
+    if (theChan->hasW() &&
+        (bot->getConfigVar("THERETURN_INTEGRATION")->asInt() != 0 || admLevel >= 750)) {
         bot->Notice(theClient, "The channel is also registered with %s.",
                     bot->getConfwNickName().c_str());
     }
diff --git a/mod.cservice/WCommand.cc b/mod.cservice/WCommand.cc
index ce8ce203..57cb96af 100644
--- a/mod.cservice/WCommand.cc
+++ b/mod.cservice/WCommand.cc
@@ -203,7 +203,7 @@ bool WCommand::Exec(iClient* theClient, const string& Message) {
         /* Is W on the channel? */
         if (!wChanUser) {
             bot->Notice(theClient, bot->getResponse(theUser, language::cant_find_on_chan).c_str(),
-                        wClient->getNickName().c_str());
+                        wClient->getNickName().c_str(), theChan->getName().c_str());
             return false;
         }
 
@@ -223,7 +223,7 @@ bool WCommand::Exec(iClient* theClient, const string& Message) {
         bot->Write(xQuery);
 
         return true;
-    } else if (Command == "PURGE") {
+    } else if (Command == "XPURGE") {
         /* Admin? */
         if (admLevel < 750) {
             bot->Notice(
@@ -251,7 +251,7 @@ bool WCommand::Exec(iClient* theClient, const string& Message) {
         } else {
             bot->Notice(theClient,
                         "%s is flagged as registered with %s in my records. To manually update my "
-                        "records, use /msg X W PURGE %s -f to force unregistration. This should "
+                        "records, use /msg X W XPURGE %s -f to force unregistration. This should "
                         "ONLY be used if %s is already purged with %s",
                         theChan->getName().c_str(), wClient->getNickName().c_str(),
                         theChan->getName().c_str(), theChan->getName().c_str(),
diff --git a/mod.cservice/cservice.cc b/mod.cservice/cservice.cc
index b225cb66..b7573d0e 100644
--- a/mod.cservice/cservice.cc
+++ b/mod.cservice/cservice.cc
@@ -7962,9 +7962,11 @@ bool cservice::doXQSASL(iServer* theServer, const string& Routing, const string&
                 for (size_t i = 0; i < st2.size(); ++i) {
                     if (st2[i].rfind("n=", 0) == 0) {
                         StringTokenizer st3(st2[i].substr(2));
-                        it->username = st3[0];
-                        if (st3.size() > 1)
-                            it->password = st3[1];
+                        if (!st3.empty()) {
+                            it->username = st3[0];
+                            if (st3.size() > 1)
+                                it->password = st3[1];
+                        }
                     } else if (st2[i].rfind("r=", 0) == 0)
                         it->client_nonce = st2[i].substr(2);
                 }
@@ -8631,12 +8633,19 @@ bool cservice::doXROplist(iServer* /*theServer*/, const string& Routing, const s
     LOG(TRACE, "XQ-OPLIST: Routing: {} Message: {}", Routing, Message);
     StringTokenizer st(Message);
 
+    /* Need at least "OPLIST <chan> <field>" before inspecting st[1]/st[2]. */
+    if (st.size() < 3) {
+        LOG(ERROR, "OPLIST insufficient response parameters");
+        return false;
+    }
+
     if (st[2] == "NO") {
         LOG(TRACE, "NO oplist reported for channel {}", st[1]);
         return true;
     }
 
-    if (st.size() < 6) {
+    /* A full OPLIST reply is accessed up to st[8] below. */
+    if (st.size() < 9) {
         LOG(ERROR, "OPLIST insufficient response parameters");
         return false;
     }