Found and fixes some of security problems.

Update script instructions:
Please overwrite ALL .php files to your server (but not settings.php).