diff --git a/public_html/_incl/tools.security.php b/public_html/_incl/tools.security.php
index 1d55a4d..bb6ffcc 100644
--- a/public_html/_incl/tools.security.php
+++ b/public_html/_incl/tools.security.php
@@ -1,5 +1,10 @@
 <?php
 
+function Ssql($string) {
+    // Sanitize a SQL Parameter to be safe on html.
+    return htmlspecialchars($string);
+}
+
 function Sf($filename) {
     /**
      * Sanitize a filename by removing any path information, null bytes, and replacing any characters that are not alphanumeric, dot, hyphen, or underscore with an underscore.
diff --git a/public_html/sysadmin/orgs.php b/public_html/sysadmin/orgs.php
index 72fd45e..fde2a3f 100644
--- a/public_html/sysadmin/orgs.php
+++ b/public_html/sysadmin/orgs.php
@@ -19,7 +19,7 @@ $form_action = $_GET["form"] ?? "";
 switch ($form_action) {
     case "create":
         $org_id = safe_path_segment(Sf($_POST["org_id"] ?? ""));
-        $org_name = Sf($_POST["org_name"] ?? "");
+        $org_name = Ssql($_POST["org_name"] ?? "");
         if (empty($org_id)) {
             die("Nombre de la organización no proporcionado.");
         }
@@ -41,7 +41,7 @@ switch ($form_action) {
         break;
     case "edit":
         $org_id = safe_path_segment(Sf($_GET['org'] ?? ''));
-        $org_name = Sf($_POST['org_name'] ?? '');
+        $org_name = Ssql($_POST['org_name'] ?? '');
         if ($org_id === '' || $org_name === '') {
             die("Datos inválidos para actualizar la organización.");
         }