diff --git a/plugins/af_redditimgur/init.php b/plugins/af_redditimgur/init.php
index 1fa61953a..63a23cd36 100755
--- a/plugins/af_redditimgur/init.php
+++ b/plugins/af_redditimgur/init.php
@@ -647,7 +647,11 @@ class Af_RedditImgur extends Plugin {
 				fieldset { border : 0; }
 				label { display : inline-block; min-width : 120px; }
 			</style>
-			<form action="backend.php?op=pluginhandler&method=testurl&plugin=af_redditimgur" method="post">
+			<form action="backend.php" method="post">
+				<input type="hidden" name="op" value="pluginhandler">
+				<input type="hidden" name="method" value="testurl">
+				<input type="hidden" name="plugin" value="af_redditimgur">
+				<input type="hidden" name="csrf_token" value="<?= $_SESSION["csrf_token"] ?>">
 				<fieldset>
 					<label>URL:</label>
 					<input name="url" size="100" value="<?= htmlspecialchars($url) ?>"></input>
diff --git a/plugins/mail/init.php b/plugins/mail/init.php
index c054196df..8a0d01aca 100644
--- a/plugins/mail/init.php
+++ b/plugins/mail/init.php
@@ -19,7 +19,7 @@ class Mail extends Plugin {
 	}
 
 	function get_js() {
-		return file_get_contents(dirname(__FILE__) . "/mail.js");
+		return file_get_contents(__DIR__ . "/mail.js");
 	}
 
 	function hook_headline_toolbar_select_menu_item($feed_id, $is_cat) {
@@ -83,9 +83,11 @@ class Mail extends Plugin {
 
 	function emailArticle() {
 
-		$ids = explode(",", $_REQUEST['param']);
+		$ids = explode(",", clean($_REQUEST['ids']));
 		$ids_qmarks = arr_qmarks($ids);
 
+		print "<form onsubmit=\"return false\">";
+
 		print \Controls\hidden_tag("op", "pluginhandler");
 		print \Controls\hidden_tag("plugin", "mail");
 		print \Controls\hidden_tag("method", "sendEmail");
@@ -156,15 +158,8 @@ class Mail extends Plugin {
 
 		print "</td><td>";
 
-/*		print "<input dojoType=\"dijit.form.ValidationTextBox\" required=\"true\"
-				style=\"width : 30em;\"
-				name=\"destination\" id=\"emailArticleDlg_destination\">"; */
-
 		print \Controls\select_tag("destination", "", $addresslist,
-									["style" => "width: 30em", "dojoType" => "dijit.form.ComboBox"]);
-
-/*		print "<div class=\"autocomplete\" id=\"emailArticleDlg_dst_choices\"
-	style=\"z-index: 30; display : none\"></div>"; */
+									["style" => "width: 30em", "required" => 1, "dojoType" => "dijit.form.ComboBox"]);
 
 		print "</td></tr><tr><td>";
 
@@ -184,11 +179,11 @@ class Mail extends Plugin {
 		print "</td></tr></table>";
 
 		print "<footer>";
-		print "<button dojoType='dijit.form.Button' onclick=\"dijit.byId('emailArticleDlg').execute()\">".__('Send e-mail')."</button> ";
-		print "<button dojoType='dijit.form.Button' onclick=\"dijit.byId('emailArticleDlg').hide()\">".__('Cancel')."</button>";
+		print \Controls\submit_tag(__('Send email'));
+		print \Controls\cancel_dialog_tag(__('Cancel'));
 		print "</footer>";
 
-		//return;
+		print "</form>";
 	}
 
 	function sendEmail() {
@@ -229,20 +224,6 @@ class Mail extends Plugin {
 		print json_encode($reply);
 	}
 
-	/* function completeEmails() {
-		$search = $_REQUEST["search"];
-
-		print "<ul>";
-
-		foreach ($_SESSION['stored_emails'] as $email) {
-			if (strpos($email, $search) !== false) {
-				print "<li>$email</li>";
-			}
-		}
-
-		print "</ul>";
-	} */
-
 	function api_version() {
 		return 2;
 	}
diff --git a/plugins/mail/mail.js b/plugins/mail/mail.js
index 5ddc0dc41..4cdf6999d 100644
--- a/plugins/mail/mail.js
+++ b/plugins/mail/mail.js
@@ -1,4 +1,4 @@
-/* global Plugins, Headlines, xhrJson, Notify, fox, __ */
+/* global Plugins, Headlines, dojo, xhrPost, xhrJson, Notify, fox, __ */
 
 Plugins.Mail = {
 	send: function(id) {
@@ -13,10 +13,7 @@ Plugins.Mail = {
 			id = ids.toString();
 		}
 
-		const query = "backend.php?op=pluginhandler&plugin=mail&method=emailArticle&param=" + encodeURIComponent(id);
-
 		const dialog = new fox.SingleUseDialog({
-			id: "emailArticleDlg",
 			title: __("Forward article by email"),
 			execute: function () {
 				if (this.validate()) {
@@ -35,16 +32,16 @@ Plugins.Mail = {
 					});
 				}
 			},
-			href: query
+			content: __("Loading, please wait...")
 		});
 
-		/* var tmph = dojo.connect(dialog, 'onLoad', function() {
-		dojo.disconnect(tmph);
+		const tmph = dojo.connect(dialog, 'onShow', function () {
+			dojo.disconnect(tmph);
 
-		   new Ajax.Autocompleter('emailArticleDlg_destination', 'emailArticleDlg_dst_choices',
-			   "backend.php?op=pluginhandler&plugin=mail&method=completeEmails",
-			   { tokens: '', paramName: "search" });
-		}); */
+			xhrPost("backend.php", {op: "pluginhandler", plugin: "mail", method: "emailArticle", ids: id}, (transport) => {
+				dialog.attr('content', transport.responseText);
+			});
+		});
 
 		dialog.show();
 	},
diff --git a/plugins/mailto/init.js b/plugins/mailto/init.js
index ae68bf49b..4bf672a88 100644
--- a/plugins/mailto/init.js
+++ b/plugins/mailto/init.js
@@ -1,4 +1,4 @@
-/* global Plugins, Headlines, fox, __ */
+/* global Plugins, Headlines, xhrPost, dojo, fox, __ */
 
 Plugins.Mailto = {
 	send: function (id) {
@@ -13,12 +13,19 @@ Plugins.Mailto = {
 			id = ids.toString();
 		}
 
-		const query = "backend.php?op=pluginhandler&plugin=mailto&method=emailArticle&param=" + encodeURIComponent(id);
-
 		const dialog = new fox.SingleUseDialog({
-			id: "emailArticleDlg",
 			title: __("Forward article by email"),
-			href: query});
+			content: __("Loading, please wait...")
+		});
+
+		const tmph = dojo.connect(dialog, 'onShow', function () {
+			dojo.disconnect(tmph);
+
+			xhrPost("backend.php", {op: "pluginhandler", plugin: "mailto", method: "emailArticle", ids: id}, (transport) => {
+				dialog.attr('content', transport.responseText);
+			});
+		});
+
 
 		dialog.show();
 	}
diff --git a/plugins/mailto/init.php b/plugins/mailto/init.php
index 3e24dcf29..4b858eae6 100644
--- a/plugins/mailto/init.php
+++ b/plugins/mailto/init.php
@@ -20,7 +20,7 @@ class MailTo extends Plugin {
 	}
 
 	function get_js() {
-		return file_get_contents(dirname(__FILE__) . "/init.js");
+		return file_get_contents(__DIR__ . "/init.js");
 	}
 
 	function hook_article_button($line) {
@@ -31,7 +31,7 @@ class MailTo extends Plugin {
 
 	function emailArticle() {
 
-		$ids = explode(",", $_REQUEST['param']);
+		$ids = explode(",", clean($_REQUEST['ids']));
 		$ids_qmarks = arr_qmarks($ids);
 
 		$tpl = new Templator();
@@ -85,7 +85,7 @@ class MailTo extends Plugin {
 		print "<p>";
 
 		print "<footer class='text-center'>";
-		print "<button dojoType='dijit.form.Button' onclick=\"dijit.byId('emailArticleDlg').hide()\">".__('Close this dialog')."</button>";
+		print \Controls\submit_tag(__('Close this dialog'));
 		print "</footer>";
 
 		//return;
diff --git a/plugins/note/init.php b/plugins/note/init.php
index 12c56f7ad..65e1f0eef 100644
--- a/plugins/note/init.php
+++ b/plugins/note/init.php
@@ -27,17 +27,17 @@ class Note extends Plugin {
 	}
 
 	function edit() {
-		$param = $_REQUEST['param'];
+		$id = clean($_REQUEST['id']);
 
 		$sth = $this->pdo->prepare("SELECT note FROM ttrss_user_entries WHERE
 			ref_id = ? AND owner_uid = ?");
-		$sth->execute([$param, $_SESSION['uid']]);
+		$sth->execute([$id, $_SESSION['uid']]);
 
 		if ($row = $sth->fetch()) {
 
 			$note = $row['note'];
 
-			print \Controls\hidden_tag("id", "$param");
+			print \Controls\hidden_tag("id", $id);
 			print \Controls\hidden_tag("op", "pluginhandler");
 			print \Controls\hidden_tag("method", "setNote");
 			print \Controls\hidden_tag("plugin", "note");
diff --git a/plugins/note/note.js b/plugins/note/note.js
index ab2ed9208..215058b21 100644
--- a/plugins/note/note.js
+++ b/plugins/note/note.js
@@ -1,11 +1,8 @@
-/* global Plugins, xhrJson, Notify, fox, __ */
+/* global dojo, xhrPost, Plugins, xhrJson, Notify, fox, __ */
 
 Plugins.Note = {
 	edit: function(id) {
-		const query = "backend.php?op=pluginhandler&plugin=note&method=edit&param=" + encodeURIComponent(id);
-
 		const dialog = new fox.SingleUseDialog({
-			id: "editNoteDlg",
 			title: __("Edit article note"),
 			execute: function () {
 				if (this.validate()) {
@@ -30,7 +27,15 @@ Plugins.Note = {
 					});
 				}
 			},
-			href: query,
+			content: __("Loading, please wait...")
+		});
+
+		const tmph = dojo.connect(dialog, 'onShow', function () {
+			dojo.disconnect(tmph);
+
+			xhrPost("backend.php", {op: "pluginhandler", plugin: "note", method: "edit", id: id}, (transport) => {
+				dialog.attr('content', transport.responseText);
+			});
 		});
 
 		dialog.show();