diff --git a/includes/basetype.class.php b/includes/basetype.class.php
index 3d4f81ca..ab50fa65 100644
--- a/includes/basetype.class.php
+++ b/includes/basetype.class.php
@@ -572,13 +572,16 @@ trait spawnHelper
                         if ($p['wait'])
                             $label[] = Lang::npc('wait').Lang::main('colon').Util::formatTime($p['wait'], false);
 
-                        $set = ['label' => '$<br><span class="q0">'.implode('<br>', $label).'</span>', 'type'  => $wpIdx];
+                        $opts = array(                      // \0 doesn't get printed and tricks Util::toJSON() into handling this as a string .. i feel slightly dirty now
+                            'label' => "\0$<br><span class=\"q0\">".implode('<br>', $label).'</span>',
+                            'type'  => $wpIdx
+                        );
 
                         // connective line
                         if ($i > 0)
-                            $set['lines'] = [[$wPoints[$i - 1]['posX'], $wPoints[$i - 1]['posY']]];
+                            $opts['lines'] = [[$wPoints[$i - 1]['posX'], $wPoints[$i - 1]['posY']]];
 
-                        $data[$s['areaId']][$s['floor']]['coords'][] = [$p['posX'], $p['posY'], $set];
+                        $data[$s['areaId']][$s['floor']]['coords'][] = [$p['posX'], $p['posY'], $opts];
                         if (empty($wpSum[$s['areaId']][$s['floor']]))
                             $wpSum[$s['areaId']][$s['floor']] = 1;
                         else
@@ -588,21 +591,21 @@ trait spawnHelper
                 }
             }
 
-            $label = [];
-
-            if (User::isInGroup(U_GROUP_STAFF))
-                $label[] = $s['guid'] < 0 ? 'Vehicle Accessory' : 'GUID'.Lang::main('colon').$s['guid'];
+            $opts   = $menu = $tt = $info = [];
+            $footer = '';
 
             if ($s['respawn'])
-                $label[] = Lang::npc('respawnIn').Lang::main('colon').Util::formatTime($s['respawn'] * 1000, false);
+                $info[1] = '<span class="q0">'.Lang::npc('respawnIn').Lang::main('colon').Util::formatTime($s['respawn'] * 1000, false).'</span>';
 
             if (User::isInGroup(U_GROUP_STAFF))
             {
+                $info[0] = $s['guid'] < 0 ? 'Vehicle Accessory' : 'GUID'.Lang::main('colon').$s['guid'];
+
                 if ($s['phaseMask'] > 1 && ($s['phaseMask'] & 0xFFFF) != 0xFFFF)
-                    $label[] = Lang::game('phases').Lang::main('colon').Util::asHex($s['phaseMask']);
+                    $info[2] = Lang::game('phases').Lang::main('colon').Util::asHex($s['phaseMask']);
 
                 if ($s['spawnMask'] == 15)
-                    $label[] = Lang::game('mode').Lang::main('colon').Lang::game('modes', -1);
+                    $info[3] = Lang::game('mode').Lang::main('colon').Lang::game('modes', -1);
                 else if ($s['spawnMask'])
                 {
                     $_ = [];
@@ -610,11 +613,25 @@ trait spawnHelper
                         if ($s['spawnMask'] & 1 << $i)
                             $_[] = Lang::game('modes', $i);
 
-                    $label[] = Lang::game('mode').Lang::main('colon').implode(', ', $_);
+                    $info[4] = Lang::game('mode').Lang::main('colon').implode(', ', $_);
                 }
+
+                $footer = '<span class="q2">Click to move to different floor</span>';
             }
 
-            $data[$s['areaId']] [$s['floor']] ['coords'] [] = [$s['posX'], $s['posY'], ['label' => '$<br><span class="q0">'.implode('<br>', $label).'</span>']];
+            if ($info)
+                $tt['info'] = $info;
+
+            if ($footer)
+                $tt['footer'] = $footer;
+
+            if ($tt)
+                $opts['tooltip'] = [$this->getField('name', true) => $tt];
+
+            if ($menu)
+                $opts['menu'] = $menu;
+
+            $data[$s['areaId']] [$s['floor']] ['coords'] [] = [$s['posX'], $s['posY'], $opts];
         }
         foreach ($data as $a => &$areas)
             foreach ($areas as $f => &$floor)
diff --git a/includes/database.class.php b/includes/database.class.php
index 23cc9db3..bd0aead1 100644
--- a/includes/database.class.php
+++ b/includes/database.class.php
@@ -36,6 +36,10 @@ class DB
         if ($options['prefix'])
             $interface->setIdentPrefix($options['prefix']);
 
+        // kill STRICT_TRANS_TABLES and STRICT_ALL_TABLES off. It prevents usage of implicit default values.
+        if ($idx == DB_AOWOW)
+            $interface->query('SET SESSION sql_mode = \'NO_ENGINE_SUBSTITUTION\'');
+
         self::$interfaceCache[$idx] = &$interface;
         self::$connectionCache[$idx] = true;
     }
diff --git a/includes/shared.php b/includes/shared.php
index 95ff3ce5..3f4e3f49 100644
--- a/includes/shared.php
+++ b/includes/shared.php
@@ -1,6 +1,6 @@
 <?php
 
-define('AOWOW_REVISION', 17);
+define('AOWOW_REVISION', 18);
 define('CLI', PHP_SAPI === 'cli');
 
 
diff --git a/includes/user.class.php b/includes/user.class.php
index b93b709a..11a1ae24 100644
--- a/includes/user.class.php
+++ b/includes/user.class.php
@@ -140,11 +140,11 @@ class User
                     $rawIp = explode(',', $rawIp)[0];       // [ip, proxy1, proxy2]
 
                 // check IPv4
-                if ($ipAddr = filter_var($rawIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE))
+                if ($ipAddr = filter_var($rawIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE))
                     break;
 
                 // check IPv6
-                if ($ipAddr = filter_var($rawIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE))
+                if ($ipAddr = filter_var($rawIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 | FILTER_FLAG_NO_RES_RANGE))
                     break;
             }
         }
@@ -349,7 +349,7 @@ class User
     public static function verifyCrypt($pass, $hash = '')
     {
         $_ = $hash ?: self::$passHash;
-        return $_ == crypt($pass, $_);
+        return $_ === crypt($pass, $_);
     }
 
     // sha1 used by TC / MaNGOS
@@ -360,7 +360,7 @@ class User
 
     private static function verifySHA1($name, $pass)
     {
-        return self::$passHash == self::hashSHA1($name, $pass);
+        return strtoupper(self::$passHash) === strtoupper(self::hashSHA1($name, $pass));
     }
 
     public static function isValidName($name, &$errCode = 0)
@@ -369,7 +369,7 @@ class User
 
         if (mb_strlen($name) < 4 || mb_strlen($name) > 16)
             $errCode = 1;
-        else if (preg_match('/[^\w\d]/i', $name))
+        else if (preg_match('/[^\w\d\-]/i', $name))
             $errCode = 2;
 
         return $errCode == 0;
diff --git a/pages/compare.php b/pages/compare.php
index 7817378c..3dd15fc8 100644
--- a/pages/compare.php
+++ b/pages/compare.php
@@ -43,6 +43,12 @@ class ComparePage extends GenericPage
         // add conditional js
         $this->addJS('?data=weight-presets.gems.enchants.itemsets&locale='.User::$localeId.'&t='.$_SESSION['dataKey']);
 
+        $this->summary = array(
+            'template' => 'compare',
+            'id'       => 'compare',
+            'parent'   => 'compare-generic'
+        );
+
         if (!$this->compareString)
             return;
 
@@ -64,12 +70,8 @@ class ComparePage extends GenericPage
 
             $outSet[] = $outString;
         }
-        $this->summary = array(
-            'template' => 'compare',
-            'id'       => 'compare',
-            'parent'   => 'compare-generic',
-            'groups'   => $outSet
-        );
+
+        $this->summary['groups'] = $outSet;
 
         $iList = new ItemList(array(['i.id', $items]));
         $data  = $iList->getListviewData(ITEMINFO_SUBITEMS | ITEMINFO_JSON);
diff --git a/pages/races.php b/pages/races.php
index e1c28255..1008d3ba 100644
--- a/pages/races.php
+++ b/pages/races.php
@@ -10,7 +10,7 @@ class RacesPage extends GenericPage
 {
     use ListPage;
 
-    protected $type          = TYPE_CLASS;
+    protected $type          = TYPE_RACE;
     protected $tpl           = 'list-page-generic';
     protected $path          = [0, 13];
     protected $tabId         = 0;
diff --git a/setup/tools/sqlgen/emotes.func.php b/setup/tools/sqlgen/emotes.func.php
index f1a3f928..25ce32f6 100644
--- a/setup/tools/sqlgen/emotes.func.php
+++ b/setup/tools/sqlgen/emotes.func.php
@@ -17,23 +17,24 @@ function emotes(/*array $ids = [] */)
     $allOK        = true;
     $locPath      = [];
 
+    DB::Aowow()->query('TRUNCATE ?_emotes_aliasses');
+
     foreach (CLISetup::$localeIds as $lId)
     {
-        DB::Aowow()->query('TRUNCATE ?_emotes_aliasses');
-
-        $path = sprintf($globStrPath, Util::$localeStrings[$lId].'/');
-        if (CLISetup::fileExists($path))
+        foreach (CLISetup::$expectedPaths as $xp => $locId)
         {
-            $locPath[$lId] = $path;
-            continue;
-        }
+            if ($lId != $locId)
+                continue;
 
-        // locale not found, try base mpqData
-        $path = sprintf($globStrPath, '');
-        if (CLISetup::fileExists($path))
-        {
-            $locPath[$lId] = $path;
-            continue;
+            if ($xp)                                        // if in subDir add trailing slash
+                $xp .= '/';
+
+            $path = sprintf($globStrPath, $xp);
+            if (CLISetup::fileExists($path))
+            {
+                $locPath[$lId] = $path;
+                continue 2;
+            }
         }
 
         CLISetup::log('GlobalStrings.lua not found for selected locale '.CLISetup::bold(Util::$localeStrings[$lId]), CLISetup::LOG_WARN);
diff --git a/static/js/ShowOnMap.js b/static/js/ShowOnMap.js
index e9d500f0..2173a51b 100644
--- a/static/js/ShowOnMap.js
+++ b/static/js/ShowOnMap.js
@@ -417,7 +417,7 @@ ShowOnMap.prototype.setLegend = function(info) {
             $WH.ae(sp, a);
         }
         else {
-            sp.innerText = info[i][0];
+            $WH.ae(sp, $WH.ct(info[i][0]));
         }
 
         $WH.ae(div, sp);
diff --git a/static/js/locale_dede.js b/static/js/locale_dede.js
index 67c4c373..9530eb65 100644
--- a/static/js/locale_dede.js
+++ b/static/js/locale_dede.js
@@ -3155,7 +3155,7 @@ var LANG = {
     ct_dialog_reporttopic:    "Meldet das Thema von $1",
     ct_dialog_thanks:         "Eure Mitteilung wurde erhalten. Vielen Dank, dass Ihr uns kontaktiert habt!",
     ct_dialog_thanks_user:    "Eure Mitteilung wurde erhalten, $1. Vielen Dank, dass Ihr uns kontaktiert habt!",
-    ct_dialog_noemailwarning: "<b>Wichtig:</b> Wenn Ihr keine E-Mail-Adresse eingebt, können nicht weiter auf Eure Rückmeldungen eingehen. Wir werden Eure E-Mail-Adresse niemals verkaufen oder weitergeben.",
+    ct_dialog_noemailwarning: "<b>Wichtig:</b> Wenn Ihr keine E-Mail-Adresse eingebt, können wir nicht weiter auf Eure Rückmeldungen eingehen. Wir werden Eure E-Mail-Adresse niemals verkaufen oder weitergeben.",
 
     ct_dialog_error_captcha:    "Der CAPTCHA, den Ihr eingegeben habt, ist nicht gültig. Bitte versucht es erneut.",
     ct_dialog_error_desc:       "Bitte gebt eine genaue, nicht zu lange Beschreibung an.",