diff --git a/pages/profile.php b/pages/profile.php
index d900a4b..c4088e7 100644
--- a/pages/profile.php
+++ b/pages/profile.php
@@ -1,132 +1,122 @@
 <?php
     $statement = $RUNTIME['PDO']->prepare("CREATE TABLE IF NOT EXISTS `iarstates` (`userID` VARCHAR(36) NOT NULL COLLATE 'utf8_unicode_ci', `filesize` BIGINT(20) NOT NULL DEFAULT '0', `iarfilename` VARCHAR(64) NOT NULL COLLATE 'utf8_unicode_ci', `running` INT(1) NOT NULL DEFAULT '0', PRIMARY KEY (`userID`) USING BTREE) COLLATE='utf8_unicode_ci' ENGINE=InnoDB;");
-    $statement->execute(); 
+    $statement->execute();
+
+    //Prüfe ob IAR grade erstellt wird.
+    $statementIARCheck = $RUNTIME['PDO']->prepare('SELECT 1 FROM iarstates WHERE userID =:userID');
+    $statementIARCheck->execute(['userID' => $_SESSION['UUID']]);
+    $IARRUNNING = $statementIARCheck->rowCount() != 0;
+    $statementIARCheck->closeCursor();
+    
+    if($_SERVER['REQUEST_METHOD'] == 'POST') {
+        include 'app/FormValidator.php';
+
+        if(isset($_POST['createIAR'])) {
+            $validator = new FormValidator(array()); // CSRF validation only
+            if($validator->isValid($_POST) && $IARRUNNING == FALSE) {
+                $iarname = md5(time().$_SESSION['UUID'] . rand()).".iar";
+        
+                $HTML->ReplaceSeitenInhalt("%%IARINFOMESSAGE%%", '<div class="alert alert-danger" role="alert">Deine IAR wird jetzt erstellt und der Download Link wird dir per PM zugesendet. '.$APIResult.'</div>'); 
+                $HTML->ReplaceSeitenInhalt("%%IARBUTTONSTATE%%", 'disabled'); 
+                
+                $statementIARSTART = $RUNTIME['PDO']->prepare('INSERT INTO iarstates (userID, filesize, iarfilename) VALUES (:userID, :filesize, :iarfilename)');
+                $statementIARSTART->execute(['userID' => $_SESSION['UUID'], 'filesize' => 0, 'iarfilename' => $iarname]);
+            }
+        }
+        else if(isset($_POST['saveProfileData'])) {
+            $validator = new FormValidator(array(
+                'formInputFeldVorname' => array('regex' => '/[^\\/<>\s]{1,64}/'),
+                'formInputFeldNachname' => array('regex' => '/[^\\/<>\s]{1,64}/'),
+                'formInputFeldEMail' => array('regex' => '/\S{1,64}@\S{1,250}.\S{2,64}/'),
+                'formInputFeldOfflineIM' => array('regex' => '(|on)'),
+                'formInputFeldPartnerName' => array('regex' => '/[^\\/<>\s]{1,64} [^\\/<>\s]{1,64}/')
+            ));
+            
+            if($validator->isValid($_POST)) {
+                if(isset($_POST['formInputFeldVorname']) && $_POST['formInputFeldVorname'] != "") {
+                    $NewFirstName = trim($_POST['formInputFeldVorname']);
+    
+                    if($NewFirstName != "" && $_SESSION['FIRSTNAME'] != $NewFirstName) {
+                        $statement = $RUNTIME['PDO']->prepare('UPDATE UserAccounts SET FirstName = :FirstName WHERE PrincipalID = :PrincipalID'); 
+                        $statement->execute(['FirstName' => $NewFirstName, 'PrincipalID' => $_SESSION['UUID']]);
+                        $_SESSION['FIRSTNAME'] = $NewFirstName;
+                        $_SESSION['USERNAME'] = $_SESSION['FIRSTNAME']." ".$_SESSION['LASTNAME'];
+                        $_SESSION['DISPLAYNAME'] = strtoupper($_SESSION['USERNAME']);
+                    }
+                }
+            
+                if(isset($_POST['formInputFeldNachname']) && $_POST['formInputFeldNachname'] != "") {
+                    $NewLastName = trim($_POST['formInputFeldNachname']);
+    
+                    if($NewLastName != "" && $_SESSION['LASTNAME'] != $NewLastName) {
+                        $statement = $RUNTIME['PDO']->prepare('UPDATE UserAccounts SET LastName = :LastName WHERE PrincipalID = :PrincipalID'); 
+                        $statement->execute(['LastName' => $NewLastName, 'PrincipalID' => $_SESSION['UUID']]);
+                        $_SESSION['LASTNAME'] = $NewLastName;
+                        $_SESSION['USERNAME'] = $_SESSION['FIRSTNAME']." ".$_SESSION['LASTNAME'];
+                        $_SESSION['DISPLAYNAME'] = strtoupper($_SESSION['USERNAME']);
+                    }
+                }
+            
+                if(isset($_POST['formInputFeldEMail']) && $_POST['formInputFeldEMail'] != "") {
+                    $NewEMail = trim($_POST['formInputFeldEMail']);
+            
+                    if($NewEMail != "" && $_SESSION['EMAIL'] != $NewEMail) {
+                        $statement = $RUNTIME['PDO']->prepare('UPDATE UserAccounts SET Email = :Email WHERE PrincipalID = :PrincipalID'); 
+                        $statement->execute(['Email' => $NewEMail, 'PrincipalID' => $_SESSION['UUID']]);
+        
+                        $statement = $RUNTIME['PDO']->prepare('UPDATE usersettings SET email = :Email WHERE useruuid = :PrincipalID'); 
+                        $statement->execute(['Email' => $NewEMail, 'PrincipalID' => $_SESSION['UUID']]);
+        
+                        $_SESSION['EMAIL'] = $NewEMail;
+                    }
+                }
+            
+                if(isset($_POST['formInputFeldOfflineIM']) && $_POST['formInputFeldOfflineIM'] == "on") {
+                    $statement = $RUNTIME['PDO']->prepare('UPDATE usersettings SET imviaemail = :IMState WHERE useruuid = :PrincipalID'); 
+                    $statement->execute(['IMState' => 'true', 'PrincipalID' => $_SESSION['UUID']]);
+                } else {
+                    $statement = $RUNTIME['PDO']->prepare('UPDATE usersettings SET imviaemail = :IMState WHERE useruuid = :PrincipalID'); 
+                    $statement->execute(['IMState' => 'false', 'PrincipalID' => $_SESSION['UUID']]);
+                }
+    
+                include 'app/OpenSim.php';
+                $opensim = new OpenSim();
+            
+                if(isset($_POST['formInputFeldPartnerName']) && $_POST['formInputFeldPartnerName'] != "") {
+                    $NewPartner = trim($_POST['formInputFeldPartnerName']);
+                    $CurrentPartner = $opensim->getPartner($_SESSION['UUID']);
+            
+                    if($CurrentPartner != "")$CurrentPartner = $opensim->getUserName($CurrentPartner);
+            
+                    if($NewPartner != "" && $CurrentPartner != $NewPartner) {
+                        $newPartnerUUID = $opensim->getUserUUID($NewPartner);
+            
+                        if($newPartnerUUID != null) {
+                            $statement = $RUNTIME['PDO']->prepare('UPDATE userprofile SET profilePartner = :profilePartner WHERE useruuid = :PrincipalID'); 
+                            $statement->execute(['profilePartner' => $newPartnerUUID, 'PrincipalID' => $_SESSION['UUID']]);
+                        }
+                    }else{
+                        $statement = $RUNTIME['PDO']->prepare('UPDATE userprofile SET profilePartner = :profilePartner WHERE useruuid = :PrincipalID'); 
+                        $statement->execute(['profilePartner' => '00000000-0000-0000-0000-000000000000', 'PrincipalID' => $_SESSION['UUID']]);
+                    }
+                }
+            }
+        }
+        else if(isset($_POST['savePassword'])) {
+
+        }
+
+        header('Location: index.php?page=profile');
+        die();
+    }
 
     $HTML->setHTMLTitle("Dein Profile");
     $HTML->importSeitenInhalt("profile.html");
 
-    //Prüfe ob IAR grade erstellt wird.
-    $IARRUNNING = FALSE;
-
-    $statementIARCheck = $RUNTIME['PDO']->prepare('SELECT 1 FROM iarstates WHERE userID =:userID');
-    $statementIARCheck->execute(['userID' => $_SESSION['UUID']]);
-    if($statementIARCheck->rowCount() != 0)
+    if(!$IARRUNNING)
     {
         $HTML->ReplaceSeitenInhalt("%%IARINFOMESSAGE%%", '<div class="alert alert-danger" role="alert">Aktuell wird eine IAR erstellt.<br>Warte bitte bis du eine PM bekommst.</div>'); 
         $HTML->ReplaceSeitenInhalt("%%IARBUTTONSTATE%%", 'disabled'); 
-        $IARRUNNING = TRUE;
-    }
-
-    if(isset($_REQUEST['createIAR']))
-    {
-        if($IARRUNNING == FALSE)
-        {
-            $iarname = md5(time().$_SESSION['UUID'] . rand()).".iar";
-    
-            $HTML->ReplaceSeitenInhalt("%%IARINFOMESSAGE%%", '<div class="alert alert-danger" role="alert">Deine IAR wird jetzt erstellt und der Download Link wird dir per PM zugesendet. '.$APIResult.'</div>'); 
-            $HTML->ReplaceSeitenInhalt("%%IARBUTTONSTATE%%", 'disabled'); 
-            
-            $statementIARSTART = $RUNTIME['PDO']->prepare('INSERT INTO iarstates (userID, filesize, iarfilename) VALUES (:userID, :filesize, :iarfilename)');
-            $statementIARSTART->execute(['userID' => $_SESSION['UUID'], 'filesize' => 0, 'iarfilename' => $iarname]);
-        }
-    }
-
-    if(isset($_REQUEST['formInputFeldVorname']) && $_REQUEST['formInputFeldVorname'] != "")
-    {
-        $NewFirstName = trim($_REQUEST['formInputFeldVorname']);
-
-        if($NewFirstName != "")
-        {
-            if($_SESSION['FIRSTNAME'] != $NewFirstName)
-            {
-                $statement = $RUNTIME['PDO']->prepare('UPDATE UserAccounts SET FirstName = :FirstName WHERE PrincipalID = :PrincipalID'); 
-                $statement->execute(['FirstName' => $NewFirstName, 'PrincipalID' => $_SESSION['UUID']]);
-                $_SESSION['FIRSTNAME'] = $NewFirstName;
-                $_SESSION['USERNAME'] = $_SESSION['FIRSTNAME']." ".$_SESSION['LASTNAME'];
-                $_SESSION['DISPLAYNAME'] = strtoupper($_SESSION['USERNAME']);
-            }
-        }
-    }
-
-    if(isset($_REQUEST['formInputFeldNachname']) && $_REQUEST['formInputFeldNachname'] != "")
-    {
-        $NewLastName = trim($_REQUEST['formInputFeldNachname']);
-
-        if($NewLastName != "")
-        {
-            if($_SESSION['LASTNAME'] != $NewLastName)
-            {
-                $statement = $RUNTIME['PDO']->prepare('UPDATE UserAccounts SET LastName = :LastName WHERE PrincipalID = :PrincipalID'); 
-                $statement->execute(['LastName' => $NewLastName, 'PrincipalID' => $_SESSION['UUID']]);
-                $_SESSION['LASTNAME'] = $NewLastName;
-                $_SESSION['USERNAME'] = $_SESSION['FIRSTNAME']." ".$_SESSION['LASTNAME'];
-                $_SESSION['DISPLAYNAME'] = strtoupper($_SESSION['USERNAME']);
-            }
-        }
-    }
-
-    if(isset($_REQUEST['formInputFeldEMail']) && $_REQUEST['formInputFeldEMail'] != "")
-    {
-        $NewEMail = trim($_REQUEST['formInputFeldEMail']);
-
-        if($NewEMail != "")
-        {
-            if($_SESSION['EMAIL'] != $NewEMail)
-            {
-                $statement = $RUNTIME['PDO']->prepare('UPDATE UserAccounts SET Email = :Email WHERE PrincipalID = :PrincipalID'); 
-                $statement->execute(['Email' => $NewEMail, 'PrincipalID' => $_SESSION['UUID']]);
-
-                $statement = $RUNTIME['PDO']->prepare('UPDATE usersettings SET email = :Email WHERE useruuid = :PrincipalID'); 
-                $statement->execute(['Email' => $NewEMail, 'PrincipalID' => $_SESSION['UUID']]);
-
-                $_SESSION['EMAIL'] = $NewEMail;
-            }
-        }
-    }
-
-    if(isset($_REQUEST['formInputFeldOfflineIM']) && $_REQUEST['formInputFeldOfflineIM'] != "")
-    {
-        $NewOfflineIM = trim($_REQUEST['formInputFeldOfflineIM']);
-
-        if($NewOfflineIM != "")
-        {
-            if($NewOfflineIM == "on" || $NewOfflineIM == "true")
-            {
-                $statement = $RUNTIME['PDO']->prepare('UPDATE usersettings SET imviaemail = :IMState WHERE useruuid = :PrincipalID'); 
-                $statement->execute(['IMState' => 'true', 'PrincipalID' => $_SESSION['UUID']]);
-            }
-        }
-    }else if(!isset($_REQUEST['formInputFeldOfflineIM']) && isset($_REQUEST['saveProfileData'])){
-        $statement = $RUNTIME['PDO']->prepare('UPDATE usersettings SET imviaemail = :IMState WHERE useruuid = :PrincipalID'); 
-        $statement->execute(['IMState' => 'false', 'PrincipalID' => $_SESSION['UUID']]);
-    }
-
-    include 'app/OpenSim.php';
-    $opensim = new OpenSim();
-
-    if(isset($_REQUEST['formInputFeldPartnerName']) && $_REQUEST['formInputFeldPartnerName'] != "")
-    {
-        $NewPartner = trim($_REQUEST['formInputFeldPartnerName']);
-        $CurrentPartner = $opensim->getPartner($_SESSION['UUID']);
-
-        if($CurrentPartner != "")$CurrentPartner = $opensim->getUserName($CurrentPartner);
-
-        if($NewPartner != "")
-        {
-            if($CurrentPartner != $NewPartner)
-            {
-                $newPartnerUUID = $opensim->getUserUUID($NewPartner);
-
-                if($newPartnerUUID != null)
-                {
-                    $statement = $RUNTIME['PDO']->prepare('UPDATE userprofile SET profilePartner = :profilePartner WHERE useruuid = :PrincipalID'); 
-                    $statement->execute(['profilePartner' => $newPartnerUUID, 'PrincipalID' => $_SESSION['UUID']]);
-                }
-            }
-        }else{
-            $statement = $RUNTIME['PDO']->prepare('UPDATE userprofile SET profilePartner = :profilePartner WHERE useruuid = :PrincipalID'); 
-            $statement->execute(['profilePartner' => '00000000-0000-0000-0000-000000000000', 'PrincipalID' => $_SESSION['UUID']]);
-        }
     }
 
     $statementLocalUsers = $RUNTIME['PDO']->prepare("SELECT FirstName,LastName FROM UserAccounts ORDER BY PrincipalID ASC");