rebased patch by 'wraeth' from
https://trac.osgeo.org/grass/changeset/66561
diff --git a/db/drivers/dbf/column.c b/db/drivers/dbf/column.c
index ee0fd6e..1d2780e 100644
--- a/db/drivers/dbf/column.c
+++ b/db/drivers/dbf/column.c
@@ -40,7 +40,7 @@ int add_column(int tab, int type, char *name, int width, int decimals)
 	sprintf(buf, "DBMI-DBF driver: column name '%s'", name);
 	name[DBF_COL_NAME - 1] = '\0';
 	sprintf(buf + strlen(buf), " truncated to '%s'", name);
-	G_warning(buf);
+	G_warning("%s", buf);
     }
 
     /* Check if the column exists */
diff --git a/db/drivers/ogr/select.c b/db/drivers/ogr/select.c
index 27ae090..6584bd5 100644
--- a/db/drivers/ogr/select.c
+++ b/db/drivers/ogr/select.c
@@ -48,7 +48,7 @@ int db__driver_open_select_cursor(dbString * sel, dbCursor * dbc, int mode)
 
     if (c->hLayer == NULL) {
 	db_d_append_error(_("Unable to select: \n"));
-	db_d_append_error(db_get_string(sel));
+	db_d_append_error("%s", db_get_string(sel));
 	db_d_append_error("\n");
 	db_d_report_error();
 	return DB_FAILED;
diff --git a/db/drivers/postgres/db.c b/db/drivers/postgres/db.c
index b02bade..5e171eb 100644
--- a/db/drivers/postgres/db.c
+++ b/db/drivers/postgres/db.c
@@ -248,7 +248,7 @@ int create_delete_db(dbHandle *handle, int create)
     if (PQstatus(pg_conn) == CONNECTION_BAD) {
 	db_d_append_error(_("Connection failed."));
 	db_d_append_error("\n");
-	db_d_append_error(PQerrorMessage(pg_conn));
+	db_d_append_error("%s", PQerrorMessage(pg_conn));
 	db_d_report_error();
 	PQfinish(pg_conn);
 	return DB_FAILED;
@@ -269,7 +269,7 @@ int create_delete_db(dbHandle *handle, int create)
 	else
 	    db_d_append_error(_("Unable to drop database <%s>"), name);
 	db_d_append_error("\n");
-	db_d_append_error(PQerrorMessage(pg_conn));
+	db_d_append_error("%s", PQerrorMessage(pg_conn));
 	db_d_report_error();
 	
 	PQclear(res);	
diff --git a/imagery/i.landsat.toar/landsat_met.c b/imagery/i.landsat.toar/landsat_met.c
index 506d719..5b612a4 100644
--- a/imagery/i.landsat.toar/landsat_met.c
+++ b/imagery/i.landsat.toar/landsat_met.c
@@ -384,14 +384,14 @@ void lsat_metadata(char *metafile, lsat_data * lsat)
 	    sprintf(key, "Band%dGainSetting", lsat->band[i].code);
 	    get_mtldata(mtldata, key, value);
 	    if (value[0] == '\0') {
-		G_warning(key);
+                G_warning("%s", key);
 		continue;
 	    }
 	    lsat->band[i].gain = atof(value);
 	    sprintf(key, "Band%dBiasSetting", lsat->band[i].code);
 	    get_mtldata(mtldata, key, value);
 	    if (value[0] == '\0') {
-		G_warning(key);
+		G_warning("%s", key);
 		continue;
 	    }
 	    lsat->band[i].bias = atof(value);
diff --git a/imagery/i.ortho.photo/i.ortho.rectify/cp.c b/imagery/i.ortho.photo/i.ortho.rectify/cp.c
index b8ec48c..86e5b33 100644
--- a/imagery/i.ortho.photo/i.ortho.rectify/cp.c
+++ b/imagery/i.ortho.photo/i.ortho.rectify/cp.c
@@ -31,7 +31,7 @@ int get_conz_points(void)
     default:
 	return 1;
     }
-    G_fatal_error(msg);
+    G_fatal_error("%s", msg);
 }
 
 int get_ref_points(void)
@@ -61,6 +61,6 @@ int get_ref_points(void)
     default:
 	return 1;
     }
-    G_fatal_error(msg);
+    G_fatal_error("%s", msg);
     /* exit(1);   shouldn't get here */
 }
diff --git a/imagery/i.ortho.photo/i.ortho.rectify/target.c b/imagery/i.ortho.photo/i.ortho.rectify/target.c
index 99f8480..462833a 100644
--- a/imagery/i.ortho.photo/i.ortho.rectify/target.c
+++ b/imagery/i.ortho.photo/i.ortho.rectify/target.c
@@ -31,5 +31,5 @@ int get_target(char *group)
     sprintf(buf, _("Mapset <%s> in target location <%s> - "), mapset, location);
     strcat(buf, stat == 0 ? _("permission denied") : _("not found"));
   error:
-    G_fatal_error(buf);
+    G_fatal_error("%s", buf);
 }
diff --git a/imagery/i.ortho.photo/lib/camera.c b/imagery/i.ortho.photo/lib/camera.c
index 26e454e..7d298be 100644
--- a/imagery/i.ortho.photo/lib/camera.c
+++ b/imagery/i.ortho.photo/lib/camera.c
@@ -36,7 +36,7 @@ int I_get_group_camera(char *group, char *camera)
 	sprintf(buf,
 		_("Unable to open camera file for group <%s> in mapset <%s>"),
 		group, G_mapset());
-	G_warning(buf);
+	G_warning("%s", buf);
 	return 0;
     }
     G_getl2(buf, sizeof(buf), fd);
diff --git a/imagery/i.ortho.photo/lib/conz_points.c b/imagery/i.ortho.photo/lib/conz_points.c
index ad604dd..9d6f940 100644
--- a/imagery/i.ortho.photo/lib/conz_points.c
+++ b/imagery/i.ortho.photo/lib/conz_points.c
@@ -104,7 +104,7 @@ int I_get_con_points(char *group, struct Ortho_Control_Points *cp)
 	sprintf(msg,
 		"unable to open control point (Z) file for group [%s in %s]",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	G_sleep(4);
 	return 0;
     }
@@ -114,7 +114,7 @@ int I_get_con_points(char *group, struct Ortho_Control_Points *cp)
     if (stat < 0) {
 	sprintf(msg, "bad format in control point file for group [%s in %s]",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	G_sleep(4);
 	return 0;
     }
@@ -131,7 +131,7 @@ int I_put_con_points(char *group, struct Ortho_Control_Points *cp)
 	sprintf(msg,
 		"unable to create control point file for group [%s in %s]",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	G_sleep(4);
 	return 0;
     }
@@ -156,7 +156,7 @@ int I_convert_con_points(char *group, struct Ortho_Control_Points *con_cp,
 	sprintf(msg,
 		"unable to open control point (Z) file for group [%s in %s]",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	G_sleep(4);
 	return 0;
     }
@@ -166,7 +166,7 @@ int I_convert_con_points(char *group, struct Ortho_Control_Points *con_cp,
     if (stat < 0) {
 	sprintf(msg, "bad format in control point file for group [%s in %s]",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	G_sleep(4);
 	return 0;
     }
diff --git a/imagery/i.ortho.photo/lib/fopen_camera.c b/imagery/i.ortho.photo/lib/fopen_camera.c
index 93cb326..2e904e9 100644
--- a/imagery/i.ortho.photo/lib/fopen_camera.c
+++ b/imagery/i.ortho.photo/lib/fopen_camera.c
@@ -46,7 +46,7 @@ static int error(char *camera, char *msga, char *msgb)
 
     sprintf(buf, "%s camera file [%s] in [%s %s] %s",
 	    msga, camera, G_location(), G_mapset(), msgb);
-    G_warning(buf);
+    G_warning("%s", buf);
 
     return 0;
 }
diff --git a/imagery/i.ortho.photo/lib/init_info.c b/imagery/i.ortho.photo/lib/init_info.c
index 0bb1a67..11f4bc6 100644
--- a/imagery/i.ortho.photo/lib/init_info.c
+++ b/imagery/i.ortho.photo/lib/init_info.c
@@ -101,7 +101,7 @@ int I_get_init_info(char *group, struct Ortho_Camera_Exp_Init *init_info)
     if (fd == NULL) {
 	sprintf(msg, "unable to open camera initial file %s in %s",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	return 0;
     }
 
@@ -110,7 +110,7 @@ int I_get_init_info(char *group, struct Ortho_Camera_Exp_Init *init_info)
     if (stat < 0) {
 	sprintf(msg, "bad format in camera initial file %s in %s",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	return 0;
     }
     return 1;
@@ -125,7 +125,7 @@ int I_put_init_info(char *group, struct Ortho_Camera_Exp_Init *init_info)
     if (fd == NULL) {
 	sprintf(msg, "unable to open camera initial file %s in %s",
 		group, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	return 0;
     }
 
diff --git a/imagery/i.ortho.photo/lib/m_mult.c b/imagery/i.ortho.photo/lib/m_mult.c
index 301ebc0..b93a512 100644
--- a/imagery/i.ortho.photo/lib/m_mult.c
+++ b/imagery/i.ortho.photo/lib/m_mult.c
@@ -21,7 +21,7 @@ int m_mult(MATRIX * a, MATRIX * b, MATRIX * c)
     if (a->ncols != b->nrows) {
 	sprintf(message, "*: matrices not conformable, %d x %d * %d x %d\n",
 		a->nrows, a->ncols, b->nrows, b->ncols);
-	fprintf(stderr, message);
+	fprintf(stderr, "%s", message);
 	return error(message);
     }
 
diff --git a/imagery/i.ortho.photo/lib/open_camera.c b/imagery/i.ortho.photo/lib/open_camera.c
index 30c6184..1b7af57 100644
--- a/imagery/i.ortho.photo/lib/open_camera.c
+++ b/imagery/i.ortho.photo/lib/open_camera.c
@@ -50,7 +50,7 @@ static int camera_error(char *camera, char *file, char *msga, char *msgb)
 
     sprintf(buf, "%sfile [%s] of group [%s in %s]%s",
 	    msga, file, camera, G_mapset(), msgb);
-    G_warning(buf);
+    G_warning("%s", buf);
 
     return 0;
 }
diff --git a/imagery/i.ortho.photo/lib/ref_points.c b/imagery/i.ortho.photo/lib/ref_points.c
index 6f03e8d..2fa6e65 100644
--- a/imagery/i.ortho.photo/lib/ref_points.c
+++ b/imagery/i.ortho.photo/lib/ref_points.c
@@ -97,7 +97,7 @@ int I_get_ref_points(char *groupname, struct Ortho_Photo_Points *cp)
 	sprintf(msg,
 		"unable to open reference point file for group [%s in %s]",
 		groupname, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	return 0;
     }
 
@@ -108,7 +108,7 @@ int I_get_ref_points(char *groupname, struct Ortho_Photo_Points *cp)
 	sprintf(msg,
 		"bad format in reference point file for group [%s in %s]",
 		groupname, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	return 0;
     }
     return 1;
@@ -124,7 +124,7 @@ int I_put_ref_points(char *groupname, struct Ortho_Photo_Points *cp)
 	sprintf(msg,
 		"unable to create reference point file for group [%s in %s]",
 		groupname, G_mapset());
-	G_warning(msg);
+	G_warning("%s", msg);
 	return 0;
     }
 
diff --git a/imagery/i.rectify/cp.c b/imagery/i.rectify/cp.c
index b0b2123..5cf06d6 100644
--- a/imagery/i.rectify/cp.c
+++ b/imagery/i.rectify/cp.c
@@ -67,7 +67,7 @@ int get_control_points(char *group, int order	/* THIS HAS BEEN ADDED WITH THE CR
 	    return 1;
 	}
     }
-    G_fatal_error(msg);
+    G_fatal_error("%s", msg);
 
     return 0; /* G_fatal_error() calls exit() */
 }
diff --git a/imagery/i.rectify/target.c b/imagery/i.rectify/target.c
index d97e3df..043628c 100644
--- a/imagery/i.rectify/target.c
+++ b/imagery/i.rectify/target.c
@@ -34,6 +34,6 @@ int get_target(char *group)
   error:
     strcat(buf, _("Please run i.target for group."));
     strcat(buf, group);
-    G_fatal_error(buf);
+    G_fatal_error("%s", buf);
     return 1;			/* never reached */
 }
diff --git a/raster/r.external/proj.c b/raster/r.external/proj.c
index d984196..9d1626f 100644
--- a/raster/r.external/proj.c
+++ b/raster/r.external/proj.c
@@ -110,7 +110,7 @@ void check_projection(struct Cell_head *cellhd, GDALDatasetH hDS, int override)
 	    strcat(error_msg,
 		   _("Consider generating a new location from the input dataset using "
 		     "the 'location' parameter.\n"));
-	    G_fatal_error(error_msg);
+	    G_fatal_error("%s", error_msg);
 	}
 	else {
 	    G_message(_("Projection of input dataset and current location "
diff --git a/raster/r.flow/mem.h b/raster/r.flow/mem.h
index ca34e0a..f763fac 100644
--- a/raster/r.flow/mem.h
+++ b/raster/r.flow/mem.h
@@ -33,7 +33,7 @@ void put_row_seg( /* l, row */ );
 		   Segment_get_row(l.seg, l.buf[row] - l.col_offset, \
 				          row + l.row_offset) < 1)) ? \
 	(sprintf(string, "r.flow: cannot write segment file for %s", l.name),\
-	 G_fatal_error(string), (DCELL *) NULL) : \
+	 G_fatal_error("%s", string), (DCELL *) NULL) :                  \
 	l.buf[row])
 
 /*   This was is Astley's version 12...
@@ -52,7 +52,7 @@ void put_row_seg( /* l, row */ );
 	(Segment_get(as.seg, &v, \
 			row + as.row_offset, col + as.col_offset) < 1 ? \
 	  (sprintf(string,"r.flow: cannot read segment file for %s",as.name), \
-	   G_fatal_error(string), 0) :					\
+	   G_fatal_error("%s", string), 0) :                             \
 	  v) : \
 	(parm.mem ? \
 	   aspect_fly(el.buf[row - 1] + col, \
@@ -64,7 +64,7 @@ void put_row_seg( /* l, row */ );
     (parm.seg ? \
 	(Segment_get(l.seg, &v, row + l.row_offset, col + l.col_offset) < 1 ? \
 	  (sprintf(string,"r.flow: cannot read segment file for %s",l.name),\
-	   G_fatal_error(string), 0) : \
+	   G_fatal_error("%s", string), 0) :                             \
 	 v) : \
 	l.buf[row][col])
 
@@ -72,7 +72,7 @@ void put_row_seg( /* l, row */ );
     (parm.seg ? \
 	(v = w, \
 	 Segment_put(l.seg, &v, row + l.row_offset, col + l.col_offset) < 1 ? \
-	  (sprintf(string,"r.flow: cannot write segment file for %s",l.name), \
-	   G_fatal_error(string), 0) : \
+           (sprintf(string, "r.flow: cannot write segment file for %s",l.name), \
+            G_fatal_error("%s", string), 0) :                            \
 	 0) : \
 	(l.buf[row][col] = w))
diff --git a/raster/r.in.gdal/main.c b/raster/r.in.gdal/main.c
index 778b5f4..457f22e 100644
--- a/raster/r.in.gdal/main.c
+++ b/raster/r.in.gdal/main.c
@@ -872,7 +872,7 @@ static void SetupReprojector(const char *pszSrcWKT, const char *pszDstLoc,
 		target_mapset, pszDstLoc);
 	strcat(errbuf, permissions == 0 ? _("permission denied")
 	       : _("not found"));
-	G_fatal_error(errbuf);
+	G_fatal_error("%s", errbuf);
     }				/* permission check */
 
     /* And switch back to original location */
diff --git a/raster/r.in.lidar/main.c b/raster/r.in.lidar/main.c
index aae2dcb..390f990 100644
--- a/raster/r.in.lidar/main.c
+++ b/raster/r.in.lidar/main.c
@@ -451,7 +451,7 @@ int main(int argc, char *argv[])
 	    strcat(error_msg,
 		   _("Consider generating a new location with 'location' parameter"
 		    " from input data set.\n"));
-	    G_fatal_error(error_msg);
+	    G_fatal_error("%s", error_msg);
 	}
 	else if (!shell_style->answer) {
 	    G_message(_("Projection of input dataset and current location "
@@ -1229,7 +1229,7 @@ int main(int argc, char *argv[])
 
 
     sprintf(buff, _("%lu points found in region."), count_total);
-    G_done_msg(buff);
+    G_done_msg("%s", buff);
     G_debug(1, "Processed %lu points.", line_total);
 
     exit(EXIT_SUCCESS);
diff --git a/raster/r.in.xyz/main.c b/raster/r.in.xyz/main.c
index d4ce602..2580217 100644
--- a/raster/r.in.xyz/main.c
+++ b/raster/r.in.xyz/main.c
@@ -1153,7 +1153,7 @@ int main(int argc, char *argv[])
 
 
     sprintf(buff, _("%lu points found in region."), count_total);
-    G_done_msg(buff);
+    G_done_msg("%s", buff);
     G_debug(1, "Processed %lu lines.", line);
 
     exit(EXIT_SUCCESS);
diff --git a/raster/r.profile/main.c b/raster/r.profile/main.c
index 458ff75..dba7ceb 100644
--- a/raster/r.profile/main.c
+++ b/raster/r.profile/main.c
@@ -187,7 +187,7 @@ int main(int argc, char *argv[])
 	sprintf(formatbuff, _("Along track dist. [%s], Elevation"), unit);
     if (clr)
 	strcat(formatbuff, _(" RGB color"));
-    G_message(formatbuff);
+    G_message("%s", formatbuff);
 
     /* Get Profile Start Coords */
     if (parm.coord_file->answer) {
diff --git a/raster/r.quant/read_rules.c b/raster/r.quant/read_rules.c
index a4e467c..d255ccd 100644
--- a/raster/r.quant/read_rules.c
+++ b/raster/r.quant/read_rules.c
@@ -20,13 +20,13 @@ int read_range(void)
     for (i = 0; i < noi; i++) {
 	if (Rast_read_fp_range(name[i], G_mapset(), &drange) <= 0) {
 	    sprintf(buff, "Can't read f_range for map %s", name[i]);
-	    G_fatal_error(buff);
+	    G_fatal_error("%s", buff);
 	}
 	Rast_get_fp_range_min_max(&drange, &tmp_dmin, &tmp_dmax);
 
 	if (Rast_read_range(name[i], G_mapset(), &range) <= 0) {
 	    sprintf(buff, "Can't read range for map %s", name[i]);
-	    G_fatal_error(buff);
+	    G_fatal_error("%s", buff);
 	}
 	Rast_get_range_min_max(&range, &tmp_min, &tmp_max);
 	if (!i || tmp_max > old_max || Rast_is_c_null_value(&old_max))
diff --git a/raster/r.random.surface/init.c b/raster/r.random.surface/init.c
index c19046b..738d843 100644
--- a/raster/r.random.surface/init.c
+++ b/raster/r.random.surface/init.c
@@ -110,7 +110,7 @@ void Init(void)
 		Seeds[i] = Seeds[i] % SEED_MAX;
 		sprintf(msg2, _(" seed is set to %d"), Seeds[i]);
 		strcat(msg, msg2);
-		G_warning(msg);
+		G_warning("%s", msg);
 	    }
 	    else if (Seeds[i] < SEED_MIN) {
 		sprintf(msg, _("Seed (%d) smaller than minimum (%d)"),
@@ -119,7 +119,7 @@ void Init(void)
 		    Seeds[i] += SEED_MAX - SEED_MIN;
 		sprintf(msg2, _(" seed is set to %d"), Seeds[i]);
 		strcat(msg, msg2);
-		G_warning(msg);
+		G_warning("%s", msg);
 	    }
 	}			/* /for */
     }				/* /else */
diff --git a/raster/r.reclass/main.c b/raster/r.reclass/main.c
index c3a8463..e640088 100644
--- a/raster/r.reclass/main.c
+++ b/raster/r.reclass/main.c
@@ -121,7 +121,7 @@ int main(int argc, char *argv[])
 	    }
 	    else {
 		strcat(buf, _(" - invalid reclass rule"));
-		G_fatal_error(buf);
+		G_fatal_error("%s", buf);
 	    }
 	    break;
 
diff --git a/raster/r.to.rast3/main.c b/raster/r.to.rast3/main.c
index 7a6e790..4901b27 100644
--- a/raster/r.to.rast3/main.c
+++ b/raster/r.to.rast3/main.c
@@ -64,7 +64,7 @@ void fatal_error(void *map, int *fd, int depths, char *errorMsg)
             close_input_raster_map(fd[i]);
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
     exit(EXIT_FAILURE);
 
 }
diff --git a/raster/r.to.rast3elev/main.c b/raster/r.to.rast3elev/main.c
index 1766514..fcd0286 100644
--- a/raster/r.to.rast3elev/main.c
+++ b/raster/r.to.rast3elev/main.c
@@ -142,7 +142,7 @@ void fatal_error(Database db, char *errorMsg)
     if (db.elev)
         close_input_raster_map(db.elev);
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
     exit(EXIT_FAILURE);
 }
 
diff --git a/raster/r.to.vect/main.c b/raster/r.to.vect/main.c
index bc7bb93..9db8ed6 100644
--- a/raster/r.to.vect/main.c
+++ b/raster/r.to.vect/main.c
@@ -216,7 +216,7 @@ int main(int argc, char *argv[])
 
 	db_append_string(&sql, ")");
 
-	G_debug(3, db_get_string(&sql));
+	G_debug(3, "%s", db_get_string(&sql));
 
 	if (db_execute_immediate(driver, &sql) != DB_OK)
 	    G_fatal_error(_("Unable to create table: %s"),
@@ -296,7 +296,7 @@ int main(int argc, char *argv[])
 		sprintf(buf, "insert into %s values ( %d, '%s')", Fi->table,
 			cat, db_get_string(&label));
 		db_set_string(&sql, buf);
-		G_debug(3, db_get_string(&sql));
+		G_debug(3, "%s", db_get_string(&sql));
 
 		if (db_execute_immediate(driver, &sql) != DB_OK)
 		    G_fatal_error(_("Unable to insert into table: %s"),
diff --git a/raster/r.to.vect/util.c b/raster/r.to.vect/util.c
index eebc212..bc8a39c 100644
--- a/raster/r.to.vect/util.c
+++ b/raster/r.to.vect/util.c
@@ -151,7 +151,7 @@ void insert_value(int cat, int val, double dval)
 
     db_append_string(&sql, ")");
 
-    G_debug(3, db_get_string(&sql));
+    G_debug(3, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK)
 	G_fatal_error(_("Cannot insert new row: %s"), db_get_string(&sql));
diff --git a/raster3d/r3.cross.rast/main.c b/raster3d/r3.cross.rast/main.c
index 1dadcde..600384f 100644
--- a/raster3d/r3.cross.rast/main.c
+++ b/raster3d/r3.cross.rast/main.c
@@ -62,7 +62,7 @@ void fatal_error(void *map, int elevfd, int outfd, char *errorMsg)
     if (elevfd != -1)
         close_output_map(elevfd);
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
     exit(EXIT_FAILURE);
 
 }
diff --git a/raster3d/r3.in.ascii/main.c b/raster3d/r3.in.ascii/main.c
index 9e92285..a67d7ad 100644
--- a/raster3d/r3.in.ascii/main.c
+++ b/raster3d/r3.in.ascii/main.c
@@ -65,7 +65,7 @@ void fatalError(char *errorMsg)
         Rast3d_close(map);
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
 }
 
 /*---------------------------------------------------------------------------*/
diff --git a/raster3d/r3.in.v5d/main.c b/raster3d/r3.in.v5d/main.c
index 7d1652f..d258818 100644
--- a/raster3d/r3.in.v5d/main.c
+++ b/raster3d/r3.in.v5d/main.c
@@ -48,7 +48,7 @@ static void fatalError(char *errorMsg)
 	/* should unopen map here! */
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
 }
 
 /*---------------------------------------------------------------------------*/
diff --git a/raster3d/r3.out.ascii/main.c b/raster3d/r3.out.ascii/main.c
index 72d50bd..2af12d0 100644
--- a/raster3d/r3.out.ascii/main.c
+++ b/raster3d/r3.out.ascii/main.c
@@ -64,7 +64,7 @@ void fatalError(char *errorMsg)
 
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
 }
 
 /*---------------------------------------------------------------------------*/
diff --git a/raster3d/r3.out.v5d/main.c b/raster3d/r3.out.v5d/main.c
index 5d54b1f..7b74c33 100644
--- a/raster3d/r3.out.v5d/main.c
+++ b/raster3d/r3.out.v5d/main.c
@@ -55,7 +55,7 @@ void fatalError(char *errorMsg)
 	    fatalError(_("Unable to close 3D raster map"));
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
 }
 
 /*---------------------------------------------------------------------------*/
diff --git a/raster3d/r3.retile/main.c b/raster3d/r3.retile/main.c
index 10fb26e..c10d7f5 100644
--- a/raster3d/r3.retile/main.c
+++ b/raster3d/r3.retile/main.c
@@ -54,7 +54,7 @@ void fatal_error(void *map, int *fd, int depths, char *errorMsg)
             Rast_unopen(fd[i]);
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
     exit(EXIT_FAILURE);
 
 }
diff --git a/raster3d/r3.to.rast/main.c b/raster3d/r3.to.rast/main.c
index 9006d22..1119f26 100644
--- a/raster3d/r3.to.rast/main.c
+++ b/raster3d/r3.to.rast/main.c
@@ -60,7 +60,7 @@ void fatal_error(void *map, int *fd, int depths, char *errorMsg)
             Rast_unopen(fd[i]);
     }
 
-    Rast3d_fatal_error(errorMsg);
+    Rast3d_fatal_error("%s", errorMsg);
     exit(EXIT_FAILURE);
 
 }
diff --git a/vector/v.in.ascii/main.c b/vector/v.in.ascii/main.c
index adcd9d2..dae9c59 100644
--- a/vector/v.in.ascii/main.c
+++ b/vector/v.in.ascii/main.c
@@ -404,7 +404,7 @@ int main(int argc, char *argv[])
 				Fi->driver);
 
 	    /* Create table */
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 	    if (db_execute_immediate(driver, &sql) != DB_OK) {
 		G_fatal_error(_("Unable to create table: %s"),
 			      db_get_string(&sql));
diff --git a/vector/v.in.ascii/points.c b/vector/v.in.ascii/points.c
index a3c5186..bfa6d2f 100644
--- a/vector/v.in.ascii/points.c
+++ b/vector/v.in.ascii/points.c
@@ -446,7 +446,7 @@ int points_to_bin(FILE * ascii, int rowlen, struct Map_info *Map,
 		db_append_string(&sql, buf2);
 	    }
 	    db_append_string(&sql, ")");
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 
 	    if (db_execute_immediate(driver, &sql) != DB_OK) {
 		G_fatal_error(_("Unable to insert new record: %s"),
diff --git a/vector/v.in.lidar/main.c b/vector/v.in.lidar/main.c
index 6b22cbe..f4cd4cf 100644
--- a/vector/v.in.lidar/main.c
+++ b/vector/v.in.lidar/main.c
@@ -472,7 +472,7 @@ int main(int argc, char *argv[])
 	    strcat(error_msg,
 		   _("Consider generating a new location with 'location' parameter"
 		    " from input data set.\n"));
-	    G_fatal_error(error_msg);
+	    G_fatal_error("%s", error_msg);
 	}
 	else {
 	    G_verbose_message(_("Projection of input dataset and current "
@@ -596,7 +596,7 @@ int main(int argc, char *argv[])
 	}
 
 	db_append_string(&sql, ")");
-	G_debug(3, db_get_string(&sql));
+	G_debug(3, "%s", db_get_string(&sql));
 
 	driver =
 	    db_start_driver_open_database(Fi->driver,
@@ -778,7 +778,7 @@ int main(int argc, char *argv[])
 		db_append_string(&sql, buf);
 	    }
 	    db_append_string(&sql, " )");
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 
 	    if (db_execute_immediate(driver, &sql) != DB_OK) {
 		G_fatal_error(_("Cannot insert new row: %s"),
diff --git a/vector/v.in.ogr/main.c b/vector/v.in.ogr/main.c
index 6604065..1b16e85 100644
--- a/vector/v.in.ogr/main.c
+++ b/vector/v.in.ogr/main.c
@@ -1101,7 +1101,7 @@ int main(int argc, char *argv[])
 		G_free(Ogr_fieldname);
 	    }
 	    db_append_string(&sql, ")");
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 
 	    driver =
 		db_start_driver_open_database(Fi->driver,
@@ -1236,7 +1236,7 @@ int main(int argc, char *argv[])
 		    db_append_string(&sql, buf);
 		}
 		db_append_string(&sql, " )");
-		G_debug(3, db_get_string(&sql));
+		G_debug(3, "%s", db_get_string(&sql));
 
 		if (db_execute_immediate(driver, &sql) != DB_OK) {
 		    db_close_database(driver);
diff --git a/vector/v.net.allpairs/main.c b/vector/v.net.allpairs/main.c
index ae877fd..b459021 100644
--- a/vector/v.net.allpairs/main.c
+++ b/vector/v.net.allpairs/main.c
@@ -172,7 +172,7 @@ int main(int argc, char *argv[])
 	    Fi->table);
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	db_close_database_shutdown_driver(driver);
@@ -264,7 +264,7 @@ int main(int argc, char *argv[])
 	    sprintf(buf, "insert into %s values (%d, %d, %d, %f)",
 		    Fi->table, cat, spnode[i].cat, spnode[j].cat, cost);
 	    db_set_string(&sql, buf);
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 
 	    if (db_execute_immediate(driver, &sql) != DB_OK) {
 		db_close_database_shutdown_driver(driver);
diff --git a/vector/v.net.centrality/main.c b/vector/v.net.centrality/main.c
index 0f89bb3..fc7058f 100644
--- a/vector/v.net.centrality/main.c
+++ b/vector/v.net.centrality/main.c
@@ -260,7 +260,7 @@ int main(int argc, char *argv[])
 	    "create table %s(cat integer%s)", Fi->table, db_get_string(&tmp));
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	G_fatal_error(_("Unable to create table: '%s'"), db_get_string(&sql));
diff --git a/vector/v.net.components/main.c b/vector/v.net.components/main.c
index 0520651..9a1d6dd 100644
--- a/vector/v.net.components/main.c
+++ b/vector/v.net.components/main.c
@@ -31,7 +31,7 @@ int insert_new_record(dbDriver * driver, struct field_info *Fi,
 
     sprintf(buf, "insert into %s values (%d, %d)", Fi->table, cat, comp);
     db_set_string(sql, buf);
-    G_debug(3, db_get_string(sql));
+    G_debug(3, "%s", db_get_string(sql));
 
     if (db_execute_immediate(driver, sql) != DB_OK) {
 	db_close_database_shutdown_driver(driver);
@@ -182,7 +182,7 @@ int main(int argc, char *argv[])
     sprintf(buf, "create table %s ( cat integer, comp integer)", Fi->table);
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	db_close_database_shutdown_driver(driver);
diff --git a/vector/v.net.distance/main.c b/vector/v.net.distance/main.c
index fbf61c8..0bd04ac 100644
--- a/vector/v.net.distance/main.c
+++ b/vector/v.net.distance/main.c
@@ -257,7 +257,7 @@ int main(int argc, char *argv[])
 	    Fi->table);
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	G_fatal_error(_("Unable to create table: '%s'"), db_get_string(&sql));
@@ -320,7 +320,7 @@ int main(int argc, char *argv[])
 		    tcat, cost);
 
 	    db_set_string(&sql, buf);
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 	    if (db_execute_immediate(driver, &sql) != DB_OK) {
 		G_fatal_error(_("Cannot insert new record: %s"),
 			      db_get_string(&sql));
diff --git a/vector/v.net.flow/main.c b/vector/v.net.flow/main.c
index 1a37d2a..a002180 100644
--- a/vector/v.net.flow/main.c
+++ b/vector/v.net.flow/main.c
@@ -174,7 +174,7 @@ int main(int argc, char *argv[])
 	    Fi->table);
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	db_close_database_shutdown_driver(driver);
@@ -255,7 +255,7 @@ int main(int argc, char *argv[])
 	    sprintf(buf, "insert into %s values (%d, %f)", Fi->table, cat,
 		    flow[i] / (double)In.dgraph.cost_multip);
 	    db_set_string(&sql, buf);
-	    G_debug(3, db_get_string(&sql));
+	    G_debug(3, "%s", db_get_string(&sql));
 
 	    if (db_execute_immediate(driver, &sql) != DB_OK) {
 		db_close_database_shutdown_driver(driver);
diff --git a/vector/v.net.path/path.c b/vector/v.net.path/path.c
index ed0f04c..a45023c 100644
--- a/vector/v.net.path/path.c
+++ b/vector/v.net.path/path.c
@@ -103,7 +103,7 @@ int path(struct Map_info *In, struct Map_info *Out, char *filename,
 	    Fi->table);
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	G_fatal_error(_("Unable to create table: '%s'"), db_get_string(&sql));
@@ -306,7 +306,7 @@ int path(struct Map_info *In, struct Map_info *Out, char *filename,
 		"insert into %s values ( %d, %d, %d, %d, %d, %f, %f, %f)",
 		Fi->table, cat, id, fcat, tcat, sp, cost, fdist, tdist);
 	db_set_string(&sql, buf);
-	G_debug(3, db_get_string(&sql));
+	G_debug(3, "%s", db_get_string(&sql));
 
 	if (db_execute_immediate(driver, &sql) != DB_OK) {
 	    G_fatal_error(_("Cannot insert new record: %s"),
diff --git a/vector/v.net.timetable/main.c b/vector/v.net.timetable/main.c
index 2e9bba6..18f2ba6 100644
--- a/vector/v.net.timetable/main.c
+++ b/vector/v.net.timetable/main.c
@@ -96,7 +96,7 @@ void init_database(struct Map_info *Out, dbDriver ** driver,
     sprintf(buf, "create table %s (%s)", (*Fi)->table, columns);
 
     db_set_string(&sql, buf);
-    G_debug(2, db_get_string(&sql));
+    G_debug(2, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(*driver, &sql) != DB_OK) {
 	db_close_database_shutdown_driver(*driver);
@@ -128,7 +128,7 @@ void insert_point(dbDriver * driver, char *table, int cat, int path,
     sprintf(buf, "insert into %s values (%d, %d, %d, %d, %d, %d)", table, cat,
 	    path, stop_id, index, arrival_time, departure_time);
     db_set_string(&sql, buf);
-    G_debug(3, db_get_string(&sql));
+    G_debug(3, "%s", db_get_string(&sql));
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	db_close_database_shutdown_driver(driver);
 	G_fatal_error(_("Cannot insert new record: %s"), db_get_string(&sql));
@@ -150,7 +150,7 @@ void insert_line(dbDriver * driver, char *table, int cat, int path,
 	    table, cat, path, from_id, to_id, route_id, index, from_time,
 	    to_time);
     db_set_string(&sql, buf);
-    G_debug(3, db_get_string(&sql));
+    G_debug(3, "%s", db_get_string(&sql));
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	db_close_database_shutdown_driver(driver);
 	G_fatal_error(_("Cannot insert new record: %s"), db_get_string(&sql));
diff --git a/vector/v.net/main.c b/vector/v.net/main.c
index d1cc5b2..12e0d39 100644
--- a/vector/v.net/main.c
+++ b/vector/v.net/main.c
@@ -171,7 +171,7 @@ int main(int argc, char **argv)
     if (file_arcs)
 	fclose(file_arcs);
 
-    G_done_msg(message);
+    G_done_msg("%s", message);
 
     return (EXIT_SUCCESS);
 }
diff --git a/vector/v.out.postgis/create.c b/vector/v.out.postgis/create.c
index 5aa1682..a33dc20 100644
--- a/vector/v.out.postgis/create.c
+++ b/vector/v.out.postgis/create.c
@@ -77,9 +77,9 @@ char *create_pgfile(const char *dsn, const char *schema, const char *olink,
 	    G_set_key_value(tokens[0], tokens[1], key_val);
 	    
 	    if (strcmp(tokens[0], "fid") == 0)
-		G_asprintf(fid_column, tokens[1]);
+                G_asprintf(fid_column, "%s", tokens[1]);
 	    if (strcmp(tokens[0], "geometry_name") == 0)
-		G_asprintf(geom_column, tokens[1]);
+		G_asprintf(geom_column, "%s", tokens[1]);
 
 	    G_free_tokens(tokens);
 	}
diff --git a/vector/v.overlay/area_area.c b/vector/v.overlay/area_area.c
index 70d5323..e766126 100644
--- a/vector/v.overlay/area_area.c
+++ b/vector/v.overlay/area_area.c
@@ -339,7 +339,7 @@ int area_area(struct Map_info *In, int *field, struct Map_info *Tmp,
 
 			db_append_string(&stmt, " )");
 
-			G_debug(3, db_get_string(&stmt));
+			G_debug(3, "%s", db_get_string(&stmt));
 
 			if (db_execute_immediate(driver, &stmt) != DB_OK)
 			    G_warning(_("Unable to insert new record: '%s'"),
diff --git a/vector/v.overlay/line_area.c b/vector/v.overlay/line_area.c
index 5bd828d..5384193 100644
--- a/vector/v.overlay/line_area.c
+++ b/vector/v.overlay/line_area.c
@@ -404,7 +404,7 @@ int line_area(struct Map_info *In, int *field, struct Map_info *Tmp,
 
 			    db_append_string(&stmt, " )");
 
-			    G_debug(3, db_get_string(&stmt));
+			    G_debug(3, "%s", db_get_string(&stmt));
 
 			    if (db_execute_immediate(driver, &stmt) != DB_OK)
 				G_warning(_("Unable to insert new record: '%s'"),
diff --git a/vector/v.overlay/main.c b/vector/v.overlay/main.c
index e9bdc91..2e163a5 100644
--- a/vector/v.overlay/main.c
+++ b/vector/v.overlay/main.c
@@ -572,7 +572,7 @@ int main(int argc, char *argv[])
 
 	db_append_string(&stmt, " )");
 
-	G_debug(3, db_get_string(&stmt));
+	G_debug(3, "%s", db_get_string(&stmt));
 
 	if (db_execute_immediate(driver, &stmt) != DB_OK) {
 	    Vect_close(&Out);
diff --git a/vector/v.random/main.c b/vector/v.random/main.c
index 51b9419..07e8671 100644
--- a/vector/v.random/main.c
+++ b/vector/v.random/main.c
@@ -462,7 +462,7 @@ int main(int argc, char *argv[])
 			sprintf(buf, "%.0f )", z);
 		    db_append_string(&sql, buf);
 
-		    G_debug(3, db_get_string(&sql));
+		    G_debug(3, "%s", db_get_string(&sql));
 		    if (db_execute_immediate(driver, &sql) != DB_OK) {
 			G_fatal_error(_("Cannot insert new row: %s"),
 				      db_get_string(&sql));
@@ -582,7 +582,7 @@ int main(int argc, char *argv[])
 		    sprintf(buf, "%.0f )", z);
 		db_append_string(&sql, buf);
 
-		G_debug(3, db_get_string(&sql));
+		G_debug(3, "%s", db_get_string(&sql));
 		if (db_execute_immediate(driver, &sql) != DB_OK) {
 		    G_fatal_error(_("Cannot insert new row: %s"),
 				  db_get_string(&sql));
diff --git a/vector/v.rectify/cp.c b/vector/v.rectify/cp.c
index c3c9464..d5e3eed 100644
--- a/vector/v.rectify/cp.c
+++ b/vector/v.rectify/cp.c
@@ -373,7 +373,7 @@ int get_control_points(char *group, char *pfile, int order, int use3d,
 	break;
     }
     if (ret != 1)
-	G_fatal_error(msg);
+        G_fatal_error("%s", msg);
 	
     if (rms) {
 	compute_rms(&cp, &cp3, order, use3d, orthorot, sep, fpr);
diff --git a/vector/v.rectify/target.c b/vector/v.rectify/target.c
index efa6dc6..77c461b 100644
--- a/vector/v.rectify/target.c
+++ b/vector/v.rectify/target.c
@@ -42,6 +42,6 @@ int get_target(char *group)
   error:
     strcat(buf, _("Please run i.target for group."));
     strcat(buf, group);
-    G_fatal_error(buf);
+    G_fatal_error("%s", buf);
     return 1;			/* never reached */
 }
diff --git a/vector/v.surf.rst/main.c b/vector/v.surf.rst/main.c
index 286d7a1..1c7f2ed 100644
--- a/vector/v.surf.rst/main.c
+++ b/vector/v.surf.rst/main.c
@@ -581,7 +581,7 @@ int main(int argc, char *argv[])
 	db_append_string(&sql2, "cat integer");
 	db_append_string(&sql2, ", flt1 double precision");
 	db_append_string(&sql2, ")");
-	G_debug(1, db_get_string(&sql2));
+	G_debug(1, "%s", db_get_string(&sql2));
 	driver2 = db_start_driver_open_database(ff->driver, ff->database);
 	if (driver2 == NULL)
 	    G_fatal_error(_("Unable to open database <%s> by driver <%s>"),
diff --git a/vector/v.vol.rst/main.c b/vector/v.vol.rst/main.c
index fe4bf63..a283d7e 100644
--- a/vector/v.vol.rst/main.c
+++ b/vector/v.vol.rst/main.c
@@ -594,7 +594,7 @@ int main(int argc, char *argv[])
 	db_append_string(&sql, " integer");
 	db_append_string(&sql, ", flt1 double precision");
 	db_append_string(&sql, ")");
-	G_debug(1, db_get_string(&sql));
+	G_debug(1, "%s", db_get_string(&sql));
 	driver = db_start_driver_open_database(f->driver, f->database);
 	if (driver == NULL)
 	    G_fatal_error(_("Unable to open database <%s> by driver <%s>"),
diff --git a/vector/v.vol.rst/vector.c b/vector/v.vol.rst/vector.c
index 3551603..a3bfc1b 100644
--- a/vector/v.vol.rst/vector.c
+++ b/vector/v.vol.rst/vector.c
@@ -72,7 +72,7 @@ int point_save(double xmm, double ymm, double zmm, double err)
     sprintf(buf, ", %f", err);
     db_append_string(&sql, buf);
     db_append_string(&sql, ")");
-    G_debug(3, db_get_string(&sql));
+    G_debug(3, "%s", db_get_string(&sql));
 
     if (db_execute_immediate(driver, &sql) != DB_OK) {
 	db_close_database(driver);
diff --git a/vector/v.what.rast/main.c b/vector/v.what.rast/main.c
index 542093f..e329710 100644
--- a/vector/v.what.rast/main.c
+++ b/vector/v.what.rast/main.c
@@ -623,7 +623,7 @@ int main(int argc, char *argv[])
 		sprintf(buf, " AND %s", opt.where->answer);
 		db_append_string(&stmt, buf);
 	    }
-	    G_debug(3, db_get_string(&stmt));
+	    G_debug(3, "%s", db_get_string(&stmt));
 
 	    /* Update table */
 	    if (db_execute_immediate(driver, &stmt) == DB_OK) {
diff --git a/vector/v.what.rast3/main.c b/vector/v.what.rast3/main.c
index d84f155..27ff931 100644
--- a/vector/v.what.rast3/main.c
+++ b/vector/v.what.rast3/main.c
@@ -305,7 +305,7 @@ int main(int argc, char *argv[])
 	    G_snprintf(buf, 2048, " AND %s", opt.where->answer);
 	    db_append_string(&stmt, buf);
 	}
-	G_debug(3, db_get_string(&stmt));
+	G_debug(3, "%s", db_get_string(&stmt));
 
 	/* Update table */
 	if (db_execute_immediate(driver, &stmt) == DB_OK) {