diff --git a/html/includes/graphs/generic_multi.inc.php b/html/includes/graphs/generic_multi.inc.php
index 1e3f4f781..c9c1053f8 100644
--- a/html/includes/graphs/generic_multi.inc.php
+++ b/html/includes/graphs/generic_multi.inc.php
@@ -34,7 +34,7 @@ foreach ($rrd_list as $rrd)
   $ds = $rrd['ds'];
   $filename = $rrd['filename'];
 
-  $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr'], $descr_len),0,$descr_len));
+  $descr = rrdtool_escape($rrd['descr'], $descr_len);
 
   $id = "ds".$i;
 
diff --git a/html/includes/graphs/generic_multi_bits_separated.inc.php b/html/includes/graphs/generic_multi_bits_separated.inc.php
index 67529851b..6d6145f1f 100644
--- a/html/includes/graphs/generic_multi_bits_separated.inc.php
+++ b/html/includes/graphs/generic_multi_bits_separated.inc.php
@@ -34,12 +34,12 @@ foreach ($rrd_list as $rrd)
 
   if (isset($rrd['descr_in']))
   {
-    $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr_in'], $descr_len),0,$descr_len)) . "  In";
+    $descr     = rrdtool_escape($rrd['descr_in'], $descr_len) . "  In";
   } else {
-    $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr'], $descr_len),0,$descr_len)) . "  In";
+    $descr     = rrdtool_escape($rrd['descr'], $descr_len) . "  In";
   }
-  $descr_out = str_replace(":", "\:", substr(str_pad($rrd['descr_out'], $descr_len),0,$descr_len)). " Out";
-  $descr     = str_replace("'", "", $descr);
+  $descr_out = rrdtool_escape($rrd['descr_out'], $descr_len) . " Out";
+  $descr     = str_replace("'", "", $descr); # FIXME does this mean ' should be filtered in rrdtool_escape? probably...
   $descr_out = str_replace("'", "", $descr_out);
 
   $rrd_options .= " DEF:".$in.$i."=".$rrd['filename'].":".$ds_in.":AVERAGE ";
diff --git a/html/includes/graphs/generic_multi_data_separated.inc.php b/html/includes/graphs/generic_multi_data_separated.inc.php
index 146b00914..cbc1bbd33 100644
--- a/html/includes/graphs/generic_multi_data_separated.inc.php
+++ b/html/includes/graphs/generic_multi_data_separated.inc.php
@@ -34,13 +34,12 @@ foreach ($rrd_list as $rrd)
 
   if (isset($rrd['descr_in']))
   {
-    $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr_in'], $descr_len),0,$descr_len)) . "  In";
+    $descr     = rrdtool_escape($rrd['descr_in'], $descr_len) . "  In";
   } else {
-    $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr'], $descr_len),0,$descr_len)) . "  In";
+    $descr     = rrdtool_escape($rrd['descr'], $descr_len) . "  In";
   }
-  $descr_out = str_replace(":", "\:", substr(str_pad($rrd['descr_out'], $descr_len),0,$descr_len)). " Out";
-
-  $descr     = str_replace("'", "", $descr);
+  $descr_out = rrdtool_escape($rrd['descr_out'], $descr_len) . " Out";
+  $descr     = str_replace("'", "", $descr); # FIXME does this mean ' should be filtered in rrdtool_escape? probably...
   $descr_out = str_replace("'", "", $descr_out);
 
   $rrd_options .= " DEF:".$in.$i."=".$rrd['filename'].":".$ds_in.":AVERAGE ";
diff --git a/html/includes/graphs/generic_multi_line.inc.php b/html/includes/graphs/generic_multi_line.inc.php
index e6411bba9..7117f79e1 100644
--- a/html/includes/graphs/generic_multi_line.inc.php
+++ b/html/includes/graphs/generic_multi_line.inc.php
@@ -34,7 +34,7 @@ foreach ($rrd_list as $rrd)
   $ds = $rrd['ds'];
   $filename = $rrd['filename'];
 
-  $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr'], $descr_len),0,$descr_len));
+  $descr = rrdtool_escape($rrd['descr'], $descr_len);
 
   $id = "ds".$i;
 
diff --git a/html/includes/graphs/generic_multi_seperated.inc.php b/html/includes/graphs/generic_multi_seperated.inc.php
index 5ff7f01f3..670a736e9 100644
--- a/html/includes/graphs/generic_multi_seperated.inc.php
+++ b/html/includes/graphs/generic_multi_seperated.inc.php
@@ -7,7 +7,7 @@ $units_descr = substr(str_pad($units_descr, 18),0,18);
 if($format == "octets" || $format == "bytes")
 {
   $units = "Bps";
-  $format = "bits";
+  $format = "bits"; # FIXME bits? or bytes?
 } else {
   $units = "bps";
   $format = "bits";
@@ -64,7 +64,7 @@ foreach ($rrd_list as $rrd)
 
   if ($i) { $stack="STACK"; }
 
-  $rrd_options .= " AREA:inbits".$i."#" . $colour_in . ":'" . substr(str_pad($rrd['descr'], 10),0,10) . "In ':$stack";
+  $rrd_options .= " AREA:inbits".$i."#" . $colour_in . ":'" . rrdtool_escape($rrd['descr'], 10) . "In ':$stack";
   $rrd_options .= " GPRINT:inbits".$i.":LAST:%6.2lf%s";
   $rrd_options .= " GPRINT:inbits".$i.":AVERAGE:%6.2lf%s";
   $rrd_options .= " GPRINT:inbits".$i.":MAX:%6.2lf%s";
diff --git a/html/includes/graphs/generic_multi_simplex_seperated.inc.php b/html/includes/graphs/generic_multi_simplex_seperated.inc.php
index d4908e5a5..da5fd92da 100644
--- a/html/includes/graphs/generic_multi_simplex_seperated.inc.php
+++ b/html/includes/graphs/generic_multi_simplex_seperated.inc.php
@@ -4,9 +4,9 @@ include("includes/graphs/common.inc.php");
 
 if($width > "500")
 {
-  $descr_len=24;
+  $descr_len = 24; # FIXME may even be more imo?
 } else {
-  $descr_len=12;
+  $descr_len = 12;
   $descr_len += round(($width - 250) / 8);
 }
 
@@ -39,7 +39,7 @@ foreach ($rrd_list as $i => $rrd)
     $colour_iter++;
   }
 
-  $descr     = str_replace(":", "\:", substr(str_pad($rrd['descr'], $descr_len),0,$descr_len));
+  $descr = rrdtool_escape($rrd['descr'], $descr_len);
 
   $rrd_options .= " DEF:".$rrd['ds'].$i."=".$rrd['filename'].":".$rrd['ds'].":AVERAGE ";
 
@@ -101,7 +101,7 @@ foreach ($rrd_list as $i => $rrd)
   $rrd_options .= " GPRINT:".$t_defname.$i.":LAST:%5.2lf%s GPRINT:".$t_defname.$i."min:MIN:%5.2lf%s";
   $rrd_options .= " GPRINT:".$t_defname.$i."max:MAX:%5.2lf%s GPRINT:".$t_defname.$i.":AVERAGE:'%5.2lf%s\\n'";
 
-  if (!$nototal) { $rrd_options .= " GPRINT:tot".$rrd['ds'].$i.":%6.2lf%s".str_replace("%", "%%", $total_units).""; }
+  if (!$nototal) { $rrd_options .= " GPRINT:tot".$rrd['ds'].$i.":%6.2lf%s".rrdtool_escape($total_units).""; }
 
   $rrd_options .= " COMMENT:'\\n'";
 }
diff --git a/includes/rrdtool.inc.php b/includes/rrdtool.inc.php
index 5cde0d6ed..f0fb833eb 100644
--- a/includes/rrdtool.inc.php
+++ b/includes/rrdtool.inc.php
@@ -224,4 +224,19 @@ function rrdtool_lastupdate($filename, $options)
   return rrdtool("lastupdate", $filename, $options);
 }
 
+function rrdtool_escape($string, $maxlength = NULL)
+{
+  $result = str_replace(':','\:',$string);
+  $result = str_replace('%','%%',$result);
+  
+  if ($maxlength != NULL)
+  {
+    return substr(str_pad($result, $maxlength),0,$maxlength+(strlen($result)-strlen($string)));
+  }
+  else
+  {
+    return $result;
+  }
+}
+
 ?>