diff --git a/src/usr/local/www/services_dhcp.php b/src/usr/local/www/services_dhcp.php
index 55111b7ef9..b130cc0e49 100644
--- a/src/usr/local/www/services_dhcp.php
+++ b/src/usr/local/www/services_dhcp.php
@@ -445,9 +445,33 @@ if ($if && isset($_POST['save'])) {
 	if ($_POST['tftp'] && !is_ipaddrv4($_POST['tftp']) && !is_domain($_POST['tftp']) && !filter_var($_POST['tftp'], FILTER_VALIDATE_URL)) {
 		$input_errors[] = gettext("A valid IP address, hostname or URL must be specified for the TFTP server.");
 	}
-	if (($_POST['nextserver'] && !is_ipaddrv4($_POST['nextserver']))) {
+
+	/* Validate Network Booting */
+	if (($_POST['nextserver'] &&
+	    !is_ipaddrv4($_POST['nextserver']))) {
 		$input_errors[] = gettext("A valid IP address must be specified for the network boot server.");
 	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename']) === 1) {
+		$input_errors[] = gettext("Invalid Default BIOS File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename32']) === 1) {
+		$input_errors[] = gettext("Invalid UEFI 32 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename64']) === 1) {
+		$input_errors[] = gettext("Invalid UEFI 64 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename32arm']) === 1) {
+		$input_errors[] = gettext("Invalid ARM 32 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename64arm']) === 1) {
+		$input_errors[] = gettext("Invalid ARM 64 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['uefihttpboot']) === 1) {
+		$input_errors[] = gettext("Invalid UEFI HTTPBoot URL.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['rootpath']) === 1) {
+		$input_errors[] = gettext("Invalid Root Path.");
+	}
 
 	if (gen_subnet($ifcfgip, $ifcfgsn) == $_POST['range_from']) {
 		$input_errors[] = gettext("The network address cannot be used in the starting subnet range.");
diff --git a/src/usr/local/www/services_dhcp_edit.php b/src/usr/local/www/services_dhcp_edit.php
index 0193a60915..c50d9def71 100644
--- a/src/usr/local/www/services_dhcp_edit.php
+++ b/src/usr/local/www/services_dhcp_edit.php
@@ -349,9 +349,34 @@ if ($_POST['save']) {
 	if ($_POST['tftp'] && !is_ipaddrv4($_POST['tftp']) && !is_domain($_POST['tftp']) && !filter_var($_POST['tftp'], FILTER_VALIDATE_URL)) {
 		$input_errors[] = gettext("A valid IPv4 address, hostname or URL must be specified for the TFTP server.");
 	}
-	if (($_POST['nextserver'] && !is_ipaddrv4($_POST['nextserver']))) {
-		$input_errors[] = gettext("A valid IPv4 address must be specified for the network boot server.");
+
+	/* Validate Network Booting */
+	if (($_POST['nextserver'] &&
+	    !is_ipaddrv4($_POST['nextserver']))) {
+		$input_errors[] = gettext("A valid IP address must be specified for the network boot server.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename']) === 1) {
+		$input_errors[] = gettext("Invalid Default BIOS File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename32']) === 1) {
+		$input_errors[] = gettext("Invalid UEFI 32 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename64']) === 1) {
+		$input_errors[] = gettext("Invalid UEFI 64 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename32arm']) === 1) {
+		$input_errors[] = gettext("Invalid ARM 32 bit File Name.");
 	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['filename64arm']) === 1) {
+		$input_errors[] = gettext("Invalid ARM 64 bit File Name.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['uefihttpboot']) === 1) {
+		$input_errors[] = gettext("Invalid UEFI HTTPBoot URL.");
+	}
+	if (preg_match('("|;|}|{|\r|\n)', $_POST['rootpath']) === 1) {
+		$input_errors[] = gettext("Invalid Root Path.");
+	}
+
 	if (isset($_POST['arp_table_static_entry']) && empty($_POST['mac'])) {
 		$input_errors[] = gettext("A valid MAC address must be specified for use with static ARP.");
 	}