diff --git a/src/sbbs3/scfg/scfgmsg.c b/src/sbbs3/scfg/scfgmsg.c
index 9c7015bdcb0326567a3604e9849b9ec1e87745a1..3ea06848a5cf5fcea551336b0640c754b0c85726 100644
--- a/src/sbbs3/scfg/scfgmsg.c
+++ b/src/sbbs3/scfg/scfgmsg.c
@@ -117,6 +117,7 @@ void msgs_cfg()
 	static int dflt,msgs_dflt,bar;
 	char str[256],str2[256],done=0,*p;
     char tmp[128];
+	char tmp_code[16];
 	int j,k,q,s;
 	int i,file,ptridx,n;
 	long ported;
@@ -570,7 +571,7 @@ import into the current message group.
 							while(*p && *p>' ') p++;	// Skip path
 							while(*p && *p<=' ') p++;	// Find tag
 							truncstr(p," \t");
-							SAFECOPY(tmpsub.code_suffix,p);
+							SAFECOPY(tmp_code,p);
 							SAFECOPY(tmpsub.sname,utos(p));
 							SAFECOPY(tmpsub.lname,utos(p));
 							SAFECOPY(tmpsub.qwkname,utos(p));
@@ -582,7 +583,7 @@ import into the current message group.
                             else p=str;
 							sprintf(tmpsub.data_dir,"%.*s",LEN_DIR,str);
 							p++;
-							sprintf(tmpsub.code_suffix,"%.8s",p);
+							SAFECOPY(tmp_code,p);
 							while(*p && *p<=SP) p++;
 							sprintf(tmpsub.sname,"%.*s",LEN_SSNAME,p);
 							p=strchr(tmpsub.sname,SP);
@@ -597,7 +598,7 @@ import into the current message group.
 							p=str;
 							while(*p && *p>SP) p++;
 							*p=0;
-							sprintf(tmpsub.code_suffix,"%.8s",str);
+							SAFECOPY(tmp_code,str);
 							p++;
 							while(*p && *p<=SP) p++;
 							sprintf(tmpsub.sname,"%.*s",LEN_SSNAME,p);
@@ -613,7 +614,7 @@ import into the current message group.
                             p=str;
 							while(*p && *p>SP) p++;
 							*p=0;
-							sprintf(tmpsub.code_suffix,"%.8s",str);
+							SAFECOPY(tmp_code,str);
 							sprintf(tmpsub.sname,"%.*s",LEN_SSNAME,utos(str));
 							sprintf(tmpsub.qwkname,"%.10s",tmpsub.sname);
 							p++;
@@ -633,7 +634,7 @@ import into the current message group.
 						sprintf(tmpsub.qwkname,"%.*s",10,str);
 						if(!fgets(str,128,stream)) break;
 						truncsp(str);
-						sprintf(tmpsub.code_suffix,"%.*s",8,str);
+						SAFECOPY(tmp_code,str);
 						if(!fgets(str,128,stream)) break;
 						truncsp(str);
 						sprintf(tmpsub.data_dir,"%.*s",LEN_DIR,str);
@@ -689,7 +690,9 @@ import into the current message group.
 							if(!fgets(str,128,stream)) break;
 							truncsp(str); } }
 
-                    prep_code(tmpsub.code_suffix);
+                    prep_code(tmp_code);						/* Strip invalid chars */
+					SAFECOPY(tmpsub.code_suffix,tmp_code);		/* THEN truncate to valid length */
+
 					truncsp(tmpsub.sname);
 					truncsp(tmpsub.lname);
 					truncsp(tmpsub.qwkname);
diff --git a/src/sbbs3/scfg/scfgxfr2.c b/src/sbbs3/scfg/scfgxfr2.c
index ae49d24edd1c72d0db002c0bf97c0daa6e6ab263..f22ed40529cf274b7fd33f2231c3b8b34e10a24e 100644
--- a/src/sbbs3/scfg/scfgxfr2.c
+++ b/src/sbbs3/scfg/scfgxfr2.c
@@ -41,6 +41,7 @@ void xfer_cfg()
 {
 	static int libs_dflt,libs_bar,dflt;
 	char str[256],str2[81],done=0,*p;
+	char tmp_code[16];
 	int file,j,k,q;
 	uint i;
 	long ported;
@@ -459,7 +460,7 @@ command: 
DIR /ON /AD /B > DIRS.RAW

 					while(*p && *p<=SP) p++;
 
 					if(k==2) { /* raw */
-						SAFECOPY(tmpdir.code_suffix,p);
+						SAFECOPY(tmp_code,p);
 						SAFECOPY(tmpdir.lname,p);
 						SAFECOPY(tmpdir.sname,p);
 						SAFECOPY(tmpdir.path,p);
@@ -470,8 +471,7 @@ command: 
DIR /ON /AD /B > DIRS.RAW

 							continue;
 						p+=5;
 						while(*p && *p<=SP) p++;
-						sprintf(tmpdir.code_suffix,"%.8s",p);
-						truncsp(tmpdir.code_suffix);
+						SAFECOPY(tmp_code,p);
 						while(*p>SP) p++;			/* Skip areaname */
 						while(*p && *p<=SP) p++;	/* Skip space */
 						while(*p>SP) p++;			/* Skip level */
@@ -489,7 +489,7 @@ command: 
DIR /ON /AD /B > DIRS.RAW

 						sprintf(tmpdir.sname,"%.*s",LEN_SSNAME,str);
 						if(!fgets(str,128,stream)) break;
 						truncsp(str);
-						sprintf(tmpdir.code_suffix,"%.*s",8,str);
+						SAFECOPY(tmp_code,str);
 						if(!fgets(str,128,stream)) break;
 						truncsp(str);
 						sprintf(tmpdir.data_dir,"%.*s",LEN_DIR,str);
@@ -547,7 +547,8 @@ command: 
DIR /ON /AD /B > DIRS.RAW

 						} 
 					}
 
-					prep_code(tmpdir.code_suffix);
+					prep_code(tmp_code);						/* Strip invalid chars */
+					SAFECOPY(tmpdir.code_suffix,tmp_code);		/* THEN truncate to valid length */
 
 					for(j=0;j<cfg.total_dirs;j++) {
 						if(cfg.dir[j]->lib!=i)