diff --git a/CHANGELOG.md b/CHANGELOG.md
index d0174f7..cbf0298 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 3.2.7
+**Maintainer**: balloon-team <opensource@gyselroth.net>\
+**Date**: Wed Sep 11 16:31:23 CEST 2019
+
+* [FIX] fallback locale does not work #261
+* [FIX] json query for users/groups is not properly escaped #260
+
+
 ## 3.2.6
 **Maintainer**: balloon-team <opensource@gyselroth.net>\
 **Date**: Thu Jul 11 12:29:23 CEST 2019
diff --git a/src/lib/core.js b/src/lib/core.js
index d435583..9808346 100755
--- a/src/lib/core.js
+++ b/src/lib/core.js
@@ -2998,7 +2998,7 @@ var balloon = {
    * @return void
    */
   _eventsWindowSearch: function(node) {
-    var value = $(this).val();
+    var value = encodeURIComponent($(this).val());
 
     var $fs_event_list  = $('#fs-event-window #fs-events-window-list'),
       $fs_event_list_ul  = $fs_event_list.find('ul');
@@ -5566,12 +5566,12 @@ var balloon = {
           return;
         }
 
-        var value = $share_consumer_search.data("kendoAutoComplete").value()
+        var value = encodeURIComponent($share_consumer_search.data("kendoAutoComplete").value());
         if(value === '' || value === undefined) {
           return;
         }
 
-        var filter = JSON.stringify({'query': {'name': $share_consumer_search.data("kendoAutoComplete").value()}});
+        var filter = JSON.stringify({'query': {'name': value}});
 
         balloon.xmlHttpRequest({
           url: balloon.base+'/groups?'+filter,
@@ -5592,7 +5592,7 @@ var balloon = {
           }
         });
 
-        filter = JSON.stringify({'query': {'username': $share_consumer_search.data("kendoAutoComplete").value()}});
+        filter = JSON.stringify({'query': {'username': value}});
 
         balloon.xmlHttpRequest({
           url: balloon.base+'/users?'+filter,
@@ -5751,7 +5751,7 @@ var balloon = {
         serverFiltering: true,
         transport: {
           read: function(operation) {
-            var value = $input.data("kendoAutoComplete").value()
+            var value = encodeURIComponent($input.data("kendoAutoComplete").value());
             if(value === '' || value === undefined) {
               operation.success([]);
               $input.data('kendoAutoComplete').close();
@@ -5764,7 +5764,7 @@ var balloon = {
               var filter = {
                 'query': {
                   'name': {
-                    "$regex": $input.data("kendoAutoComplete").value(),
+                    "$regex": value,
                     "$options": "i"
                   },
                 }
@@ -5800,7 +5800,7 @@ var balloon = {
             var filter = {
               'query': {
                 'username': {
-                  "$regex": $input.data("kendoAutoComplete").value(),
+                  "$regex": value,
                   "$options": "i"
                 },
               }
@@ -6893,7 +6893,7 @@ var balloon = {
       $('#fs-search').removeClass('fs-search-filtered');
     }
 
-    var query = balloon.buildQuery(content, filters);
+    var query = balloon.buildQuery(encodeURIComponent(content), filters);
 
     if(query === undefined) {
       return false
diff --git a/src/lib/translate.js b/src/lib/translate.js
index 7c91731..e70acfb 100755
--- a/src/lib/translate.js
+++ b/src/lib/translate.js
@@ -24,7 +24,9 @@ const kendoCultures = {
   'en-GB': require('kendo-ui-core/js/cultures/kendo.culture.en-GB.js'),
   'en-AU': require('kendo-ui-core/js/cultures/kendo.culture.en-AU.js'),
   'en-US': require('kendo-ui-core/js/cultures/kendo.culture.en-US.js'),
-}
+};
+
+const defaultLang = 'en';
 
 var translate = {
   config: {},
@@ -100,7 +102,7 @@ var translate = {
           prefix: 'i18next_res_',
           expirationTime: 60*60*120
         },
-        fallbackLng: translate.config.defaultLang,
+        fallbackLng: translate.config.defaultLang || defaultLang,
         backend: {
           ajax: translate.load,
           loadPath: function(lng,ns){