diff --git a/main.go b/main.go
index 27ca2f1..f16e50a 100644
--- a/main.go
+++ b/main.go
@@ -55,7 +55,7 @@ func serveTemplate(w http.ResponseWriter, r *http.Request) {
         var scales = getMyDevs(userName)
         var last_metrics []OneMetric
 
-	if r.URL.Path == "/scales.html" {
+	if (r.URL.Path == "/scales.html") || (r.URL.Path == "/abos.html") {
                 // wir holen noch die letzten Metriken
                 for _, v := range scales {
                    last_metric := getLastMetrics(v)
diff --git a/scales.go b/scales.go
index 0829622..6bc1d34 100644
--- a/scales.go
+++ b/scales.go
@@ -3,6 +3,7 @@ package main
 import (
     "fmt"
     "log"
+    "regexp"
     "net/http"
 )
 
@@ -22,6 +23,12 @@ func save_scale_settingsHandler(response http.ResponseWriter, request *http.Requ
            // Query()["deveui"] will return an array of items, 
            // we only want the single item.
            mydeveui := deveui[0]
+   
+           if (len(mydeveui) != 16) {
+             log.Println("specified 'deveui' has invalid length")
+	     fmt.Fprintf(response, "{ \"rc\": 8, \"msg\": \"specified deveui has invalid length\" }")
+             return
+           }
            
            if !(Contains(getMyDevs(name),mydeveui)) {
              log.Println("specified 'deveui' does not belong to this user")
@@ -39,6 +46,14 @@ func save_scale_settingsHandler(response http.ResponseWriter, request *http.Requ
              return
            }
            myalias := alias[0]
+
+           // validate alias
+           match, _ := regexp.MatchString("^[a-zA-Z0-9 ]{1,16}$", myalias)
+           if !(match) {
+             log.Println("Url Param 'alias' is not valid")
+	     fmt.Fprintf(response, "{ \"rc\": 9, \"msg\": \"alias is not valid\" }")
+             return
+           }
            
            alarmactive, ok3 := request.URL.Query()["alarmactive"]
 
@@ -48,6 +63,12 @@ func save_scale_settingsHandler(response http.ResponseWriter, request *http.Requ
              return
            }
            myalarmactive := alarmactive[0]
+
+           if !((myalarmactive == "0") || (myalarmactive == "1")) {
+             log.Println("Url Param 'alarmactive' is not valid")
+	     fmt.Fprintf(response, "{ \"rc\": 10, \"msg\": \"alarmactive is not valid\" }")
+             return
+           }
            
            smsnumber, ok4 := request.URL.Query()["smsnumber"]
 
@@ -57,6 +78,14 @@ func save_scale_settingsHandler(response http.ResponseWriter, request *http.Requ
              return
            }
            mysmsnumber := smsnumber[0]
+
+           match1, _ := regexp.MatchString(`^\+[0-9]{11,11}$`, mysmsnumber)
+           if !(match1) {
+             log.Println("Url Param 'smsnumber' is not valid")
+	     fmt.Fprintf(response, "{ \"rc\": 11, \"msg\": \"smsnumber is not valid, must be in in format +41791234567\" }")
+             return
+           }
+
            var mydev Dev
            mydev.Deveui = mydeveui
            mydev.Alias = myalias
diff --git a/snippets/abos.html b/snippets/abos.html
new file mode 100644
index 0000000..0cc1b4d
--- /dev/null
+++ b/snippets/abos.html
@@ -0,0 +1,31 @@
+{{define "body_content"}}
+<p class="title is-4">Abos</p>
+<p>Hier k&ouml;nnen blablabla...</p>
+<div class="columns is-marginless">
+  <div class="column is-full"></div>
+</div>
+{{ if ne .UserName "" }}
+{{range .LastMetrics}}
+<div class="columns is-vcentered is-marginless">
+  <div class="column is-full has-background-primary">
+    <span id="alias_{{.Deveui}}" class="is-size-5">{{.Alias}}</span>
+    <div class="select is-pulled-right is-vcentered">
+      <select class="has-background-light">
+        <option>keine Verl&auml;ngerung</option>
+        <option>1 Jahr verl&auml;ngern</option>
+        <option>2 Jahre verl&auml;ngern</option>
+        <option>3 Jahre verl&auml;ngern</option>
+      </select>
+    </div>
+  </div>
+</div>
+<div class="columns">
+  <div class="column is-full"></div>
+</div>
+{{end}}
+</div>
+
+{{ else }}
+<h4>Bitte zuerst <a href="login.html">einloggen</a></h4>
+{{end}}
+{{end}}
diff --git a/snippets/scales.html b/snippets/scales.html
index 946a71a..49dad53 100644
--- a/snippets/scales.html
+++ b/snippets/scales.html
@@ -9,9 +9,8 @@
     </header>
     <section class="modal-card-body">
       <!-- Content ... -->
-      <p id="deveui" hidden></p>
       <div class="field">
-        <label id="label" class="label">Bezeichnung (1234567812345678)</label>
+        <label id="label" class="label">Bezeichnung</label>
         <div class="control has-icons-right">
           <input id="alias" class="input" type="text" maxlength="16">
           <span id="alias_exclamation" class="icon is-small is-right">
@@ -40,6 +39,10 @@
         </div>
         <p id="smsnumber_errormsg" class="help is-danger"></p>
       </div>
+      
+      <div class="is-size-7">
+Device ID: <span id="deveui"></span>
+      </div>
     </section>
     <footer class="modal-card-foot">
       <button id="modal-save" class="button is-success">OK</button>
@@ -100,6 +103,12 @@
       </nav>
     </div>
   </div>
+  <p id="paid_until_{{.Deveui}}" class="has-text-centered" style="align-items: center;"><a class="button is-warning is-small" href="/abos.html">
+    <span class="icon">
+      <i class="fa fa-shopping-cart"></i>
+    </span>
+    <span>Abo verl&auml;ngern (aktiv bis 01.01.1999)</span>
+  </a></p>
 </div>
 <div>
 </div>
@@ -127,9 +136,7 @@ $(".show-modal").click(function() {
   var alarmactive = $('#alarmactive_'+deveui).html();
   var smsnumber = $('#smsnumber_'+deveui).html();
   
-  var label = "Bezeichnung (" + deveui + ")";
   $("#alias").val(alias);
-  $("#label").html(label);
   console.log(alarmactive);
   if (alarmactive == "1") {
     $('#checkbox').prop('checked', true);
@@ -152,11 +159,12 @@ $("#modal-save").click(function() {
   }
 
   // Validation Code
+  var is_valid = true;
   if (!validate('alias',$('#alias').val())) {
      $('#alias_errormsg').html('Ung&uuml;ltige Bezeichnung; erlaubte Zeichen A-Z, 0-9 und Leerschlag');
      $("#alias").addClass("is-danger");  
      $("#alias_exclamation").show();
-     return;
+     is_valid = false;
   } else {
      $('#alias_errormsg').html('');
      $("#alias").removeClass("is-danger");  
@@ -167,13 +175,17 @@ $("#modal-save").click(function() {
      $('#smsnumber_errormsg').html('Beispiel einer g&uuml;ltigen SMS Nummer: +41761234567');
      $("#smsnumber").addClass("is-danger");  
      $("#smsnumber_exclamation").show();
-     return;
+     is_valid = false;
   } else {
      $('#smsnumber_errormsg').html('');
      $("#smsnumber").removeClass("is-danger");  
      $("#smsnumber_exclamation").hide();
   }
 
+  if (!(is_valid)) {
+    return;
+  }
+
   $.ajax({
     url: "save_scale_settings",
     type: "get", //send it through get method