diff --git a/admin/calendar.php b/admin/calendar.php
index 9a47d762..44e9851d 100644
--- a/admin/calendar.php
+++ b/admin/calendar.php
@@ -495,6 +495,30 @@ require_once(HESK_PATH . 'inc/show_admin_nav.inc.php');
         </div>
     </div>
 </div>
+<div class="ticket-popover-template" style="display: none">
+    <div>
+        <div class="popover-tracking-id">
+            <strong><?php echo $hesklang['trackID']; ?></strong>
+            <span></span>
+        </div>
+        <div class="popover-owner">
+            <strong><?php echo $hesklang['owner']; ?></strong>
+            <span></span>
+        </div>
+        <div class="popover-subject">
+            <strong><?php echo $hesklang['subject']; ?></strong>
+            <span></span>
+        </div>
+        <div class="popover-category">
+            <strong><?php echo $hesklang['category']; ?></strong>
+            <span></span>
+        </div>
+        <div class="popover-priority">
+            <strong><?php echo $hesklang['priority']; ?></strong>
+            <span></span>
+        </div>
+    </div>
+</div>
 <div style="display: none">
     <p id="lang_error_loading_events"><?php echo $hesklang['error_loading_events']; ?></p>
     <p id="lang_error_deleting_event"><?php echo $hesklang['error_deleting_event']; ?></p>
diff --git a/internal-api/dao/calendar_dao.php b/internal-api/dao/calendar_dao.php
index 571e2426..48605557 100644
--- a/internal-api/dao/calendar_dao.php
+++ b/internal-api/dao/calendar_dao.php
@@ -1,6 +1,8 @@
 <?php
 
 function get_events($start, $end, $hesk_settings, $staff = true) {
+    global $hesk_settings;
+
     $sql = "SELECT `events`.*, `categories`.`name` AS `category_name`, `categories`.`color` AS `category_color` ";
 
     if ($staff) {
@@ -65,8 +67,8 @@ function get_events($start, $end, $hesk_settings, $staff = true) {
         INNER JOIN `" . hesk_dbEscape($hesk_settings['db_pfix']) . "categories` AS `categories`
             ON `categories`.`id` = `tickets`.`category`
             AND `categories`.`usage` <> 2
-        WHERE `due_date` >= FROM_UNIXTIME(" . intval($start) . " / 1000)
-        AND `due_date` <= FROM_UNIXTIME(" . intval($end) . " / 1000)
+        WHERE `due_date` >= FROM_UNIXTIME(" . hesk_dbEscape($start) . " / 1000)
+        AND `due_date` <= FROM_UNIXTIME(" . hesk_dbEscape($end) . " / 1000)
         AND `status` IN (SELECT `id` FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "statuses` WHERE `IsClosed` = 0) ";
         mfh_log_debug('Calendar', $sql, '');
 
diff --git a/js/calendar/mods-for-hesk-calendar.js b/js/calendar/mods-for-hesk-calendar.js
index 483e372e..29ae77c0 100644
--- a/js/calendar/mods-for-hesk-calendar.js
+++ b/js/calendar/mods-for-hesk-calendar.js
@@ -44,29 +44,36 @@ $(document).ready(function() {
         eventDrop: respondToDragAndDrop,
         eventResize: respondToDragAndDrop,
         eventMouseover: function(event) {
-            if (event.type === 'TICKET') {
-                // Don't build a popover for tickets
-                return;
-            }
-
             var contents = $('.popover-template').html();
             var $contents = $(contents);
 
             var format = 'dddd, MMMM Do YYYY';
             var endDate = event.end == null ? event.start : event.end;
 
-            if (!event.allDay) {
+            if (!event.allDay && event.type !== 'TICKET') {
                 format += ', HH:mm';
             }
 
-            if (event.location === '') {
-                $contents.find('.popover-location').hide();
+            if (event.type === 'TICKET') {
+                contents = $('.ticket-popover-template').html();
+                $contents = $(contents);
+
+                $contents.find('.popover-tracking-id span').text(event.trackingId).end()
+                    .find('.popover-owner span').text('// TODO').end()
+                    .find('.popover-subject span').text(event.title).end()
+                    .find('.popover-category span').text(event.categoryName).end()
+                    .find('.popover-priority span').text('// TODO');
+            } else {
+                if (event.location === '') {
+                    $contents.find('.popover-location').hide();
+                }
+
+                $contents.find('.popover-category span').text(event.categoryName).end()
+                    .find('.popover-location span').text(event.location).end()
+                    .find('.popover-from span').text(event.start.format(format)).end()
+                    .find('.popover-to span').text(endDate.format(format));
             }
 
-            $contents.find('.popover-category span').text(event.categoryName).end()
-                .find('.popover-location span').text(event.location).end()
-                .find('.popover-from span').text(event.start.format(format)).end()
-                .find('.popover-to span').text(endDate.format(format));
             var $eventMarkup = $(this);
             $eventMarkup.popover({
                 title: event.title,
@@ -78,11 +85,6 @@ $(document).ready(function() {
             }).popover('show');
         },
         eventMouseout: function(event) {
-            if (event.type === 'TICKET') {
-                // There's no popover to destroy
-                return;
-            }
-
             $(this).popover('destroy');
         },
         dayRender: function(date, cell) {
@@ -248,6 +250,7 @@ function buildEvent(id, dbObject) {
             allDay: true,
             type: dbObject.type,
             categoryId: dbObject.categoryId,
+            categoryName: dbObject.categoryName,
             className: 'category-' + dbObject.categoryId,
             textColor: calculateTextColor(dbObject.categoryColor)
         };