diff --git a/libraries/LanguageManager.php b/libraries/LanguageManager.php
index 910108d518..6003948e72 100644
--- a/libraries/LanguageManager.php
+++ b/libraries/LanguageManager.php
@@ -819,9 +819,8 @@ class LanguageManager
         $langs = $this->availableLanguages();
 
         // try to find out user's language by checking its HTTP_ACCEPT_LANGUAGE variable;
-        // prevent XSS
         $accepted_languages = PMA_getenv('HTTP_ACCEPT_LANGUAGE');
-        if ($accepted_languages && false === mb_strpos($accepted_languages, '<')) {
+        if ($accepted_languages) {
             foreach (explode(',', $accepted_languages) as $header) {
                 foreach ($langs as $language) {
                     if ($language->matchesAcceptLanguage($header)) {
diff --git a/libraries/plugins/auth/AuthenticationHttp.php b/libraries/plugins/auth/AuthenticationHttp.php
index 62dcc01690..3f76a130b5 100644
--- a/libraries/plugins/auth/AuthenticationHttp.php
+++ b/libraries/plugins/auth/AuthenticationHttp.php
@@ -128,10 +128,8 @@ class AuthenticationHttp extends AuthenticationPlugin
             } elseif (PMA_getenv('AUTH_USER')) {
                 // WebSite Professional
                 $PHP_AUTH_USER = PMA_getenv('AUTH_USER');
-            } elseif (PMA_getenv('HTTP_AUTHORIZATION')
-                && false === strpos(PMA_getenv('HTTP_AUTHORIZATION'), '<')
-            ) {
-                // IIS, might be encoded, see below; also prevent XSS
+            } elseif (PMA_getenv('HTTP_AUTHORIZATION')) {
+                // IIS, might be encoded, see below
                 $PHP_AUTH_USER = PMA_getenv('HTTP_AUTHORIZATION');
             } elseif (PMA_getenv('Authorization')) {
                 // FastCGI, might be encoded, see below