From 0ce4fd2750491a54d27f94cc1403f9da21738aa6 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Tue, 19 Jan 2016 21:01:32 +1100
Subject: [PATCH] Fix XSS in DB_search.php

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
---
 libraries/DbSearch.class.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libraries/DbSearch.class.php b/libraries/DbSearch.class.php
index 9ffd1d802b..ab5089e94d 100644
--- a/libraries/DbSearch.class.php
+++ b/libraries/DbSearch.class.php
@@ -340,7 +340,8 @@ class PMA_DbSearch
             $browse_result_path = 'sql.php' . PMA_generate_common_url($this_url_params);
             $html_output .= '<td><a name="browse_search" href="'
                 . $browse_result_path . '" onclick="loadResult(\''
-                . $browse_result_path . '\',\'' . $each_table . '\',\''
+                . $browse_result_path . '\',\''
+                . PMA_escapeJsString(htmlspecialchars($each_table)) . '\',\''
                 . PMA_generate_common_url($GLOBALS['db'], $each_table) . '\''
                 . ');return false;" >'
                 . __('Browse') . '</a></td>';