diff --git a/ChangeLog b/ChangeLog
index d8b56ced28..43abe9e53e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,7 @@ phpMyAdmin - ChangeLog
 - bug #3854 Incorrect header for Safari 6.0
 - bug #3705 Attempt to open trigger for edit gives NULL
 - Use HTML5 DOCTYPE 
+- [security] Self-XSS on GIS visualisation page, reported by Janek Vind
 
 3.5.7.0 (2013-02-15)
 - bug #3779 [core] Problem with backslash in enum fields
diff --git a/tbl_gis_visualization.php b/tbl_gis_visualization.php
index 0811d01aeb..1cf5c014ca 100644
--- a/tbl_gis_visualization.php
+++ b/tbl_gis_visualization.php
@@ -110,7 +110,7 @@ $visualization = PMA_GIS_visualizationResults($data, $visualizationSettings, $fo
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?>
 <fieldset>
     <legend><?php echo __('Display GIS Visualization'); ?></legend>
-    <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
+    <div id="placeholder" style="width:<?php echo htmlspecialchars($visualizationSettings['width']); ?>px;height:<?php echo htmlspecialchars($visualizationSettings['height']); ?>px;">
         <?php echo $visualization; ?>
     </div>
     <div id="openlayersmap"></div>
@@ -202,4 +202,4 @@ $visualization = PMA_GIS_visualizationResults($data, $visualizationSettings, $fo
  */
 require './libraries/footer.inc.php';
 
-?>
\ No newline at end of file
+?>