diff --git a/js/tbl_zoom_plot_jqplot.js b/js/tbl_zoom_plot_jqplot.js
index 897caed666..469c4828e7 100644
--- a/js/tbl_zoom_plot_jqplot.js
+++ b/js/tbl_zoom_plot_jqplot.js
@@ -558,7 +558,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
                 value[dataLabel], // for highlighter
                 // (may set an undefined value)
                 value.where_clause, // for click on point
-                key               // key from searchedData
+                key,               // key from searchedData
+                value.where_clause_sign
             ]);
         });
 
@@ -591,7 +592,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
                     'server' : PMA_commonParams.get('server'),
                     'db' : PMA_commonParams.get('db'),
                     'table' : PMA_commonParams.get('table'),
-                    'where_clause' : data[3]
+                    'where_clause' : data[3],
+                    'where_clause_sign' : data[5]
                 };
 
                 $.post('tbl_zoom_select.php', post_params, function (data) {
diff --git a/libraries/classes/Controllers/Table/TableSearchController.php b/libraries/classes/Controllers/Table/TableSearchController.php
index 16ed3fe1fd..e9f1e48e05 100644
--- a/libraries/classes/Controllers/Table/TableSearchController.php
+++ b/libraries/classes/Controllers/Table/TableSearchController.php
@@ -8,6 +8,7 @@
 namespace PhpMyAdmin\Controllers\Table;
 
 use PhpMyAdmin\Controllers\TableController;
+use PhpMyAdmin\Core;
 use PhpMyAdmin\DatabaseInterface;
 use PhpMyAdmin\Relation;
 use PhpMyAdmin\Sql;
@@ -345,13 +346,15 @@ class TableSearchController extends TableController
             );
             //Append it to row array as where_clause
             $row['where_clause'] = $uniqueCondition[0];
+            $row['where_clause_sign'] = Core::signSqlQuery($uniqueCondition[0]);
 
             $tmpData = array(
                 $_POST['criteriaColumnNames'][0] =>
                     $row[$_POST['criteriaColumnNames'][0]],
                 $_POST['criteriaColumnNames'][1] =>
                     $row[$_POST['criteriaColumnNames'][1]],
-                'where_clause' => $uniqueCondition[0]
+                'where_clause' => $uniqueCondition[0],
+                'where_clause_sign' => Core::signSqlQuery($uniqueCondition[0])
             );
             $tmpData[$dataLabel] = ($dataLabel) ? $row[$dataLabel] : '';
             $data[] = $tmpData;
@@ -419,6 +422,10 @@ class TableSearchController extends TableController
      */
     public function getDataRowAction()
     {
+        if (! Core::checkSqlQuerySignature($_POST['where_clause'], $_POST['where_clause_sign'])) {
+            return;
+        }
+
         $extra_data = array();
         $row_info_query = 'SELECT * FROM ' . Util::backquote($_POST['db']) . '.'
             . Util::backquote($_POST['table']) . ' WHERE ' .  $_POST['where_clause'];
diff --git a/libraries/classes/Display/Results.php b/libraries/classes/Display/Results.php
index 80120f20c8..6809c227c9 100644
--- a/libraries/classes/Display/Results.php
+++ b/libraries/classes/Display/Results.php
@@ -3001,6 +3001,7 @@ class Results
             $_url_params = array(
                 'db'            => $this->__get('db'),
                 'table'         => $meta->orgtable,
+                'where_clause_sign' => Core::signSqlQuery($whereClauseMap[$row_no][$meta->orgtable]),
                 'where_clause'  => $whereClauseMap[$row_no][$meta->orgtable],
                 'transform_key' => $meta->orgname
             );
diff --git a/libraries/classes/InsertEdit.php b/libraries/classes/InsertEdit.php
index 10a91ae3a9..ad692f0509 100644
--- a/libraries/classes/InsertEdit.php
+++ b/libraries/classes/InsertEdit.php
@@ -18,6 +18,7 @@ use PhpMyAdmin\Template;
 use PhpMyAdmin\Transformations;
 use PhpMyAdmin\Url;
 use PhpMyAdmin\Util;
+use PhpMyAdmin\Core;
 
 /**
  * PhpMyAdmin\InsertEdit class
@@ -2480,6 +2481,7 @@ class InsertEdit
             $_url_params = array(
                 'db'            => $db,
                 'table'         => $table,
+                'where_clause_sign' => Core::signSqlQuery($_POST['where_clause']),
                 'where_clause'  => $_POST['where_clause'],
                 'transform_key' => $column_name
             );
@@ -3275,6 +3277,7 @@ class InsertEdit
                         'db'            => $db,
                         'table'         => $table,
                         'transform_key' => $column['Field'],
+                        'where_clause_sign' => Core::signSqlQuery($where_clause),
                         'where_clause'  => $where_clause
                     );
                     $transformation_options['wrapper_link']
diff --git a/transformation_wrapper.php b/transformation_wrapper.php
index a1d653b08f..a1c8416aab 100644
--- a/transformation_wrapper.php
+++ b/transformation_wrapper.php
@@ -63,6 +63,12 @@ foreach ($request_params as $one_request_param) {
  */
 $GLOBALS['dbi']->selectDb($db);
 if (isset($where_clause)) {
+
+    if (! Core::checkSqlQuerySignature($where_clause, isset($_GET['where_clause_sign']) ? $_GET['where_clause_sign'] : '')) {
+        /* l10n: In case a SQL query did not pass a security check  */
+        Core::fatalError(__('There is an issue with your request.'));
+        exit;
+    }
     $result = $GLOBALS['dbi']->query(
         'SELECT * FROM ' . PhpMyAdmin\Util::backquote($table)
         . ' WHERE ' . $where_clause . ';',