From 170238ecb2f5ab1c5aab56520d53193c2813eede Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Fri, 1 Feb 2013 07:43:02 -0500
Subject: [PATCH] Escape table name in relational schema editing

---
 libraries/schema/User_Schema.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php
index 399341247f..fb1af6d5ff 100644
--- a/libraries/schema/User_Schema.class.php
+++ b/libraries/schema/User_Schema.class.php
@@ -526,7 +526,7 @@ class PMA_User_Schema
             $reset_draginit .= '    document.edcoord.elements["c_table_' . $i . '[x]"].value = "2"' . "\n";
             $reset_draginit .= '    document.edcoord.elements["c_table_' . $i . '[y]"].value = "' . (15 * $i) . '"' . "\n";
 
-            echo '<div id="table_' . $i . '" class="pdflayout_table"><u>' . $temp_sh_page['table_name'] . '</u>';
+            echo '<div id="table_' . $i . '" class="pdflayout_table"><u>' . htmlspecialchars($temp_sh_page['table_name']) . '</u>';
             if (isset($with_field_names)) {
                 $fields = PMA_DBI_get_columns($db, $temp_sh_page['table_name']);
                 // if the table has been dropped from outside phpMyAdmin,