Merge remote-tracking branch 'upstream/master'

2016-11-15 18:08:24 +02:00 · 2016-11-15 18:08:24 +02:00 · 1bd5fe709d
commit 1bd5fe709d
parent 91f3928c2d 819ec1b552
336 changed files with 134491 additions and 126341 deletions
--- a/.travis.yml
+++ b/.travis.yml
@ -6,6 +6,7 @@
 language: php

 php:
+  - "7.1.0RC3"
  - "7.0"
  - "5.6"
  - "5.5"
@ -55,6 +56,8 @@ matrix:
      env: CI_MODE=selenium
    - php: "7.0"
      env: CI_MODE=release
+    - php: "7.0"
+      env: CI_MODE=docs
 cache:
  directories:
    - $HOME/.composer/cache/
--- a/79
+++ b/79
@ -3,7 +3,6 @@ phpMyAdmin - ChangeLog

 4.7.0.0 (not yet released)
 - patch #12233 [Display] Improve message when renaming database to same name
- issue #11924 Remove caching of server information
 - issue #6146  Log authentication attempts to syslog
 - issue #11981 Remove support for Swekey authentication
 - issue #11987 Remove code for no longer supported MSIE versions
@ -26,6 +25,15 @@ phpMyAdmin - ChangeLog
 - issue #12463 Incorrect link in the href of icon at Hide/Show unhide links
 - issue #12330 Shortcut for closing console
 - issue #12465 Improved handling of http requests
+- issue #12474 Broken links in Setup forms Navigation
+- issue #12494 Can't add a new User
+- issue #12523 Add 'token' Parameter in all POST requests (Fix 'Token mismatch' errors)
+- issue #12302 Improved usage of number_format
+- issue #12656 Server selection not working
+- issue #12543 NULL results in dataset are colored grey
+- issue #12664 Create Bookmark broken
+- issue #12688 Use unsigned int for storing bookmark ID
+- issue #12352 Added password strength indicator

 4.6.5 (not yet released)
 - issue        Remove potentionally license problematic sRGB profile
@ -46,6 +54,75 @@ phpMyAdmin - ChangeLog
 - issue #12292 Unable to edit transformations
 - issue #12502 Remove unused paramenter when connecting to MySQLi
 - issue #12303 Fix number formatting with different settings of precision in PHP
+- issue #12405 Use single quotes in PHP code
+- issue #12534 Option for the dropped column is not removed from 'after_field' select, after the column is dropped
+- issue #12531 Properly detect DROP DATABASE queries
+- issue #12470 Fix possible race condition in setting URL hash
+- issue #11924 Remove caching of server information
+- issue #11628 Proper parsing of INSERT ... ON DUPLICATE KEY queries
+- issue #12545 Proper parsing of CREATE TABLE ... PARTITION queries
+- issue #12473 Code can throw unhandled exception
+- issue #12550 Do not try to keep alive session even after expiry
+- issue #12512 Fixed rendering BBCode links in setup
+- issue #12518 Fixed copy of table with generated columns
+- issue #12221 Fixed export of table with generated columns
+- issue #12320 Copying a user does not copy usergroup
+- issue #12272 Adding a new row with default enum goes to no selection when you want to add more then 2 rows
+- issue #12487 Drag and drop import prevents file dropping to blob column file selector on the insert tab
+- issue #12554 Absence of scrolling makes it impossible to read longer text values in grid editing
+- issue #12530 "Edit routine" crashes when the current user is not the definer, even if privileges are adequate
+- issue #12300 Export selective tables by-default dumps Events also
+- issue #12298 Fixed export of view definitions
+- issue #12242 Edit routine detail dialog does not fill "Return length" field in mysql functions
+- issue #12575 New index Confirm adds whitespace around the field name
+- issue #12382 Bug in zoom search
+- issue #12321 Assign LIMIT clause only to syntactically correct queries
+- issue #12461 Can't Execute SQL With Sub-Query Due To "LIMIT 0,25" Inserted At Wrong Place
+- issue #12511 Clarify documentation on ArbitraryServerRegexp
+- issue #12508 Remove duplicate code in SQL escaping
+- issue #12475 Cleanup code for getting table information
+- issue #12579 phpMyAdmin's export of a Select statment without a FROM clause generates Wrong SQL
+- issue #12316 Correct export of complex SELECT statements
+- issue #12080 Fixed parsing of subselect queries
+- issue #11740 Fixed handling DELETE ... USING queries
+- issue #12100 Fixed handling of CASE operator
+- issue #12455 Query history stores separate entry for every letter typed
+- issue #12327 Create PHP code no longer works
+- issue #12179 Fixed bookmarking of query with multiple statements
+- issue #12419 Wrong description on GRANT OPTION
+- issue #12615 Fixed regexp for matching browser versions
+- issue #12569 Avoid showing import errors twice
+- issue #12362 prefs_manage.php can leave an orphaned temporary file
+- issue #12619 Unable to export csv when using union select
+- issue #12625 Broken Edit links in query results of JOIN query
+- issue #12634 Drop DB error in import if DB doesn't exist
+- issue #12338 Designer reverts to first saved ER after EACH relation create or delete
+- issue #12639 'Show trace' in Console generates JS error for functions in query's trace called without any arguments
+- issue #12366 Fix user creation with certain MariaDB setups
+- issue #12616 Refuse to work with mbstring.func_overload enabled
+- issue #12472 Properly report connection without password in setup
+- issue #12365 Fix records count for large tables
+- issue #12533 Fix records count for complex queries
+- issue #12454 Query history not updated in console until page refresh
+- issue #12344 Fixed parsing of labels in loop
+- issue #12228 Fixed parsing of BEGIN labels
+- issue #12637 Fixed editing some timestamp values
+- issue #12622 Fixed javascript error in designer
+- issue #12334 Missing page indicator or VIEWs
+- issue #12610 Export of tables with Timestamp/Datetime/Time columns defined with ON UPDATE clause with precision fails
+- issue #12661 Error inserting into pma__history after timeout
+- issue #12195 Row_format = fixed not visible
+- issue #12665 Cannot add a foreign key - non-indexed fields not listed in InnoDB tables
+- issue #12674 Allow for proper MySQL-allowed strings as identifiers
+- issue #12651 Allow for partial dates on table insert page
+- issue #12681 Fixed designer with tables using special chars
+- issue #12652 Fixed visual query builder for foreign keys with more fields
+- issue #12257 Improved search page performance
+- issue #12322 Avoid selecting default function for foreign keys
+- issue #12453 Fixed escaping of SQL parts in some corner cases
+- issue #12542 Missing table name in account privileges editor
+- issue #12691 Remove ksort call on empty array in PMA_getPlugins function
+- issue #12443 Check parameter type before processing

 4.6.4 (2016-08-16)
 - issue        [security] Weaknesses with cookie encryption, see PMASA-2016-29
--- a/README.rst
+++ b/README.rst
@ -26,10 +26,6 @@ Code status
    :alt: Buildtime Trend badge
    :target: https://buildtimetrend.herokuapp.com/dashboard/phpmyadmin/phpmyadmin

-.. image:: https://todofy.org/b/phpmyadmin/phpmyadmin
-    :alt: todofy badge
-    :target: https://todofy.org/r/phpmyadmin/phpmyadmin
-
 .. image:: https://bestpractices.coreinfrastructure.org/projects/213/badge
    :alt: CII Best Practices
    :target: https://bestpractices.coreinfrastructure.org/projects/213
--- a/browse_foreigners.php
+++ b/browse_foreigners.php
@ -47,7 +47,8 @@ $foreignData = PMA_getForeignData(
    isset($_REQUEST['foreign_filter'])
    ? $_REQUEST['foreign_filter']
    : '',
-    isset($foreign_limit) ? $foreign_limit : null
+    isset($foreign_limit) ? $foreign_limit : null,
+    true // for getting value in $foreignData['the_total']
 );

 // HTML output
--- a/composer.json
+++ b/composer.json
@ -30,7 +30,7 @@
        "ext-mbstring": "*",
        "ext-xml": "*",
        "phpmyadmin/sql-parser": "~3.4",
-        "phpmyadmin/motranslator": "~1.0",
+        "phpmyadmin/motranslator": "^2.0",
        "phpmyadmin/shapefile": "~0.1 || ~1.0",
        "tecnickcom/tcpdf": "~6.2",
        "phpseclib/phpseclib": "~2.0",
--- a/db_export.php
+++ b/db_export.php
@ -110,7 +110,7 @@ foreach ($tables as $each_table) {
    } else {
        $structure_checked = $is_checked;
    }
-    if (isset($_GET['table_data'])) {
+    if (isset($_GET['table_data']) && is_array($_GET['table_data'])) {
        $data_checked = PMA_getCheckedClause(
            $each_table['Name'], $_GET['table_data']
        );
--- a/db_operations.php
+++ b/db_operations.php
@ -36,7 +36,7 @@ $sql_query = '';
 /**
 * Rename/move or copy database
 */
-if (mb_strlen($GLOBALS['db'])
+if (strlen($GLOBALS['db'] > 0)
    && (! empty($_REQUEST['db_rename']) || ! empty($_REQUEST['db_copy']))
 ) {
    if (! empty($_REQUEST['db_rename'])) {
@ -45,9 +45,7 @@ if (mb_strlen($GLOBALS['db'])
        $move = false;
    }

-    if (! isset($_REQUEST['newname'])
-        || ! mb_strlen($_REQUEST['newname'])
-    ) {
+    if (! isset($_REQUEST['newname']) || strlen($_REQUEST['newname']) === 0) {
        $message = PMA\libraries\Message::error(__('The database name is empty!'));
    } else {
        $_error = false;
@ -300,7 +298,7 @@ if ($cfgRelation['pdfwork'] && $num_tables > 0) {
        SELECT *
        FROM ' . PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['db'])
        . '.' . PMA\libraries\Util::backquote($cfgRelation['pdf_pages']) . '
-        WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($GLOBALS['db'])
+        WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($GLOBALS['db'])
        . '\'';
    $test_rs = PMA_queryAsControlUser(
        $test_query,
--- a/db_tracking.php
+++ b/db_tracking.php
@ -114,7 +114,7 @@ $cfgRelation = PMA_getRelationsParam();
 $all_tables_query = ' SELECT table_name, MAX(version) as version FROM ' .
    PMA\libraries\Util::backquote($cfgRelation['db']) . '.' .
    PMA\libraries\Util::backquote($cfgRelation['tracking']) .
-    ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($_REQUEST['db']) .
+    ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['db']) .
    '\' ' .
    ' GROUP BY table_name' .
    ' ORDER BY table_name ASC';
--- a/doc/_ext/configext.py
+++ b/doc/_ext/configext.py
@ -52,21 +52,21 @@ class ConfigOption(ObjectDescription):
        # Generic index entries
        indexentry = self.indextemplate % (name,)
        self.indexnode['entries'].append((indextype, indexentry,
-                                          targetname, targetname))
+                                          targetname, targetname, None))
        self.indexnode['entries'].append((indextype, name,
-                                          targetname, targetname))
+                                          targetname, targetname, None))

        # Server section
        if targetparts[0] == 'Servers' and len(targetparts) > 1:
            indexname = ', '.join(targetparts[1:])
            self.indexnode['entries'].append((indextype, 'server configuration; %s' % indexname,
-                                              targetname, targetname))
+                                              targetname, targetname, None))
            self.indexnode['entries'].append((indextype, indexname,
-                                              targetname, targetname))
+                                              targetname, targetname, None))
        else:
            indexname = ', '.join(targetparts)
            self.indexnode['entries'].append((indextype, indexname,
-                                              targetname, targetname))
+                                              targetname, targetname, None))

        self.env.domaindata['config']['objects'][self.objtype, name] = \
            self.env.docname, targetname
@ -84,8 +84,8 @@ class ConfigSectionXRefRole(XRefRole):
        tgtid = 'index-%s' % env.new_serialno('index')
        indexnode = addnodes.index()
        indexnode['entries'] = [
-            ('single', varname, tgtid, varname),
-            ('single', 'configuration section; %s' % varname, tgtid, varname)
+            ('single', varname, tgtid, varname, None),
+            ('single', 'configuration section; %s' % varname, tgtid, varname, None)
        ]
        targetnode = nodes.target('', '', ids=[tgtid])
        document.note_explicit_target(targetnode)
@ -118,7 +118,7 @@ class ConfigSection(ObjectDescription):
                indextype = 'single'
                indexentry = self.indextemplate % (name,)
            self.indexnode['entries'].append((indextype, indexentry,
-                                              targetname, targetname))
+                                              targetname, targetname, None))
        self.env.domaindata['config']['objects'][self.objtype, name] = \
            self.env.docname, targetname

@ -135,8 +135,8 @@ class ConfigOptionXRefRole(XRefRole):
        tgtid = 'index-%s' % env.new_serialno('index')
        indexnode = addnodes.index()
        indexnode['entries'] = [
-            ('single', varname, tgtid, varname),
-            ('single', 'configuration option; %s' % varname, tgtid, varname)
+            ('single', varname, tgtid, varname, None),
+            ('single', 'configuration option; %s' % varname, tgtid, varname, None)
        ]
        targetnode = nodes.target('', '', ids=[tgtid])
        document.note_explicit_target(targetnode)
@ -185,4 +185,3 @@ class ConfigFileDomain(Domain):

 def setup(app):
    app.add_domain(ConfigFileDomain)
-
--- a/doc/charts.rst
+++ b/doc/charts.rst
@ -34,13 +34,13 @@ Pie chart

 Query results for a simple pie chart can be generated with:

-.. code-block:: sql
+.. code-block:: mysql

-    SELECT 'Food' AS 'expense', 
-       1250 AS 'amount' UNION
-    SELECT 'Accommodation', 500 UNION
-    SELECT 'Travel', 720 UNION
-    SELECT 'Misc', 220
+    SELECT 'Food' AS 'expense', 
+       1250 AS 'amount' UNION
+    SELECT 'Accommodation', 500 UNION
+    SELECT 'Travel', 720 UNION
+    SELECT 'Misc', 220

 And the result of this query is:

@ -67,16 +67,16 @@ Both bar charts and column chats support stacking. Upon selecting one of these t

 Query results for a simple bar or column chart can be generated with:

-.. code-block:: sql
+.. code-block:: mysql

-    SELECT 
-       'ACADEMY DINOSAUR' AS 'title',
-       0.99 AS 'rental_rate',
-       20.99 AS 'replacement_cost' UNION
-    SELECT 'ACE GOLDFINGER', 4.99, 12.99 UNION
-    SELECT 'ADAPTATION HOLES', 2.99, 18.99 UNION
-    SELECT 'AFFAIR PREJUDICE', 2.99, 26.99 UNION
-    SELECT 'AFRICAN EGG', 2.99, 22.99
+    SELECT 
+       'ACADEMY DINOSAUR' AS 'title',
+       0.99 AS 'rental_rate',
+       20.99 AS 'replacement_cost' UNION
+    SELECT 'ACE GOLDFINGER', 4.99, 12.99 UNION
+    SELECT 'ADAPTATION HOLES', 2.99, 18.99 UNION
+    SELECT 'AFFAIR PREJUDICE', 2.99, 26.99 UNION
+    SELECT 'AFRICAN EGG', 2.99, 22.99

 And the result of this query is:

@ -114,15 +114,15 @@ These charts can be used to illustrate trends in underlying data. Spline charts

 Query results for a simple line, spline or timeline chart can be generated with:

-.. code-block:: sql
+.. code-block:: mysql

-    SELECT 
-       DATE('2006-01-08') AS 'date', 
-       2056 AS 'revenue',
-       1378 AS 'cost' UNION
-    SELECT DATE('2006-01-09'), 1898, 2301 UNION
-    SELECT DATE('2006-01-15'), 1560, 600 UNION
-    SELECT DATE('2006-01-17'), 3457, 1565
+    SELECT 
+       DATE('2006-01-08') AS 'date', 
+       2056 AS 'revenue',
+       1378 AS 'cost' UNION
+    SELECT DATE('2006-01-09'), 1898, 2301 UNION
+    SELECT DATE('2006-01-15'), 1560, 600 UNION
+    SELECT DATE('2006-01-17'), 3457, 1565

 And the result of this query is:

--- a/doc/config.rst
+++ b/doc/config.rst
@ -577,6 +577,10 @@ Server connection settings
    :type: boolean
    :default: false

+    .. deprecated:: 4.7.0
+
+        This setting was removed as it can produce unexpected results.
+
    Allow attempt to log in without password when a login with password
    fails. This can be used together with http authentication, when
    authentication is done some other way and phpMyAdmin gets user name
@ -635,7 +639,7 @@ Server connection settings

    More information on regular expressions can be found in the `PCRE
    pattern syntax
-    <https://php.net/manual/en/reference.pcre.pattern.syntax.php>`_ portion
+    <https://secure.php.net/manual/en/reference.pcre.pattern.syntax.php>`_ portion
    of the PHP reference manual.

 .. config:option:: $cfg['Servers'][$i]['verbose']
@ -829,7 +833,7 @@ Server connection settings
      ``pma__column_info``)
    * to update your PRE-2.5.0 Column\_comments table use this:  and
      remember that the Variable in :file:`config.inc.php` has been renamed from
-      :config:option:`$cfg['Servers'][$i]['column\_comments']` to
+      :samp:`$cfg['Servers'][$i]['column\_comments']` to
      :config:option:`$cfg['Servers'][$i]['column\_info']`

      .. code-block:: mysql
@ -1468,14 +1472,14 @@ Generic settings
    :type: boolean
    :default: false

-    Whether `persistent connections <https://php.net/manual/en/features
+    Whether `persistent connections <https://secure.php.net/manual/en/features
    .persistent-connections.php>`_ should be used or not. Works with
    following extensions:

-    * mysql (`mysql\_pconnect <https://php.net/manual/en/function.mysql-
+    * mysql (`mysql\_pconnect <https://secure.php.net/manual/en/function.mysql-
      pconnect.php>`_),
    * mysqli (requires PHP 5.3.0 or newer, `more information
-      <https://php.net/manual/en/mysqli.persistconns.php>`_).
+      <https://secure.php.net/manual/en/mysqli.persistconns.php>`_).

 .. config:option:: $cfg['ForceSSL']

@ -1512,7 +1516,7 @@ Generic settings
    :default: ``''``

    Path for storing session data (`session\_save\_path PHP parameter
-    <https://php.net/session_save_path>`_).
+    <https://secure.php.net/session_save_path>`_).

 .. config:option:: $cfg['MemoryLimit']

@ -1664,7 +1668,7 @@ Cookie authentication options

    Define how long a login cookie is valid. Please note that php
    configuration option `session.gc\_maxlifetime
-    <https://php.net/manual/en/session.configuration.php#ini.session.gc-
+    <https://secure.php.net/manual/en/session.configuration.php#ini.session.gc-
    maxlifetime>`_ might limit session validity and if the session is lost,
    the login cookie is also invalidated. So it is a good idea to set
    ``session.gc_maxlifetime`` at least to the same value of
@ -1714,6 +1718,30 @@ Cookie authentication options
    to the given regular expression. The regular expression must be enclosed
    with a delimiter character.

+    It is recommended to include start and end symbols in the regullar
+    expression, so that you can avoid partial matches on the string.
+
+    **Examples:**
+
+    .. code-block:: php
+
+        // Allow connection to three listed servers:
+        $cfg['ArbitraryServerRegexp'] = '/^(server|another|yetdifferent)$/'; 
+
+        // Allow connection to range of IP addresses:
+        $cfg['ArbitraryServerRegexp'] = '@^192\.168\.0\.[0-9]{1,}$@';
+
+        // Allow connection to server name ending with -mysql:
+        $cfg['ArbitraryServerRegexp'] = '@^[^:]\-mysql$@';
+
+    .. note::
+
+        The whole server name is matched, it can include port as well. Due to
+        way MySQL is permissive in connection parameters, it is possible to use
+        connection strings as ```server:3306-mysql```. This can be used to
+        bypass regullar expression by the suffix, while connecting to another
+        server.
+
 .. config:option:: $cfg['CaptchaLoginPublicKey']

    :type: string
@ -2263,7 +2291,13 @@ Export and import settings
    * ``custom-no-form`` same as ``custom`` but does not display the option
      of using quick export

+.. config:option:: $cfg['Export']['charset']

+    :type: string
+    :default: ``''``
+
+    Defines charset for generated export. By default no charset conversion is
+    done assuming UTF-8.

 .. config:option:: $cfg['Import']

@ -2274,6 +2308,13 @@ Export and import settings
    items are similar to texts seen on import page, so you can easily
    identify what they mean.

+.. config:option:: $cfg['Import']['charset']
+
+    :type: string
+    :default: ``''``
+
+    Defines charset for import. By default no charset conversion is done
+    assuming UTF-8.

 Tabs display settings
 ---------------------
@ -3183,7 +3224,9 @@ Google Cloud SQL with SSL
 To connect to Google Could SQL, you currently need to disable certificate
 verification. This is caused by the certficate being issued for CN matching
 your instance name, but you connect to an IP address and PHP tries to match
-these two. With verfication you end up with error message like::
+these two. With verfication you end up with error message like:
+
+.. code-block:: text

    Peer certificate CN=`api-project-851612429544:pmatest' did not match expected CN=`8.8.8.8'

--- a/doc/faq.rst
+++ b/doc/faq.rst
@ -207,7 +207,7 @@ your server - as mentioned in :ref:`faq1_17`. This problem is
 generally caused by using MySQL version 4.1 or newer. MySQL changed
 the authentication hash and your PHP is trying to use the old method.
 The proper solution is to use the `mysqli extension
-<https://php.net/mysqli>`_ with the proper client library to match
+<https://secure.php.net/mysqli>`_ with the proper client library to match
 your MySQL installation. More
 information (and several workarounds) are located in the `MySQL
 Documentation <https://dev.mysql.com/doc/refman/5.7/en/old-client.html>`_.
@ -254,8 +254,8 @@ current setup):

    [PHP]

-    ; Directory in which the loadable extensions (modules) reside.
-    extension_dir = "C:/Apache2/modules/php/ext"
+    ; Directory in which the loadable extensions (modules) reside.
+    extension_dir = "C:/Apache2/modules/php/ext"

 The :file:`php.ini` can be loaded from several locations (especially on
 Windows), so please check you're updating the correct one. If using Apache, you
@ -263,14 +263,14 @@ can tell it to use specific path for this file using ``PHPIniDir`` directive:

 .. code-block:: apache

-    LoadFile "C:/php/php5ts.dll"
-    LoadModule php5_module "C:/php/php5apache2_2.dll"
+    LoadFile "C:/php/php5ts.dll"
+    LoadModule php5_module "C:/php/php5apache2_2.dll"
    <IfModule php5_module>
-        PHPIniDir "C:/PHP"
-        <Location>
-           AddType text/html .php
-           AddHandler application/x-httpd-php .php
-        </Location>
+        PHPIniDir "C:/PHP"
+        <Location>
+           AddType text/html .php
+           AddHandler application/x-httpd-php .php
+        </Location>
    </IfModule>

 In some rare cases this problem can be also caused by other extensions loaded
@ -373,7 +373,7 @@ This can happen due to a MySQL bug when having database / table names
 with upper case characters although ``lower_case_table_names`` is
 set to 1. To fix this, turn off this directive, convert all database
 and table names to lower case and turn it on again. Alternatively,
-there's a bug-fix available starting with MySQL 3.23.56 /
+there's a bug-fix available starting with MySQL 3.23.56 /
 4.0.11-gamma.

 .. _faq1_29:
@ -838,7 +838,7 @@ Here are a few points to check:
 ---------------------------------

 To be able to see a progress bar during your uploads, your server must
-have the `APC <https://php.net/manual/en/book.apc.php>`_ extension, the
+have the `APC <https://secure.php.net/manual/en/book.apc.php>`_ extension, the
 `uploadprogress <https://pecl.php.net/package/uploadprogress>`_ one, or
 you must be running PHP 5.4.0 or higher. Moreover, the JSON extension
 has to be enabled in your PHP.
@ -1068,7 +1068,7 @@ is no way for PHP to set the charset before authenticating.
 .. seealso::

    `phpMyAdmin issue 12232 <https://github.com/phpmyadmin/phpmyadmin/issues/12232>`_,
-    `MySQL documentation note <https://php.net/manual/en/mysqli.real-connect.php#refsect1-mysqli.real-connect-notes>`_
+    `MySQL documentation note <https://secure.php.net/manual/en/mysqli.real-connect.php#refsect1-mysqli.real-connect-notes>`_

 .. _faqmultiuser:

@ -1351,7 +1351,9 @@ browser cache to see if the problem goes away.
 5.20 I get errors about violating Content Security Policy.
 ----------------------------------------------------------

-If you see errors like::
+If you see errors like:
+
+.. code-block:: text

    Refused to apply inline style because it violates the following Content Security Policy directive

@ -1371,6 +1373,28 @@ Programs known to cause these kind of errors:

 * Kaspersky Internet Security

+.. _faq5_21:
+
+5.21 I get errors about potentially unsafe operation when browsing table or executing SQL query.
+------------------------------------------------------------------------------------------------
+
+If you see errors like:
+
+.. code-block:: text
+
+    A potentially unsafe operation has been detected in your request to this site.
+
+This is usually caused by web application firewall doing requests filtering. It
+tries to prevent SQL injection, however phpMyAdmin is tool designed to execute 
+SQL queries, thus it makes it unusable.
+
+Please whitelist phpMyAdmin scripts from the web application firewall settings
+or disable it completely for phpMyAdmin path.
+
+Programs known to cause these kind of errors:
+
+* Wordfence Web Application Firewall
+
 .. _faqusing:

 Using phpMyAdmin
@ -1441,6 +1465,9 @@ re–written, if possible it is suggested that you upgrade to take
 advantage of the new features.  For additional help on this subject,
 look for the word "upload" in this document.

+Note: For errors while importing of dumps exported from older MySQL versions to newer MySQL versions,
+please check :ref:`faq6_41`.
+
 .. _faq6_6:

 6.6 How can I use the relation table in Query-by-example?
@ -1775,7 +1802,7 @@ in Browse mode or on the Structure page.
 -----------------------------------

 In all places where phpMyAdmin accepts format strings, you can use
-``@VARIABLE@`` expansion and `strftime <https://php.net/strftime>`_
+``@VARIABLE@`` expansion and `strftime <https://secure.php.net/strftime>`_
 format strings. The expanded variables depend on a context (for
 example, if you haven't chosen a table, you can not get the table
 name), but the following variables can be used:
@ -2106,6 +2133,31 @@ Parameters should be prefixed with a colon(:) and when the "Bind parameters" che
 these parameters will be identified and input fields for these parameters will be presented.
 Values entered in these field will be substituted in the query before being executed.

+.. _faq6_41:
+
+6.41 I get import errors while importing the dumps exported from older MySQL versions (pre-5.7.6) into newer MySQL versions (5.7.7+), but they work fine when imported back on same older versions ?
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+
+If you get errors like *#1031 - Table storage engine for 'table_name' doesn't have this option*
+while importing the dumps exported from pre-5.7.7 MySQL servers into new MySQL server versions 5.7.7+,
+it might be because ROW_FORMAT=FIXED is not supported with InnoDB tables. Moreover, the value of
+`innodb_strict_mode <http://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_strict_mode>`_ would define if this would be reported as a warning or as an error.
+
+Since MySQL version 5.7.9, the default value for `innodb_strict_mode` is `ON` and thus would generate
+an error when such a CREATE TABLE or ALTER TABLE statement is encountered.
+
+There are two ways of preventing such errors while importing:
+
+* Change the value of `innodb_strict_mode` to `OFF` before starting the import and turn it `ON` after
+  the import is successfully completed.
+* This can be achieved in two ways:
+
+  * Go to 'Variables' page and edit the value of `innodb_strict_mode`
+  * Run the query : `SET GLOBAL `innodb_strict_mode` = '[value]'`
+
+After the import is done, it is suggested that the value of `innodb_strict_mode` should be reset to the
+original value.
+
 .. _faqproject:

 phpMyAdmin project
--- a/doc/glossary.rst
+++ b/doc/glossary.rst
@ -213,7 +213,7 @@ From Wikipedia, the free encyclopedia

       If you have troubles installing this extension, please follow :ref:`faqmysql`, it provides useful hints.
       
-       ..seealso:: <https://php.net/manual/en/book.mbstring.php>
+       ..seealso:: <https://secure.php.net/manual/en/book.mbstring.php>

    MCrypt
      a cryptographic library.	
@ -223,7 +223,7 @@ From Wikipedia, the free encyclopedia
    mcrypt
      the MCrypt PHP extension.	

-      .. seealso:: <https://php.net/mcrypt>
+      .. seealso:: <https://secure.php.net/mcrypt>

    MIME
      Multipurpose Internet Mail Extensions is
@ -248,12 +248,12 @@ From Wikipedia, the free encyclopedia
    mysqli
      the improved MySQL client PHP extension.	

-      .. seealso:: <https://php.net/manual/en/book.mysqli.php>
+      .. seealso:: <https://secure.php.net/manual/en/book.mysqli.php>

    mysql
      the MySQL client PHP extension.	

-      .. seealso:: <https://php.net/manual/en/book.mysql.php>
+      .. seealso:: <https://secure.php.net/manual/en/book.mysql.php>

    OpenDocument
      open standard for office documents.	
@ -281,7 +281,7 @@ From Wikipedia, the free encyclopedia
      Perl Compatible Regular Expressions is the perl-compatible regular
      expression functions for PHP	

-      .. seealso:: <https://php.net/pcre>
+      .. seealso:: <https://secure.php.net/pcre>

    PHP
      short for "PHP: Hypertext Preprocessor", is an open-source, reflective
--- a/doc/require.rst
+++ b/doc/require.rst
@ -21,19 +21,19 @@ PHP
  ("image/jpeg: inline") with their original aspect ratio.

 * When using the cookie authentication (the default), the `openssl
-  <https://php.net/openssl>`_ extension is strongly suggested.
+  <https://secure.php.net/openssl>`_ extension is strongly suggested.

 * To support upload progress bars, see :ref:`faq2_9`.

 * To support XML and Open Document Spreadsheet importing, you need the
-  `libxml <https://php.net/libxml>`_ extension.
+  `libxml <https://secure.php.net/libxml>`_ extension.

 * To support reCAPTCHA on the login page, you need the
-  `openssl <https://php.net/openssl>`_ extension.
+  `openssl <https://secure.php.net/openssl>`_ extension.

 * To support displaying phpMyAdmin's latest version, you need to enable
  ``allow_url_open`` in your :file:`php.ini` or to have the
-  `curl <https://php.net/curl>`_ extension.
+  `curl <https://secure.php.net/curl>`_ extension.

 * Performance suggestion: install the ``ctype`` extension.

--- a/doc/setup.rst
+++ b/doc/setup.rst
@ -163,10 +163,26 @@ environment variables:
    
    Host name or IP address of the database server to use.

+    .. seealso:: :config:option:`$cfg['Servers'][$i]['host']`
+
 .. envvar:: PMA_HOSTS
    
    Comma separated host names or IP addresses of the database servers to use.

+    .. note:: Used only if :envvar:`PMA_HOST` is empty.
+
+.. envvar:: PMA_VERBOSE
+    
+    Verbose name the database server.
+
+    .. seealso:: :config:option:`$cfg['Servers'][$i]['verbose']`
+
+.. envvar:: PMA_VERBOSES
+    
+    Comma separated verbose name the database servers.
+
+    .. note:: Used only if :envvar:`PMA_VERBOSE` is empty.
+
 .. envvar:: PMA_USER
    
    User name to use for :ref:`auth_config`.
@ -193,20 +209,34 @@ By default, :ref:`cookie` is used, but if :envvar:`PMA_USER` and

    The credentials you need to login are stored in the MySQL server, in case
    of Docker image there are various ways to set it (for example
-    :envvar:`MYSQL_ROOT_PASSWORD` when starting MySQL container). Please check 
+    :samp:`MYSQL_ROOT_PASSWORD` when starting MySQL container). Please check 
    documentation for `MariaDB container <https://hub.docker.com/r/_/mariadb/>`_
    or `MySQL container <https://hub.docker.com/r/_/mysql/>`_.

-Additionally configuration can be tweaked by :file:`/config.user.inc.php`. If
+Additionally configuration can be tweaked by :file:`/www/config.user.inc.php`. If
 this file exists, it will be loaded after configuration generated from above
 environment variables, so you can override any configuration variable. This
 configuraiton can be added as a volume when invoking docker using 
-`-v /some/local/directory/config.user.inc.php:/config.user.inc.php` parameters.
+`-v /some/local/directory/config.user.inc.php:/www/config.user.inc.php` parameters.

 .. seealso:: 
   
    See :ref:`config` for detailed description of configuration options.

+Docker Volumes
+--------------
+
+You can use following volumes to customise image behavior:
+
+:file:`/www/config.user.inc.php`
+
+    Can be used for additional settings, see previous chapter for more details.
+
+:file:`/sessions/`
+
+    Directory where PHP sessions are stored. You might want to share this 
+    for example when uswing :ref:`auth_signon`.
+
 Docker Examples
 ---------------

@ -302,8 +332,8 @@ simple configuration may look like this:
    $i=0;
    $i++;
    $cfg['Servers'][$i]['auth_type']     = 'cookie';
-    // if you insist on "root" having no password:
-    // $cfg['Servers'][$i]['AllowNoPasswordRoot'] = true; `
+    // if you insist on "root" having no password:
+    // $cfg['Servers'][$i]['AllowNoPasswordRoot'] = true; `
    ?>

 Or, if you prefer to not be prompted every time you log in:
@ -430,7 +460,7 @@ Setup script on openSUSE
 Some openSUSE releases do not include setup script in the package. In case you
 want to generate configuration on these you can either download original
 package from <https://www.phpmyadmin.net/> or use setup script on our demo
-server: <https://demo.phpmyadmin.net/master/setup/>.
+server: <https://demo.phpmyadmin.net/STABLE/setup/>.


 .. _verify:
@ -466,9 +496,10 @@ Some additional downloads (for example themes) might be signed by Michal Čihař

 and you can get more identification information from <https://keybase.io/nijel>.

-You should verify that the signature matches
-the archive you have downloaded. This way you can be sure that you are using
-the same code that was released.
+You should verify that the signature matches the archive you have downloaded.
+This way you can be sure that you are using the same code that was released.
+You should also verify the date of the signature to make sure that you
+downloaded the latest version.

 Each archive is accompanied with ``.asc`` files which contains the PGP signature
 for it. Once you have both of them in the same folder, you can verify the signature:
@ -604,6 +635,8 @@ If you already had this infrastructure and:
  :file:`sql/upgrade_tables_mysql_4_1_2+.sql`.
 * upgraded to phpMyAdmin 4.3.0 or newer from 2.5.0 or newer (<= 4.2.x),
  please use :file:`sql/upgrade_column_info_4_3_0+.sql`.
+* upgraded to phpMyAdmin 4.7.0 or newer from 4.3.0 or newer,
+  please use :file:`sql/upgrade_tables_4_7_0+.sql`.

 and then create new tables by importing :file:`sql/create_tables.sql`.

@ -850,8 +883,9 @@ are always ways to make your installation more secure:
 * Serve phpMyAdmin on HTTPS only. Preferably, you should use HSTS as well, so that
  you're protected from protocol downgrade attacks.
 * Ensure your PHP setup follows recommendations for production sites, for example
-  `display_errors <https://php.net/manual/en/errorfunc.configuration.php#ini.display-errors>`_ 
+  `display_errors <https://secure.php.net/manual/en/errorfunc.configuration.php#ini.display-errors>`_ 
  should be disabled.
+* Remove the ``test`` directory from phpMyAdmin, unless you are developing and need test suite.
 * Remove the ``setup`` directory from phpMyAdmin, you will probably not
  use it after the initial setup.
 * Properly choose an authentication method - :ref:`cookie`
@ -867,7 +901,8 @@ are always ways to make your installation more secure:
  can do this using ``robots.txt`` file in root of your webserver or limit
  access by web server configuration, see :ref:`faq1_42`.
 * In case you don't want all MySQL users to be able to access
-  phpMyAdmin, you can use :config:option:`$cfg['Servers'][$i]['AllowDeny']['rules']` to limit them.
+  phpMyAdmin, you can use :config:option:`$cfg['Servers'][$i]['AllowDeny']['rules']` to limit them
+  or :config:option:`$cfg['Servers'][$i]['AllowRoot']` to deny root user access.
 * Consider hiding phpMyAdmin behind an authentication proxy, so that
  users need to authenticate prior to providing MySQL credentials
  to phpMyAdmin. You can achieve this by configuring your web server to request
--- a/doc/transformations.rst
+++ b/doc/transformations.rst
@ -122,8 +122,8 @@ libraries/plugins/transformations/TEMPLATE\_ABSTRACT files for adding
 your own transformation plug-in. You can also generate a new
 transformation plug-in (with or without the abstract transformation
 class), by using
-:file:`libraries/plugins/transformations/generator_plugin.sh` or
-:file:`libraries/plugins/transformations/generator_main_class.sh`.
+:file:`scripts/transformations_generator_plugin.sh` or
+:file:`scripts/transformations_generator_main_class.sh`.

 The applyTransformation() method always gets passed three variables:

@ -133,9 +133,9 @@ The applyTransformation() method always gets passed three variables:
   function as an array.
 #. **$meta** - Contains an object with information about your column. The
   data is drawn from the output of the `mysql\_fetch\_field()
-   <https://php.net/mysql_fetch_field>`_ function. This means, all
+   <https://secure.php.net/mysql_fetch_field>`_ function. This means, all
   object properties described on the `manual page
-   <https://php.net/mysql_fetch_field>`_ are available in this
+   <https://secure.php.net/mysql_fetch_field>`_ are available in this
   variable and can be used to transform a column accordingly to
   unsigned/zerofill/not\_null/... properties. The $meta->mimetype
   variable contains the original MIME-type of the column (i.e.
--- a/export.php
+++ b/export.php
@ -259,9 +259,7 @@ if ($_REQUEST['output_format'] == 'astext') {
 // Generate error url and check for needed variables
 if ($export_type == 'server') {
    $err_url = 'server_export.php' . URL::getCommon();
-} elseif ($export_type == 'database'
-    && mb_strlen($db)
-) {
+} elseif ($export_type == 'database' && strlen($db) > 0) {
    $err_url = 'db_export.php' . URL::getCommon(array('db' => $db));
    // Check if we have something to export
    if (isset($table_select)) {
@ -269,9 +267,7 @@ if ($export_type == 'server') {
    } else {
        $tables = array();
    }
-} elseif ($export_type == 'table' && mb_strlen($db)
-    && mb_strlen($table)
-) {
+} elseif ($export_type == 'table' && strlen($db) > 0 && strlen($table) > 0) {
    $err_url = 'tbl_export.php' . URL::getCommon(
        array(
            'db' => $db, 'table' => $table
--- a/import.php
+++ b/import.php
@ -124,13 +124,13 @@ if (! empty($sql_query)) {
            // making sure that :param does not apply values to :param1
            $sql_query = preg_replace(
                '/' . $quoted . '([^a-zA-Z0-9_])/',
-                PMA\libraries\Util::sqlAddSlashes($replacement) . '${1}',
+                $GLOBALS['dbi']->escapeString($replacement) . '${1}',
                $sql_query
            );
            // for parameters the appear at the end of the string
            $sql_query = preg_replace(
                '/' . $quoted . '$/',
-                PMA\libraries\Util::sqlAddSlashes($replacement),
+                $GLOBALS['dbi']->escapeString($replacement),
                $sql_query
            );
        }
@ -203,7 +203,10 @@ if ($_POST == array() && $_GET == array()) {
    $_SESSION['Import_message']['message'] = $message->getDisplay();
    $_SESSION['Import_message']['go_back_url'] = $GLOBALS['goto'];

-    $message->display();
+    $response = PMA\libraries\Response::getInstance();
+    $response->setRequestStatus(false);
+    $response->addJSON('message', $message);
+
    exit; // the footer is displayed automatically
 }

@ -268,17 +271,17 @@ if ($import_type == 'table') {
    $goto = 'server_import.php';
 } else {
    if (empty($goto) || !preg_match('@^(server|db|tbl)(_[a-z]*)*\.php$@i', $goto)) {
-        if (mb_strlen($table) && mb_strlen($db)) {
+        if (strlen($table) > 0 && strlen($db) > 0) {
            $goto = 'tbl_structure.php';
-        } elseif (mb_strlen($db)) {
+        } elseif (strlen($db) > 0) {
            $goto = 'db_structure.php';
        } else {
            $goto = 'server_sql.php';
        }
    }
-    if (mb_strlen($table) && mb_strlen($db)) {
+    if (strlen($table) > 0 && strlen($db) > 0) {
        $common = URL::getCommon(array('db' => $db, 'table' => $table));
-    } elseif (mb_strlen($db)) {
+    } elseif (strlen($db) > 0) {
        $common = URL::getCommon(array('db' => $db));
    } else {
        $common = URL::getCommon();
@ -296,7 +299,7 @@ if (basename($_SERVER['SCRIPT_NAME']) === 'import.php') {
 }


-if (mb_strlen($db)) {
+if (strlen($db) > 0) {
    $GLOBALS['dbi']->selectDb($db);
 }

@ -679,6 +682,7 @@ if ($go_sql) {
    }

    $html_output = '';
+
    foreach ($sql_queries as $sql_query) {

        // parse sql query
@ -691,6 +695,19 @@ if ($go_sql) {
        // @todo: possibly refactor
        extract($analyzed_sql_results);

+        // Check if User is allowed to issue a 'DROP DATABASE' Statement
+        if (PMA_hasNoRightsToDropDatabase(
+            $analyzed_sql_results, $cfg['AllowUserDropDatabase'], $GLOBALS['is_superuser']
+        )) {
+            PMA\libraries\Util::mysqlDie(
+                __('"DROP DATABASE" statements are disabled.'),
+                '',
+                false,
+                $_SESSION['Import_message']['go_back_url']
+            );
+            return;
+        } // end if
+
        if ($table != $table_from_sql && !empty($table_from_sql)) {
            $table = $table_from_sql;
        }
@ -701,7 +718,7 @@ if ($go_sql) {
            $db, // db
            $table, // table
            null, // find_real_end
-            $_REQUEST['sql_query'], // sql_query_for_bookmark
+            null, // sql_query_for_bookmark - see below
            null, // extra_data
            null, // message_to_show
            null, // message
@ -717,6 +734,18 @@ if ($go_sql) {
        );
    }

+    // sql_query_for_bookmark is not included in PMA_executeQueryAndGetQueryResponse
+    // since only one bookmark has to be added for all the queries submitted through
+    // the SQL tab
+    if (! empty($_POST['bkm_label']) && ! empty($import_text)) {
+        $cfgBookmark = Bookmark::getParams();
+        PMA_storeTheQueryAsBookmark(
+            $db, $cfgBookmark['user'],
+            $_REQUEST['sql_query'], $_POST['bkm_label'],
+            isset($_POST['bkm_replace']) ? $_POST['bkm_replace'] : null
+        );
+    }
+
    $response = PMA\libraries\Response::getInstance();
    $response->addJSON('ajax_reload', $ajax_reload);
    $response->addHTML($html_output);
--- a/import_status.php
+++ b/import_status.php
@ -32,7 +32,7 @@ if (ini_get('session.upload_progress.enabled')) {
    session_start();
    foreach ($_SESSION as $key => $value) {
        // only copy session-prefixed data
-        if (mb_substr($key, 0, mb_strlen(UPLOAD_PREFIX))
+        if (substr($key, 0, strlen(UPLOAD_PREFIX))
            == UPLOAD_PREFIX) {
            $sessionupload[$key] = $value;
        }
@ -67,7 +67,7 @@ if (defined('SESSIONUPLOAD')) {

    // remove session upload data that are not set anymore
    foreach ($_SESSION as $key => $value) {
-        if (mb_substr($key, 0, mb_strlen(UPLOAD_PREFIX))
+        if (substr($key, 0, strlen(UPLOAD_PREFIX))
            == UPLOAD_PREFIX
            && ! isset($sessionupload[$key])
        ) {
--- a/index.php
+++ b/index.php
@ -10,6 +10,7 @@ use PMA\libraries\URL;
 use PMA\libraries\Sanitize;
 use PMA\libraries\Charsets;
 use PMA\libraries\ThemeManager;
+use PMA\libraries\LanguageManager;

 /**
 * Gets some core libraries and displays a top message if required
@ -236,9 +237,9 @@ echo '  <ul>';
 // Displays language selection combo
 if (empty($cfg['Lang'])) {
    echo '<li id="li_select_lang" class="no_bullets">';
-    include_once 'libraries/display_select_lang.lib.php';
+
    echo PMA\libraries\Util::getImage('s_lang.png') , " "
-        , PMA_getLanguageSelectorHtml();
+        , LanguageManager::getInstance()->getSelectorDisplay();
    echo '</li>';
 }

@ -432,21 +433,6 @@ echo '</div>';

 echo '</div>';

-/**
- * As we try to handle charsets by ourself, mbstring overloads just
- * break it, see bug 1063821.
- */
-if (@extension_loaded('mbstring') && @ini_get('mbstring.func_overload') > 1) {
-    trigger_error(
-        __(
-            'You have enabled mbstring.func_overload in your PHP '
-            . 'configuration. This option is incompatible with phpMyAdmin '
-            . 'and might cause some data to be corrupted!'
-        ),
-        E_USER_WARNING
-    );
-}
-
 /**
 * mbstring is used for handling multibytes inside parser, so it is good
 * to tell user something might be broken without it, see bug #1063149.
@ -484,7 +470,7 @@ if ($cfg['LoginCookieValidityDisableWarning'] == false) {
    if ($gc_time < $GLOBALS['cfg']['LoginCookieValidity'] ) {
        trigger_error(
            __(
-                'Your PHP parameter [a@https://php.net/manual/en/session.' .
+                'Your PHP parameter [a@https://secure.php.net/manual/en/session.' .
                'configuration.php#ini.session.gc-maxlifetime@_blank]session.' .
                'gc_maxlifetime[/a] is lower than cookie validity configured ' .
                'in phpMyAdmin, because of this, your login might expire sooner ' .
--- a/js/codemirror/addon/lint/sql-lint.js
+++ b/js/codemirror/addon/lint/sql-lint.js
@ -33,6 +33,7 @@ CodeMirror.sqlLint = function(text, updateLinting, options, cm) {
            token: PMA_commonParams.get('token'),
            server: PMA_commonParams.get('server'),
            options: options.lintOptions,
+            no_history: true,
        },
        success: handleResponse
    });
--- a/js/common.js
+++ b/js/common.js
@ -298,6 +298,13 @@ PMA_DROP_IMPORT = {
     * @return void
     */
    _dragenter : function (event) {
+
+        // We don't want to prevent users from using
+        // browser's default drag-drop feature on some page(s)
+        if ($(".noDragDrop").length !== 0) {
+            return;
+        }
+
        event.stopPropagation();
        event.preventDefault();
        if (!PMA_DROP_IMPORT._hasFiles(event)) {
@ -333,6 +340,12 @@ PMA_DROP_IMPORT = {
     * @return void
     */
    _dragover: function (event) {
+        // We don't want to prevent users from using
+        // browser's default drag-drop feature on some page(s)
+        if ($(".noDragDrop").length !== 0) {
+            return;
+        }
+
        event.stopPropagation();
        event.preventDefault();
        if (!PMA_DROP_IMPORT._hasFiles(event)) {
@ -348,6 +361,11 @@ PMA_DROP_IMPORT = {
     * @return void
     */
    _dragleave: function (event) {
+        // We don't want to prevent users from using
+        // browser's default drag-drop feature on some page(s)
+        if ($(".noDragDrop").length !== 0) {
+            return;
+        }
        event.stopPropagation();
        event.preventDefault();
        var $pma_drop_handler = $(".pma_drop_handler");
@ -408,6 +426,12 @@ PMA_DROP_IMPORT = {
     * @return void
     */
    _drop: function (event) {
+        // We don't want to prevent users from using
+        // browser's default drag-drop feature on some page(s)
+        if ($(".noDragDrop").length !== 0) {
+            return;
+        }
+
        var dbname = PMA_commonParams.get('db');
        var server = PMA_commonParams.get('server');

--- a/js/config.js
+++ b/js/config.js
@ -588,8 +588,9 @@ function setTab(tab_id)
        }
        $this.find('li').removeClass('active').find('a[href=#' + tab_id + ']').parent().addClass('active');
        $this.parent().find('div.tabs_contents fieldset').hide().filter('#' + tab_id).show();
-        location.hash = 'tab_' + tab_id;
-        $this.parent().find('input[name=tab_hash]').val(location.hash);
+        var hashValue = 'tab_' + tab_id;
+        location.hash = hashValue;
+        $this.parent().find('input[name=tab_hash]').val(hashValue);
    });
 }

--- a/js/console.js
+++ b/js/console.js
@ -186,7 +186,7 @@ var PMA_console = {
            });

            $(document).ajaxComplete(function (event, xhr, ajaxOptions) {
-                if (ajaxOptions.dataType != 'json') {
+                if (ajaxOptions.dataType && ajaxOptions.dataType.indexOf('json') != -1) {
                    return;
                }
                try {
@ -1229,7 +1229,7 @@ PMA_consoleDebug = {
            functionName += dbgStep.type;
        }
        functionName += dbgStep.function;
-        if (dbgStep.args.length) {
+        if (dbgStep.args && dbgStep.args.length) {
            functionName += '(...)';
        } else {
            functionName += '()';
@ -1297,7 +1297,7 @@ PMA_consoleDebug = {
                            .append(
                            $('<span class="file">').text(this._formatFileName(step))
                        );
-                    if (step.args.length) {
+                    if (step.args && step.args.length) {
                        $stepElem
                            .append(
                            $('<span class="args">').html(this._formatFunctionArgs(step))
--- a/js/db_central_columns.js
+++ b/js/db_central_columns.js
@ -132,7 +132,6 @@ AJAX.registerOnload('db_central_columns.js', function () {
        $('#tableslistcontainer').find('.checkall').show();
    });
    $('.edit_save_form').click(function(event) {
-        //alert(1);
        event.preventDefault();
        event.stopPropagation();
        var rownum = $(this).data('rownum');
@ -142,14 +141,14 @@ AJAX.registerOnload('db_central_columns.js', function () {
                       .attr('name', $(this).attr('name'));
            }
        });
+
        if($('#f_' + rownum + ' .default_type').val() === 'USER_DEFINED') {
            $('#f_' + rownum + ' .default_type').attr('name','col_default_sel');
        } else {
            $('#f_' + rownum + ' .default_value').attr('name','col_default_val');
        }
-       // alert(rownum);
+
        var datastring = $('#f_' + rownum + ' :input').serialize();
-        //console.log(datastring);
        $.ajax({
            type: "POST",
            url: "db_central_columns.php",
--- a/js/db_operations.js
+++ b/js/db_operations.js
@ -135,9 +135,14 @@ AJAX.registerOnload('db_operations.js', function () {
            PMA_messages.strDoYouReally,
            'DROP DATABASE `' + escapeHtml(PMA_commonParams.get('db') + '`')
        );
+        var params = {
+            'is_js_confirmed': '1',
+            'ajax_request': true,
+            'token': PMA_commonParams.get('token')
+        };
        $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
            PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
-            $.post(url, {'is_js_confirmed': '1', 'ajax_request': true}, function (data) {
+            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success) {
                    //Database deleted successfully, refresh both the frames
                    PMA_reloadNavigation();
--- a/js/db_search.js
+++ b/js/db_search.js
@ -85,7 +85,12 @@ function deleteResult(result_path, msg)
            var $msg = PMA_ajaxShowMessage(PMA_messages.strDeleting, false);
            /** Load the deleted option to the page*/
            $('#sqlqueryform').html('');
-            $.post(result_path, {'ajax_request': true, 'is_js_confirmed': true},
+            var params = {
+                'ajax_request': true,
+                'is_js_confirmed': true,
+                'token' : PMA_commonParams.get('token')
+            };
+            $.post(result_path, params,
                function (data) {
                    if (typeof data === 'undefined' || !data.success) {
                        PMA_ajaxShowMessage(data.error, false);
--- a/js/db_structure.js
+++ b/js/db_structure.js
@ -217,9 +217,11 @@ AJAX.registerOnload('db_structure.js', function () {
        if ($(this).val() === 'make_consistent_with_central_list') {
            event.preventDefault();
            event.stopPropagation();
-            jqConfirm(PMA_messages.makeConsistentMessage, function(){
-                        $('#tablesForm').submit();
-                    });
+            jqConfirm(
+                PMA_messages.makeConsistentMessage, function(){
+                    $('#tablesForm').submit();
+                }
+            );
            return false;
        }
        else if ($(this).val() === 'copy_tbl' || $(this).val() === 'add_prefix_tbl' || $(this).val() === 'replace_prefix_tbl' || $(this).val() === 'copy_tbl_change_prefix') {
@ -303,6 +305,7 @@ AJAX.registerOnload('db_structure.js', function () {
            PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

            var params = getJSConfirmCommonParam(this);
+            params.token = PMA_commonParams.get('token');

            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success === true) {
@ -366,6 +369,7 @@ AJAX.registerOnload('db_structure.js', function () {
            var $msg = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

            var params = getJSConfirmCommonParam(this);
+            params.token = PMA_commonParams.get('token');

            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success === true) {
--- a/js/db_tracking.js
+++ b/js/db_tracking.js
@ -83,7 +83,12 @@ AJAX.registerOnload('db_tracking.js', function () {
        $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) {
            PMA_ajaxShowMessage(PMA_messages.strDeletingTrackingData);
            AJAX.source = $anchor;
-            $.post(url, {'ajax_page_request': true, 'ajax_request': true}, AJAX.responseHandler);
+            var params = {
+                'ajax_page_request': true,
+                'ajax_request': true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, AJAX.responseHandler);
        });
    });
 });
--- a/js/export.js
+++ b/js/export.js
@ -545,6 +545,16 @@ function toggle_table_select(row) {
    }
 }

+function handleAddProcCheckbox() {
+    if ($('#table_structure_all').is(':checked') === true
+        && $('#table_data_all').is(':checked') === true
+    ) {
+        $('#checkbox_sql_procedure_function').prop('checked', true);
+    } else {
+        $('#checkbox_sql_procedure_function').prop('checked', false);
+    }
+}
+
 AJAX.registerOnload('export.js', function () {
    /**
     * For SQL plugin, if "CREATE TABLE options" is checked/unchecked, check/uncheck each of its sub-options
@ -584,26 +594,31 @@ AJAX.registerOnload('export.js', function () {
    $('input[name="table_select[]"]').on('change', function() {
        toggle_table_select($(this).closest('tr'));
        check_table_select_all();
+        handleAddProcCheckbox();
    });

    $('input[name="table_structure[]"]').on('change', function() {
        check_table_selected($(this).closest('tr'));
        check_table_select_all();
+        handleAddProcCheckbox();
    });

    $('input[name="table_data[]"]').on('change', function() {
        check_table_selected($(this).closest('tr'));
        check_table_select_all();
+        handleAddProcCheckbox();
    });

    $('#table_structure_all').on('change', function() {
        toggle_table_select_all_str();
        check_selected_tables();
+        handleAddProcCheckbox();
    });

    $('#table_data_all').on('change', function() {
        toggle_table_select_all_data();
        check_selected_tables();
+        handleAddProcCheckbox();
    });

    if ($("input[name='export_type']").val() == 'database') {
@ -810,6 +825,8 @@ AJAX.registerOnload('export.js', function () {
    toggle_quick_or_custom();
    toggle_structure_data_opts();
    toggle_sql_include_comments();
+    check_table_select_all();
+    handleAddProcCheckbox();

    /**
     * Initially disables the "Dump some row(s)" sub-options
--- a/js/functions.js
+++ b/js/functions.js
@ -152,6 +152,8 @@ function PMA_addDatepicker($this_element, type, options)
    }
    else if (type == "time") {
        $this_element.timepicker($.extend(defaultOptions, options));
+        // Add a tip regarding entering MySQL allowed-values for TIME data-type
+        PMA_tooltip($this_element, 'input', PMA_messages.strMysqlAllowedValuesTip);
    }
 }

@ -185,6 +187,14 @@ function addDateTimePicker() {
                showMicrosec: showMicrosec,
                timeFormat: timeFormat
            });
+
+            // Add a tip regarding entering MySQL allowed-values
+            // for TIME and DATE data-type
+            if ($(this).hasClass('timefield')) {
+                PMA_tooltip($(this), 'input', PMA_messages.strMysqlAllowedValuesTipTime);
+            } else if ($(this).hasClass('datefield')) {
+                PMA_tooltip($(this), 'input', PMA_messages.strMysqlAllowedValuesTipDate);
+            }
        });
    }
 }
@ -461,8 +471,13 @@ function suggestPassword(passwd_form)
        passwd.value += pwchars.charAt(Math.abs(randomWords[i]) % pwchars.length);
    }

-    passwd_form.text_pma_pw.value = passwd.value;
-    passwd_form.text_pma_pw2.value = passwd.value;
+    $jquery_passwd_form = $(passwd_form);
+
+    passwd_form.elements['pma_pw'].value = passwd.value;
+    passwd_form.elements['pma_pw2'].value = passwd.value;
+    meter_obj = $jquery_passwd_form.find('meter[name="pw_meter"]').first();
+    meter_obj_label = $jquery_passwd_form.find('span[name="pw_strength"]').first();
+    checkPasswordStrength(passwd.value, meter_obj, meter_obj_label);
    return true;
 }

@ -613,8 +628,12 @@ function confirmLink(theLink, theSqlQuery)
    if (is_confirmed) {
        if ($(theLink).hasClass('formLinkSubmit')) {
            var name = 'is_js_confirmed';
+
            if ($(theLink).attr('href').indexOf('usesubform') != -1) {
-                name = 'subform[' + $(theLink).attr('href').substr('#').match(/usesubform\[(\d+)\]/i)[1] + '][is_js_confirmed]';
+                var matches = $(theLink).attr('href').substr('#').match(/usesubform\[(\d+)\]/i);
+                if (matches != null) {
+                    name = 'subform[' + matches[1] + '][is_js_confirmed]';
+                }
            }

            $(theLink).parents('form').append('<input type="hidden" name="' + name + '" value="1" />');
@ -629,8 +648,7 @@ function confirmLink(theLink, theSqlQuery)
 } // end of the 'confirmLink()' function

 /**
- * Displays an error message if a "DROP DATABASE" statement is submitted
- * while it isn't allowed, else confirms a "DROP/DELETE/ALTER" query before
+ * Confirms a "DROP/DELETE/ALTER" query before
 * submitting it if required.
 * This function is called by the 'checkSqlQuery()' js function.
 *
@ -648,17 +666,6 @@ function confirmQuery(theForm1, sqlQuery1)
        return true;
    }

-    // "DROP DATABASE" statement isn't allowed
-    if (PMA_messages.strNoDropDatabases !== '') {
-        var drop_re = new RegExp('(^|;)\\s*DROP\\s+(IF EXISTS\\s+)?DATABASE\\s', 'i');
-        if (drop_re.test(sqlQuery1.value)) {
-            alert(PMA_messages.strNoDropDatabases);
-            theForm1.reset();
-            sqlQuery1.focus();
-            return false;
-        } // end if
-    } // end if
-
    // Confirms a "DROP/DELETE/ALTER/TRUNCATE" statement
    //
    // TODO: find a way (if possible) to use the parser-analyser
@ -666,7 +673,7 @@ function confirmQuery(theForm1, sqlQuery1)
    // For now, I just added a ^ to check for the statement at
    // beginning of expression

-    var do_confirm_re_0 = new RegExp('^\\s*DROP\\s+(IF EXISTS\\s+)?(TABLE|DATABASE|PROCEDURE)\\s', 'i');
+    var do_confirm_re_0 = new RegExp('^\\s*DROP\\s+(IF EXISTS\\s+)?(TABLE|PROCEDURE)\\s', 'i');
    var do_confirm_re_1 = new RegExp('^\\s*ALTER\\s+TABLE\\s+((`[^`]+`)|([A-Za-z0-9_$]+))\\s+DROP\\s', 'i');
    var do_confirm_re_2 = new RegExp('^\\s*DELETE\\s+FROM\\s', 'i');
    var do_confirm_re_3 = new RegExp('^\\s*TRUNCATE\\s', 'i');
@ -911,13 +918,13 @@ AJAX.registerOnload('functions.js', function () {
                data: params,
                success: function (data) {
                    if (data.success) {
-                        if (PMA_commonParams.get('LoginCookieValidity')-_idleSecondsCounter > 5) {
-                            var interval = (PMA_commonParams.get('LoginCookieValidity') - _idleSecondsCounter - 5) * 1000;
-                            if (interval > Math.pow(2, 31) - 1) { // max value for setInterval() function
-                                interval = Math.pow(2, 31) - 1;
-                            }
+                        var remaining = PMA_commonParams.get('LoginCookieValidity') - _idleSecondsCounter;
+                        if (remaining > 5) {
+                            // max value for setInterval() function
+                            var interval = Math.min(remaining * 1000, Math.pow(2, 31) - 1);
                            updateTimeout = window.setTimeout(UpdateIdleTime, interval);
-                        } else {
+                        } else if (remaining > 0) {
+                            // We're close to session expiry
                            updateTimeout = window.setTimeout(UpdateIdleTime, 2000);
                        }
                    } else { //timeout occurred
@ -3171,6 +3178,10 @@ AJAX.registerOnload('functions.js', function () {
                return;
            }

+            if (data._scripts) {
+                AJAX.scriptHandler.load(data._scripts);
+            }
+
            $('<div id="change_password_dialog"></div>')
                .dialog({
                    title: PMA_messages.strChangePassword,
@ -3187,7 +3198,6 @@ AJAX.registerOnload('functions.js', function () {
                .find("legend").remove().end()
                .find("table.noclick").unwrap().addClass("some-margin")
                .find("input#text_pma_pw").focus();
-            displayPasswordGenerateButton();
            $('#fieldset_change_password_footer').hide();
            PMA_ajaxRemoveMessage($msgbox);
            $('#change_password_form').bind('submit', function (e) {
@ -4624,6 +4634,16 @@ AJAX.registerTeardown('functions.js', function () {

 AJAX.registerOnload('functions.js', function () {
    $('input#print').click(printPage);
+    $('.logout').click(function() {
+        var form = $(
+            '<form method="POST" action="' + $(this).attr('href') + '" class="disableAjax">' +
+            '<input type="hidden" name="token" value="' + PMA_commonParams.get('token') + '"/>' +
+            '</form>'
+        );
+        $('body').append(form);
+        form.submit();
+        return false;
+    });
    /**
     * Ajaxification for the "Create View" action
     */
@ -4952,6 +4972,30 @@ function PMA_ignorePhpErrors(clearPrevErrors){
    $pmaErrors.remove();
 }

+/**
+ * Toggle the Datetimepicker UI if the date value entered
+ * by the user in the 'text box' is not going to be accepted
+ * by the Datetimepicker plugin (but is accepted by MySQL)
+ */
+function toggleDatepickerIfInvalid($td, $input_field) {
+    // Regex allowed by the Datetimepicker UI
+    var dtexpDate = new RegExp(['^([0-9]{4})',
+        '-(((01|03|05|07|08|10|12)-((0[1-9])|([1-2][0-9])|(3[0-1])))|((02|04|06|09|11)',
+        '-((0[1-9])|([1-2][0-9])|30)))$'].join(''));
+    var dtexpTime = new RegExp(['^(([0-1][0-9])|(2[0-3]))',
+        ':((0[0-9])|([1-5][0-9]))',
+        ':((0[0-9])|([1-5][0-9]))(\.[0-9]{1,6}){0,1}$'].join(''));
+
+    // If key-ed in Time or Date values are unsupported by the UI, close it
+    if ($td.attr('data-type') === 'date' && ! dtexpDate.test($input_field.val())) {
+        $input_field.datepicker('hide');
+    } else if ($td.attr('data-type') === 'time' && ! dtexpTime.test($input_field.val())) {
+        $input_field.datepicker('hide');
+    } else {
+        $input_field.datepicker('show');
+    }
+}
+
 /**
 * Unbind all event handlers before tearing down a page
 */
--- a/js/indexes.js
+++ b/js/indexes.js
@ -609,7 +609,12 @@ AJAX.registerOnload('indexes.js', function () {

        $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) {
            var $msg = PMA_ajaxShowMessage(PMA_messages.strDroppingPrimaryKeyIndex, false);
-            $.post(url, {'is_js_confirmed': 1, 'ajax_request': true}, function (data) {
+            var params = {
+                'is_js_confirmed': 1,
+                'ajax_request': true,
+                'token' : PMA_commonParams.get('token')
+            };
+            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success === true) {
                    PMA_ajaxRemoveMessage($msg);
                    var $table_ref = $rows_to_hide.closest('table');
--- a/js/makegrid.js
+++ b/js/makegrid.js
@ -1051,7 +1051,21 @@ function PMA_makegrid(t, enableResize, enableReorder, enableVisib, enableGridEdi
                        timeFormat: timeFormat
                    });

+                    $input_field.on('keyup', function (e) {
+                        if (e.which == 13) {
+                            // post on pressing "Enter"
+                            e.preventDefault();
+                            e.stopPropagation();
+                            g.saveOrPostEditedCell();
+                        } else if (e.which == 27) {
+                        } else {
+                            toggleDatepickerIfInvalid($td, $input_field);
+                        }
+                    });
+
                    $input_field.datepicker("show");
+                    toggleDatepickerIfInvalid($td, $input_field);
+
                    // unbind the mousedown event to prevent the problem of
                    // datepicker getting closed, needs to be checked for any
                    // change in names when updating
--- a/js/messages.php
+++ b/js/messages.php
@ -39,11 +39,6 @@ if (!defined('TESTSUITE')) {
    );
 }

-$js_messages['strNoDropDatabases'] = __('"DROP DATABASE" statements are disabled.');
-if ($cfg['AllowUserDropDatabase']) {
-    $js_messages['strNoDropDatabases'] = '';
-}
-
 /* For confirmations */
 $js_messages['strConfirm'] = __('Confirm');
 $js_messages['strDoYouReally'] = __('Do you really want to execute "%s"?');
@ -395,6 +390,8 @@ $js_messages['strDeleting'] = __('Deleting');
 $js_messages['MissingReturn']
    = __('The definition of a stored function must contain a RETURN statement!');
 $js_messages['strExport'] = __('Export');
+$js_messages['NoExportable']
+    = __('No routine is exportable. Required privileges may be lacking.');

 /* For ENUM/SET editor*/
 $js_messages['enum_editor'] = __('ENUM/SET editor');
@ -525,6 +522,18 @@ $js_messages['strYes'] = __('Yes');
 $js_messages['strCopyEncryptionKey'] = __('Do you want to copy encryption key?');
 $js_messages['strEncryptionKey'] = __('Encryption key');

+/* For Tip to be shown on Time field */
+$js_messages['strMysqlAllowedValuesTipTime'] = __(
+    'MySQL accepts additional values not selectable by the slider;'
+    . ' key in those values directly if desired'
+);
+
+/* For Tip to be shown on Date field */
+$js_messages['strMysqlAllowedValuesTipDate'] = __(
+    'MySQL accepts additional values not selectable by the datepicker;'
+    . ' key in those values directly if desired'
+);
+
 /* For Lock symbol Tooltip */
 $js_messages['strLockToolTip'] = __(
    'Indicates that you have made changes to this page;'
@ -718,6 +727,13 @@ $js_messages['strAddPrefix'] = __('Add table prefix');
 $js_messages['strReplacePrefix'] = __('Replace table with prefix');
 $js_messages['strCopyPrefix'] = __('Copy table with prefix');

+/* For password strength simulation */
+$js_messages['strExtrWeak'] = __('Extremely weak');
+$js_messages['strVeryWeak'] = __('Very weak');
+$js_messages['strWeak'] = __('Weak');
+$js_messages['strGood'] = __('Good');
+$js_messages['strStrong'] = __('Strong');
+
 echo "var PMA_messages = new Array();\n";
 foreach ($js_messages as $name => $js_message) {
    Sanitize::printJsValue("PMA_messages['" . $name . "']", $js_message);
--- a/js/navigation.js
+++ b/js/navigation.js
@ -609,7 +609,8 @@ $(function () {
            data: {
                favorite_tables: (isStorageSupported('localStorage') && typeof window.localStorage.favorite_tables !== 'undefined')
                    ? window.localStorage.favorite_tables
-                    : ''
+                    : '',
+                token: PMA_commonParams.get('token')
            },
            success: function (data) {
                if (data.changes) {
@ -940,7 +941,8 @@ function PMA_ensureNaviSettings(selflink) {

    if (!$('#pma_navigation_settings').length) {
        var params = {
-            getNaviSettings: true
+            getNaviSettings: true,
+            token: PMA_commonParams.get('token')
        };
        var url = $('#pma_navigation').find('a.navigation_url').attr('href');
        $.post(url, params, function (data) {
@ -1537,6 +1539,8 @@ PMA_fastFilter.filter.prototype.request = function () {
    }
    var url = $('#pma_navigation').find('a.navigation_url').attr('href');
    var params = self.$this.find('> ul > li > form.fast_filter').first().serialize();
+    params.token = PMA_commonParams.get('token');
+
    if (self.$this.find('> ul > li > form.fast_filter:first input[name=searchClause]').length === 0) {
        var $input = $('#pma_navigation_tree').find('li.fast_filter.db_fast_filter input.searchClause');
        if ($input.length && $input.val() != $input[0].defaultValue) {
--- a/js/pmd/history.js
+++ b/js/pmd/history.js
@ -658,6 +658,10 @@ function query_from()
    var key2;
    var key3;
    var parts1;
+
+    // the constraints that have been used in the LEFT JOIN
+    var constraints_added = [];
+
    for (i = 0; i < history_array.length; i++) {
        from_array.push(history_array[i].get_tab());
    }
@ -666,6 +670,7 @@ function query_from()
    temp = tab_left.shift();
    quer = '`' + temp + '`';
    tab_used.push(temp);
+
    // if master table (key2) matches with tab used get all keys and check if tab_left matches
    // after this check if master table (key2) matches with tab left then check if any foreign matches with master .
    for (i = 0; i < 2; i++) {
@ -677,11 +682,18 @@ function query_from()
                        for (key3 in contr[K][key][key2]) {
                            parts1 = contr[K][key][key2][key3][0].split(".");
                            if (found(tab_left, parts1[1]) > 0) {
-                                query += "\n" + 'LEFT JOIN ';
-                                query += '`' + parts1[1] + '` ON ';
-                                query += '`' + parts[1] + '`.`' + key3 + '` = ';
-                                query += '`' + parts1[1] + '`.`' + contr[K][key][key2][key3][1] + '` ';
-                                t_tab_left.push(parts1[1]);
+                                if (found(constraints_added, key) > 0) {
+                                    query += ' AND ' + '`' + parts[1] + '`.`' + key3 + '` = ';
+                                    query += '`' + parts1[1] + '`.`' + contr[K][key][key2][key3][1] + '` ';
+                                } else {
+                                    query += "\n" + 'LEFT JOIN ';
+                                    query += '`' + parts[1] + '` ON ';
+                                    query += '`' + parts1[1] + '`.`' + contr[K][key][key2][key3][1] + '` = ';
+                                    query += '`' + parts[1] + '`.`' + key3 + '` ';
+
+                                    constraints_added.push(key);
+                                }
+                                t_tab_left.push(parts[1]);
                            }
                        }
                    }
@ -701,10 +713,17 @@ function query_from()
                        for (key3 in contr[K][key][key2]) {
                            parts1 = contr[K][key][key2][key3][0].split(".");
                            if (found(tab_used, parts1[1]) > 0) {
-                                query += "\n" + 'LEFT JOIN ';
-                                query += '`' + parts[1] + '` ON ';
-                                query += '`' + parts1[1] + '`.`' + contr[K][key][key2][key3][1] + '` = ';
-                                query += '`' + parts[1] + '`.`' + key3 + '` ';
+                                if (found(constraints_added, key) > 0) {
+                                    query += ' AND ' + '`' + parts[1] + '`.`' + key3 + '` = ';
+                                    query += '`' + parts1[1] + '`.`' + contr[K][key][key2][key3][1] + '` ';
+                                } else {
+                                    query += "\n" + 'LEFT JOIN ';
+                                    query += '`' + parts[1] + '` ON ';
+                                    query += '`' + parts1[1] + '`.`' + contr[K][key][key2][key3][1] + '` = ';
+                                    query += '`' + parts[1] + '`.`' + key3 + '` ';
+
+                                    constraints_added.push(key);
+                                }
                                t_tab_left.push(parts[1]);
                            }
                        }
--- a/js/pmd/move.js
+++ b/js/pmd/move.js
@ -681,6 +681,49 @@ function Save2(callback)
    }
 }

+
+function submitSaveDialogAndClose(callback)
+{
+    var $form = $("#save_page");
+    var name = $form.find('input[name="selected_value"]').val().trim();
+    if (name === '') {
+        PMA_ajaxShowMessage(PMA_messages.strEnterValidPageName, false);
+        return;
+    }
+    $('#page_save_dialog').dialog('close');
+
+    if (pmd_tables_enabled) {
+        var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
+        PMA_prepareForAjaxRequest($form);
+        $.post($form.attr('action'), $form.serialize() + Get_url_pos(), function (data) {
+            if (data.success === false) {
+                PMA_ajaxShowMessage(data.error, false);
+            } else {
+                PMA_ajaxRemoveMessage($msgbox);
+                MarkSaved();
+                if (data.id) {
+                    selected_page = data.id;
+                }
+                $('#page_name').text(name);
+                if (typeof callback !== 'undefined') {
+                    callback();
+                }
+            }
+        });
+    } else {
+        Save_to_new_page(db, name, Get_url_pos(), function (page) {
+            MarkSaved();
+            if (page.pg_nr) {
+                selected_page = page.pg_nr;
+            }
+            $('#page_name').text(page.page_descr);
+            if (typeof callback !== 'undefined') {
+                callback();
+            }
+        });
+    }
+}
+
 function Save3(callback)
 {
    if (parseInt(selected_page) !== -1) {
@ -689,44 +732,8 @@ function Save3(callback)
        var button_options = {};
        button_options[PMA_messages.strGo] = function () {
            var $form = $("#save_page");
-            var name = $form.find('input[name="selected_value"]').val().trim();
-            if (name === '') {
-                PMA_ajaxShowMessage(PMA_messages.strEnterValidPageName, false);
-                return;
-            }
-            $(this).dialog('close');
-
-            if (pmd_tables_enabled) {
-                var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
-                PMA_prepareForAjaxRequest($form);
-                $.post($form.attr('action'), $form.serialize() + Get_url_pos(), function (data) {
-                    if (data.success === false) {
-                        PMA_ajaxShowMessage(data.error, false);
-                    } else {
-                        PMA_ajaxRemoveMessage($msgbox);
-                        MarkSaved();
-                        if (data.id) {
-                            selected_page = data.id;
-                        }
-                        $('#page_name').text(name);
-                        if (typeof callback !== 'undefined') {
-                            callback();
-                        }
-                    }
-                });
-            } else {
-                Save_to_new_page(db, name, Get_url_pos(), function (page) {
-                    MarkSaved();
-                    if (page.pg_nr) {
-                        selected_page = page.pg_nr;
-                    }
-                    $('#page_name').text(page.page_descr);
-                    if (typeof callback !== 'undefined') {
-                        callback();
-                    }
-                });
-            }
-        };
+            $form.submit();
+        }
        button_options[PMA_messages.strCancel] = function () {
            $(this).dialog('close');
        };
@ -739,6 +746,10 @@ function Save3(callback)
            .append('<input type="hidden" name="save_page" value="new" />')
            .append('<label for="selected_value">' + PMA_messages.strPageName +
                '</label>:<input type="text" name="selected_value" />');
+        $form.on('submit', function(e){
+            e.preventDefault();
+            submitSaveDialogAndClose(callback);
+        });
        $('<div id="page_save_dialog"></div>')
            .append($form)
            .dialog({
@ -1095,7 +1106,7 @@ function Load_page(page) {

 function Grid()
 {
-	var value_sent = '';
+    var value_sent = '';
    if (!ON_grid) {
        ON_grid = 1;
        value_sent = 'on';
@ -1237,8 +1248,7 @@ function New_relation()
            PMA_ajaxShowMessage(data.error, false);
        } else {
            PMA_ajaxRemoveMessage($msgbox);
-            // Load_page(selected_page);
-            $("#designer_tab").click();
+            Load_page(selected_page);
        }
    }); // end $.post()
 }
@ -1469,8 +1479,7 @@ function Upd_relation()
            PMA_ajaxShowMessage(data.error, false);
        } else {
            PMA_ajaxRemoveMessage($msgbox);
-            // Load_page(selected_page);
-            $("#designer_tab").click();
+            Load_page(selected_page);
        }
    }); // end $.post()
 }
--- a/js/replication.js
+++ b/js/replication.js
@ -83,7 +83,12 @@ AJAX.registerOnload('replication.js', function () {
        $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) {
            PMA_ajaxShowMessage();
            AJAX.source = $anchor;
-            $.post(url, {'ajax_page_request': true, 'ajax_request': true}, AJAX.responseHandler);
+            var params = {
+                'ajax_page_request': true,
+                'ajax_request': true,
+                'token': PMA_commonParams.get('tokens')
+            };
+            $.post(url, params, AJAX.responseHandler);
        });
    });
 });
--- a/js/rte.js
+++ b/js/rte.js
@ -128,6 +128,11 @@ RTE.COMMON = {
            var count = export_anchors.length;
            var returnCount = 0;

+            // No routine is exportable (due to privilege issues)
+            if (count === 0) {
+                PMA_ajaxShowMessage(PMA_messages.NoExportable);
+            }
+
            export_anchors.each(function () {
                $.get($(this).attr('href'), {'ajax_request': true}, function (data) {
                    returnCount++;
@ -149,6 +154,7 @@ RTE.COMMON = {
        } else {
            $.get($this.attr('href'), {'ajax_request': true}, showExport);
        }
+        PMA_ajaxRemoveMessage($msg);

        function showExport(data) {
            if (data.success === true) {
@ -396,7 +402,12 @@ RTE.COMMON = {
             *          the AJAX message shown to the user
             */
            var $msg = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
-            $.post(url, {'is_js_confirmed': 1, 'ajax_request': true}, function (data) {
+            var params = {
+                'is_js_confirmed': 1,
+                'ajax_request': true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, function (data) {
                if (data.success === true) {
                    /**
                     * @var $table Object containing reference
@ -470,7 +481,12 @@ RTE.COMMON = {
                 * @var $curr_row Object containing reference to the current row
                 */
                var $curr_row = $anchor.parents('tr');
-                $.post($anchor.attr('href'), {'is_js_confirmed': 1, 'ajax_request': true}, function (data) {
+                var params = {
+                    'is_js_confirmed': 1,
+                    'ajax_request': true,
+                    'token': PMA_commonParams.get('token')
+                };
+                $.post($anchor.attr('href'), params, function (data) {
                    returnCount++;
                    if (data.success === true) {
                        /**
@ -818,7 +834,11 @@ RTE.ROUTINE = {
         *          the AJAX message shown to the user
         */
        var $msg = PMA_ajaxShowMessage();
-        $.post($this.attr('href'), {'ajax_request': true}, function (data) {
+        var params = {
+            'ajax_request': true,
+            'token': PMA_commonParams.get('token')
+        };
+        $.post($this.attr('href'), params, function (data) {
            if (data.success === true) {
                PMA_ajaxRemoveMessage($msg);
                // If 'data.dialog' is true we show a dialog with a form
--- a/js/server_privileges.js
+++ b/js/server_privileges.js
@ -31,6 +31,36 @@ function checkAddUser(the_form)
    return PMA_checkPassword($(the_form));
 } // end of the 'checkAddUser()' function

+function checkPasswordStrength(value, meter_obj, meter_object_label, username = null) {
+    // List of words we don't want to appear in the password
+    customDict = [
+        'phpmyadmin',
+        'mariadb',
+        'mysql',
+        'php',
+        'my',
+        'admin',
+    ];
+    if (username != null) {
+        customDict.push(username)
+    }
+    var zxcvbn_obj = zxcvbn(value, customDict);
+    var strength = zxcvbn_obj.score;
+    strength = parseInt(strength);
+    meter_obj.val(strength);
+    switch(strength){
+        case 0: meter_obj_label.html(PMA_messages.strExtrWeak);
+                break;
+        case 1: meter_obj_label.html(PMA_messages.strVeryWeak);
+                break;
+        case 2: meter_obj_label.html(PMA_messages.strWeak);
+                break;
+        case 3: meter_obj_label.html(PMA_messages.strGood);
+                break;
+        case 4: meter_obj_label.html(PMA_messages.strStrong);
+    }
+}
+
 /**
 * AJAX scripts for server_privileges page.
 *
@ -92,6 +122,23 @@ AJAX.registerOnload('server_privileges.js', function () {
        }
    });

+    /**
+     * Indicating password strength
+     */
+    $('#text_pma_pw').on('keyup', function () {
+        meter_obj = $('#password_strength_meter');
+        meter_obj_label = $('#password_strength');
+        username = $('input[name="username"]');
+        username = username.val();
+        checkPasswordStrength($(this).val(), meter_obj, meter_obj_label, username);
+    });
+
+    $('#text_pma_change_pw').on('keyup', function () {
+        meter_obj = $('#change_password_strength_meter');
+        meter_obj_label = $('#change_password_strength');
+        checkPasswordStrength($(this).val(), meter_obj, meter_obj_label, PMA_commonParams.get('user'));
+    });
+
    /**
     * Display a notice if sha256_password is selected
     */
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@ -1365,7 +1365,8 @@ AJAX.registerOnload('server_status_monitor.js', function () {
            ajax_request: true,
            chart_data: 1,
            type: 'chartgrid',
-            requiredData: JSON.stringify(runtime.dataList)
+            requiredData: JSON.stringify(runtime.dataList),
+            token: PMA_commonParams.get('token')
        }, function (data) {
            var chartData;
            if (typeof data !== 'undefined' && data.success === true) {
@ -2006,7 +2007,8 @@ AJAX.registerOnload('server_status_monitor.js', function () {
            ajax_request: true,
            query_analyzer: true,
            query: codemirror_editor ? codemirror_editor.getValue() : $('#sqlquery').val(),
-            database: db
+            database: db,
+            token: PMA_commonParams.get('token')
        }, function (data) {
            var i, l;
            if (typeof data !== 'undefined' && data.success === true) {
--- a/js/server_variables.js
+++ b/js/server_variables.js
@ -86,7 +86,8 @@ AJAX.registerOnload('server_variables.js', function () {
                    ajax_request: true,
                    type: 'setval',
                    varName: varName,
-                    varValue: $valueCell.find('input').val()
+                    varValue: $valueCell.find('input').val(),
+                    token: PMA_commonParams.get('token')
                }, function (data) {
                    if (data.success) {
                        $valueCell
--- a/js/sql.js
+++ b/js/sql.js
@ -171,7 +171,12 @@ AJAX.registerOnload('sql.js', function () {
            if ($link.hasClass('formLinkSubmit')) {
                submitFormLink($link);
            } else {
-                $.post(url, {'ajax_request': true, 'is_js_confirmed': true}, function (data) {
+                var params = {
+                    'ajax_request': true,
+                    'is_js_confirmed': true,
+                    'token': PMA_commonParams.get('token')
+                };
+                $.post(url, params, function (data) {
                    if (data.success) {
                        PMA_ajaxShowMessage(data.message);
                        $link.closest('tr').remove();
--- a/js/tbl_change.js
+++ b/js/tbl_change.js
@ -100,7 +100,7 @@ function isDate(val, tmstmp)
    }
    val = arrayVal.join("-");
    var pos = 2;
-    var dtexp = new RegExp(/^([0-9]{4})-(((01|03|05|07|08|10|12)-((0[1-9])|([1-2][0-9])|(3[0-1])))|((02|04|06|09|11)-((0[1-9])|([1-2][0-9])|30)))$/);
+    var dtexp = new RegExp(/^([0-9]{4})-(((01|03|05|07|08|10|12)-((0[0-9])|([1-2][0-9])|(3[0-1])))|((02|04|06|09|11)-((0[0-9])|([1-2][0-9])|30))|((00)-(00)))$/);
    if (val.length == 8) {
        pos = 0;
    }
@ -143,7 +143,7 @@ function isTime(val)
        }
    }
    val = arrayVal.join(":");
-    var tmexp = new RegExp(/^(([0-1][0-9])|(2[0-3])):((0[0-9])|([1-5][0-9])):((0[0-9])|([1-5][0-9]))(\.[0-9]{1,6}){0,1}$/);
+    var tmexp = new RegExp(/^(-)?(([0-7]?[0-9][0-9])|(8[0-2][0-9])|(83[0-8])):((0[0-9])|([1-5][0-9])):((0[0-9])|([1-5][0-9]))(\.[0-9]{1,6}){0,1}$/);
    return tmexp.test(val);
 }

@ -551,8 +551,9 @@ AJAX.registerOnload('tbl_change.js', function () {
                }

                // handle input text fields and textareas
-                if ($this_element.is('.textfield') || $this_element.is('.char')) {
+                if ($this_element.is('.textfield') || $this_element.is('.char') || $this_element.is('textarea')) {
                    // do not remove the 'value' attribute for ENUM columns
+                    // special handling for radio fields after updating ids to unique - see below
                    if ($this_element.closest('tr').find('span.column_type').html() != 'enum') {
                        $this_element.val($this_element.closest('tr').find('span.default_value').html());
                    }
@ -675,6 +676,15 @@ AJAX.registerOnload('tbl_change.js', function () {
                $(this).attr('tabindex', tabindex);
                // update the IDs of textfields to ensure that they are unique
                $(this).attr('id', "field_" + tabindex + "_3");
+
+                // special handling for radio fields after updating ids to unique
+                if ($(this).closest('tr').find('span.column_type').html() === 'enum') {
+                    if ($(this).val() === $(this).closest('tr').find('span.default_value').html()) {
+                        $(this).prop('checked', true);
+                    } else {
+                        $(this).prop('checked', false);
+                    }
+                }
            });
            $('.control_at_footer')
            .each(function () {
--- a/js/tbl_operations.js
+++ b/js/tbl_operations.js
@ -137,7 +137,11 @@ AJAX.registerOnload('tbl_operations.js', function () {
            $(".result_query").remove();
        }
        //variables which stores the common attributes
-        $.post($(this).attr('href'), { ajax_request: 1 }, function (data) {
+        var params = {
+            ajax_request: 1,
+            token: PMA_commonParams.get('token')
+        };
+        $.post($(this).attr('href'), params, function (data) {
            function scrollToTop() {
                $('html, body').animate({ scrollTop: 0 });
            }
@ -214,6 +218,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
            var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

            var params = getJSConfirmCommonParam(this);
+            params.token = PMA_commonParams.get('token');

            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success === true) {
@ -248,7 +253,12 @@ AJAX.registerOnload('tbl_operations.js', function () {
        $(this).PMA_confirm(question, $(this).attr('href'), function (url) {

            var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
-            $.post(url, {'is_js_confirmed': '1', 'ajax_request': true}, function (data) {
+            var params = {
+                'is_js_confirmed': '1',
+                'ajax_request': true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success === true) {
                    PMA_ajaxRemoveMessage($msgbox);
                    // Table deleted successfully, refresh both the frames
@ -281,6 +291,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
            PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

            var params = getJSConfirmCommonParam(this);
+            params.token = PMA_commonParams.get('token');

            $.post(url, params, function (data) {
                if ($(".sqlqueryresults").length !== 0) {
--- a/js/tbl_relation.js
+++ b/js/tbl_relation.js
@ -218,7 +218,12 @@ AJAX.registerOnload('tbl_relation.js', function () {

        $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) {
            var $msg = PMA_ajaxShowMessage(PMA_messages.strDroppingForeignKey, false);
-            $.post(url, {'is_js_confirmed': 1, 'ajax_request': true}, function (data) {
+            var params = {
+                'is_js_confirmed': 1,
+                'ajax_request': true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, function (data) {
                if (data.success === true) {
                    PMA_ajaxRemoveMessage($msg);
                    PMA_commonActions.refreshMain(false, function () {
--- a/js/tbl_select.js
+++ b/js/tbl_select.js
@ -149,6 +149,7 @@ AJAX.registerOnload('tbl_select.js', function () {
        } else {
            values.displayAllColumns = true;
        }
+        values.token = PMA_commonParams.get('token');

        $.post($search_form.attr('action'), values, function (data) {
            PMA_ajaxRemoveMessage($msgbox);
--- a/js/tbl_structure.js
+++ b/js/tbl_structure.js
@ -201,7 +201,7 @@ AJAX.registerOnload('tbl_structure.js', function () {
        /**
         * @var curr_column_name    String containing name of the field referred to by {@link curr_row}
         */
-        var curr_column_name = $curr_row.children('th').children('label').text();
+        var curr_column_name = $curr_row.children('th').children('label').text().trim();
        curr_column_name = escapeHtml(curr_column_name);
        /**
         * @var $after_field_item    Corresponding entry in the 'After' field.
@ -213,7 +213,13 @@ AJAX.registerOnload('tbl_structure.js', function () {
        var question = PMA_sprintf(PMA_messages.strDoYouReally, 'ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`;');
        $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
            var $msg = PMA_ajaxShowMessage(PMA_messages.strDroppingColumn, false);
-            $.post(url, {'is_js_confirmed' : 1, 'ajax_request' : true, 'ajax_page_request' : true}, function (data) {
+            var params = {
+                'is_js_confirmed' : 1,
+                'ajax_request' : true,
+                'ajax_page_request' : true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, function (data) {
                if (typeof data !== 'undefined' && data.success === true) {
                    PMA_ajaxRemoveMessage($msg);
                    if ($('.result_query').length) {
@ -233,8 +239,16 @@ AJAX.registerOnload('tbl_structure.js', function () {
                    }
                    $after_field_item.remove();
                    $curr_row.hide("medium").remove();
-                    //by default select the last option to add new column (in case last column is dropped)
+
+                    // Remove the dropped column from select menu for 'after field'
+                    $("select[name=after_field]").find(
+                        '[value="' + curr_column_name + '"]'
+                    ).remove();
+
+                    // by default select the (new) last option to add new column
+                    // (in case last column is dropped)
                    $("select[name=after_field] option:last").attr("selected","selected");
+
                    //refresh table stats
                    if (data.tableStat) {
                        $('#tablestatistics').html(data.tableStat);
@ -267,7 +281,7 @@ AJAX.registerOnload('tbl_structure.js', function () {

        var $this = $(this);
        var curr_table_name = $this.closest('form').find('input[name=table]').val();
-        var curr_column_name = $this.parents('tr').children('th').children('label').text();
+        var curr_column_name = $this.parents('tr').children('th').children('label').text().trim();

        var add_clause = '';
        if ($this.is('.add_primary_key_anchor')) {
@ -287,7 +301,12 @@ AJAX.registerOnload('tbl_structure.js', function () {
        $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
            PMA_ajaxShowMessage();
            AJAX.source = $this;
-            $.post(url, {'ajax_request' : true, 'ajax_page_request' : true}, AJAX.responseHandler);
+            var params = {
+                'ajax_request' : true,
+                'ajax_page_request' : true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, AJAX.responseHandler);
        }); // end $.PMA_confirm()
    }); //end Add key

@ -442,10 +461,14 @@ AJAX.registerOnload('tbl_structure.js', function () {
        var $link = $(this);

        function submitPartitionAction(url) {
-            var submitData = '&ajax_request=true&ajax_page_request=true';
+            var params = {
+                'ajax_request' : true,
+                'ajax_page_request' : true,
+                'token': PMA_commonParams.get('token')
+            };
            PMA_ajaxShowMessage();
            AJAX.source = $link;
-            $.post(url, submitData, AJAX.responseHandler);
+            $.post(url, params, AJAX.responseHandler);
        }

        if ($link.is('#partition_action_DROP')) {
@ -471,10 +494,14 @@ AJAX.registerOnload('tbl_structure.js', function () {
        var $link = $(this);
        var question = PMA_messages.strRemovePartitioningWarning;
        $link.PMA_confirm(question, $link.attr('href'), function (url) {
-            var submitData = '&ajax_request=true&ajax_page_request=true';
+            var params = {
+                'ajax_request' : true,
+                'ajax_page_request' : true,
+                'token': PMA_commonParams.get('token')
+            };
            PMA_ajaxShowMessage();
            AJAX.source = $link;
-            $.post(url, submitData, AJAX.responseHandler);
+            $.post(url, params, AJAX.responseHandler);
        });
    });
 });
--- a/js/tbl_tracking.js
+++ b/js/tbl_tracking.js
@ -80,7 +80,12 @@ AJAX.registerOnload('tbl_tracking.js', function () {
        $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) {
            PMA_ajaxShowMessage();
            AJAX.source = $anchor;
-            $.post(url, {'ajax_page_request': true, 'ajax_request': true}, AJAX.responseHandler);
+            var params = {
+                'ajax_page_request': true,
+                'ajax_request': true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, AJAX.responseHandler);
        });
    });

@ -94,7 +99,12 @@ AJAX.registerOnload('tbl_tracking.js', function () {
        $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) {
            PMA_ajaxShowMessage();
            AJAX.source = $anchor;
-            $.post(url, {'ajax_page_request': true, 'ajax_request': true}, AJAX.responseHandler);
+            var params = {
+                'ajax_page_request': true,
+                'ajax_request': true,
+                'token': PMA_commonParams.get('token')
+            };
+            $.post(url, params, AJAX.responseHandler);
        });
    });
 });
--- a/js/zxcvbn.js
+++ b/js/zxcvbn.js
--- a/libraries/Advisor.php
+++ b/libraries/Advisor.php
@ -429,6 +429,7 @@ class Advisor
        // Actually evaluate the code
        ob_start();
        try {
+            // TODO: replace by using symfony/expression-language
            eval('$value = ' . $expr . ';');
            $err = ob_get_contents();
        } catch (Exception $e) {
@ -464,8 +465,9 @@ class Advisor
        $lines = array();

        if ($file === FALSE) {
-            $errors[] = __(
-                'Error in reading file: The file \'' . $filename .'\' does not exist or is not readable'
+            $errors[] = sprintf(
+                __('Error in reading file: The file \'%s\' does not exist or is not readable!'),
+                $filename
            );
            return array('rules' => $rules, 'lines' => $lines, 'errors' => $errors);
        }
--- a/libraries/Bookmark.php
+++ b/libraries/Bookmark.php
@ -119,10 +119,10 @@ class Bookmark
        $query = "INSERT INTO " . Util::backquote($cfgBookmark['db'])
            . "." . Util::backquote($cfgBookmark['table'])
            . " (id, dbase, user, query, label) VALUES (NULL, "
-            . "'" . Util::sqlAddSlashes($this->_database) . "', "
-            . "'" . Util::sqlAddSlashes($this->_user) . "', "
-            . "'" . Util::sqlAddSlashes($this->_query) . "', "
-            . "'" . Util::sqlAddSlashes($this->_label) . "')";
+            . "'" . $GLOBALS['dbi']->escapeString($this->_database) . "', "
+            . "'" . $GLOBALS['dbi']->escapeString($this->_user) . "', "
+            . "'" . $GLOBALS['dbi']->escapeString($this->_query) . "', "
+            . "'" . $GLOBALS['dbi']->escapeString($this->_label) . "')";
        return $GLOBALS['dbi']->query($query, $controllink);
    }

@ -182,7 +182,7 @@ class Bookmark
        for ($i = 1; $i <= $number_of_variables; $i++) {
            $var = '';
            if (! empty($variables[$i])) {
-                $var = Util::sqlAddSlashes($variables[$i]);
+                $var = $GLOBALS['dbi']->escapeString($variables[$i]);
            }
            $query = str_replace('[VARIABLE' . $i . ']', $var, $query);
            // backward compatibility
@ -234,9 +234,9 @@ class Bookmark
    public static function createBookmark($bkm_fields, $all_users = false)
    {
        if (!(isset($bkm_fields['bkm_sql_query'])
-            && mb_strlen($bkm_fields['bkm_sql_query']) > 0
+            && strlen($bkm_fields['bkm_sql_query']) > 0
            && isset($bkm_fields['bkm_label'])
-            && mb_strlen($bkm_fields['bkm_label']) > 0)
+            && strlen($bkm_fields['bkm_label']) > 0)
        ) {
            return false;
        }
@ -273,9 +273,9 @@ class Bookmark
        $query = "SELECT * FROM " . Util::backquote($cfgBookmark['db'])
            . "." . Util::backquote($cfgBookmark['table'])
            . " WHERE `user` = ''"
-            . " OR `user` = '" . Util::sqlAddSlashes($cfgBookmark['user']) . "'";
+            . " OR `user` = '" . $GLOBALS['dbi']->escapeString($cfgBookmark['user']) . "'";
        if ($db !== false) {
-            $query .= " AND dbase = '" . Util::sqlAddSlashes($db) . "'";
+            $query .= " AND dbase = '" . $GLOBALS['dbi']->escapeString($db) . "'";
        }
        $query .= " ORDER BY label";

@ -334,17 +334,17 @@ class Bookmark

        $query = "SELECT * FROM " . Util::backquote($cfgBookmark['db'])
            . "." . Util::backquote($cfgBookmark['table'])
-            . " WHERE dbase = '" . Util::sqlAddSlashes($db) . "'";
+            . " WHERE dbase = '" . $GLOBALS['dbi']->escapeString($db) . "'";
        if (! $action_bookmark_all) {
            $query .= " AND (user = '"
-                . Util::sqlAddSlashes($cfgBookmark['user']) . "'";
+                . $GLOBALS['dbi']->escapeString($cfgBookmark['user']) . "'";
            if (! $exact_user_match) {
                $query .= " OR user = ''";
            }
            $query .= ")";
        }
        $query .= " AND " . Util::backquote($id_field)
-            . " = " . Util::sqlAddSlashes($id) . " LIMIT 1";
+            . " = " . $GLOBALS['dbi']->escapeString($id) . " LIMIT 1";

        $result = $GLOBALS['dbi']->fetchSingleRow($query, 'ASSOC', $controllink);
        if (! empty($result)) {
--- a/libraries/Config.php
+++ b/libraries/Config.php
@ -135,16 +135,9 @@ class Config
            $this->set('OBGzip', false);
        }

-        // disable output-buffering (if set to 'auto') for IE6, else enable it.
+        // enable output-buffering (if set to 'auto')
        if (strtolower($this->get('OBGzip')) == 'auto') {
-            if ($this->get('PMA_USR_BROWSER_AGENT') == 'IE'
-                && $this->get('PMA_USR_BROWSER_VER') >= 6
-                && $this->get('PMA_USR_BROWSER_VER') < 7
-            ) {
-                $this->set('OBGzip', false);
-            } else {
-                $this->set('OBGzip', true);
-            }
+            $this->set('OBGzip', true);
        }
    }

@ -195,20 +188,20 @@ class Config
        // (must check everything else before Mozilla)

        $is_mozilla = preg_match(
-            '@Mozilla/([0-9].[0-9]{1,2})@',
+            '@Mozilla/([0-9]\.[0-9]{1,2})@',
            $HTTP_USER_AGENT,
            $mozilla_version
        );

        if (preg_match(
-            '@Opera(/| )([0-9].[0-9]{1,2})@',
+            '@Opera(/| )([0-9]\.[0-9]{1,2})@',
            $HTTP_USER_AGENT,
            $log_version
        )) {
            $this->set('PMA_USR_BROWSER_VER', $log_version[2]);
            $this->set('PMA_USR_BROWSER_AGENT', 'OPERA');
        } elseif (preg_match(
-            '@(MS)?IE ([0-9]{1,2}.[0-9]{1,2})@',
+            '@(MS)?IE ([0-9]{1,2}\.[0-9]{1,2})@',
            $HTTP_USER_AGENT,
            $log_version
        )) {
@ -222,7 +215,7 @@ class Config
            $this->set('PMA_USR_BROWSER_VER', intval($log_version[1]) + 4);
            $this->set('PMA_USR_BROWSER_AGENT', 'IE');
        } elseif (preg_match(
-            '@OmniWeb/([0-9].[0-9]{1,2})@',
+            '@OmniWeb/([0-9]{1,3})@',
            $HTTP_USER_AGENT,
            $log_version
        )) {
@ -267,7 +260,7 @@ class Config
                'PMA_USR_BROWSER_VER', $log_version[1]
            );
            $this->set('PMA_USR_BROWSER_AGENT', 'FIREFOX');
-        } elseif (preg_match('@rv:1.9(.*)Gecko@', $HTTP_USER_AGENT)) {
+        } elseif (preg_match('@rv:1\.9(.*)Gecko@', $HTTP_USER_AGENT)) {
            $this->set('PMA_USR_BROWSER_VER', '1.9');
            $this->set('PMA_USR_BROWSER_AGENT', 'GECKO');
        } elseif ($is_mozilla) {
@ -1612,7 +1605,7 @@ class Config
    public function setCookie($cookie, $value, $default = null,
        $validity = null, $httponly = true
    ) {
-        if (mb_strlen($value) && null !== $default && $value === $default
+        if (strlen($value) > 0 && null !== $default && $value === $default
        ) {
            // default value is used
            if (isset($_COOKIE[$cookie])) {
@ -1622,7 +1615,7 @@ class Config
            return false;
        }

-        if (!mb_strlen($value) && isset($_COOKIE[$cookie])) {
+        if (strlen($value) === 0 && isset($_COOKIE[$cookie])) {
            // remove cookie, value is empty
            return $this->removeCookie($cookie);
        }
--- a/libraries/DatabaseInterface.php
+++ b/libraries/DatabaseInterface.php
@ -341,7 +341,7 @@ class DatabaseInterface
                    . implode(
                        '\', \'',
                        array_map(
-                            'PMA\libraries\Util::sqlAddSlashes',
+                            array($this, 'escapeString'),
                            $table
                        )
                    )
@ -349,13 +349,13 @@ class DatabaseInterface
            } elseif (true === $tbl_is_group) {
                $sql_where_table = 'AND t.`TABLE_NAME` LIKE \''
                    . Util::escapeMysqlWildcards(
-                        Util::sqlAddSlashes($table)
+                        $GLOBALS['dbi']->escapeString($table)
                    )
                    . '%\'';
            } else {
                $sql_where_table = 'AND t.`TABLE_NAME` '
                    . Util::getCollateForIS() . ' = \''
-                    . Util::sqlAddSlashes($table) . '\'';
+                    . $GLOBALS['dbi']->escapeString($table) . '\'';
            }
        } else {
            $sql_where_table = '';
@ -470,7 +470,7 @@ class DatabaseInterface
            // comparison (if we are looking for the db Aa we don't want
            // to find the db aa)
            $this_databases = array_map(
-                'PMA\libraries\Util::sqlAddSlashes',
+                array($this, 'escapeString'),
                $databases
            );

@ -535,14 +535,15 @@ class DatabaseInterface
                                . implode(
                                    '\', \'',
                                    array_map(
-                                        'PMA\libraries\Util::sqlAddSlashes',
-                                        $table
+                                        array($this, 'escapeString'),
+                                        $table,
+                                        $link
                                    )
                                ) . '\')';
                        } else {
                            $sql .= " `Name` LIKE '"
                                . Util::escapeMysqlWildcards(
-                                    Util::sqlAddSlashes($table, true)
+                                    $this->escapeString($table, $link)
                                )
                                . "%'";
                        }
@ -782,7 +783,7 @@ class DatabaseInterface
            // get table information from information_schema
            if (! empty($database)) {
                $sql_where_schema = 'WHERE `SCHEMA_NAME` LIKE \''
-                    . Util::sqlAddSlashes($database) . '\'';
+                    . $this->escapeString($database, $link) . '\'';
            } else {
                $sql_where_schema = '';
            }
@ -1017,19 +1018,19 @@ class DatabaseInterface
            // get columns information from information_schema
            if (null !== $database) {
                $sql_wheres[] = '`TABLE_SCHEMA` = \''
-                    . Util::sqlAddSlashes($database) . '\' ';
+                    . $this->escapeString($database, $link) . '\' ';
            } else {
                $array_keys[] = 'TABLE_SCHEMA';
            }
            if (null !== $table) {
                $sql_wheres[] = '`TABLE_NAME` = \''
-                    . Util::sqlAddSlashes($table) . '\' ';
+                    . $this->escapeString($table, $link) . '\' ';
            } else {
                $array_keys[] = 'TABLE_NAME';
            }
            if (null !== $column) {
                $sql_wheres[] = '`COLUMN_NAME` = \''
-                    . Util::sqlAddSlashes($column) . '\' ';
+                    . $this->escapeString($column, $link) . '\' ';
            } else {
                $array_keys[] = 'COLUMN_NAME';
            }
@ -1074,7 +1075,7 @@ class DatabaseInterface
            $sql = 'SHOW FULL COLUMNS FROM '
                . Util::backquote($database) . '.' . Util::backquote($table);
            if (null !== $column) {
-                $sql .= " LIKE '" . Util::sqlAddSlashes($column, true) . "'";
+                $sql .= " LIKE '" . $this->escapeString($column, $link) . "'";
            }

            $columns = $this->fetchResult($sql, 'Field', null, $link);
@ -1159,7 +1160,7 @@ class DatabaseInterface
        $sql = 'SHOW ' . ($full ? 'FULL' : '') . ' COLUMNS FROM '
            . Util::backquote($database) . '.' . Util::backquote($table)
            . (($column !== null) ? "LIKE '"
-            . Util::sqlAddSlashes($column, true) . "'" : '');
+            . $GLOBALS['dbi']->escapeString($column) . "'" : '');

        return $sql;
    }
@ -1399,7 +1400,7 @@ class DatabaseInterface
            }
            $result = $this->tryQuery(
                "SET collation_connection = '"
-                . Util::sqlAddSlashes($GLOBALS['collation_connection'])
+                . $this->escapeString($GLOBALS['collation_connection'], $link)
                . "';",
                $link,
                self::QUERY_STORE
@ -1411,7 +1412,7 @@ class DatabaseInterface
                );
                $this->query(
                    "SET collation_connection = '"
-                    . Util::sqlAddSlashes($default_collation)
+                    . $this->escapeString($GLOBALS['collation_connection'], $link)
                    . "';",
                    $link,
                    self::QUERY_STORE
@ -1748,10 +1749,11 @@ class DatabaseInterface
     * @param string $db    db name
     * @param string $which PROCEDURE | FUNCTION | EVENT | VIEW
     * @param string $name  the procedure|function|event|view name
+     * @param object $link  MySQL link
     *
     * @return string the definition
     */
-    public function getDefinition($db, $which, $name)
+    public function getDefinition($db, $which, $name, $link = null)
    {
        $returned_field = array(
            'PROCEDURE' => 'Create Procedure',
@ -1762,7 +1764,7 @@ class DatabaseInterface
        $query = 'SHOW CREATE ' . $which . ' '
            . Util::backquote($db) . '.'
            . Util::backquote($name);
-        return($this->fetchValue($query, 0, $returned_field[$which]));
+        return($this->fetchValue($query, 0, $returned_field[$which], $link));
    }

    /**
@ -1794,13 +1796,13 @@ class DatabaseInterface
                . " `DTD_IDENTIFIER`"
                . " FROM `information_schema`.`ROUTINES`"
                . " WHERE `ROUTINE_SCHEMA` " . Util::getCollateForIS()
-                . " = '" . Util::sqlAddSlashes($db) . "'";
+                . " = '" . $GLOBALS['dbi']->escapeString($db) . "'";
            if (PMA_isValid($which, array('FUNCTION','PROCEDURE'))) {
                $query .= " AND `ROUTINE_TYPE` = '" . $which . "'";
            }
            if (! empty($name)) {
                $query .= " AND `SPECIFIC_NAME`"
-                    . " = '" . Util::sqlAddSlashes($name) . "'";
+                    . " = '" . $GLOBALS['dbi']->escapeString($name) . "'";
            }
            $result = $this->fetchResult($query);
            if (!empty($result)) {
@ -1809,10 +1811,10 @@ class DatabaseInterface
        } else {
            if ($which == 'FUNCTION' || $which == null) {
                $query = "SHOW FUNCTION STATUS"
-                    . " WHERE `Db` = '" . Util::sqlAddSlashes($db) . "'";
+                    . " WHERE `Db` = '" . $GLOBALS['dbi']->escapeString($db) . "'";
                if (! empty($name)) {
                    $query .= " AND `Name` = '"
-                        . Util::sqlAddSlashes($name) . "'";
+                        . $GLOBALS['dbi']->escapeString($name) . "'";
                }
                $result = $this->fetchResult($query);
                if (!empty($result)) {
@ -1821,10 +1823,10 @@ class DatabaseInterface
            }
            if ($which == 'PROCEDURE' || $which == null) {
                $query = "SHOW PROCEDURE STATUS"
-                    . " WHERE `Db` = '" . Util::sqlAddSlashes($db) . "'";
+                    . " WHERE `Db` = '" . $GLOBALS['dbi']->escapeString($db) . "'";
                if (! empty($name)) {
                    $query .= " AND `Name` = '"
-                        . Util::sqlAddSlashes($name) . "'";
+                        . $GLOBALS['dbi']->escapeString($name) . "'";
                }
                $result = $this->fetchResult($query);
                if (!empty($result)) {
@ -1884,16 +1886,16 @@ class DatabaseInterface
                . "`DATABASE_COLLATION` AS `Database Collation`"
                . " FROM `information_schema`.`EVENTS`"
                . " WHERE `EVENT_SCHEMA` " . Util::getCollateForIS()
-                . " = '" . Util::sqlAddSlashes($db) . "'";
+                . " = '" . $GLOBALS['dbi']->escapeString($db) . "'";
            if (! empty($name)) {
                $query .= " AND `EVENT_NAME`"
-                    . " = '" . Util::sqlAddSlashes($name) . "'";
+                    . " = '" . $GLOBALS['dbi']->escapeString($name) . "'";
            }
        } else {
            $query = "SHOW EVENTS FROM " . Util::backquote($db);
            if (! empty($name)) {
                $query .= " AND `Name` = '"
-                    . Util::sqlAddSlashes($name) . "'";
+                    . $GLOBALS['dbi']->escapeString($name) . "'";
            }
        }

@ -1936,16 +1938,16 @@ class DatabaseInterface
                . ', EVENT_OBJECT_SCHEMA, EVENT_OBJECT_TABLE, DEFINER'
                . ' FROM information_schema.TRIGGERS'
                . ' WHERE EVENT_OBJECT_SCHEMA ' . Util::getCollateForIS() . '='
-                . ' \'' . Util::sqlAddSlashes($db) . '\'';
+                . ' \'' . $GLOBALS['dbi']->escapeString($db) . '\'';

            if (! empty($table)) {
                $query .= " AND EVENT_OBJECT_TABLE " . Util::getCollateForIS()
-                    . " = '" . Util::sqlAddSlashes($table) . "';";
+                    . " = '" . $GLOBALS['dbi']->escapeString($table) . "';";
            }
        } else {
            $query = "SHOW TRIGGERS FROM " . Util::backquote($db);
            if (! empty($table)) {
-                $query .= " LIKE '" . Util::sqlAddSlashes($table, true) . "';";
+                $query .= " LIKE '" . $GLOBALS['dbi']->escapeString($table) . "';";
            }
        }

@ -2222,9 +2224,9 @@ class DatabaseInterface
    /**
     * Return connection parameters for the database server
     *
-     * @param integer $mode    Connection mode on of CONNECT_USER, CONNECT_CONTROL
-     *                         or CONNECT_AUXILIARY.
-     * @param array   $server  Server information like host/port/socket/persistent
+     * @param integer $mode   Connection mode on of CONNECT_USER, CONNECT_CONTROL
+     *                        or CONNECT_AUXILIARY.
+     * @param array   $server Server information like host/port/socket/persistent
     *
     * @return array user, host and server settings array
     */
@ -2310,9 +2312,9 @@ class DatabaseInterface
    /**
     * connects to the database server
     *
-     * @param integer $mode    Connection mode on of CONNECT_USER, CONNECT_CONTROL
-     *                         or CONNECT_AUXILIARY.
-     * @param array   $server  Server information like host/port/socket/persistent
+     * @param integer $mode   Connection mode on of CONNECT_USER, CONNECT_CONTROL
+     *                        or CONNECT_AUXILIARY.
+     * @param array   $server Server information like host/port/socket/persistent
     *
     * @return mixed false on error or a connection object on success
     */
@ -2328,21 +2330,12 @@ class DatabaseInterface
            return false;
        }

-        $error_count = $GLOBALS['error_handler']->countErrors();
+        // Do not show location and backtrace for connection errors
+        $GLOBALS['error_handler']->setHideLocation(true);
        $result = $this->_extension->connect(
            $user, $password, $server
        );
-
-        /* Any errors from connection? */
-        if ($GLOBALS['error_handler']->countErrors() > $error_count) {
-            $errors = $GLOBALS['error_handler']->sliceErrors($error_count);
-            foreach ($errors as $error) {
-                trigger_error(
-                    $error->getMessage(),
-                    E_USER_ERROR
-                );
-            }
-        }
+        $GLOBALS['error_handler']->setHideLocation(false);

        if ($result) {
            /* Run post connect for user connections */
@ -2677,6 +2670,27 @@ class DatabaseInterface
    }

    /**
+     * returns properly escaped string for use in MySQL queries
+     *
+     * @param string $str  string to be escaped
+     * @param mixed  $link optional database link to use
+     *
+     * @return string a MySQL escaped string
+     */
+    public function escapeString($str, $link = null)
+    {
+        if ($link === null) {
+            $link = $this->getLink();
+        }
+
+        if ($this->_extension === null) {
+            return $str;
+        }
+
+        return $this->_extension->escapeString($link, $str);
+    }
+
+    /*
     * Gets correct link object.
     *
     * @param object $link optional database link to use
@ -2692,6 +2706,7 @@ class DatabaseInterface
        if (isset($GLOBALS['userlink']) && !is_null($GLOBALS['userlink'])) {
            return $GLOBALS['userlink'];
        } else {
+            error_log("YAHA\n", 3, "/tmp/a.txt");
            return false;
        }
    }
@ -2771,7 +2786,7 @@ class DatabaseInterface
        if (! $GLOBALS['cfg']['Server']['DisableIS']) {
            // this is slow with thousands of databases
            $sql = 'SELECT DEFAULT_COLLATION_NAME FROM information_schema.SCHEMATA'
-                . ' WHERE SCHEMA_NAME = \'' . Util::sqlAddSlashes($db)
+                . ' WHERE SCHEMA_NAME = \'' . $this->escapeString($db)
                . '\' LIMIT 1';
            return $this->fetchValue($sql);
        } else {
--- a/libraries/DbList.php
+++ b/libraries/DbList.php
@ -45,7 +45,7 @@ class DbList
     * @param string $param parameter name
     *
     * @return mixed
-     * @see https://php.net/language.oop5.overloading
+     * @see https://secure.php.net/language.oop5.overloading
     */
    public function __get($param)
    {
@ -68,7 +68,7 @@ class DbList
     * @param mixed  $value value to set
     *
     * @return void
-     * @see https://php.net/language.oop5.overloading
+     * @see https://secure.php.net/language.oop5.overloading
     */
    public function __set($param, $value)
    {
--- a/libraries/DbQbe.php
+++ b/libraries/DbQbe.php
@ -1600,7 +1600,7 @@ class DbQbe
        // Will include master tables and all tables that can be combined into
        // a cluster by their relation
        $finalized = array();
-        if (mb_strlen($master) > 0) {
+        if (strlen($master) > 0) {
            // Add master tables
            $finalized[$master] = '';
        }
--- a/libraries/DbSearch.php
+++ b/libraries/DbSearch.php
@ -142,7 +142,7 @@ class DbSearch
        ) {
            unset($this->_criteriaColumnName);
        } else {
-            $this->_criteriaColumnName = Util::sqlAddSlashes(
+            $this->_criteriaColumnName = $GLOBALS['dbi']->escapeString(
                $_REQUEST['criteriaColumnName'], true
            );
        }
@ -206,9 +206,8 @@ class DbSearch
        // For "as regular expression" (search option 4), LIKE won't be used
        // Usage example: If user is searching for a literal $ in a regexp search,
        // he should enter \$ as the value.
-        $criteriaSearchStringEscaped = Util::sqlAddSlashes(
-            $this->_criteriaSearchString,
-            ($this->_criteriaSearchType == 4 ? false : true)
+        $criteriaSearchStringEscaped = $GLOBALS['dbi']->escapeString(
+            $this->_criteriaSearchString
        );
        // Extract search words or pattern
        $search_words = (($this->_criteriaSearchType > 2)
@ -217,14 +216,14 @@ class DbSearch

        foreach ($search_words as $search_word) {
            // Eliminates empty values
-            if (mb_strlen($search_word) === 0) {
+            if (strlen($search_word) === 0) {
                continue;
            }
            $likeClausesPerColumn = array();
            // for each column in the table
            foreach ($allColumns as $column) {
                if (! isset($this->_criteriaColumnName)
-                    || mb_strlen($this->_criteriaColumnName) == 0
+                    || strlen($this->_criteriaColumnName) === 0
                    || $column['Field'] == $this->_criteriaColumnName
                ) {
                    $column = 'CONVERT(' . Util::backquote($column['Field'])
--- a/libraries/DisplayResults.php
+++ b/libraries/DisplayResults.php
@ -636,7 +636,7 @@ class DisplayResults
            $the_total = $unlim_num_rows;
        } elseif ((($displayParts['nav_bar'] == '1')
            || ($displayParts['sort_lnk'] == '1'))
-            && (mb_strlen($db) && !empty($table))
+            && (strlen($db) > 0 && strlen($table) > 0)
        ) {
            $the_total = $GLOBALS['dbi']->getTable($db, $table)->countRecords();
        }
@ -870,9 +870,10 @@ class DisplayResults
        $endpos = $_SESSION['tmpval']['pos']
            + $_SESSION['tmpval']['max_rows'];

-        if (($endpos < $this->__get('unlim_num_rows'))
-            && ($this->__get('num_rows') >= $_SESSION['tmpval']['max_rows'])
-            && ($_SESSION['tmpval']['max_rows'] != self::ALL_ROWS)
+        if ($this->__get('unlim_num_rows') === false // view with unknown number of rows
+            || ($endpos < $this->__get('unlim_num_rows')
+            && $this->__get('num_rows') >= $_SESSION['tmpval']['max_rows']
+            && $_SESSION['tmpval']['max_rows'] != self::ALL_ROWS)
        ) {

            $table_navigation_html
@ -1078,12 +1079,12 @@ class DisplayResults

        $maxRows = $_SESSION['tmpval']['max_rows'];
        $onsubmit = 'onsubmit="return '
-            . ($_SESSION['tmpval']['pos']
+            . (($_SESSION['tmpval']['pos']
                + $maxRows
                < $this->__get('unlim_num_rows')
                && $this->__get('num_rows') >= $maxRows)
            ? 'true'
-            : 'false' . '"';
+            : 'false') . '"';

        // display the End button
        $buttons_html .= $this->_getTableNavigationButton(
@ -1976,7 +1977,7 @@ class DisplayResults
        // FROM `PMA_relation` AS `1` , `PMA_relation` AS `2`

        $sort_tbl = (isset($fields_meta->table)
-            && mb_strlen($fields_meta->table)
+            && strlen($fields_meta->table) > 0
            && $fields_meta->orgname == $fields_meta->name)
            ? Util::backquote(
                $fields_meta->table
@ -2116,7 +2117,7 @@ class DisplayResults
            if (mb_strpos($name_to_use_in_sort, '(') !== false) {
                $sort_order .=  $query_head  . $name_to_use_in_sort . ' ' ;
            } else {
-                if (mb_strlen($sort_tbl_new) > 0) {
+                if (strlen($sort_tbl_new) > 0) {
                    $sort_tbl_new .= ".";
                }
                $sort_order .=  $query_head  . $sort_tbl_new
@ -2167,7 +2168,7 @@ class DisplayResults
        $sort_order = mb_substr(
            $sort_order,
            0,
-            mb_strlen($sort_order)-2
+            mb_strlen($sort_order) - 2
        );
        if (empty($order_img)) {
            $order_img = '';
@ -4050,7 +4051,7 @@ class DisplayResults
            || $bool_nowrap) ? ' nowrap' : '';

        $where_comparison = ' = \''
-            . Util::sqlAddSlashes($column)
+            . $GLOBALS['dbi']->escapeString($column)
            . '\'';

        $cell = $this->_getRowData(
@ -4353,7 +4354,7 @@ class DisplayResults
        }

        // 2.3 Prepare the navigation bars
-        if (!mb_strlen($this->__get('table'))) {
+        if (strlen($this->__get('table')) === 0) {

            if ($analyzed_sql_results['querytype'] == 'SELECT') {
                // table does not always contain a real table name,
@ -4404,7 +4405,7 @@ class DisplayResults
            }
        }

-        if (mb_strlen($this->__get('table'))) {
+        if (strlen($this->__get('table')) > 0) {
            // This method set the values for $map array
            $this->_setParamForLinkForeignKeyRelatedTables($map);

@ -5452,7 +5453,7 @@ class DisplayResults

            // Field to display from the foreign table?
            if (isset($map[$meta->name][2])
-                && mb_strlen($map[$meta->name][2])
+                && strlen($map[$meta->name][2]) > 0
            ) {
                $dispval = $this->_getFromForeign(
                    $map, $meta, $where_comparison
--- a/libraries/Error.php
+++ b/libraries/Error.php
@ -83,6 +83,11 @@ class Error extends Message
     */
    protected $backtrace = array();

+    /**
+     * Hide location of errors
+     */
+    protected $hide_location = false;
+
    /**
     * Constructor
     *
@ -146,6 +151,18 @@ class Error extends Message
        return $result;
    }

+    /**
+     * Toggles location hiding
+     *
+     * @param boolean $hide Whether to hide
+     *
+     * @return void
+     */
+    public function setHideLocation($hide)
+    {
+        $this->hide_location = $hide;
+    }
+
    /**
     * sets PMA\libraries\Error::$_backtrace
     *
@ -441,7 +458,8 @@ class Error extends Message
     */
    public function isUserError()
    {
-        return $this->getNumber() & (E_USER_WARNING | E_USER_ERROR | E_USER_NOTICE);
+        return $this->hide_location ||
+            ($this->getNumber() & (E_USER_WARNING | E_USER_ERROR | E_USER_NOTICE));
    }

    /**
--- a/libraries/ErrorHandler.php
+++ b/libraries/ErrorHandler.php
@ -23,6 +23,11 @@ class ErrorHandler
     */
    protected $errors = array();

+    /**
+     * Hide location of errors
+     */
+    protected $hide_location = false;
+
    /**
     * Constructor - set PHP error handler
     *
@ -77,6 +82,18 @@ class ErrorHandler
        }
    }

+    /**
+     * Toggles location hiding
+     *
+     * @param boolean $hide Whether to hide
+     *
+     * @return void
+     */
+    public function setHideLocation($hide)
+    {
+        $this->hide_location = $hide;
+    }
+
    /**
     * returns array with all errors
     *
@ -170,6 +187,7 @@ class ErrorHandler
            $errfile,
            $errline
        );
+        $error->setHideLocation($this->hide_location);

        // do not repeat errors
        $this->errors[$error->getHash()] = $error;
--- a/libraries/Footer.php
+++ b/libraries/Footer.php
@ -237,6 +237,10 @@ class Footer
        if (! PMA_isValid($_REQUEST['no_history'])
            && empty($GLOBALS['error_message'])
            && ! empty($GLOBALS['sql_query'])
+            && (isset($GLOBALS['dbi'])
+            && ($GLOBALS['dbi']->getLink()
+            || isset($GLOBALS['controllink'])
+            && $GLOBALS['controllink']))
        ) {
            PMA_setHistory(
                PMA_ifSetOr($GLOBALS['db'], ''),
--- a/libraries/Header.php
+++ b/libraries/Header.php
@ -260,6 +260,9 @@ class Header
            && isset($GLOBALS['cfg']['Server']['auth_type'])
        ) {
            $params['auth_type'] = $GLOBALS['cfg']['Server']['auth_type'];
+            if (isset($GLOBALS['cfg']['Server']['user'])) {
+                $params['user'] = $GLOBALS['cfg']['Server']['user'];
+            }
        }

        return $params;
@ -630,10 +633,7 @@ class Header
        $dir  = $GLOBALS['text_dir'];

        $retval  = "<!DOCTYPE HTML>";
-        $retval .= "<html lang='$lang' dir='$dir' class='";
-        $retval .= mb_strtolower(PMA_USR_BROWSER_AGENT) . " ";
-        $retval .= mb_strtolower(PMA_USR_BROWSER_AGENT)
-            . intval(PMA_USR_BROWSER_VER) . "'>";
+        $retval .= "<html lang='$lang' dir='$dir'>";
        $retval .= '<head>';

        return $retval;
@ -787,7 +787,7 @@ class Header
    {
        $retval = '';
        if ($this->_menuEnabled
-            && mb_strlen($table)
+            && strlen($table) > 0
            && $GLOBALS['cfg']['NumRecentTables'] > 0
        ) {
            $tmp_result = RecentFavoriteTable::getInstance('recent')
--- a/libraries/Index.php
+++ b/libraries/Index.php
@ -132,7 +132,7 @@ class Index
        Index::_loadIndexes($table, $schema);
        if (! isset(Index::$_registry[$schema][$table][$index_name])) {
            $index = new Index;
-            if (mb_strlen($index_name)) {
+            if (strlen($index_name) > 0) {
                $index->setName($index_name);
                Index::$_registry[$schema][$table][$index->getName()] = $index;
            }
@ -263,7 +263,7 @@ class Index
    public function addColumn($params)
    {
        if (isset($params['Column_name'])
-            && mb_strlen($params['Column_name'])
+            && strlen($params['Column_name']) > 0
        ) {
            $this->_columns[$params['Column_name']] = new IndexColumn($params);
        }
@ -436,7 +436,7 @@ class Index
    public function getComments()
    {
        $comments = $this->getRemarks();
-        if (mb_strlen($comments)) {
+        if (strlen($comments) > 0) {
            $comments .= "\n";
        }
        $comments .= $this->getComment();
--- a/libraries/LanguageManager.php
+++ b/libraries/LanguageManager.php
@ -8,6 +8,7 @@
 namespace PMA\libraries;

 use PMA\libraries\Language;
+use PMA\libraries\URL;

 /**
 * Language selection manager
@ -890,4 +891,43 @@ class LanguageManager
            );
        }
    }
+
+
+    /**
+     * Returns HTML code for the language selector
+     *
+     * @param boolean $use_fieldset whether to use fieldset for selection
+     * @param boolean $show_doc     whether to show documentation links
+     *
+     * @return string
+     *
+     * @access  public
+     */
+    public function getSelectorDisplay($use_fieldset = false, $show_doc = true)
+    {
+        $_form_params = array(
+            'db' => $GLOBALS['db'],
+            'table' => $GLOBALS['table'],
+        );
+
+        // For non-English, display "Language" with emphasis because it's
+        // not a proper word in the current language; we show it to help
+        // people recognize the dialog
+        $language_title = __('Language')
+            . (__('Language') != 'Language' ? ' - <em>Language</em>' : '');
+        if ($show_doc) {
+            $language_title .= Util::showDocu('faq', 'faq7-2');
+        }
+
+        $available_languages = $this->sortedLanguages();
+
+        return Template::get('select_lang')->render(
+            array(
+                'language_title' => $language_title,
+                'use_fieldset' => $use_fieldset,
+                'available_languages' => $available_languages,
+                '_form_params' => $_form_params,
+            )
+        );
+    }
 }
--- a/libraries/ListDatabase.php
+++ b/libraries/ListDatabase.php
@ -138,7 +138,7 @@ class ListDatabase extends ListAbstract
    protected function checkOnlyDatabase()
    {
        if (is_string($GLOBALS['cfg']['Server']['only_db'])
-            && mb_strlen($GLOBALS['cfg']['Server']['only_db'])
+            && strlen($GLOBALS['cfg']['Server']['only_db']) > 0
        ) {
            $GLOBALS['cfg']['Server']['only_db'] = array(
                $GLOBALS['cfg']['Server']['only_db']
@ -176,7 +176,7 @@ class ListDatabase extends ListAbstract
     */
    public function getDefault()
    {
-        if (mb_strlen($GLOBALS['db'])) {
+        if (strlen($GLOBALS['db']) > 0) {
            return $GLOBALS['db'];
        }

--- a/libraries/Menu.php
+++ b/libraries/Menu.php
@ -97,11 +97,11 @@ class Menu
    {
        $url_params = array('db' => $this->_db);

-        if (mb_strlen($this->_table)) {
+        if (strlen($this->_table) > 0) {
            $tabs = $this->_getTableTabs();
            $url_params['table'] = $this->_table;
            $level = 'table';
-        } else if (mb_strlen($this->_db)) {
+        } else if (strlen($this->_db) > 0) {
            $tabs = $this->_getDbTabs();
            $level = 'db';
        } else {
@ -145,7 +145,7 @@ class Menu
                . " AND `tab` LIKE '" . $level . "%'"
                . " AND `usergroup` = (SELECT usergroup FROM "
                . $userTable . " WHERE `username` = '"
-                . Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "')";
+                . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "')";

            $result = PMA_queryAsControlUser($sql_query, false);
            if ($result) {
@ -208,7 +208,7 @@ class Menu
            __('Server')
        );

-        if (mb_strlen($this->_db)) {
+        if (strlen($this->_db) > 0) {
            $retval .= $separator;
            if (Util::showIcons('TabsMode')) {
                $retval .= Util::getImage(
@ -228,7 +228,7 @@ class Menu
            );
            // if the table is being dropped, $_REQUEST['purge'] is set to '1'
            // so do not display the table name in upper div
-            if (mb_strlen($this->_table)
+            if (strlen($this->_table) > 0
                && ! (isset($_REQUEST['purge']) && $_REQUEST['purge'] == '1')
            ) {
                include './libraries/tbl_info.inc.php';
--- a/libraries/Message.php
+++ b/libraries/Message.php
@ -666,9 +666,9 @@ class Message
    {
        $message = $this->message;

-        if (0 === mb_strlen($message)) {
+        if (strlen($message) === 0) {
            $string = $this->getString();
-            if (0 === mb_strlen($string)) {
+            if (strlen($string) === 0) {
                $message = '';
            } else {
                $message = $string;
--- a/libraries/OpenDocument.php
+++ b/libraries/OpenDocument.php
@ -0,0 +1,176 @@
+<?php
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ * Simple interface for creating OASIS OpenDocument files.
+ *
+ * @package PhpMyAdmin
+ */
+namespace PMA\libraries;
+
+
+use PMA\libraries\ZipFile;
+
+/**
+ * Simplfied OpenDocument creator class
+ *
+ * @package PhpMyAdmin
+ */
+class OpenDocument
+{
+
+    const NS = <<<EOT
+xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0"
+xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0"
+xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0"
+xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0"
+xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0"
+xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0"
+EOT;
+
+    /**
+     * Minimalistic creator of OASIS OpenDocument
+     *
+     * @param string $mime desired MIME type
+     * @param string $data document content
+     *
+     * @return string  OASIS OpenDocument data
+     *
+     * @access  public
+     */
+    public static function create($mime, $data)
+    {
+        $zipfile = new ZipFile();
+        $zipfile -> addFile($mime, 'mimetype');
+        $zipfile -> addFile($data, 'content.xml');
+        $zipfile -> addFile(
+            '<?xml version="1.0" encoding="UTF-8"?' . '>'
+            . '<office:document-meta '
+            . 'xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" '
+            . 'xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" '
+            . 'office:version="1.0">'
+            . '<office:meta>'
+            . '<meta:generator>phpMyAdmin ' . PMA_VERSION . '</meta:generator>'
+            . '<meta:initial-creator>phpMyAdmin ' . PMA_VERSION
+            . '</meta:initial-creator>'
+            . '<meta:creation-date>' . strftime('%Y-%m-%dT%H:%M:%S')
+            . '</meta:creation-date>'
+            . '</office:meta>'
+            . '</office:document-meta>',
+            'meta.xml'
+        );
+        $zipfile -> addFile(
+            '<?xml version="1.0" encoding="UTF-8"?' . '>'
+            . '<office:document-styles ' . OpenDocument::NS
+            . 'office:version="1.0">'
+            . '<office:font-face-decls>'
+            . '<style:font-face style:name="Arial Unicode MS"'
+            . ' svg:font-family="\'Arial Unicode MS\'" style:font-pitch="variable"/>'
+            . '<style:font-face style:name="DejaVu Sans1"'
+            . ' svg:font-family="\'DejaVu Sans\'" style:font-pitch="variable"/>'
+            . '<style:font-face style:name="HG Mincho Light J"'
+            . ' svg:font-family="\'HG Mincho Light J\'" style:font-pitch="variable"/>'
+            . '<style:font-face style:name="DejaVu Serif"'
+            . ' svg:font-family="\'DejaVu Serif\'" style:font-family-generic="roman"'
+            . ' style:font-pitch="variable"/>'
+            . '<style:font-face style:name="Thorndale"'
+            . ' svg:font-family="Thorndale" style:font-family-generic="roman"'
+            . ' style:font-pitch="variable"/>'
+            . '<style:font-face style:name="DejaVu Sans"'
+            . ' svg:font-family="\'DejaVu Sans\'" style:font-family-generic="swiss"'
+            . ' style:font-pitch="variable"/>'
+            . '</office:font-face-decls>'
+            . '<office:styles>'
+            . '<style:default-style style:family="paragraph">'
+            . '<style:paragraph-properties fo:hyphenation-ladder-count="no-limit"'
+            . ' style:text-autospace="ideograph-alpha" style:punctuation-wrap="hanging"'
+            . ' style:line-break="strict" style:tab-stop-distance="0.4925in"'
+            . ' style:writing-mode="page"/>'
+            . '<style:text-properties style:use-window-font-color="true"'
+            . ' style:font-name="DejaVu Serif" fo:font-size="12pt" fo:language="en"'
+            . ' fo:country="US" style:font-name-asian="DejaVu Sans1"'
+            . ' style:font-size-asian="12pt" style:language-asian="none"'
+            . ' style:country-asian="none" style:font-name-complex="DejaVu Sans1"'
+            . ' style:font-size-complex="12pt" style:language-complex="none"'
+            . ' style:country-complex="none" fo:hyphenate="false"'
+            . ' fo:hyphenation-remain-char-count="2"'
+            . ' fo:hyphenation-push-char-count="2"/>'
+            . '</style:default-style>'
+            . '<style:style style:name="Standard" style:family="paragraph"'
+            . ' style:class="text"/>'
+            . '<style:style style:name="Text_body" style:display-name="Text body"'
+            . ' style:family="paragraph" style:parent-style-name="Standard"'
+            . ' style:class="text">'
+            . '<style:paragraph-properties fo:margin-top="0in"'
+            . ' fo:margin-bottom="0.0835in"/>'
+            . '</style:style>'
+            . '<style:style style:name="Heading" style:family="paragraph"'
+            . ' style:parent-style-name="Standard" style:next-style-name="Text_body"'
+            . ' style:class="text">'
+            . '<style:paragraph-properties fo:margin-top="0.1665in"'
+            . ' fo:margin-bottom="0.0835in" fo:keep-with-next="always"/>'
+            . '<style:text-properties style:font-name="DejaVu Sans" fo:font-size="14pt"'
+            . ' style:font-name-asian="DejaVu Sans1" style:font-size-asian="14pt"'
+            . ' style:font-name-complex="DejaVu Sans1" style:font-size-complex="14pt"/>'
+            . '</style:style>'
+            . '<style:style style:name="Heading_1" style:display-name="Heading 1"'
+            . ' style:family="paragraph" style:parent-style-name="Heading"'
+            . ' style:next-style-name="Text_body" style:class="text"'
+            . ' style:default-outline-level="1">'
+            . '<style:text-properties style:font-name="Thorndale" fo:font-size="24pt"'
+            . ' fo:font-weight="bold" style:font-name-asian="HG Mincho Light J"'
+            . ' style:font-size-asian="24pt" style:font-weight-asian="bold"'
+            . ' style:font-name-complex="Arial Unicode MS"'
+            . ' style:font-size-complex="24pt" style:font-weight-complex="bold"/>'
+            . '</style:style>'
+            . '<style:style style:name="Heading_2" style:display-name="Heading 2"'
+            . ' style:family="paragraph" style:parent-style-name="Heading"'
+            . ' style:next-style-name="Text_body" style:class="text"'
+            . ' style:default-outline-level="2">'
+            . '<style:text-properties style:font-name="DejaVu Serif"'
+            . ' fo:font-size="18pt" fo:font-weight="bold"'
+            . ' style:font-name-asian="DejaVu Sans1" style:font-size-asian="18pt"'
+            . ' style:font-weight-asian="bold" style:font-name-complex="DejaVu Sans1"'
+            . ' style:font-size-complex="18pt" style:font-weight-complex="bold"/>'
+            . '</style:style>'
+            . '</office:styles>'
+            . '<office:automatic-styles>'
+            . '<style:page-layout style:name="pm1">'
+            . '<style:page-layout-properties fo:page-width="8.2673in"'
+            . ' fo:page-height="11.6925in" style:num-format="1"'
+            . ' style:print-orientation="portrait" fo:margin-top="1in"'
+            . ' fo:margin-bottom="1in" fo:margin-left="1.25in"'
+            . ' fo:margin-right="1.25in" style:writing-mode="lr-tb"'
+            . ' style:footnote-max-height="0in">'
+            . '<style:footnote-sep style:width="0.0071in"'
+            . ' style:distance-before-sep="0.0398in"'
+            . ' style:distance-after-sep="0.0398in" style:adjustment="left"'
+            . ' style:rel-width="25%" style:color="#000000"/>'
+            . '</style:page-layout-properties>'
+            . '<style:header-style/>'
+            . '<style:footer-style/>'
+            . '</style:page-layout>'
+            . '</office:automatic-styles>'
+            . '<office:master-styles>'
+            . '<style:master-page style:name="Standard" style:page-layout-name="pm1"/>'
+            . '</office:master-styles>'
+            . '</office:document-styles>',
+            'styles.xml'
+        );
+        $zipfile -> addFile(
+            '<?xml version="1.0" encoding="UTF-8"?' . '>'
+            . '<manifest:manifest'
+            . ' xmlns:manifest="urn:oasis:names:tc:opendocument:xmlns:manifest:1.0">'
+            . '<manifest:file-entry manifest:media-type="' . $mime
+            . '" manifest:full-path="/"/>'
+            . '<manifest:file-entry manifest:media-type="text/xml"'
+            . ' manifest:full-path="content.xml"/>'
+            . '<manifest:file-entry manifest:media-type="text/xml"'
+            . ' manifest:full-path="meta.xml"/>'
+            . '<manifest:file-entry manifest:media-type="text/xml"'
+            . ' manifest:full-path="styles.xml"/>'
+            . '</manifest:manifest>',
+            'META-INF/manifest.xml'
+        );
+        return $zipfile -> file();
+    }
+}
--- a/libraries/Partition.php
+++ b/libraries/Partition.php
@ -153,8 +153,8 @@ class Partition extends SubPartition
        if (Partition::havePartitioning()) {
            $result = $GLOBALS['dbi']->fetchResult(
                "SELECT * FROM `information_schema`.`PARTITIONS`"
-                . " WHERE `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($db)
-                . "' AND `TABLE_NAME` = '" . Util::sqlAddSlashes($table) . "'"
+                . " WHERE `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($db)
+                . "' AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($table) . "'"
            );
            if ($result) {
                $partitionMap = array();
@ -194,8 +194,8 @@ class Partition extends SubPartition
        if (Partition::havePartitioning()) {
            return $GLOBALS['dbi']->fetchResult(
                "SELECT DISTINCT `PARTITION_NAME` FROM `information_schema`.`PARTITIONS`"
-                . " WHERE `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($db)
-                . "' AND `TABLE_NAME` = '" . Util::sqlAddSlashes($table) . "'"
+                . " WHERE `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($db)
+                . "' AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($table) . "'"
            );
        } else {
            return array();
@ -215,8 +215,8 @@ class Partition extends SubPartition
        if (Partition::havePartitioning()) {
            $partition_method = $GLOBALS['dbi']->fetchResult(
                "SELECT `PARTITION_METHOD` FROM `information_schema`.`PARTITIONS`"
-                . " WHERE `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($db) . "'"
-                . " AND `TABLE_NAME` = '" . Util::sqlAddSlashes($table) . "'"
+                . " WHERE `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($db) . "'"
+                . " AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($table) . "'"
                . " LIMIT 1"
            );
            if (! empty($partition_method)) {
--- a/libraries/RecentFavoriteTable.php
+++ b/libraries/RecentFavoriteTable.php
@ -98,7 +98,7 @@ class RecentFavoriteTable
        // Read from phpMyAdmin database, if recent tables is not in session
        $sql_query
            = " SELECT `tables` FROM " . $this->_getPmaTable() .
-            " WHERE `username` = '" . Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'";
+            " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'";

        $return = array();
        $result = PMA_queryAsControlUser($sql_query, false);
@ -121,8 +121,8 @@ class RecentFavoriteTable
        $username = $GLOBALS['cfg']['Server']['user'];
        $sql_query
            = " REPLACE INTO " . $this->_getPmaTable() . " (`username`, `tables`)" .
-                " VALUES ('" . Util::sqlAddSlashes($username) . "', '"
-                . Util::sqlAddSlashes(
+                " VALUES ('" . $GLOBALS['dbi']->escapeString($username) . "', '"
+                . $GLOBALS['dbi']->escapeString(
                    json_encode($this->_tables)
                ) . "')";

--- a/libraries/Response.php
+++ b/libraries/Response.php
@ -335,13 +335,13 @@ class Response

            $debug = $this->_footer->getDebugMessage();
            if (empty($_REQUEST['no_debug'])
-                && mb_strlen($debug)
+                && strlen($debug) > 0
            ) {
                $this->addJSON('_debug', $debug);
            }

            $errors = $this->_footer->getErrorMessages();
-            if (mb_strlen($errors)) {
+            if (strlen($errors) > 0) {
                $this->addJSON('_errors', $errors);
            }
            $promptPhpErrors = $GLOBALS['error_handler']->hasErrorsForPrompt();
--- a/libraries/Sanitize.php
+++ b/libraries/Sanitize.php
@ -53,6 +53,14 @@ class Sanitize
            './server_privileges.php?',
            './tbl_structure.php?',
        );
+        // Adjust path to setup script location
+        if (defined('PMA_SETUP')) {
+            foreach ($valid_starts as $key => $value) {
+                if (substr($value, 0, 2) === './') {
+                    $valid_starts[$key] = '.' . $value;
+                }
+            }
+        }
        if ($other) {
            $valid_starts[] = 'mailto:';
            $valid_starts[] = 'ftp://';
--- a/libraries/SavedSearches.php
+++ b/libraries/SavedSearches.php
@ -273,7 +273,7 @@ class SavedSearches
        //If it's an insert.
        if (null === $this->getId()) {
            $wheres = array(
-                "search_name = '" . Util::sqlAddSlashes($this->getSearchName())
+                "search_name = '" . $GLOBALS['dbi']->escapeString($this->getSearchName())
                . "'"
            );
            $existingSearches = $this->getList($wheres);
@ -292,10 +292,10 @@ class SavedSearches
            $sqlQuery = "INSERT INTO " . $savedSearchesTbl
                . "(`username`, `db_name`, `search_name`, `search_data`)"
                . " VALUES ("
-                . "'" . Util::sqlAddSlashes($this->getUsername()) . "',"
-                . "'" . Util::sqlAddSlashes($this->getDbname()) . "',"
-                . "'" . Util::sqlAddSlashes($this->getSearchName()) . "',"
-                . "'" . Util::sqlAddSlashes(json_encode($this->getCriterias()))
+                . "'" . $GLOBALS['dbi']->escapeString($this->getUsername()) . "',"
+                . "'" . $GLOBALS['dbi']->escapeString($this->getDbname()) . "',"
+                . "'" . $GLOBALS['dbi']->escapeString($this->getSearchName()) . "',"
+                . "'" . $GLOBALS['dbi']->escapeString(json_encode($this->getCriterias()))
                . "')";

            $result = (bool)PMA_queryAsControlUser($sqlQuery);
@ -311,7 +311,7 @@ class SavedSearches
        //Else, it's an update.
        $wheres = array(
            "id != " . $this->getId(),
-            "search_name = '" . Util::sqlAddSlashes($this->getSearchName()) . "'"
+            "search_name = '" . $GLOBALS['dbi']->escapeString($this->getSearchName()) . "'"
        );
        $existingSearches = $this->getList($wheres);

@ -328,9 +328,9 @@ class SavedSearches

        $sqlQuery = "UPDATE " . $savedSearchesTbl
            . "SET `search_name` = '"
-            . Util::sqlAddSlashes($this->getSearchName()) . "', "
+            . $GLOBALS['dbi']->escapeString($this->getSearchName()) . "', "
            . "`search_data` = '"
-            . Util::sqlAddSlashes(json_encode($this->getCriterias())) . "' "
+            . $GLOBALS['dbi']->escapeString(json_encode($this->getCriterias())) . "' "
            . "WHERE id = " . $this->getId();
        return (bool)PMA_queryAsControlUser($sqlQuery);
    }
@ -358,7 +358,7 @@ class SavedSearches
            . Util::backquote($this->_config['cfgRelation']['savedsearches']);

        $sqlQuery = "DELETE FROM " . $savedSearchesTbl
-            . "WHERE id = '" . Util::sqlAddSlashes($this->getId()) . "'";
+            . "WHERE id = '" . $GLOBALS['dbi']->escapeString($this->getId()) . "'";

        return (bool)PMA_queryAsControlUser($sqlQuery);
    }
@ -386,7 +386,7 @@ class SavedSearches
            . Util::backquote($this->_config['cfgRelation']['savedsearches']);
        $sqlQuery = "SELECT id, search_name, search_data "
            . "FROM " . $savedSearchesTbl . " "
-            . "WHERE id = '" . Util::sqlAddSlashes($this->getId()) . "' ";
+            . "WHERE id = '" . $GLOBALS['dbi']->escapeString($this->getId()) . "' ";

        $resList = PMA_queryAsControlUser($sqlQuery);

@ -426,8 +426,8 @@ class SavedSearches
        $sqlQuery = "SELECT id, search_name "
            . "FROM " . $savedSearchesTbl . " "
            . "WHERE "
-            . "username = '" . Util::sqlAddSlashes($this->getUsername()) . "' "
-            . "AND db_name = '" . Util::sqlAddSlashes($this->getDbname()) . "' ";
+            . "username = '" . $GLOBALS['dbi']->escapeString($this->getUsername()) . "' "
+            . "AND db_name = '" . $GLOBALS['dbi']->escapeString($this->getDbname()) . "' ";

        foreach ($wheres as $where) {
            $sqlQuery .= "AND " . $where . " ";
--- a/libraries/SysInfoLinux.php
+++ b/libraries/SysInfoLinux.php
@ -76,16 +76,16 @@ class SysInfoLinux extends \PMA\libraries\SysInfo

        $mem = array_merge($defaults, $mem);

+        foreach ($mem as $idx => $value) {
+            $mem[$idx] = intval($value);
+        }
+
        $mem['MemUsed'] = $mem['MemTotal']
            - $mem['MemFree'] - $mem['Cached'] - $mem['Buffers'];

        $mem['SwapUsed'] = $mem['SwapTotal']
            - $mem['SwapFree'] - $mem['SwapCached'];

-        foreach ($mem as $idx => $value) {
-            $mem[$idx] = intval($value);
-        }
-
        return $mem;
    }
 }
--- a/libraries/SystemDatabase.php
+++ b/libraries/SystemDatabase.php
@ -50,7 +50,7 @@ class SystemDatabase
            "SELECT * FROM %s.%s WHERE `db_name` = '%s'",
            Util::backquote($cfgRelation['db']),
            Util::backquote($cfgRelation['column_info']),
-            Util::sqlAddSlashes($db)
+            $GLOBALS['dbi']->escapeString($db)
        );

        return $this->dbi->tryQuery($pma_transformation_sql);
@ -105,7 +105,7 @@ class SystemDatabase
                    $data_row['comment'],
                    $data_row['mimetype'],
                    $data_row['transformation'],
-                    Util::sqlAddSlashes(
+                    $GLOBALS['dbi']->escapeString(
                        $data_row['transformation_options']
                    )
                );
--- a/libraries/Table.php
+++ b/libraries/Table.php
@ -190,8 +190,8 @@ class Table
        $result = $this->_dbi->fetchResult(
            "SELECT TABLE_NAME
            FROM information_schema.VIEWS
-            WHERE TABLE_SCHEMA = '" . Util::sqlAddSlashes($db) . "'
-                AND TABLE_NAME = '" . Util::sqlAddSlashes($table) . "'"
+            WHERE TABLE_SCHEMA = '" . $GLOBALS['dbi']->escapeString($db) . "'
+                AND TABLE_NAME = '" . $GLOBALS['dbi']->escapeString($table) . "'"
        );
        return $result ? true : false;
    }
@ -210,8 +210,8 @@ class Table
        $result = $this->_dbi->fetchResult(
            "SELECT TABLE_NAME
            FROM information_schema.VIEWS
-            WHERE TABLE_SCHEMA = '" . Util::sqlAddSlashes($this->_db_name) . "'
-                AND TABLE_NAME = '" . Util::sqlAddSlashes($this->_name) . "'
+            WHERE TABLE_SCHEMA = '" . $GLOBALS['dbi']->escapeString($this->_db_name) . "'
+                AND TABLE_NAME = '" . $GLOBALS['dbi']->escapeString($this->_name) . "'
                AND IS_UPDATABLE = 'YES'"
        );
        return $result ? true : false;
@ -365,6 +365,13 @@ class Table
        } else {
            if ($attribute != '') {
                $query .= ' ' . $attribute;
+
+                if ($is_timestamp
+                    && preg_match('/TIMESTAMP/i', $attribute)
+                    && $length !== 0
+                ) {
+                    $query .= '(' . $length . ')';
+                }
            }

            $matches = preg_match(
@ -401,13 +408,13 @@ class Table
                    } else {
                        // Invalid BOOLEAN value
                        $query .= ' DEFAULT \''
-                            . Util::sqlAddSlashes($default_value) . '\'';
+                            . $GLOBALS['dbi']->escapeString($default_value) . '\'';
                    }
                } elseif ($type == 'BINARY' || $type == 'VARBINARY') {
                    $query .= ' DEFAULT 0x' . $default_value;
                } else {
                    $query .= ' DEFAULT \''
-                        . Util::sqlAddSlashes($default_value) . '\'';
+                        . $GLOBALS['dbi']->escapeString($default_value) . '\'';
                }
                break;
            /** @noinspection PhpMissingBreakStatementInspection */
@ -420,6 +427,9 @@ class Table
                // else fall-through intended, no break here
            case 'CURRENT_TIMESTAMP' :
                $query .= ' DEFAULT ' . $default_type;
+                if ($length !== 0 && $is_timestamp) {
+                    $query .= '(' . $length . ')';
+                }
                break;
            case 'NONE' :
            default :
@ -431,7 +441,7 @@ class Table
            }
        }
        if (!empty($comment)) {
-            $query .= " COMMENT '" . Util::sqlAddSlashes($comment) . "'";
+            $query .= " COMMENT '" . $GLOBALS['dbi']->escapeString($comment) . "'";
        }

        // move column
@ -443,6 +453,49 @@ class Table
        return $query;
    } // end function

+    /**
+     * Checks if the number of records in a table is at least equal to
+     * $min_records
+     *
+     * @param int $min_records Number of records to check for in a table
+     *
+     * @return bool True, if at least $min_records exist, False otherwise.
+     */
+    public function checkIfMinRecordsExist($min_records = 0)
+    {
+        $check_query = 'SELECT ';
+        $fieldsToSelect = '';
+
+        $uniqueFields = $this->getUniqueColumns(true, false);
+        if (count($uniqueFields) > 0) {
+            $fieldsToSelect = implode(', ', $uniqueFields);
+        } else {
+            $indexedCols = $this->getIndexedColumns(true, false);
+            if (count($indexedCols) > 0) {
+                $fieldsToSelect = implode(', ', $indexedCols);
+            } else {
+                $fieldsToSelect = '*';
+            }
+        }
+
+        $check_query .= $fieldsToSelect
+            . ' FROM ' . $this->getFullName(true)
+            . ' LIMIT ' . $min_records;
+
+        $res = $GLOBALS['dbi']->tryQuery(
+            $check_query
+        );
+
+        if ($res !== false) {
+            $num_records = $GLOBALS['dbi']->numRows($res);
+            if ($num_records >= $min_records) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
    /**
     * Counts and returns (or displays) the number of records in a table
     *
@ -504,7 +557,7 @@ class Table
            // completely the record counting for views

            if ($GLOBALS['cfg']['MaxExactCountViews'] == 0) {
-                $row_count = 0;
+                $row_count = false;
            } else {
                // Counting all rows of a VIEW could be too long,
                // so use a LIMIT clause.
@ -605,14 +658,14 @@ class Table
        $where_parts = array();
        foreach ($where_fields as $_where => $_value) {
            $where_parts[] = Util::backquote($_where) . ' = \''
-                . Util::sqlAddSlashes($_value) . '\'';
+                . $GLOBALS['dbi']->escapeString($_value) . '\'';
        }

        $new_parts = array();
        $new_value_parts = array();
        foreach ($new_fields as $_where => $_value) {
            $new_parts[] = Util::backquote($_where);
-            $new_value_parts[] = Util::sqlAddSlashes($_value);
+            $new_value_parts[] = $GLOBALS['dbi']->escapeString($_value);
        }

        $table_copy_query = '
@ -631,7 +684,7 @@ class Table
            $value_parts = array();
            foreach ($table_copy_row as $_key => $_val) {
                if (isset($row_fields[$_key]) && $row_fields[$_key] == 'cc') {
-                    $value_parts[] = Util::sqlAddSlashes($_val);
+                    $value_parts[] = $GLOBALS['dbi']->escapeString($_val);
                }
            }

@ -714,7 +767,7 @@ class Table

        // If the target database is not specified, the operation is taking
        // place in the same database.
-        if (! isset($target_db) || ! mb_strlen($target_db)) {
+        if (! isset($target_db) || strlen($target_db) === 0) {
            $target_db = $source_db;
        }

@ -971,10 +1024,17 @@ class Table
            $GLOBALS['dbi']->query($sql_set_mode);
            $GLOBALS['sql_query'] .= "\n\n" . $sql_set_mode . ';';

-            $sql_insert_data = 'INSERT INTO ' . $target
-                . ' SELECT * FROM ' . $source;
-            $GLOBALS['dbi']->query($sql_insert_data);
-            $GLOBALS['sql_query'] .= "\n\n" . $sql_insert_data . ';';
+            $_old_table = new Table($source_table, $source_db);
+            $nonGeneratedCols = $_old_table->getNonGeneratedColumns(true);
+            if (count($nonGeneratedCols) > 0) {
+                $sql_insert_data = 'INSERT INTO ' . $target . '('
+                    . implode(', ', $nonGeneratedCols)
+                    . ') SELECT ' . implode(', ', $nonGeneratedCols)
+                    . ' FROM ' . $source;
+
+                $GLOBALS['dbi']->query($sql_insert_data);
+                $GLOBALS['sql_query'] .= "\n\n" . $sql_insert_data . ';';
+            }
        }

        PMA_getRelationsParam();
@ -1025,10 +1085,10 @@ class Table
                . Util::backquote($GLOBALS['cfgRelation']['column_info'])
                . ' WHERE '
                . ' db_name = \''
-                . Util::sqlAddSlashes($source_db) . '\''
+                . $GLOBALS['dbi']->escapeString($source_db) . '\''
                . ' AND '
                . ' table_name = \''
-                . Util::sqlAddSlashes($source_table) . '\''
+                . $GLOBALS['dbi']->escapeString($source_table) . '\''
            );

            // Write every comment as new copied entry. [MIME]
@ -1043,21 +1103,21 @@ class Table
                    . ($GLOBALS['cfgRelation']['mimework']
                        ? ', mimetype, transformation, transformation_options'
                        : '')
-                    . ') ' . ' VALUES(' . '\'' . Util::sqlAddSlashes($target_db)
-                    . '\',\'' . Util::sqlAddSlashes($target_table) . '\',\''
-                    . Util::sqlAddSlashes($comments_copy_row['column_name'])
+                    . ') ' . ' VALUES(' . '\'' . $GLOBALS['dbi']->escapeString($target_db)
+                    . '\',\'' . $GLOBALS['dbi']->escapeString($target_table) . '\',\''
+                    . $GLOBALS['dbi']->escapeString($comments_copy_row['column_name'])
                    . '\''
                    . ($GLOBALS['cfgRelation']['mimework']
-                        ? ',\'' . Util::sqlAddSlashes(
+                        ? ',\'' . $GLOBALS['dbi']->escapeString(
                            $comments_copy_row['comment']
                        )
-                        . '\',' . '\'' . Util::sqlAddSlashes(
+                        . '\',' . '\'' . $GLOBALS['dbi']->escapeString(
                            $comments_copy_row['mimetype']
                        )
-                        . '\',' . '\'' . Util::sqlAddSlashes(
+                        . '\',' . '\'' . $GLOBALS['dbi']->escapeString(
                            $comments_copy_row['transformation']
                        )
-                        . '\',' . '\'' . Util::sqlAddSlashes(
+                        . '\',' . '\'' . $GLOBALS['dbi']->escapeString(
                            $comments_copy_row['transformation_options']
                        )
                        . '\''
@ -1182,31 +1242,42 @@ class Table
     * checks if given name is a valid table name,
     * currently if not empty, trailing spaces, '.', '/' and '\'
     *
-     * @param string $table_name name to check
+     * @param string  $table_name    name to check
+     * @param boolean $is_backquoted whether this name is used inside backquotes or not
     *
     * @todo add check for valid chars in filename on current system/os
     * @see  https://dev.mysql.com/doc/refman/5.0/en/legal-names.html
     *
     * @return boolean whether the string is valid or not
     */
-    static function isValidName($table_name)
+    static function isValidName($table_name, $is_backquoted = false)
    {
-        if ($table_name !== trim($table_name)) {
-            // trailing spaces
+        if ($table_name !== rtrim($table_name)) {
+            // trailing spaces not allowed even in backquotes
            return false;
        }

-        if (! mb_strlen($table_name)) {
+        if (strlen($table_name) === 0) {
            // zero length
            return false;
        }

-        if (preg_match('/[.\/\\\\]+/i', $table_name)) {
-            // illegal char . / \
+        if (! $is_backquoted && $table_name !== trim($table_name)) {
+            // spaces at the start or in between only allowed inside backquotes
            return false;
        }

-        return true;
+        if (! $is_backquoted && preg_match('/^[a-zA-Z0-9_$]+$/', $table_name)) {
+            // only allow the above regex in unquoted identifiers
+            // see : http://dev.mysql.com/doc/refman/5.7/en/identifiers.html
+            return true;
+        } else if ($is_backquoted) {
+            // If backquoted, all characters should be allowed (except w/ trailing spaces)
+            return true;
+        }
+
+        // If not backquoted and doesn't follow the above regex
+        return false;
    }

    /**
@ -1247,7 +1318,10 @@ class Table
            return true;
        }

-        if (! Table::isValidName($new_name)) {
+        // Allow whitespaces (not trailing) in $new_name,
+        // since we are using $backquoted in getting the fullName of table
+        // below to be used in the query
+        if (! Table::isValidName($new_name, true)) {
            $this->errors[] = __('Invalid table name:') . ' '
                . $new_table->getFullName();
            return false;
@ -1450,6 +1524,40 @@ class Table
        }
    }

+    /**
+     * Get non-generated columns in table
+     *
+     * @param bool $backquoted whether to quote name with backticks ``
+     *
+     * @return array
+     */
+    public function getNonGeneratedColumns($backquoted = true)
+    {
+        $columns_meta_query = 'SHOW COLUMNS FROM ' . $this->getFullName(true);
+        $ret = array();
+
+        $columns_meta_query_result = $this->_dbi->fetchResult(
+            $columns_meta_query
+        );
+
+        if ($columns_meta_query_result
+            && $columns_meta_query_result !== false
+        ) {
+            foreach ($columns_meta_query_result as $column) {
+                $value = $column['Field'];
+                if ($backquoted === true) {
+                    $value = Util::backquote($value);
+                }
+
+                if (strpos($column['Extra'], 'GENERATED') === false) {
+                    array_push($ret, $value);
+                }
+            }
+        }
+
+        return $ret;
+    }
+
    /**
     * Return UI preferences for this table from phpMyAdmin database.
     *
@ -1463,9 +1571,9 @@ class Table

        // Read from phpMyAdmin database
        $sql_query = " SELECT `prefs` FROM " . $pma_table
-            . " WHERE `username` = '" . Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'"
-            . " AND `db_name` = '" . Util::sqlAddSlashes($this->_db_name) . "'"
-            . " AND `table_name` = '" . Util::sqlAddSlashes($this->_name) . "'";
+            . " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'"
+            . " AND `db_name` = '" . $GLOBALS['dbi']->escapeString($this->_db_name) . "'"
+            . " AND `table_name` = '" . $GLOBALS['dbi']->escapeString($this->_name) . "'";

        $row = $this->_dbi->fetchArray(PMA_queryAsControlUser($sql_query));
        if (isset($row[0])) {
@ -1486,14 +1594,14 @@ class Table
        $pma_table = Util::backquote($cfgRelation['db']) . "."
            . Util::backquote($cfgRelation['table_uiprefs']);

-        $secureDbName = Util::sqlAddSlashes($this->_db_name);
+        $secureDbName = $GLOBALS['dbi']->escapeString($this->_db_name);

        $username = $GLOBALS['cfg']['Server']['user'];
        $sql_query = " REPLACE INTO " . $pma_table
            . " (username, db_name, table_name, prefs) VALUES ('"
-            . Util::sqlAddSlashes($username) . "', '" . $secureDbName
-            . "', '" . Util::sqlAddSlashes($this->_name) . "', '"
-            . Util::sqlAddSlashes(json_encode($this->uiprefs)) . "')";
+            . $GLOBALS['dbi']->escapeString($username) . "', '" . $secureDbName
+            . "', '" . $GLOBALS['dbi']->escapeString($this->_name) . "', '"
+            . $GLOBALS['dbi']->escapeString(json_encode($this->uiprefs)) . "')";

        $success = $this->_dbi->tryQuery($sql_query, $GLOBALS['controllink']);

@ -1860,7 +1968,7 @@ class Table
        if (! empty($keyBlockSizes)) {
            $sql_query .= sprintf(
                ' KEY_BLOCK_SIZE = ',
-                Util::sqlAddSlashes($keyBlockSizes)
+                $GLOBALS['dbi']->escapeString($keyBlockSizes)
            );
        }

@ -1875,14 +1983,14 @@ class Table

        $parser = $index->getParser();
        if ($index->getChoice() == 'FULLTEXT' && ! empty($parser)) {
-            $sql_query .= ' WITH PARSER ' . Util::sqlAddSlashes($parser);
+            $sql_query .= ' WITH PARSER ' . $GLOBALS['dbi']->escapeString($parser);
        }

        $comment = $index->getComment();
        if (! empty($comment)) {
            $sql_query .= sprintf(
                " COMMENT '%s'",
-                Util::sqlAddSlashes($comment)
+                $GLOBALS['dbi']->escapeString($comment)
            );
        }

@ -1909,28 +2017,28 @@ class Table
                    . Util::backquote($GLOBALS['cfgRelation']['db'])
                    . '.' . Util::backquote($cfgRelation['table_info'])
                    . ' WHERE db_name  = \''
-                    . Util::sqlAddSlashes($this->_db_name) . '\''
+                    . $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
                    . ' AND table_name = \''
-                    . Util::sqlAddSlashes($this->_name) . '\'';
+                    . $GLOBALS['dbi']->escapeString($this->_name) . '\'';
            } elseif ($disp != $display_field) {
                $upd_query = 'UPDATE '
                    . Util::backquote($GLOBALS['cfgRelation']['db'])
                    . '.' . Util::backquote($cfgRelation['table_info'])
                    . ' SET display_field = \''
-                    . Util::sqlAddSlashes($display_field) . '\''
+                    . $GLOBALS['dbi']->escapeString($display_field) . '\''
                    . ' WHERE db_name  = \''
-                    . Util::sqlAddSlashes($this->_db_name) . '\''
+                    . $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
                    . ' AND table_name = \''
-                    . Util::sqlAddSlashes($this->_name) . '\'';
+                    . $GLOBALS['dbi']->escapeString($this->_name) . '\'';
            }
        } elseif ($display_field != '') {
            $upd_query = 'INSERT INTO '
                . Util::backquote($GLOBALS['cfgRelation']['db'])
                . '.' . Util::backquote($cfgRelation['table_info'])
                . '(db_name, table_name, display_field) VALUES('
-                . '\'' . Util::sqlAddSlashes($this->_db_name) . '\','
-                . '\'' . Util::sqlAddSlashes($this->_name) . '\','
-                . '\'' . Util::sqlAddSlashes($display_field) . '\')';
+                . '\'' . $GLOBALS['dbi']->escapeString($this->_db_name) . '\','
+                . '\'' . $GLOBALS['dbi']->escapeString($this->_name) . '\','
+                . '\'' . $GLOBALS['dbi']->escapeString($display_field) . '\')';
        }

        if ($upd_query) {
@ -1979,12 +2087,12 @@ class Table
                        . '(master_db, master_table, master_field, foreign_db,'
                        . ' foreign_table, foreign_field)'
                        . ' values('
-                        . '\'' . Util::sqlAddSlashes($this->_db_name) . '\', '
-                        . '\'' . Util::sqlAddSlashes($this->_name) . '\', '
-                        . '\'' . Util::sqlAddSlashes($master_field) . '\', '
-                        . '\'' . Util::sqlAddSlashes($foreign_db) . '\', '
-                        . '\'' . Util::sqlAddSlashes($foreign_table) . '\','
-                        . '\'' . Util::sqlAddSlashes($foreign_field) . '\')';
+                        . '\'' . $GLOBALS['dbi']->escapeString($this->_db_name) . '\', '
+                        . '\'' . $GLOBALS['dbi']->escapeString($this->_name) . '\', '
+                        . '\'' . $GLOBALS['dbi']->escapeString($master_field) . '\', '
+                        . '\'' . $GLOBALS['dbi']->escapeString($foreign_db) . '\', '
+                        . '\'' . $GLOBALS['dbi']->escapeString($foreign_table) . '\','
+                        . '\'' . $GLOBALS['dbi']->escapeString($foreign_field) . '\')';

                } elseif ($existrel[$master_field]['foreign_db'] != $foreign_db
                    || $existrel[$master_field]['foreign_table'] != $foreign_table
@ -1994,28 +2102,28 @@ class Table
                        . Util::backquote($GLOBALS['cfgRelation']['db'])
                        . '.' . Util::backquote($cfgRelation['relation'])
                        . ' SET foreign_db       = \''
-                        . Util::sqlAddSlashes($foreign_db) . '\', '
+                        . $GLOBALS['dbi']->escapeString($foreign_db) . '\', '
                        . ' foreign_table    = \''
-                        . Util::sqlAddSlashes($foreign_table) . '\', '
+                        . $GLOBALS['dbi']->escapeString($foreign_table) . '\', '
                        . ' foreign_field    = \''
-                        . Util::sqlAddSlashes($foreign_field) . '\' '
+                        . $GLOBALS['dbi']->escapeString($foreign_field) . '\' '
                        . ' WHERE master_db  = \''
-                        . Util::sqlAddSlashes($this->_db_name) . '\''
+                        . $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
                        . ' AND master_table = \''
-                        . Util::sqlAddSlashes($this->_name) . '\''
+                        . $GLOBALS['dbi']->escapeString($this->_name) . '\''
                        . ' AND master_field = \''
-                        . Util::sqlAddSlashes($master_field) . '\'';
+                        . $GLOBALS['dbi']->escapeString($master_field) . '\'';
                } // end if... else....
            } elseif (isset($existrel[$master_field])) {
                $upd_query = 'DELETE FROM '
                    . Util::backquote($GLOBALS['cfgRelation']['db'])
                    . '.' . Util::backquote($cfgRelation['relation'])
                    . ' WHERE master_db  = \''
-                    . Util::sqlAddSlashes($this->_db_name) . '\''
+                    . $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
                    . ' AND master_table = \''
-                    . Util::sqlAddSlashes($this->_name) . '\''
+                    . $GLOBALS['dbi']->escapeString($this->_name) . '\''
                    . ' AND master_field = \''
-                    . Util::sqlAddSlashes($master_field) . '\'';
+                    . $GLOBALS['dbi']->escapeString($master_field) . '\'';
            } // end if... else....

            if (isset($upd_query)) {
@ -2297,10 +2405,10 @@ class Table
                FROM
                `information_schema`.`COLUMNS`
                WHERE
-                `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($this->_db_name) . "'
-                AND `TABLE_NAME` = '" . Util::sqlAddSlashes($this->_name) . "'";
+                `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($this->_db_name) . "'
+                AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($this->_name) . "'";
            if ($column != null) {
-                $sql .= " AND  `COLUMN_NAME` = '" . Util::sqlAddSlashes($column)
+                $sql .= " AND  `COLUMN_NAME` = '" . $GLOBALS['dbi']->escapeString($column)
                    . "'";
            }
            $columns = $this->_dbi->fetchResult($sql, 'Field', 'Expression');
--- a/libraries/Theme.php
+++ b/libraries/Theme.php
@ -364,8 +364,48 @@ class Theme
            }
        }

-        $theme = $this;
-        include './themes/sprites.css.php';
+        $sprites = $this->getSpriteData();
+        /* Check if there is a valid data file for sprites */
+        if (count($sprites) > 0) {
+
+            $bg = $this->getImgPath() . 'sprites.png?v=' . urlencode(PMA_VERSION);
+            ?>
+            /* Icon sprites */
+            .icon {
+            margin: 0;
+            margin-<?php echo $left; ?>: .3em;
+            padding: 0 !important;
+            width: 16px;
+            height: 16px;
+            background-image: url('<?php echo $bg; ?>') !important;
+            background-repeat: no-repeat !important;
+            background-position: top left !important;
+            }
+            <?php
+
+            $template = ".ic_%s { background-position: 0 -%upx !important;%s%s }\n";
+            foreach ($sprites as $name => $data) {
+                // generate the CSS code for each icon
+                $width = '';
+                $height = '';
+                // if either the height or width of an icon is 16px,
+                // then it's pointless to set this as a parameter,
+                //since it will be inherited from the "icon" class
+                if ($data['width'] != 16) {
+                    $width = " width: " . $data['width'] . "px;";
+                }
+                if ($data['height'] != 16) {
+                    $height = " height: " . $data['height'] . "px;";
+                }
+                printf(
+                    $template,
+                    $name,
+                    ($data['position'] * 16),
+                    $width,
+                    $height
+                );
+            }
+        }

        return $success;
    }
--- a/libraries/Tracker.php
+++ b/libraries/Tracker.php
@ -123,8 +123,8 @@ class Tracker
        }

        $sql_query = " SELECT tracking_active FROM " . self::_getTrackingTable() .
-        " WHERE db_name = '" . Util::sqlAddSlashes($dbname) . "' " .
-        " AND table_name = '" . Util::sqlAddSlashes($tablename) . "' " .
+        " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
+        " AND table_name = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " .
        " ORDER BY version DESC LIMIT 1";

        $result = $GLOBALS['dbi']->fetchValue($sql_query);
@ -238,15 +238,15 @@ class Tracker
        "tracking " .
        ") " .
        "values (
-        '" . Util::sqlAddSlashes($dbname) . "',
-        '" . Util::sqlAddSlashes($tablename) . "',
-        '" . Util::sqlAddSlashes($version) . "',
-        '" . Util::sqlAddSlashes($date) . "',
-        '" . Util::sqlAddSlashes($date) . "',
-        '" . Util::sqlAddSlashes($snapshot) . "',
-        '" . Util::sqlAddSlashes($create_sql) . "',
-        '" . Util::sqlAddSlashes("\n") . "',
-        '" . Util::sqlAddSlashes($tracking_set)
+        '" . $GLOBALS['dbi']->escapeString($dbname) . "',
+        '" . $GLOBALS['dbi']->escapeString($tablename) . "',
+        '" . $GLOBALS['dbi']->escapeString($version) . "',
+        '" . $GLOBALS['dbi']->escapeString($date) . "',
+        '" . $GLOBALS['dbi']->escapeString($date) . "',
+        '" . $GLOBALS['dbi']->escapeString($snapshot) . "',
+        '" . $GLOBALS['dbi']->escapeString($create_sql) . "',
+        '" . $GLOBALS['dbi']->escapeString("\n") . "',
+        '" . $GLOBALS['dbi']->escapeString($tracking_set)
        . "' )";

        $result = PMA_queryAsControlUser($sql_query);
@ -276,12 +276,12 @@ class Tracker
        $sql_query = "/*NOTRACK*/\n"
            . "DELETE FROM " . self::_getTrackingTable()
            . " WHERE `db_name` = '"
-            . Util::sqlAddSlashes($dbname) . "'"
+            . $GLOBALS['dbi']->escapeString($dbname) . "'"
            . " AND `table_name` = '"
-            . Util::sqlAddSlashes($tablename) . "'";
+            . $GLOBALS['dbi']->escapeString($tablename) . "'";
        if ($version) {
            $sql_query .= " AND `version` = '"
-                . Util::sqlAddSlashes($version) . "'";
+                . $GLOBALS['dbi']->escapeString($version) . "'";
        }
        $result = PMA_queryAsControlUser($sql_query);

@ -334,15 +334,15 @@ class Tracker
        "tracking " .
        ") " .
        "values (
-        '" . Util::sqlAddSlashes($dbname) . "',
-        '" . Util::sqlAddSlashes('') . "',
-        '" . Util::sqlAddSlashes($version) . "',
-        '" . Util::sqlAddSlashes($date) . "',
-        '" . Util::sqlAddSlashes($date) . "',
-        '" . Util::sqlAddSlashes('') . "',
-        '" . Util::sqlAddSlashes($create_sql) . "',
-        '" . Util::sqlAddSlashes("\n") . "',
-        '" . Util::sqlAddSlashes($tracking_set)
+        '" . $GLOBALS['dbi']->escapeString($dbname) . "',
+        '" . $GLOBALS['dbi']->escapeString('') . "',
+        '" . $GLOBALS['dbi']->escapeString($version) . "',
+        '" . $GLOBALS['dbi']->escapeString($date) . "',
+        '" . $GLOBALS['dbi']->escapeString($date) . "',
+        '" . $GLOBALS['dbi']->escapeString('') . "',
+        '" . $GLOBALS['dbi']->escapeString($create_sql) . "',
+        '" . $GLOBALS['dbi']->escapeString("\n") . "',
+        '" . $GLOBALS['dbi']->escapeString($tracking_set)
        . "' )";

        $result = PMA_queryAsControlUser($sql_query);
@ -370,9 +370,9 @@ class Tracker

        $sql_query = " UPDATE " . self::_getTrackingTable() .
        " SET `tracking_active` = '" . $new_state . "' " .
-        " WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
-        " AND `table_name` = '" . Util::sqlAddSlashes($tablename) . "' " .
-        " AND `version` = '" . Util::sqlAddSlashes($version) . "' ";
+        " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
+        " AND `table_name` = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " .
+        " AND `version` = '" . $GLOBALS['dbi']->escapeString($version) . "' ";

        $result = PMA_queryAsControlUser($sql_query);

@ -408,7 +408,7 @@ class Tracker
        if (is_array($new_data)) {
            foreach ($new_data as $data) {
                $new_data_processed .= '# log ' . $date . ' ' . $data['username']
-                    . Util::sqlAddSlashes($data['statement']) . "\n";
+                    . $GLOBALS['dbi']->escapeString($data['statement']) . "\n";
            }
        } else {
            $new_data_processed = $new_data;
@ -416,9 +416,9 @@ class Tracker

        $sql_query = " UPDATE " . self::_getTrackingTable() .
        " SET `" . $save_to . "` = '" . $new_data_processed . "' " .
-        " WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
-        " AND `table_name` = '" . Util::sqlAddSlashes($tablename) . "' " .
-        " AND `version` = '" . Util::sqlAddSlashes($version) . "' ";
+        " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
+        " AND `table_name` = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " .
+        " AND `version` = '" . $GLOBALS['dbi']->escapeString($version) . "' ";

        $result = PMA_queryAsControlUser($sql_query);

@ -474,8 +474,8 @@ class Tracker
    static public function getVersion($dbname, $tablename, $statement = null)
    {
        $sql_query = " SELECT MAX(version) FROM " . self::_getTrackingTable() .
-        " WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
-        " AND `table_name` = '" . Util::sqlAddSlashes($tablename) . "' ";
+        " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
+        " AND `table_name` = '" . $GLOBALS['dbi']->escapeString($tablename) . "' ";

        if ($statement != "") {
            $sql_query .= " AND FIND_IN_SET('"
@ -503,12 +503,12 @@ class Tracker
    static public function getTrackedData($dbname, $tablename, $version)
    {
        $sql_query = " SELECT * FROM " . self::_getTrackingTable() .
-            " WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' ";
+            " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' ";
        if (! empty($tablename)) {
            $sql_query .= " AND `table_name` = '"
-                . Util::sqlAddSlashes($tablename) . "' ";
+                . $GLOBALS['dbi']->escapeString($tablename) . "' ";
        }
-        $sql_query .= " AND `version` = '" . Util::sqlAddSlashes($version)
+        $sql_query .= " AND `version` = '" . $GLOBALS['dbi']->escapeString($version)
            . "' " . " ORDER BY `version` DESC LIMIT 1";

        $mixed = $GLOBALS['dbi']->fetchAssoc(PMA_queryAsControlUser($sql_query));
@ -830,14 +830,14 @@ class Tracker
                    . " UPDATE " . self::_getTrackingTable()
                    . " SET " . Util::backquote($save_to)
                    . " = CONCAT( " . Util::backquote($save_to) . ",'\n"
-                    . Util::sqlAddSlashes($query) . "') ,"
+                    . $GLOBALS['dbi']->escapeString($query) . "') ,"
                    . " `date_updated` = '" . $date . "' ";

                // If table was renamed we have to change
                // the tablename attribute in pma_tracking too
                if ($result['identifier'] == 'RENAME TABLE') {
                    $sql_query .= ', `table_name` = \''
-                        . Util::sqlAddSlashes($result['tablename_after_rename'])
+                        . $GLOBALS['dbi']->escapeString($result['tablename_after_rename'])
                        . '\' ';
                }

@ -848,10 +848,10 @@ class Tracker
                // we want to track
                $sql_query .=
                " WHERE FIND_IN_SET('" . $result['identifier'] . "',tracking) > 0" .
-                " AND `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
+                " AND `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
                " AND `table_name` = '"
-                . Util::sqlAddSlashes($result['tablename']) . "' " .
-                " AND `version` = '" . Util::sqlAddSlashes($version) . "' ";
+                . $GLOBALS['dbi']->escapeString($result['tablename']) . "' " .
+                " AND `version` = '" . $GLOBALS['dbi']->escapeString($version) . "' ";

                PMA_queryAsControlUser($sql_query);
            }
--- a/libraries/URL.php
+++ b/libraries/URL.php
@ -41,10 +41,10 @@ class URL
            $skip    =& $_skip;
        } else {
            $params = array();
-            if (mb_strlen($db)) {
+            if (strlen($db) > 0) {
                $params['db'] = $db;
            }
-            if (mb_strlen($table)) {
+            if (strlen($table) > 0) {
                $params['table'] = $table;
            }
        }
@ -248,7 +248,7 @@ class URL
            $arg_separator = ini_get('arg_separator.input');
            if (mb_strpos($arg_separator, ';') !== false) {
                $separator = ';';
-            } elseif (mb_strlen($arg_separator) > 0) {
+            } elseif (strlen($arg_separator) > 0) {
                $separator = $arg_separator{0};
            } else {
                $separator = '&';
--- a/libraries/Util.php
+++ b/libraries/Util.php
@ -29,76 +29,6 @@ if (! defined('PHPMYADMIN')) {
 */
 class Util
 {
-
-    /**
-     * Detects which function to use for pow.
-     *
-     * @return string Function name.
-     */
-    public static function detectPow()
-    {
-        if (function_exists('bcpow')) {
-            // BCMath Arbitrary Precision Mathematics Function
-            return 'bcpow';
-        } elseif (function_exists('gmp_pow')) {
-            // GMP Function
-            return 'gmp_pow';
-        } else {
-            // PHP function
-            return 'pow';
-        }
-    }
-
-    /**
-     * Exponential expression / raise number into power
-     *
-     * @param string $base         base to raise
-     * @param string $exp          exponent to use
-     * @param string $use_function pow function to use, or false for auto-detect
-     *
-     * @return mixed string or float
-     */
-    public static function pow($base, $exp, $use_function = '')
-    {
-        static $pow_function = null;
-
-        if ($pow_function == null) {
-            $pow_function = self::detectPow();
-        }
-
-        if (! $use_function) {
-            if ($exp < 0) {
-                $use_function = 'pow';
-            } else {
-                $use_function = $pow_function;
-            }
-        }
-
-        if (($exp < 0) && ($use_function != 'pow')) {
-            return false;
-        }
-
-        switch ($use_function) {
-        case 'bcpow' :
-            // bcscale() needed for testing pow() with base values < 1
-            bcscale(10);
-            $pow = bcpow($base, $exp);
-            break;
-        case 'gmp_pow' :
-             $pow = gmp_strval(gmp_pow($base, $exp));
-            break;
-        case 'pow' :
-            $base = $base;
-            $exp = (int) $exp;
-            $pow = pow($base, $exp);
-            break;
-        default:
-            $pow = $use_function($base, $exp);
-        }
-
-        return $pow;
-    }
-
    /**
     * Checks whether configuration value tells to show icons.
     *
@ -284,50 +214,6 @@ class Util
            . $max_size . '" />';
    }

-    /**
-     * Add slashes before "'" and "\" characters so a value containing them can
-     * be used in a sql comparison.
-     *
-     * @param string $a_string the string to slash
-     * @param bool   $is_like  whether the string will be used in a 'LIKE' clause
-     *                         (it then requires two more escaped sequences) or not
-     * @param bool   $crlf     whether to treat cr/lfs as escape-worthy entities
-     *                         (converts \n to \\n, \r to \\r)
-     * @param bool   $php_code whether this function is used as part of the
-     *                         "Create PHP code" dialog
-     *
-     * @return string   the slashed string
-     *
-     * @access  public
-     */
-    public static function sqlAddSlashes(
-        $a_string = '',
-        $is_like = false,
-        $crlf = false,
-        $php_code = false
-    ) {
-        if ($is_like) {
-            $a_string = str_replace('\\', '\\\\\\\\', $a_string);
-        } else {
-            $a_string = str_replace('\\', '\\\\', $a_string);
-        }
-
-        if ($crlf) {
-            $a_string = strtr(
-                $a_string,
-                array("\n" => '\n', "\r" => '\r', "\t" => '\t')
-            );
-        }
-
-        if ($php_code) {
-            $a_string = str_replace('\'', '\\\'', $a_string);
-        } else {
-            $a_string = str_replace('\'', '\\\'', $a_string);
-        }
-
-        return $a_string;
-    } // end of the 'sqlAddSlashes()' function
-
    /**
     * Add slashes before "_" and "%" characters for using them in MySQL
     * database, table and field names.
@ -715,12 +601,12 @@ class Util
                    'sql_query' => $sql_query,
                    'show_query' => 1,
                );
-                if (mb_strlen($table)) {
+                if (strlen($table) > 0) {
                    $_url_params['db'] = $db;
                    $_url_params['table'] = $table;
                    $doedit_goto = '<a href="tbl_sql.php'
                        . URL::getCommon($_url_params) . '">';
-                } elseif (mb_strlen($db)) {
+                } elseif (strlen($db) > 0) {
                    $_url_params['db'] = $db;
                    $doedit_goto = '<a href="db_sql.php'
                        . URL::getCommon($_url_params) . '">';
@ -983,7 +869,7 @@ class Util
        }

        // '0' is also empty for php :-(
-        if (mb_strlen($a_name) && $a_name !== '*') {
+        if (strlen($a_name) > 0 && $a_name !== '*') {
            return '`' . str_replace('`', '``', $a_name) . '`';
        } else {
            return $a_name;
@ -1040,7 +926,7 @@ class Util
        }

        // '0' is also empty for php :-(
-        if (mb_strlen($a_name) && $a_name !== '*') {
+        if (strlen($a_name) > 0 && $a_name !== '*') {
            return $quote . $a_name . $quote;
        } else {
            return $a_name;
@ -1152,13 +1038,15 @@ class Util

            if (! empty($GLOBALS['show_as_php'])) {
                $new_line = '\\n"<br />' . "\n" . '&nbsp;&nbsp;&nbsp;&nbsp;. "';
-                $query_base = htmlspecialchars(addslashes($query_base));
+                $query_base = '$sql  = \'' . $query_base;
+                $query_base = '<code class="php"><pre>' . "\n"
+                    . htmlspecialchars(addslashes($query_base));
                $query_base = preg_replace(
                    '/((\015\012)|(\015)|(\012))/',
                    $new_line,
                    $query_base
                );
-                $query_base = '$sql  = "' . $query_base . '"';
+                $query_base = '$sql  = \'' . $query_base . '"';
            } elseif ($query_too_big) {
                $query_base = htmlspecialchars($query_base);
            } else {
@ -1174,9 +1062,9 @@ class Util
            if (! isset($GLOBALS['db'])) {
                $GLOBALS['db'] = '';
            }
-            if (mb_strlen($GLOBALS['db'])) {
+            if (strlen($GLOBALS['db']) > 0) {
                $url_params['db'] = $GLOBALS['db'];
-                if (mb_strlen($GLOBALS['table'])) {
+                if (strlen($GLOBALS['table']) > 0) {
                    $url_params['table'] = $GLOBALS['table'];
                    $edit_link = 'tbl_sql.php';
                } else {
@ -1231,7 +1119,9 @@ class Util

            // even if the query is big and was truncated, offer the chance
            // to edit it (unless it's enormous, see linkOrButton() )
-            if (! empty($cfg['SQLQuery']['Edit'])) {
+            if (! empty($cfg['SQLQuery']['Edit'])
+                && empty($GLOBALS['show_as_php'])
+            ) {
                $edit_link .= URL::getCommon($url_params) . '#querybox';
                $edit_link = ' ['
                    . self::linkOrButton($edit_link, __('Edit'))
@ -1300,7 +1190,8 @@ class Util

            //Clean up the end of the PHP
            if (! empty($GLOBALS['show_as_php'])) {
-                $retval .= '";';
+                $retval .= '\';' . "\n"
+                    . '</pre></code>';
            }
            $retval .= '</div>';

@ -1330,7 +1221,10 @@ class Util
            /**
             * TODO: Should we have $cfg['SQLQuery']['InlineEdit']?
             */
-            if (! empty($cfg['SQLQuery']['Edit']) && ! $query_too_big) {
+            if (! empty($cfg['SQLQuery']['Edit'])
+                && ! $query_too_big
+                && empty($GLOBALS['show_as_php'])
+            ) {
                $inline_edit_link = ' ['
                    . self::linkOrButton(
                        '#',
@ -1448,15 +1342,15 @@ class Util
            __('EiB')
        );

-        $dh   = self::pow(10, $comma);
-        $li   = self::pow(10, $limes);
+        $dh   = pow(10, $comma);
+        $li   = pow(10, $limes);
        $unit = $byteUnits[0];

        for ($d = 6, $ex = 15; $d >= 1; $d--, $ex-=3) {
-            $unitSize = $li * self::pow(10, $ex);
+            $unitSize = $li * pow(10, $ex);
            if (isset($byteUnits[$d]) && $value >= $unitSize) {
                // use 1024.0 to avoid integer overflow on 64-bit machines
-                $value = round($value / (self::pow(1024, $d) / $dh)) /$dh;
+                $value = round($value / (pow(1024, $d) / $dh)) /$dh;
                $unit = $byteUnits[$d];
                break 1;
            } // end if
@ -1475,26 +1369,6 @@ class Util
        return array(trim($return_value), $unit);
    } // end of the 'formatByteDown' function

-    /**
-     * Changes thousands and decimal separators to locale specific values.
-     *
-     * @param string $value the value
-     *
-     * @return string
-     */
-    public static function localizeNumber($value)
-    {
-        return str_replace(
-            array(',', '.'),
-            array(
-                /* l10n: Thousands separator */
-                __(','),
-                /* l10n: Decimal separator */
-                __('.'),
-            ),
-            $value
-        );
-    }

    /**
     * Formats $value to the given length and appends SI prefixes
@ -1536,11 +1410,18 @@ class Util
        $originalValue = $value;
        //number_format is not multibyte safe, str_replace is safe
        if ($digits_left === 0) {
-            $value = number_format($value, $digits_right);
+            $value = number_format(
+                $value,
+                $digits_right,
+                /* l10n: Decimal separator */
+                __('.'),
+                /* l10n: Thousands separator */
+                __(',')
+            );
            if (($originalValue != 0) && (floatval($value) == 0)) {
-                $value = ' <' . (1 / self::pow(10, $digits_right));
+                $value = ' <' . (1 / pow(10, $digits_right));
            }
-            return self::localizeNumber($value);
+            return $value;
        }

        // this units needs no translation, ISO
@ -1572,7 +1453,7 @@ class Util
            $sign = '';
        }

-        $dh = self::pow(10, $digits_right);
+        $dh = pow(10, $digits_right);

        /*
         * This gives us the right SI prefix already,
@ -1584,7 +1465,7 @@ class Util
         * So if we have 3,6,9,12.. free digits ($digits_left - $cur_digits)
         * to use, then lower the SI prefix
         */
-        $cur_digits = floor(log10($value / self::pow(1000, $d, 'pow'))+1);
+        $cur_digits = floor(log10($value / pow(1000, $d))+1);
        if ($digits_left > $cur_digits) {
            $d -= floor(($digits_left - $cur_digits)/3);
        }
@ -1593,23 +1474,36 @@ class Util
            $d = 0;
        }

-        $value = round($value / (self::pow(1000, $d, 'pow') / $dh)) /$dh;
+        $value = round($value / (pow(1000, $d) / $dh)) /$dh;
        $unit = $units[$d];

        // number_format is not multibyte safe, str_replace is safe
-        $formattedValue = number_format($value, $digits_right);
+        $formattedValue = number_format(
+            $value,
+            $digits_right,
+            /* l10n: Decimal separator */
+            __('.'),
+            /* l10n: Thousands separator */
+            __(',')
+        );
        // If we don't want any zeros, remove them now
        if ($noTrailingZero && strpos($formattedValue, '.') !== false) {
            $formattedValue = preg_replace('/\.?0+$/', '', $formattedValue);
        }
-        $localizedValue = self::localizeNumber($formattedValue);

        if ($originalValue != 0 && floatval($value) == 0) {
-            return ' <' . self::localizeNumber((1 / self::pow(10, $digits_right)))
+            return ' <' . number_format(
+                (1 / pow(10, $digits_right)),
+                $digits_right,
+                /* l10n: Decimal separator */
+                __('.'),
+                /* l10n: Thousands separator */
+                __(',')
+            )
            . ' ' . $unit;
        }

-        return $sign . $localizedValue . ' ' . $unit;
+        return $sign . $formattedValue . ' ' . $unit;
    } // end of the 'formatNumber' function

    /**
@ -1625,13 +1519,13 @@ class Util

        if (preg_match('/^[0-9]+GB$/', $formatted_size)) {
            $return_value = mb_substr($formatted_size, 0, -2)
-                * self::pow(1024, 3);
+                * pow(1024, 3);
        } elseif (preg_match('/^[0-9]+MB$/', $formatted_size)) {
            $return_value = mb_substr($formatted_size, 0, -2)
-                * self::pow(1024, 2);
+                * pow(1024, 2);
        } elseif (preg_match('/^[0-9]+K$/', $formatted_size)) {
            $return_value = mb_substr($formatted_size, 0, -1)
-                * self::pow(1024, 1);
+                * pow(1024, 1);
        }
        return $return_value;
    }// end of the 'extractValueFromFormattedSize' function
@ -1690,7 +1584,7 @@ class Util
            __('Sat'));

        if ($format == '') {
-            /* l10n: See https://php.net/manual/en/function.strftime.php */
+            /* l10n: See https://secure.php.net/manual/en/function.strftime.php */
            $format = __('%B %d, %Y at %I:%M %p');
        }

@ -2227,7 +2121,7 @@ class Util
            $meta        = $fields_meta[$i];

            // do not use a column alias in a condition
-            if (! isset($meta->orgname) || ! mb_strlen($meta->orgname)) {
+            if (! isset($meta->orgname) || strlen($meta->orgname) === 0) {
                $meta->orgname = $meta->name;

                if (!empty($analyzed_sql_results['statement']->expr)) {
@ -2325,7 +2219,7 @@ class Util
                        . self::printableBitValue($row[$i], $meta->length) . "'";
                } else {
                    $con_val = '= \''
-                        . self::sqlAddSlashes($row[$i], false, true) . '\'';
+                        . $GLOBALS['dbi']->escapeString($row[$i]) . '\'';
                }
            }

@ -2698,8 +2592,8 @@ class Util
     */
    public static function getDbLink($database = null)
    {
-        if (! mb_strlen($database)) {
-            if (! mb_strlen($GLOBALS['db'])) {
+        if (strlen($database) === 0) {
+            if (strlen($GLOBALS['db']) === 0) {
                return '';
            }
            $database = $GLOBALS['db'];
@ -3967,7 +3861,7 @@ class Util
     * @return string   An HTML snippet of a dropdown list with function
     *                    names appropriate for the requested column.
     */
-    public static function getFunctionsForField($field, $insert_mode)
+    public static function getFunctionsForField($field, $insert_mode, $foreignData)
    {
        $default_function = self::getDefaultFunctionForField($field, $insert_mode);
        $dropdown_built = array();
@ -3979,7 +3873,7 @@ class Util
        $functions = $GLOBALS['PMA_Types']->getFunctions($field['True_Type']);
        foreach ($functions as $function) {
            $retval .= '<option';
-            if ($default_function === $function) {
+            if (isset($foreignData['foreign_link']) && $foreignData['foreign_link'] !== false && $default_function === $function) {
                $retval .= ' selected="selected"';
            }
            $retval .= '>' . $function . '</option>' . "\n";
@ -4072,7 +3966,7 @@ class Util
                    'SCHEMA_PRIVILEGES',
                    $username,
                    $priv,
-                    self::sqlAddSlashes($db)
+                    $GLOBALS['dbi']->escapeString($db)
                )
            );
            if ($schema_privileges) {
@ -4095,8 +3989,8 @@ class Util
                    'TABLE_PRIVILEGES',
                    $username,
                    $priv,
-                    self::sqlAddSlashes($db),
-                    self::sqlAddSlashes($tbl)
+                    $GLOBALS['dbi']->escapeString($db),
+                    $GLOBALS['dbi']->escapeString($tbl)
                )
            );
            if ($table_privileges) {
@ -4193,7 +4087,7 @@ class Util

        }

-        if (mb_strlen($buffer) > 0) {
+        if (strlen($buffer) > 0) {
            // The leftovers in the buffer are the last value (if any)
            $values[] = $buffer;
        }
@ -4308,12 +4202,12 @@ class Util
     */
    public static function handleContext(array $context)
    {
-        if (mb_strlen($GLOBALS['cfg']['ProxyUrl'])) {
+        if (strlen($GLOBALS['cfg']['ProxyUrl']) > 0) {
            $context['http'] = array(
                'proxy' => $GLOBALS['cfg']['ProxyUrl'],
                'request_fulluri' => true
            );
-            if (mb_strlen($GLOBALS['cfg']['ProxyUser'])) {
+            if (strlen($GLOBALS['cfg']['ProxyUser']) > 0) {
                $auth = base64_encode(
                    $GLOBALS['cfg']['ProxyUser'] . ':' . $GLOBALS['cfg']['ProxyPass']
                );
@ -4334,9 +4228,9 @@ class Util
     */
    public static function configureCurl($curl_handle)
    {
-        if (mb_strlen($GLOBALS['cfg']['ProxyUrl'])) {
+        if (strlen($GLOBALS['cfg']['ProxyUrl']) > 0) {
            curl_setopt($curl_handle, CURLOPT_PROXY, $GLOBALS['cfg']['ProxyUrl']);
-            if (mb_strlen($GLOBALS['cfg']['ProxyUser'])) {
+            if (strlen($GLOBALS['cfg']['ProxyUser']) > 0) {
                curl_setopt(
                    $curl_handle,
                    CURLOPT_PROXYUSERPWD,
@ -4920,7 +4814,6 @@ class Util
            curl_setopt($curl_handle, CURLOPT_HEADER, true);
        }

-
        if ($method == "POST") {
            curl_setopt($curl_handle, CURLOPT_POSTFIELDS, $content);
        }
--- a/libraries/advisor.lib.php
+++ b/libraries/advisor.lib.php
@ -32,7 +32,7 @@ function ADVISOR_bytime($num, $precision)
    $num = round($num, $precision);

    if ($num == 0) {
-        $num = '<' . PMA\libraries\Util::pow(10, -$precision);
+        $num = '<' . pow(10, -$precision);
    }

    return "$num $per";
--- a/libraries/central_columns.lib.php
+++ b/libraries/central_columns.lib.php
@ -62,10 +62,10 @@ function PMA_getColumnsList($db, $from=0, $num=25)
    //get current values of $db from central column list
    if ($num == 0) {
        $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
+            . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
    } else {
        $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
+            . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' '
            . 'LIMIT ' . $from . ', ' . $num . ';';
    }
    $has_list = (array) $GLOBALS['dbi']->fetchResult(
@ -93,7 +93,7 @@ function PMA_getCentralColumnsCount($db)
    $central_list_table = $cfgCentralColumns['table'];
    $query = 'SELECT count(db_name) FROM ' .
        Util::backquote($central_list_table) . ' '
-        . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
+        . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
    $res = $GLOBALS['dbi']->fetchResult(
        $query, null, null, $GLOBALS['controllink']
    );
@ -124,7 +124,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
    $central_list_table = $cfgCentralColumns['table'];
    if ($allFields) {
        $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
+            . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' AND col_name IN (' . $cols . ');';
        $has_list = (array) $GLOBALS['dbi']->fetchResult(
            $query, null, null, $GLOBALS['controllink']
        );
@ -132,7 +132,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
    } else {
        $query = 'SELECT col_name FROM '
            . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
+            . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' AND col_name IN (' . $cols . ');';
        $has_list = (array) $GLOBALS['dbi']->fetchResult(
            $query, null, null, $GLOBALS['controllink']
        );
@ -189,14 +189,14 @@ function PMA_getInsertQuery($column, $def, $db, $central_list_table)
    $default = isset($def['Default'])?$def['Default']:"";
    $insQuery = 'INSERT INTO '
        . Util::backquote($central_list_table) . ' '
-        . 'VALUES ( \'' . Util::sqlAddSlashes($db) . '\' ,'
-        . '\'' . Util::sqlAddSlashes($column) . '\',\''
-        . Util::sqlAddSlashes($type) . '\','
-        . '\'' . Util::sqlAddSlashes($length) . '\',\''
-        . Util::sqlAddSlashes($collation) . '\','
-        . '\'' . Util::sqlAddSlashes($isNull) . '\','
+        . 'VALUES ( \'' . $GLOBALS['dbi']->escapeString($db) . '\' ,'
+        . '\'' . $GLOBALS['dbi']->escapeString($column) . '\',\''
+        . $GLOBALS['dbi']->escapeString($type) . '\','
+        . '\'' . $GLOBALS['dbi']->escapeString($length) . '\',\''
+        . $GLOBALS['dbi']->escapeString($collation) . '\','
+        . '\'' . $GLOBALS['dbi']->escapeString($isNull) . '\','
        . '\'' . implode(',', array($extra, $attribute))
-        . '\',\'' . Util::sqlAddSlashes($default) . '\');';
+        . '\',\'' . $GLOBALS['dbi']->escapeString($default) . '\');';
    return $insQuery;
 }

@ -234,7 +234,7 @@ function PMA_syncUniqueColumns($field_select, $isTable=true, $table=null)
                $db, $table, null, true, $GLOBALS['userlink']
            );
            foreach ($fields[$table] as $field => $def) {
-                $cols .= "'" . Util::sqlAddSlashes($field) . "',";
+                $cols .= "'" . $GLOBALS['dbi']->escapeString($field) . "',";
            }
        }

@ -256,7 +256,7 @@ function PMA_syncUniqueColumns($field_select, $isTable=true, $table=null)
            $table = $_REQUEST['table'];
        }
        foreach ($field_select as $column) {
-            $cols .= "'" . Util::sqlAddSlashes($column) . "',";
+            $cols .= "'" . $GLOBALS['dbi']->escapeString($column) . "',";
        }
        $has_list = PMA_findExistingColNames($db, trim($cols, ','));
        foreach ($field_select as $column) {
@ -338,7 +338,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
                $db, $table, $GLOBALS['userlink']
            );
            foreach ($fields[$table] as $col_select) {
-                $cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
+                $cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
            }
        }
        $cols = trim($cols, ',');
@ -354,7 +354,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
    } else {
        $cols = '';
        foreach ($field_select as $col_select) {
-            $cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
+            $cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
        }
        $cols = trim($cols, ',');
        $has_list = PMA_findExistingColNames($db, $cols);
@ -378,7 +378,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
    $GLOBALS['dbi']->selectDb($pmadb, $GLOBALS['controllink']);

    $query = 'DELETE FROM ' . Util::backquote($central_list_table) . ' '
-        . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
+        . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' AND col_name IN (' . $cols . ');';

    if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
        $message = Message::error(__('Could not remove columns!'));
@ -416,7 +416,7 @@ function PMA_makeConsistentWithList($db, $selected_tables)
            //it is not referenced by another column
            if ($column_status['isEditable']) {
                $query .= ' MODIFY ' . Util::backquote($column['col_name']) . ' '
-                    . Util::sqlAddSlashes($column['col_type']);
+                    . $GLOBALS['dbi']->escapeString($column['col_type']);
                if ($column['col_length']) {
                    $query .= '(' . $column['col_length'] . ')';
                }
@ -431,11 +431,11 @@ function PMA_makeConsistentWithList($db, $selected_tables)
                $query .= ' ' . $column['col_extra'];
                if ($column['col_default']) {
                    if ($column['col_default'] != 'CURRENT_TIMESTAMP') {
-                        $query .= ' DEFAULT \'' . Util::sqlAddSlashes(
+                        $query .= ' DEFAULT \'' . $GLOBALS['dbi']->escapeString(
                            $column['col_default']
                        ) . '\'';
                    } else {
-                        $query .= ' DEFAULT ' . Util::sqlAddSlashes(
+                        $query .= ' DEFAULT ' . $GLOBALS['dbi']->escapeString(
                            $column['col_default']
                        );
                    }
@ -483,7 +483,7 @@ function PMA_getCentralColumnsFromTable($db, $table, $allFields=false)
    );
    $cols = '';
    foreach ($fields as $col_select) {
-        $cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
+        $cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
    }
    $cols = trim($cols, ',');
    $has_list = PMA_findExistingColNames($db, $cols, $allFields);
@ -533,16 +533,16 @@ function PMA_updateOneColumn($db, $orig_col_name, $col_name, $col_type,
        $query = PMA_getInsertQuery($col_name, $def, $db, $centralTable);
    } else {
        $query = 'UPDATE ' . Util::backquote($centralTable)
-            . ' SET col_type = \'' . Util::sqlAddSlashes($col_type) . '\''
-            . ', col_name = \'' . Util::sqlAddSlashes($col_name) . '\''
-            . ', col_length = \'' . Util::sqlAddSlashes($col_length) . '\''
+            . ' SET col_type = \'' . $GLOBALS['dbi']->escapeString($col_type) . '\''
+            . ', col_name = \'' . $GLOBALS['dbi']->escapeString($col_name) . '\''
+            . ', col_length = \'' . $GLOBALS['dbi']->escapeString($col_length) . '\''
            . ', col_isNull = ' . $col_isNull
-            . ', col_collation = \'' . Util::sqlAddSlashes($collation) . '\''
+            . ', col_collation = \'' . $GLOBALS['dbi']->escapeString($collation) . '\''
            . ', col_extra = \''
            . implode(',', array($col_extra, $col_attribute)) . '\''
-            . ', col_default = \'' . Util::sqlAddSlashes($col_default) . '\''
-            . ' WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
-            . 'AND col_name = \'' . Util::sqlAddSlashes($orig_col_name)
+            . ', col_default = \'' . $GLOBALS['dbi']->escapeString($col_default) . '\''
+            . ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' '
+            . 'AND col_name = \'' . $GLOBALS['dbi']->escapeString($orig_col_name)
            . '\'';
    }
    if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
@ -1146,7 +1146,7 @@ function PMA_getCentralColumnsListRaw($db, $table)
    $centralTable = $cfgCentralColumns['table'];
    if (empty($table) || $table == '') {
        $query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
-            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
+            . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
    } else {
        $GLOBALS['dbi']->selectDb($db, $GLOBALS['userlink']);
        $columns = (array) $GLOBALS['dbi']->getColumnNames(
@ -1154,11 +1154,11 @@ function PMA_getCentralColumnsListRaw($db, $table)
        );
        $cols = '';
        foreach ($columns as $col_select) {
-            $cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
+            $cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
        }
        $cols = trim($cols, ',');
        $query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
-            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\'';
+            . 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
        if ($cols) {
            $query .= ' AND col_name NOT IN (' . $cols . ')';
        }
@ -1386,7 +1386,7 @@ function PMA_getHTMLforEditingPage($selected_fld,$selected_db)
    $html .= PMA_getCentralColumnsEditTableHeader($header_cells);
    $selected_fld_safe = array();
    foreach ($selected_fld as $key) {
-        $selected_fld_safe[] = Util::sqlAddSlashes($key);
+        $selected_fld_safe[] = $GLOBALS['dbi']->escapeString($key);
    }
    $columns_list = implode("','", $selected_fld_safe);
    $columns_list = "'" . $columns_list . "'";
--- a/libraries/cleanup.lib.php
+++ b/libraries/cleanup.lib.php
@ -1,7 +0,0 @@
-<?php
-/* vim: set expandtab sw=4 ts=4 sts=4: */
-/**
- * Functions for cleanup of user input.
- *
- * @package PhpMyAdmin
- */
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@ -80,7 +80,7 @@ require_once './vendor/autoload.php';
 /**
 * Load gettext functions.
 */
-MoTranslator\Loader::load_functions();
+MoTranslator\Loader::loadFunctions();

 /**
 * initialize the error handler
@ -372,56 +372,32 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 * could access this variables before we reach this point
 * f.e. PMA\libraries\Config: fontsize
 *
+ * Check for token mismatch only if the Request method is POST
+ * GET Requests would never have token and therefore checking
+ * mis-match does not make sense
+ *
 * @todo variables should be handled by their respective owners (objects)
 * f.e. lang, server, collation_connection in PMA\libraries\Config
 */
+
 $token_mismatch = true;
 $token_provided = false;
-if (PMA_isValid($_REQUEST['token'])) {
-    $token_provided = true;
-    $token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
-}

-if ($token_mismatch) {
-    /**
-     *  List of parameters which are allowed from unsafe source
-     */
-    $allow_list = array(
-        /* needed for direct access, see FAQ 1.34
-         * also, server needed for cookie login screen (multi-server)
-         */
-        'server', 'db', 'table', 'target', 'lang',
-        /* Session ID */
-        'phpMyAdmin',
-        /* Cookie preferences */
-        'pma_lang', 'pma_collation_connection',
-        /* Possible login form */
-        'pma_servername', 'pma_username', 'pma_password',
-        'g-recaptcha-response',
-        /* Needed to send the correct reply */
-        'ajax_request',
-        /* Permit to log out even if there is a token mismatch */
-        'old_usr',
-        /* Permit redirection with token-mismatch in url.php */
-        'url',
-        /* Permit session expiry flag */
-        'session_expired',
-        /* JS loading */
-        'scripts', 'call_done',
-        /* Navigation panel */
-        'aPath', 'vPath', 'pos', 'pos2_name', 'pos2_value', 'searchClause', 'searchClause2'
-    );
-    /**
-     * Allow changing themes in test/theme.php
-     */
-    if (defined('PMA_TEST_THEME')) {
-        $allow_list[] = 'set_theme';
+if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+    if (PMA_isValid($_POST['token'])) {
+        $token_provided = true;
+        $token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_POST['token']);
    }
-    /**
-     * Do actual cleanup
-     */
-    PMA\libraries\Sanitize::removeRequestVars($allow_list);

+    if ($token_mismatch) {
+        /**
+         * We don't allow any POST operation parameters if the token is mismatched
+         * or is not provided
+         *
+         */
+        $whitelist = array();
+        PMA\libraries\Sanitize::removeRequestVars($whitelist);
+    }
 }


@ -493,6 +469,20 @@ if ($GLOBALS['text_dir'] == 'ltr') {
 $GLOBALS['PMA_Config']->checkPermissions();
 $GLOBALS['PMA_Config']->checkErrors();

+/**
+ * As we try to handle charsets by ourself, mbstring overloads just
+ * break it, see bug 1063821.
+ */
+if (@extension_loaded('mbstring') && @ini_get('mbstring.func_overload') != '0') {
+    PMA_fatalError(
+        __(
+            'You have enabled mbstring.func_overload in your PHP '
+            . 'configuration. This option is incompatible with phpMyAdmin '
+            . 'and might cause some data to be corrupted!'
+        )
+    );
+}
+
 /******************************************************************************/
 /* setup servers                                       LABEL_setup_servers    */

@ -777,7 +767,7 @@ if (! defined('PMA_MINIMUM_COMMON')) {
        if ($cfg['Server']['SessionTimeZone'] != '') {
            $sql_query_tz = 'SET ' . Util::backquote('time_zone') . ' = '
                . '\''
-                . Util::sqlAddSlashes($cfg['Server']['SessionTimeZone'])
+                . $GLOBALS['dbi']->escapeString($cfg['Server']['SessionTimeZone'])
                . '\'';

            if (! $userlink->query($sql_query_tz)) {
--- a/libraries/config.default.php
+++ b/libraries/config.default.php
@ -23,7 +23,7 @@
 * Your phpMyAdmin URL.
 *
 * Complete the variable below with the full URL ie
- *    http://www.your_web.net/path_to_your_phpMyAdmin_directory/
+ *    https://example.com/path_to_your_phpMyAdmin_directory/
 *
 * It must contain characters that are valid for a URL, and the path is
 * case sensitive on some Web servers, for example Unix-based servers.
@ -297,13 +297,6 @@ $cfg['Servers'][$i]['SignonURL'] = '';
 */
 $cfg['Servers'][$i]['LogoutURL'] = '';

-/**
- * Whether to try to connect without password
- *
- * @global boolean $cfg['Servers'][$i]['nopassword']
- */
-$cfg['Servers'][$i]['nopassword'] = false;
-
 /**
 * If set to a db-name, only this db is displayed in navigation panel
 * It may also be an array of db-names
--- a/libraries/config/ConfigFile.php
+++ b/libraries/config/ConfigFile.php
@ -416,7 +416,7 @@ class ConfigFile
        $dsn = 'mysqli://';
        if ($this->getValue("$path/auth_type") == 'config') {
            $dsn .= $this->getValue("$path/user");
-            if (! $this->getValue("$path/nopassword")) {
+            if (! empty($this->getValue("$path/password"))) {
                $dsn .= ':***';
            }
            $dsn .= '@';
--- a/libraries/config/Validator.php
+++ b/libraries/config/Validator.php
@ -271,8 +271,10 @@ class Validator
        }

        if (! $error && $values['Servers/1/auth_type'] == 'config') {
-            $password = !empty($values['Servers/1/nopassword']) && $values['Servers/1/nopassword'] ? null
-                : (empty($values['Servers/1/password']) ? '' : $values['Servers/1/password']);
+            $password = '';
+            if (! empty($values['Servers/1/password'])) {
+                $password = $values['Servers/1/password'];
+            }
            $test = static::testDBConnection(
                empty($values['Servers/1/connect_type']) ? '' : $values['Servers/1/connect_type'],
                empty($values['Servers/1/host']) ? '' : $values['Servers/1/host'],
@ -282,6 +284,7 @@ class Validator
                $password,
                'Server'
            );
+
            if ($test !== true) {
                $result = array_merge($result, $test);
            }
--- a/libraries/config/messages.inc.php
+++ b/libraries/config/messages.inc.php
@ -705,8 +705,6 @@ $strConfigServers_central_columns_desc = __(
    'Leave blank for no central columns support, suggested: '
    . '[kbd]pma__central_columns[/kbd].'
 );
-$strConfigServers_nopassword_desc = __('Try to connect without password.');
-$strConfigServers_nopassword_name = __('Connect without password');
 $strConfigServers_only_db_desc = __(
    'You can use MySQL wildcard characters (% and _), escape them if you want to '
    . 'use their literal instances, i.e. use [kbd]\'my\_db\'[/kbd] and not '
--- a/libraries/config/setup.forms.php
+++ b/libraries/config/setup.forms.php
@ -33,8 +33,7 @@ $forms['Servers']['Server'] = array('Servers' => array(1 => array(
    'socket',
    'ssl',
    'connect_type',
-    'compress',
-    'nopassword')));
+    'compress')));
 $forms['Servers']['Server_auth'] = array('Servers' => array(1 => array(
    'auth_type',
    ':group:' . __('Config authentication'),
--- a/libraries/controllers/server/ServerDatabasesController.php
+++ b/libraries/controllers/server/ServerDatabasesController.php
@ -481,7 +481,7 @@ class ServerDatabasesController extends Controller
                    $current["SCHEMA_NAME"],
                    $replication_info[$type]['Ignore_DB']
                );
-                if (mb_strlen($key) > 0) {
+                if (strlen($key) > 0) {
                    $out = Util::getIcon(
                        's_cancel.png',
                        __('Not replicated')
@ -491,7 +491,7 @@ class ServerDatabasesController extends Controller
                        $current["SCHEMA_NAME"], $replication_info[$type]['Do_DB']
                    );

-                    if (mb_strlen($key) > 0
+                    if (strlen($key) > 0
                        || count($replication_info[$type]['Do_DB']) == 0
                    ) {
                        // if ($key != null) did not work for index "0"
--- a/libraries/controllers/server/ServerVariablesController.php
+++ b/libraries/controllers/server/ServerVariablesController.php
@ -135,7 +135,7 @@ class ServerVariablesController extends Controller
        // when server is running in ANSI_QUOTES sql_mode
        $varValue = $this->dbi->fetchSingleRow(
            'SHOW GLOBAL VARIABLES WHERE Variable_name=\''
-            . Util::sqlAddSlashes($_REQUEST['varName']) . '\';',
+            . $GLOBALS['dbi']->escapeString($_REQUEST['varName']) . '\';',
            'NUM'
        );

@ -182,12 +182,12 @@ class ServerVariablesController extends Controller
                'gb' => 3,
                'gib' => 3
            );
-            $value = floatval($matches[1]) * Util::pow(
+            $value = floatval($matches[1]) * pow(
                1024,
                $exp[mb_strtolower($matches[3])]
            );
        } else {
-            $value = Util::sqlAddSlashes($value);
+            $value = $GLOBALS['dbi']->escapeString($value);
        }

        if (! is_numeric($value)) {
@ -202,7 +202,7 @@ class ServerVariablesController extends Controller
            // Some values are rounded down etc.
            $varValue = $this->dbi->fetchSingleRow(
                'SHOW GLOBAL VARIABLES WHERE Variable_name="'
-                . Util::sqlAddSlashes($_REQUEST['varName'])
+                . $GLOBALS['dbi']->escapeString($_REQUEST['varName'])
                . '";', 'NUM'
            );
            list($formattedValue, $isHtmlFormatted) = $this->_formatVariable(
--- a/libraries/controllers/table/TableChartController.php
+++ b/libraries/controllers/table/TableChartController.php
@ -105,14 +105,14 @@ class TableChartController extends TableController
        /**
         * Runs common work
         */
-        if (mb_strlen($this->table)) {
+        if (strlen($this->table) > 0) {
            $url_params['goto'] = Util::getScriptNameForOption(
                $this->cfg['DefaultTabTable'], 'table'
            );
            $url_params['back'] = 'tbl_sql.php';
            include 'libraries/tbl_common.inc.php';
            include 'libraries/tbl_info.inc.php';
-        } elseif (mb_strlen($this->db)) {
+        } elseif (strlen($this->db) > 0) {
            $url_params['goto'] = Util::getScriptNameForOption(
                $this->cfg['DefaultTabDatabase'], 'database'
            );
@ -188,9 +188,7 @@ class TableChartController extends TableController
        $db = &$this->db;
        $table = &$this->table;

-        $tableLength = mb_strlen($this->table);
-        $dbLength = mb_strlen($this->db);
-        if ($tableLength && $dbLength) {
+        if (strlen($this->table) > 0 && strlen($this->db) > 0) {
            include './libraries/tbl_common.inc.php';
        }

--- a/libraries/controllers/table/TableSearchController.php
+++ b/libraries/controllers/table/TableSearchController.php
@ -391,10 +391,10 @@ class TableSearchController extends TableController
            return;
        }
        $key = array_search($field, $this->_columnNames);
-        $search_index = 0;
-        if (PMA_isValid($_REQUEST['it'], 'integer')) {
-            $search_index = $_REQUEST['it'];
-        }
+        $search_index
+            = ((isset($_REQUEST['it']) && is_numeric($_REQUEST['it']))
+                ? intval($_REQUEST['it']) : 0);
+
        $properties = $this->getColumnProperties($search_index, $key);
        $this->response->addJSON(
            'field_type', htmlspecialchars($properties['type'])
@ -647,7 +647,7 @@ class TableSearchController extends TableController
            . " FROM " . Util::backquote($this->db)
            . "." . Util::backquote($this->table)
            . " WHERE " . Util::backquote($column)
-            . " RLIKE '" . Util::sqlAddSlashes($find) . "' COLLATE "
+            . " RLIKE '" . $GLOBALS['dbi']->escapeString($find) . "' COLLATE "
            . $charSet . "_bin"; // here we
        // change the collation of the 2nd operand to a case sensitive
        // binary collation to make sure that the comparison is case sensitive
@ -705,13 +705,13 @@ class TableSearchController extends TableController
            if (is_array($toReplace)) {
                foreach ($toReplace as $row) {
                    $sql_query .= "\n WHEN " . Util::backquote($column)
-                        . " = '" . Util::sqlAddSlashes($row[0])
-                        . "' THEN '" . Util::sqlAddSlashes($row[1]) . "'";
+                        . " = '" . $GLOBALS['dbi']->escapeString($row[0])
+                        . "' THEN '" . $GLOBALS['dbi']->escapeString($row[1]) . "'";
                }
            }
            $sql_query .= " END"
                . " WHERE " . Util::backquote($column)
-                . " RLIKE '" . Util::sqlAddSlashes($find) . "' COLLATE "
+                . " RLIKE '" . $GLOBALS['dbi']->escapeString($find) . "' COLLATE "
                . $charSet . "_bin"; // here we
            // change the collation of the 2nd operand to a case sensitive
            // binary collation to make sure that the comparison
@ -965,10 +965,10 @@ class TableSearchController extends TableController
            $parens_close = '';
        }
        $enum_where = '\''
-            . Util::sqlAddSlashes($criteriaValues[0]) . '\'';
+            . $GLOBALS['dbi']->escapeString($criteriaValues[0]) . '\'';
        for ($e = 1; $e < $enum_selected_count; $e++) {
            $enum_where .= ', \''
-                . Util::sqlAddSlashes($criteriaValues[$e]) . '\'';
+                . $GLOBALS['dbi']->escapeString($criteriaValues[$e]) . '\'';
        }

        return ' ' . $func_type . ' ' . $parens_open
@ -1027,7 +1027,7 @@ class TableSearchController extends TableController
            $gis_data = Util::createGISData($criteriaValues);
            $where = $geom_function_applied . " " . $func_type . " " . $gis_data;

-        } elseif (mb_strlen($criteriaValues) > 0) {
+        } elseif (strlen($criteriaValues) > 0) {
            $where = $geom_function_applied . " "
                . $func_type . " '" . $criteriaValues . "'";
        }
@ -1094,7 +1094,7 @@ class TableSearchController extends TableController
                && 'NOT BETWEEN' != $func_type
            ) {
                return $backquoted_name . ' ' . $func_type . ' ' . $quot
-                        . Util::sqlAddSlashes($criteriaValues) . $quot;
+                        . $GLOBALS['dbi']->escapeString($criteriaValues) . $quot;
            }
            $func_type = str_replace(' (...)', '', $func_type);

@ -1113,7 +1113,7 @@ class TableSearchController extends TableController
                    $value = 'NULL';
                    continue;
                }
-                $value = $quot . Util::sqlAddSlashes(trim($value))
+                $value = $quot . $GLOBALS['dbi']->escapeString(trim($value))
                    . $quot;
            }

--- a/libraries/controllers/table/TableStructureController.php
+++ b/libraries/controllers/table/TableStructureController.php
@ -1039,9 +1039,7 @@ class TableStructureController extends TableController
        ) {
            foreach ($_REQUEST['field_mimetype'] as $fieldindex => $mimetype) {
                if (isset($_REQUEST['field_name'][$fieldindex])
-                    && mb_strlen(
-                        $_REQUEST['field_name'][$fieldindex]
-                    )
+                    && strlen($_REQUEST['field_name'][$fieldindex]) > 0
                ) {
                    PMA_setMIME(
                        $this->db, $this->table,
@ -1210,8 +1208,8 @@ class TableStructureController extends TableController
                    FROM `INFORMATION_SCHEMA`.`VIEWS`
                    WHERE TABLE_SCHEMA='%s'
                    AND TABLE_NAME='%s';",
-                    Util::sqlAddSlashes($this->db),
-                    Util::sqlAddSlashes($this->table)
+                    $GLOBALS['dbi']->escapeString($this->db),
+                    $GLOBALS['dbi']->escapeString($this->table)
                )
            );

--- a/libraries/core.lib.php
+++ b/libraries/core.lib.php
@ -99,7 +99,7 @@ function PMA_ifSetOr(&$var, $default = null, $type = 'similar')
 * @return boolean whether valid or not
 *
 * @todo add some more var types like hex, bin, ...?
- * @see     https://php.net/gettype
+ * @see     https://secure.php.net/gettype
 */
 function PMA_isValid(&$var, $type = 'length', $compare = null)
 {
@ -166,7 +166,7 @@ function PMA_isValid(&$var, $type = 'length', $compare = null)
    if ($type === 'length' || $type === 'scalar') {
        $is_scalar = is_scalar($var);
        if ($is_scalar && $type === 'length') {
-            return (bool) mb_strlen($var);
+            return strlen($var) > 0;
        }
        return $is_scalar;
    }
@ -278,7 +278,7 @@ function PMA_getPHPDocLink($target)
        $lang = $GLOBALS['lang'];
    }

-    return PMA_linkURL('https://php.net/manual/' . $lang . '/' . $target);
+    return PMA_linkURL('https://secure.php.net/manual/' . $lang . '/' . $target);
 }

 /**
@ -579,7 +579,7 @@ function PMA_downloadHeader($filename, $mimetype, $length = 0, $no_cache = true)
        PMA_noCacheHeader();
    }
    /* Replace all possibly dangerous chars in filename */
-    $filename = str_replace(array(';', '"', "\n", "\r"), '-', $filename);
+    $filename = Sanitize::sanitizeFilename($filename);
    if (!empty($filename)) {
        header('Content-Description: File Transfer');
        header('Content-Disposition: attachment; filename="' . $filename . '"');
@ -781,22 +781,6 @@ function PMA_addJSCode($str)
    $scripts->addCode($str);
 }

-/**
- * Adds JS code snippet for variable assignment
- * to be displayed by the PMA\libraries\Response class.
- *
- * @param string $key    Name of value to set
- * @param mixed  $value  Value to set, can be either string or array of strings
- * @param bool   $escape Whether to escape value or keep it as it is
- *                       (for inclusion of js code)
- *
- * @return void
- */
-function PMA_addJSVar($key, $value, $escape = true)
-{
-    PMA_addJSCode(Sanitize::getJsValue($key, $value, $escape));
-}
-
 /**
 * Replace some html-unfriendly stuff
 *
--- a/libraries/create_addfield.lib.php
+++ b/libraries/create_addfield.lib.php
@ -167,7 +167,7 @@ function PMA_buildIndexStatements($index, $index_choice,
    $keyBlockSizes = $index['Key_block_size'];
    if (! empty($keyBlockSizes)) {
        $sql_query .= " KEY_BLOCK_SIZE = "
-             . PMA\libraries\Util::sqlAddSlashes($keyBlockSizes);
+             . $GLOBALS['dbi']->escapeString($keyBlockSizes);
    }

    // specifying index type is allowed only for primary, unique and index only
@ -181,12 +181,12 @@ function PMA_buildIndexStatements($index, $index_choice,

    $parser = $index['Parser'];
    if ($index['Index_choice'] == 'FULLTEXT' && ! empty($parser)) {
-        $sql_query .= " WITH PARSER " . PMA\libraries\Util::sqlAddSlashes($parser);
+        $sql_query .= " WITH PARSER " . $GLOBALS['dbi']->escapeString($parser);
    }

    $comment = $index['Index_comment'];
    if (! empty($comment)) {
-        $sql_query .= " COMMENT '" . PMA\libraries\Util::sqlAddSlashes($comment)
+        $sql_query .= " COMMENT '" . $GLOBALS['dbi']->escapeString($comment)
            . "'";
    }

@ -425,11 +425,11 @@ function PMA_getTableCreationQuery($db, $table)
        && $_REQUEST['tbl_storage_engine'] == 'FEDERATED'
    ) {
        $sql_query .= " CONNECTION = '"
-            . PMA\libraries\Util::sqlAddSlashes($_REQUEST['connection']) . "'";
+            . $GLOBALS['dbi']->escapeString($_REQUEST['connection']) . "'";
    }
    if (!empty($_REQUEST['comment'])) {
        $sql_query .= ' COMMENT = \''
-            . PMA\libraries\Util::sqlAddSlashes($_REQUEST['comment']) . '\'';
+            . $GLOBALS['dbi']->escapeString($_REQUEST['comment']) . '\'';
    }
    $sql_query .= PMA_getPartitionsDefinition();
    $sql_query .= ';';
--- a/libraries/db_common.inc.php
+++ b/libraries/db_common.inc.php
@ -41,7 +41,7 @@ $err_url = PMA\libraries\Util::getScriptNameForOption(
 * headers
 */
 if (! isset($is_db) || ! $is_db) {
-    if (mb_strlen($db)) {
+    if (strlen($db) > 0) {
        $is_db = $GLOBALS['dbi']->selectDb($db);
        // This "Command out of sync" 2014 error may happen, for example
        // after calling a MySQL procedure; at this point we can't select
@ -57,7 +57,7 @@ if (! isset($is_db) || ! $is_db) {
    $uri = './index.php'
        . URL::getCommonRaw(array())
        . (isset($message) ? '&message=' . urlencode($message) : '') . '&reload=1';
-    if (!mb_strlen($db) || ! $is_db) {
+    if (strlen($db) === 0 || ! $is_db) {
        $response = PMA\libraries\Response::getInstance();
        if ($response->isAjax()) {
            $response->setRequestStatus(false);
--- a/libraries/db_designer.lib.php
+++ b/libraries/db_designer.lib.php
@ -82,7 +82,7 @@ function PMA_getPageIdsAndNames($db)
    $page_query = "SELECT `page_nr`, `page_descr` FROM "
        . PMA\libraries\Util::backquote($cfgRelation['db']) . "."
        . PMA\libraries\Util::backquote($cfgRelation['pdf_pages'])
-        . " WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($db) . "'"
+        . " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($db) . "'"
        . " ORDER BY `page_descr`";
    $page_rs = PMA_queryAsControlUser(
        $page_query, false, PMA\libraries\DatabaseInterface::QUERY_STORE
--- a/libraries/db_table_exists.inc.php
+++ b/libraries/db_table_exists.inc.php
@ -14,7 +14,7 @@ if (! defined('PHPMYADMIN')) {
 }

 if (empty($is_db)) {
-    if (mb_strlen($db)) {
+    if (strlen($db) > 0) {
        $is_db = @$GLOBALS['dbi']->selectDb($db);
    } else {
        $is_db = false;
@ -57,13 +57,13 @@ if (empty($is_table)
 ) {
    // Not a valid table name -> back to the db_sql.php

-    if (mb_strlen($table)) {
+    if (strlen($table) > 0) {
        $is_table = $GLOBALS['dbi']->getCachedTableContent(array($db, $table), false);

        if (! $is_table) {
            $_result = $GLOBALS['dbi']->tryQuery(
                'SHOW TABLES LIKE \''
-                . PMA\libraries\Util::sqlAddSlashes($table, true) . '\';',
+                . $GLOBALS['dbi']->escapeString($table) . '\';',
                null, PMA\libraries\DatabaseInterface::QUERY_STORE
            );
            $is_table = @$GLOBALS['dbi']->numRows($_result);
@ -75,7 +75,7 @@ if (empty($is_table)

    if (! $is_table) {
        if (!defined('IS_TRANSFORMATION_WRAPPER')) {
-            if (mb_strlen($table)) {
+            if (strlen($table) > 0) {
                // SHOW TABLES doesn't show temporary tables, so try select
                // (as it can happen just in case temporary table, it should be
                // fast):
--- a/libraries/dbi/DBIDummy.php
+++ b/libraries/dbi/DBIDummy.php
@ -698,7 +698,7 @@ $GLOBALS['dummy_queries'] = array(
    array(
        'query'  => "SELECT `PARTITION_METHOD` "
            . "FROM `information_schema`.`PARTITIONS` "
-            . "WHERE `TABLE_SCHEMA` = 'db' AND `TABLE_NAME` = 'table'",
+            . "WHERE `TABLE_SCHEMA` = 'db' AND `TABLE_NAME` = 'table' LIMIT 1",
        'result' => array(),
    ),
    array(
@ -895,9 +895,9 @@ class DBIDummy implements DBIExtension
    /**
     * connects to the database server
     *
-     * @param string $user                 mysql user name
-     * @param string $password             mysql user password
-     * @param array  $server               host/port/socket/persistent
+     * @param string $user     mysql user name
+     * @param string $password mysql user password
+     * @param array  $server   host/port/socket/persistent
     *
     * @return mixed false on error or a mysqli object on success
     */
@ -1253,4 +1253,17 @@ class DBIDummy implements DBIExtension
    {
        return '';
    }
+
+    /**
+     * returns properly escaped string for use in MySQL queries
+     *
+     * @param mixed  $link database link
+     * @param string $str  string to be escaped
+     *
+     * @return string a MySQL escaped string
+     */
+    public function escapeString($link, $str)
+    {
+        return $str;
+    }
 }
--- a/Show More
+++ b/Show More