diff --git a/libraries/core.lib.php b/libraries/core.lib.php
index ed2c058f99..337347a53e 100644
--- a/libraries/core.lib.php
+++ b/libraries/core.lib.php
@@ -899,6 +899,24 @@ function PMA_sanitizeMySQLHost($name)
     return $name;
 }
 
+/**
+ * Sanitizes MySQL username
+ *
+ * * strips part behind null byte
+ *
+ * @param string $name User given username
+ *
+ * @return string
+ */
+function PMA_sanitizeMySQLUser($name)
+{
+    $position = strpos($name, chr(0));
+    if ($position !== false) {
+        return substr($name, 0, $position);
+    }
+    return $name;
+}
+
 /**
  * Safe unserializer wrapper
  *
diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php
index 5c4a87d203..d0ac972b8c 100644
--- a/libraries/plugins/auth/AuthenticationCookie.class.php
+++ b/libraries/plugins/auth/AuthenticationCookie.class.php
@@ -333,7 +333,7 @@ class AuthenticationCookie extends AuthenticationPlugin
 
         if (! empty($_REQUEST['pma_username'])) {
             // The user just logged in
-            $GLOBALS['PHP_AUTH_USER'] = $_REQUEST['pma_username'];
+            $GLOBALS['PHP_AUTH_USER'] = PMA_sanitizeMySQLUser($_REQUEST['pma_username']);
             $GLOBALS['PHP_AUTH_PW']   = empty($_REQUEST['pma_password'])
                 ? ''
                 : $_REQUEST['pma_password'];
diff --git a/libraries/plugins/auth/AuthenticationHttp.class.php b/libraries/plugins/auth/AuthenticationHttp.class.php
index f81ab92a55..54a49ad09c 100644
--- a/libraries/plugins/auth/AuthenticationHttp.class.php
+++ b/libraries/plugins/auth/AuthenticationHttp.class.php
@@ -158,6 +158,9 @@ class AuthenticationHttp extends AuthenticationPlugin
             unset($usr_pass);
         }
 
+        // sanitize username
+        $PHP_AUTH_USER = PMA_sanitizeMySQLUser($PHP_AUTH_USER);
+
         // User logged out -> ensure the new username is not the same
         $old_usr = isset($_REQUEST['old_usr']) ? $_REQUEST['old_usr'] : '';
         if (! empty($old_usr)