diff --git a/ChangeLog b/ChangeLog
index b7a77bb34f..d631fc8d26 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,7 +5,12 @@ phpMyAdmin - ChangeLog
 - bug #4516 Odd export behavior
 
 4.2.7.1 (2014-08-17)
+- bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
+- bug #4503 [security] Self-XSSes in monitor
+- bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
+- bug #4517 [security] XSS in relation view
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
diff --git a/js/functions.js b/js/functions.js
index a970a81584..bcdead8e17 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () {
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string
diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
index c3a0c53893..f5465ed6f7 100644
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@@ -908,7 +908,7 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             label: $('#variableInput').val().replace(/_/g, " ")
         };
         newChart.series.push(newSeries);
-        $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
+        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
         newChart.nodes.push(serie);
         $('#variableInput').val('');
         $('input[name="differentialValue"]').prop('checked', true);
diff --git a/js/sql.js b/js/sql.js
index 8b77c1aae0..aad4a454e8 100644
--- a/js/sql.js
+++ b/js/sql.js
@@ -119,7 +119,7 @@ AJAX.registerOnload('sql.js', function () {
     // Delete row from SQL results
     $('a.delete_row.ajax').live('click', function (e) {
         e.preventDefault();
-        var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text());
+        var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text()));
         var $link = $(this);
         $link.PMA_confirm(question, $link.attr('href'), function (url) {
             $msgbox = PMA_ajaxShowMessage();
diff --git a/js/tbl_chart.js b/js/tbl_chart.js
index 943d4aee35..04c9c40b0c 100644
--- a/js/tbl_chart.js
+++ b/js/tbl_chart.js
@@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) {
         },
         axes : {
             xaxis : {
-                label : settings.xaxisLabel
+                label : escapeHtml(settings.xaxisLabel)
             },
             yaxis : {
                 label : settings.yaxisLabel
diff --git a/libraries/tbl_relation.lib.php b/libraries/tbl_relation.lib.php
index 0e1bc3d802..60b020ed47 100644
--- a/libraries/tbl_relation.lib.php
+++ b/libraries/tbl_relation.lib.php
@@ -554,7 +554,7 @@ function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $d
         $html_output .= __('Constraint name');
         $html_output .= '<input type="text" name="constraint_name['
             . $myfield_md5 . ']"'
-            . ' value="' . $constraint_name . '"/>';
+            . ' value="' . htmlspecialchars($constraint_name) . '"/>';
         $html_output .= '</span>' . "\n";
 
         $html_output .= '<span class="formelement clearfloat">';