diff --git a/templates/config/form_display/form_top.twig b/templates/config/form_display/form_top.twig
index f18a319857..9afc5e4928 100644
--- a/templates/config/form_display/form_top.twig
+++ b/templates/config/form_display/form_top.twig
@@ -1,4 +1,4 @@
-<form method="{{ method }}" action="{{ action|raw }}" class="config-form disableAjax">
+<form method="{{ method }}" action="{{ action|e('html_attr') }}" class="config-form disableAjax">
   <input type="hidden" name="tab_hash" value="">
   {% if has_check_page_refresh %}
     <input type="hidden" name="check_page_refresh" id="check_page_refresh" value="">
diff --git a/test/classes/Config/FormDisplayTemplateTest.php b/test/classes/Config/FormDisplayTemplateTest.php
index b5fca909f8..aadd6b42c7 100644
--- a/test/classes/Config/FormDisplayTemplateTest.php
+++ b/test/classes/Config/FormDisplayTemplateTest.php
@@ -38,13 +38,13 @@ class FormDisplayTemplateTest extends AbstractTestCase
      */
     public function testDisplayFormTop(): void
     {
-        $_SERVER['REQUEST_URI'] = 'https://www.phpmyadmin.net';
+        $_SERVER['REQUEST_URI'] = 'https://www.phpmyadmin.net/index.php?key=value&key2=">value2';
         $GLOBALS['cfg']['ServerDefault'] = '';
         $result = $this->formDisplayTemplate->displayFormTop(null, 'posted', [1]);
 
         $this->assertStringContainsString(
-            '<form method="get" action="https://www.phpmyadmin.net" ' .
-            'class="config-form disableAjax">',
+            '<form method="get" action="https&#x3A;&#x2F;&#x2F;www.phpmyadmin.net&#x2F;'
+            . 'index.php&#x3F;key&#x3D;value&amp;key2&#x3D;&quot;&gt;value2" class="config-form disableAjax">',
             $result
         );
 
diff --git a/test/classes/Config/PageSettingsTest.php b/test/classes/Config/PageSettingsTest.php
index 8282e44721..15b5bbae84 100644
--- a/test/classes/Config/PageSettingsTest.php
+++ b/test/classes/Config/PageSettingsTest.php
@@ -54,7 +54,7 @@ class PageSettingsTest extends AbstractTestCase
             '<div id="page_settings_modal">'
             . '<div class="page_settings">'
             . '<form method="post" '
-            . 'action="index.php?db=db&server=1&lang=en" '
+            . 'action="index.php&#x3F;db&#x3D;db&amp;server&#x3D;1&amp;lang&#x3D;en" '
             . 'class="config-form disableAjax">',
             $html
         );