diff --git a/tbl_tracking.php b/tbl_tracking.php
index ba093b6d0a..e3b63efa10 100644
--- a/tbl_tracking.php
+++ b/tbl_tracking.php
@@ -170,7 +170,11 @@ if (isset($_REQUEST['submit_create_version'])) {
     $tracking_set = rtrim($tracking_set, ',');
 
     if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) {
-        $msg = PMA_Message::success(sprintf(__('Version %1$s was created, tracking for %2$s is active.'), $_REQUEST['version'], htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table'])));
+        $msg = PMA_Message::success(sprintf(
+            __('Version %1$s was created, tracking for %2$s is active.'),
+            htmlspecialchars($_REQUEST['version']),
+            htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table'])
+        ));
         $msg->display();
     }
 }
@@ -178,7 +182,11 @@ if (isset($_REQUEST['submit_create_version'])) {
 // Deactivate tracking
 if (isset($_REQUEST['submit_deactivate_now'])) {
     if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) {
-        $msg = PMA_Message::success(sprintf(__('Tracking for %1$s was deactivated at version %2$s.'), htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table']), $_REQUEST['version']));
+        $msg = PMA_Message::success(sprintf(
+            __('Tracking for %1$s was deactivated at version %2$s.'),
+            htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table']),
+            htmlspecialchars($_REQUEST['version'])
+        ));
         $msg->display();
     }
 }
@@ -186,7 +194,11 @@ if (isset($_REQUEST['submit_deactivate_now'])) {
 // Activate tracking
 if (isset($_REQUEST['submit_activate_now'])) {
     if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) {
-        $msg = PMA_Message::success(sprintf(__('Tracking for %1$s was activated at version %2$s.'), htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table']), $_REQUEST['version']));
+        $msg = PMA_Message::success(sprintf(
+            __('Tracking for %1$s was activated at version %2$s.'),
+            htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table']),
+            htmlspecialchars($_REQUEST['version'])
+        ));
         $msg->display();
     }
 }
@@ -243,7 +255,7 @@ if (isset($_REQUEST['snapshot'])) {
         $drop_create_statements .= $data['ddlog'][1]['statement'];
     }
     // Print SQL code
-    PMA_showMessage(sprintf(__('Version %s snapshot (SQL code)'), $_REQUEST['version']), $drop_create_statements);
+    PMA_showMessage(sprintf(__('Version %s snapshot (SQL code)'), htmlspecialchars($_REQUEST['version'])), $drop_create_statements);
 
     // Unserialize snapshot
     $temp = unserialize($data['schema_snapshot']);