diff --git a/ChangeLog b/ChangeLog
index b11870391e..04fcb15d2d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,10 @@ phpMyAdmin - ChangeLog
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
 
+4.2.10.1 (2014-10-21)
+- bug #4562 [security] XSS in debug SQL output
+- bug #4563 [security] XSS in monitor query analyzer
+
 4.2.10.0 (2014-10-11)
 - bug #4361 Can't change font size (when config.inc.php not present)
 - bug #4542 Tab key in column name not shown
diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
index 4432cafdc6..97684d8ced 100644
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@@ -1855,7 +1855,7 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             if (name == 'user_host') {
                 return value.replace(/(\[.*?\])+/g, '');
             }
-            return value;
+            return escapeHtml(value);
         };
 
         for (var i = 0, l = rows.length; i < l; i++) {
@@ -2011,7 +2011,7 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             for (i = 0, l = data.explain.length; i < l; i++) {
                 explain += '<div class="explain-' + i + '"' + (i > 0 ?  'style="display:none;"' : '') + '>';
                 $.each(data.explain[i], function (key, value) {
-                    value = (value === null) ? 'null' : value;
+                    value = (value === null) ? 'null' : escapeHtml(value);
 
                     if (key == 'type' && value.toLowerCase() == 'all') {
                         value = '<span class="attention">' + value + '</span>';
diff --git a/libraries/DatabaseInterface.class.php b/libraries/DatabaseInterface.class.php
index edab4255b9..ece44907a5 100644
--- a/libraries/DatabaseInterface.class.php
+++ b/libraries/DatabaseInterface.class.php
@@ -139,10 +139,11 @@ class PMA_DatabaseInterface
             $_SESSION['debug']['queries'][$hash] = array();
             if ($result == false) {
                 $_SESSION['debug']['queries'][$hash]['error']
-                    = '<b style="color:red">' . mysqli_error($link) . '</b>';
+                    = '<b style="color:red">'
+                        . htmlspecialchars(mysqli_error($link)) . '</b>';
             }
             $_SESSION['debug']['queries'][$hash]['count'] = 1;
-            $_SESSION['debug']['queries'][$hash]['query'] = $query;
+            $_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query);
             $_SESSION['debug']['queries'][$hash]['time'] = $time;
         }