diff --git a/ChangeLog b/ChangeLog
index 7327e2d205..ff99e65d10 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -54,6 +54,10 @@ phpMyAdmin - ChangeLog
 - issue #12012 Column definition with default value and comment in CREATE TABLE expoerted faulty.
 - issue #12020 New statement but no delimiter and unexpected token with REPLACE.
 - issue #12029 Fixed incorrect usage of SQL parser context in SQL export
+- issue        [security] XSS vulnerability in SQL parser, see PMASA-2016-10.
+- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-11.
+- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-12.
+- issue        [security] Vulnerability allowing man-in-the-middle attack on API call to GitHub, see PMASA-2016-13.
 
 4.5.5.0 (2016-02-22)
 - issue        Undefined index: is_ajax_request
diff --git a/db_central_columns.php b/db_central_columns.php
index 29b71832e8..6908076285 100644
--- a/db_central_columns.php
+++ b/db_central_columns.php
@@ -92,7 +92,7 @@ if (isset($_REQUEST['total_rows']) && $_REQUEST['total_rows']) {
 } else {
     $total_rows = PMA_getCentralColumnsCount($db);
 }
-if (isset($_REQUEST['pos'])) {
+if (PMA_isValid($_REQUEST['pos'], 'integer')) {
     $pos = $_REQUEST['pos'];
 } else {
     $pos = 0;
diff --git a/file_echo.php b/file_echo.php
index 0d65f0f7be..7c9374b9eb 100644
--- a/file_echo.php
+++ b/file_echo.php
@@ -64,12 +64,16 @@ if (isset($_REQUEST['filename']) && isset($_REQUEST['image'])) {
 
 } else if (isset($_REQUEST['monitorconfig'])) {
     /* For monitor chart config export */
-    PMA_downloadHeader('monitor.cfg', 'application/force-download');
+    PMA_downloadHeader('monitor.cfg', 'application/json; charset=UTF-8');
+    header('X-Content-Type-Options: nosniff');
+
     echo urldecode($_REQUEST['monitorconfig']);
 
 } else if (isset($_REQUEST['import'])) {
     /* For monitor chart config import */
-    header('Content-type: text/plain');
+    header('Content-Type: application/json; charset=UTF-8');
+    header('X-Content-Type-Options: nosniff');
+
     if (!file_exists($_FILES['file']['tmp_name'])) {
         exit();
     }
diff --git a/js/functions.js b/js/functions.js
index ddcfc5636b..c7a1f23a38 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -340,6 +340,24 @@ function escapeHtml(unsafe) {
     }
 }
 
+function escapeJsString(unsafe) {
+    if (typeof(unsafe) != 'undefined') {
+        return unsafe
+            .toString()
+            .replace("\000", '')
+            .replace('\\', '\\\\')
+            .replace('\'', '\\\'')
+            .replace("'", "\\\'")
+            .replace('"', '\"')
+            .replace(""", "\"")
+            .replace("\n", '\n')
+            .replace("\r", '\r')
+            .replace(/<\/script/gi, '</\' + \'script')
+    } else {
+        return false;
+    }
+}
+
 function PMA_sprintf() {
     return sprintf.apply(this, arguments);
 }
@@ -1819,7 +1837,7 @@ AJAX.registerOnload('functions.js', function () {
         var $inner_sql = $(this).parent().prev().find('code.sql');
         var old_text   = $inner_sql.html();
 
-        var new_content = "<textarea name=\"sql_query_edit\" id=\"sql_query_edit\">" + sql_query + "</textarea>\n";
+        var new_content = "<textarea name=\"sql_query_edit\" id=\"sql_query_edit\">" + escapeHtml(sql_query) + "</textarea>\n";
         new_content    += getForeignKeyCheckboxLoader();
         new_content    += "<input type=\"submit\" id=\"sql_query_edit_save\" class=\"button btnSave\" value=\"" + PMA_messages.strGo + "\"/>\n";
         new_content    += "<input type=\"button\" id=\"sql_query_edit_discard\" class=\"button btnDiscard\" value=\"" + PMA_messages.strCancel + "\"/>\n";
diff --git a/js/normalization.js b/js/normalization.js
index 48abc71554..da1dbfe6e0 100644
--- a/js/normalization.js
+++ b/js/normalization.js
@@ -82,7 +82,7 @@ function goTo2NFStep1() {
             $("#mainContent #extra").html(data.extra);
             $("#mainContent #newCols").html('');
             if (data.subText !== '') {
-                $('.tblFooters').html('<input type="submit" value="' + PMA_messages.strDone + '" onclick="processDependencies(\'' + data.primary_key + '\');">');
+                $('.tblFooters').html('<input type="submit" value="' + PMA_messages.strDone + '" onclick="processDependencies(\'' + escapeJsString(escapeHtml(data.primary_key)) + '\');">');
             } else {
                 if (normalizeto === '3nf') {
                     $("#mainContent #newCols").html(PMA_messages.strToNextStep);
@@ -128,7 +128,7 @@ function goToStep4()
             $("#mainContent #newCols").html('');
             $('.tblFooters').html('');
             for(var pk in primary_key) {
-                $("#extra input[value='" + primary_key[pk] + "']").attr("disabled","disabled");
+                $("#extra input[value='" + escapeJsString(primary_key[pk]) + "']").attr("disabled","disabled");
             }
         }
     );
@@ -153,7 +153,7 @@ function goToStep3()
             $('.tblFooters').html('');
             primary_key = $.parseJSON(data.primary_key);
             for(var pk in primary_key) {
-                $("#extra input[value='" + primary_key[pk] + "']").attr("disabled","disabled");
+                $("#extra input[value='" + escapeJsString(primary_key[pk]) + "']").attr("disabled","disabled");
             }
         }
     );
@@ -638,7 +638,7 @@ AJAX.registerOnload('normalization.js', function() {
                 '</ol>';
             $("#newCols").html(confirmStr);
             $('.tblFooters').html('<input type="submit" value="' + PMA_messages.strCancel + '" onclick="$(\'#newCols\').html(\'\');$(\'#extra input[type=checkbox]\').removeAttr(\'checked\')"/>' +
-                '<input type="submit" value="' + PMA_messages.strGo + '" onclick="moveRepeatingGroup(\'' + repeatingCols + '\')"/>');
+                '<input type="submit" value="' + PMA_messages.strGo + '" onclick="moveRepeatingGroup(\'' + escapeJsString(escapeHtml(repeatingCols)) + '\')"/>');
         }
     });
     $("#mainContent p").on("click", "#createPrimaryKey", function(event) {
diff --git a/libraries/Config.php b/libraries/Config.php
index e76a880edf..1a5f9d4bb2 100644
--- a/libraries/Config.php
+++ b/libraries/Config.php
@@ -724,8 +724,8 @@ class Config
         Util::configureCurl($handle);
         curl_setopt($handle, CURLOPT_FOLLOWLOCATION, 0);
         curl_setopt($handle, CURLOPT_RETURNTRANSFER, 1);
-        curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, 0);
-        curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, 0);
+        curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, '2');
+        curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, '1');
         curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5);
         curl_setopt($handle, CURLOPT_TIMEOUT, 5);
         curl_setopt($handle, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
diff --git a/libraries/controllers/table/TableSearchController.php b/libraries/controllers/table/TableSearchController.php
index a0000a1dc4..be91c9bdce 100644
--- a/libraries/controllers/table/TableSearchController.php
+++ b/libraries/controllers/table/TableSearchController.php
@@ -460,7 +460,11 @@ class TableSearchController extends TableController
             return;
         }
         $key = array_search($field, $this->_columnNames);
-        $properties = $this->getColumnProperties($_REQUEST['it'], $key);
+        $search_index = 0;
+        if (PMA_isValid($_REQUEST['it'], 'integer')) {
+            $search_index = $_REQUEST['it'];
+        }
+        $properties = $this->getColumnProperties($search_index, $key);
         $this->response->addJSON(
             'field_type', htmlspecialchars($properties['type'])
         );
diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
index 8f829367d1..74354fdb1f 100644
--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@@ -3608,7 +3608,7 @@ function PMA_getUsersOverview($result, $db_rights, $pmaThemeImage, $text_dir)
         __('Export'), 'b_tblexport.png', 'export'
     );
     $html_output .= '<input type="hidden" name="initial" '
-        . 'value="' . (isset($_GET['initial']) ? $_GET['initial'] : '') . '" />';
+        . 'value="' . (isset($_GET['initial']) ? htmlspecialchars($_GET['initial']) : '') . '" />';
     $html_output .= '</div>'
         . '<div class="clear_both" style="clear:both"></div>';
 
diff --git a/libraries/sql-parser/src/Utils/Error.php b/libraries/sql-parser/src/Utils/Error.php
index a9c0814fcf..f0ad5afbb2 100644
--- a/libraries/sql-parser/src/Utils/Error.php
+++ b/libraries/sql-parser/src/Utils/Error.php
@@ -90,7 +90,7 @@ class Error
                 ++$i,
                 $err[0],
                 $err[1],
-                $err[2],
+                htmlspecialchars($err[2]),
                 $err[3]
             );
         }
diff --git a/libraries/tcpdf/include/tcpdf_static.php b/libraries/tcpdf/include/tcpdf_static.php
index 4ab18b6c4d..a1915d640b 100644
--- a/libraries/tcpdf/include/tcpdf_static.php
+++ b/libraries/tcpdf/include/tcpdf_static.php
@@ -2508,8 +2508,6 @@ class TCPDF_STATIC {
 				}
 				curl_setopt($cs, CURLOPT_CONNECTTIMEOUT, 5);
 				curl_setopt($cs, CURLOPT_TIMEOUT, 30);
-				curl_setopt($cs, CURLOPT_SSL_VERIFYPEER, false);
-				curl_setopt($cs, CURLOPT_SSL_VERIFYHOST, false);
 				curl_setopt($cs, CURLOPT_USERAGENT, 'TCPDF');
 				$ret = curl_exec($cs);
 				curl_close($cs);
diff --git a/normalization.php b/normalization.php
index da990da793..0160f31c1e 100644
--- a/normalization.php
+++ b/normalization.php
@@ -71,7 +71,7 @@ $scripts = $header->getScripts();
 $scripts->addFile('normalization.js');
 $scripts->addFile('jquery/jquery.uitablefilter.js');
 $normalForm = '1nf';
-if (isset($_REQUEST['normalizeTo'])) {
+if (PMA_isValid($_REQUEST['normalizeTo'], array('1nf', '2nf', '3nf'))) {
     $normalForm = $_REQUEST['normalizeTo'];
 }
 if (isset($_REQUEST['createNewTables2NF'])) {
diff --git a/templates/database/structure/sortable_header.phtml b/templates/database/structure/sortable_header.phtml
index 31aa4c6a74..42951bc6b0 100644
--- a/templates/database/structure/sortable_header.phtml
+++ b/templates/database/structure/sortable_header.phtml
@@ -51,16 +51,21 @@ if ($requested_sort == $sort) {
 }
 $_url_params = array(
     'db' => $_REQUEST['db'],
+    'pos' => 0, // We set the position back to 0 every time they sort.
+    'sort' => $sort,
+    'sort_order' => $future_sort_order,
 );
-$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
-// We set the position back to 0 every time they sort.
-$url .= "&amp;pos=0&amp;sort=$sort&amp;sort_order=$future_sort_order";
-if (! empty($_REQUEST['tbl_type'])) {
-    $url .= "&amp;tbl_type=" . $_REQUEST['tbl_type'];
+
+if (PMA_isValid($_REQUEST['tbl_type'], array('view', 'table'))) {
+     $_url_params['tbl_type'] = $_REQUEST['tbl_type'];
 }
 if (! empty($_REQUEST['tbl_group'])) {
-    $url .= "&amp;tbl_group=" . $_REQUEST['tbl_group'];
+    $_url_params['tbl_group'] = $_REQUEST['tbl_group'];
 }
+
+$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
+
+echo PMA_Util::linkOrButton(
 echo PMA\libraries\Util::linkOrButton(
     $url, $title . $order_img, $order_link_params
-);
\ No newline at end of file
+);
diff --git a/templates/table/search/input_box.phtml b/templates/table/search/input_box.phtml
index a9bda7639d..4446865616 100644
--- a/templates/table/search/input_box.phtml
+++ b/templates/table/search/input_box.phtml
@@ -20,7 +20,7 @@ if ($_foreigners
                <?php if (isset($criteriaValues[$column_index])
                    && is_string($criteriaValues[$column_index])
                ): ?>
-                   value="<?= $criteriaValues[$column_index]; ?>"
+                   value="<?= htmlspecialchars($criteriaValues[$column_index]); ?>"
                <?php endif; ?> />
         <a class="ajax browse_foreign"
            href="<?= ('browse_foreigners.php') , PMA_URL_getCommon(array('db' => $db, 'table' => $table))
@@ -90,6 +90,7 @@ if ($_foreigners
                 && is_array($criteriaValues[$column_index])
                 && in_array($value[$j], $criteriaValues[$column_index])
             ): ?>
+<<<<<<< HEAD
                 <option value="<?= $value[$j]; ?>"
                         selected>
                     <?= $value[$j]; ?>
@@ -97,6 +98,15 @@ if ($_foreigners
             <?php else: ?>
                 <option value="<?= $value[$j]; ?>">
                     <?= $value[$j]; ?>
+=======
+                <option value="<?php echo htmlspecialchars($value[$j]); ?>"
+                        selected>
+                    <?php echo htmlspecialchars($value[$j]); ?>
+                </option>
+            <?php else: ?>
+                <option value="<?php echo htmlspecialchars($value[$j]); ?>">
+                    <?php echo htmlspecialchars($value[$j]); ?>
+>>>>>>> MAINT_4_5_5-security
                 </option>
             <?php endif; ?>
         <?php endfor; ?>
@@ -126,7 +136,11 @@ if ($_foreigners
            <?php if (isset($criteriaValues[$column_index])
                && is_string($criteriaValues[$column_index])
            ): ?>
+<<<<<<< HEAD
                value="<?= $criteriaValues[$column_index]; ?>"
+=======
+               value="<?php echo htmlspecialchars($criteriaValues[$column_index]); ?>"
+>>>>>>> MAINT_4_5_5-security
            <?php endif; ?>/>
 
-<?php endif; ?>
\ No newline at end of file
+<?php endif; ?>
diff --git a/templates/table/search/rows_zoom.phtml b/templates/table/search/rows_zoom.phtml
index 7ddaff8053..0dcb712a04 100644
--- a/templates/table/search/rows_zoom.phtml
+++ b/templates/table/search/rows_zoom.phtml
@@ -68,7 +68,7 @@ for ($i = 0; $i < 4; $i++): ?>
         </td>
         <!-- Inputbox for search criteria value -->
         <td>
-            <?= (isset($value[$i]) ? htmlspecialchars($value[$i]) : ''); ?>
+            <?= (isset($value[$i]) ? $value[$i] : ''); ?>
         </td>
     </tr>
     <!-- Displays hidden fields -->
diff --git a/test/classes/ConfigTest.php b/test/classes/ConfigTest.php
index 131e5fa53b..31422f8dec 100644
--- a/test/classes/ConfigTest.php
+++ b/test/classes/ConfigTest.php
@@ -50,6 +50,7 @@ class ConfigTest extends PMATestCase
         $GLOBALS['server'] = 0;
         $_SESSION['is_git_revision'] = true;
         $GLOBALS['PMA_Config'] = new PMA\libraries\Config(CONFIG_FILE);
+        $GLOBALS['cfg']['ProxyUrl'] = '';
 
         //for testing file permissions
         $this->permTestObj = new PMA\libraries\Config("./config.sample.inc.php");
@@ -889,14 +890,19 @@ class ConfigTest extends PMATestCase
             $this->markTestSkipped('Missing curl extension!');
         }
         $this->assertTrue(
-            $this->object->checkHTTP("http://www.phpmyadmin.net/test/data")
+            $this->object->checkHTTP("https://www.phpmyadmin.net/test/data")
         );
         $this->assertContains(
             "TEST DATA",
-            $this->object->checkHTTP("http://www.phpmyadmin.net/test/data", true)
+            $this->object->checkHTTP("https://www.phpmyadmin.net/test/data", true)
         );
         $this->assertFalse(
-            $this->object->checkHTTP("http://www.phpmyadmin.net/test/nothing")
+            $this->object->checkHTTP("https://www.phpmyadmin.net/test/nothing")
+        );
+        // Use rate limit API as it's not subject to rate limiting
+        $this->assertContains(
+            '"resources"',
+            $this->object->checkHTTP("https://api.github.com/rate_limit", true)
         );
     }
 }