diff --git a/ChangeLog b/ChangeLog
index df7d39be2c..aea3acd1bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.0.10.1 (2014-07-17)
 - bug #4488 [security] XSS injection due to unescaped table name (triggers)
+- bug #4492 [security] XSS in AJAX confirmation messages 
 
 4.0.10.0 (2013-12-04)
 - bug #4150 Clicking database name in query window opens a new tab
diff --git a/js/functions.js b/js/functions.js
index 11e6ae6b8e..96171ec3aa 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -3368,7 +3368,7 @@ AJAX.registerOnload('functions.js', function() {
         var question = PMA_messages.strDropTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'DROP TABLE ' + PMA_commonParams.get('table')
+            'DROP TABLE ' + escapeHtml(PMA_commonParams.get('table'))
         );
 
         $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
@@ -3401,7 +3401,7 @@ AJAX.registerOnload('functions.js', function() {
         var question = PMA_messages.strTruncateTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'TRUNCATE ' + PMA_commonParams.get('table')
+            'TRUNCATE ' + escapeHtml(PMA_commonParams.get('table'))
         );
         $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
             PMA_ajaxShowMessage(PMA_messages['strProcessingRequest']);
diff --git a/js/tbl_structure.js b/js/tbl_structure.js
index 7a6620f7fc..69564a1b1e 100644
--- a/js/tbl_structure.js
+++ b/js/tbl_structure.js
@@ -144,6 +144,7 @@ AJAX.registerOnload('tbl_structure.js', function() {
          * @var curr_column_name    String containing name of the field referred to by {@link curr_row}
          */
         var curr_column_name = $curr_row.children('th').children('label').text();
+        curr_column_name = escapeHtml(curr_column_name);
         /**
          * @var $after_field_item    Corresponding entry in the 'After' field.
          */