diff --git a/ChangeLog b/ChangeLog
index 2c404949e9..370c235f12 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,6 +25,8 @@ phpMyAdmin - ChangeLog
 - bug #3957 Cookies must be enabled past this point
 - bug #3956 "Browse foreign values" search filter / page selector not working
 - bug #3579 NOW() function incorrectly selected (partial regression)
+- [security] Javascript execution vulnerability in Create view,
+  reported by Maxim Rupp (see PMASA-2013-6)
 
 4.0.2.0 (2013-05-24)
 - bug #3902 Cannot browse when table name contains keyword "call"
diff --git a/view_create.php b/view_create.php
index 9c6ccd361d..af53a5550c 100644
--- a/view_create.php
+++ b/view_create.php
@@ -114,7 +114,8 @@ if (isset($_REQUEST['createview'])) {
             $response->addJSON(
                 'message',
                 PMA_Message::error(
-                    "<i>$sql_query</i><br /><br />" . $GLOBALS['dbi']->getError()
+                    "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
+                    . $GLOBALS['dbi']->getError()
                 )
             );
             $response->isSuccess(false);