diff --git a/ChangeLog b/ChangeLog
index 270b5145ca..29e256c6e5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -72,6 +72,7 @@ phpMyAdmin - ChangeLog
 - patch #3314626 [display] CharTextareaRows is not respected
 - bug #3417089 [synchronize] Extraneous db choices
 - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15
+- [security] Fixed XSS in setup (verbose parameter)
 
 3.4.5.0 (2011-09-14)
 - bug #3375325 [interface] Page list in navigation frame looks odd
diff --git a/Documentation.html b/Documentation.html
index af27b89d50..1c47508839 100644
--- a/Documentation.html
+++ b/Documentation.html
@@ -4341,8 +4341,8 @@ INSERT INTO REL_towns VALUES ('M', 'Montréal');
         <dd>Currently opened database</dd>
     <dt><code>@TABLE@</code></dt>
         <dd>Currently opened table</dd>
-    <dt><code>@FIELDS@</code></dt>
-        <dd>Fields of currently opened table</dd>
+    <dt><code>@COLUMNS@</code></dt>
+        <dd>Columns of the currently opened table</dd>
     <dt><code>@PHPMYADMIN@</code></dt>
         <dd>phpMyAdmin with version</dd>
 </dl>
diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index 2cc2278d42..5dcf21ed22 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -3097,7 +3097,7 @@ function PMA_getTitleForTarget($target)
 }
 
 /**
- * Formats user string, expading @VARIABLES@, accepting strftime format string.
+ * Formats user string, expanding @VARIABLES@, accepting strftime format string.
  *
  * @param string   $string  Text where to do expansion.
  * @param function $escape  Function to call for escaping variable values.
@@ -3149,20 +3149,25 @@ function PMA_expandUserString($string, $escape = null, $updates = array())
         }
     }
 
-    /* Fetch fields list if required */
+    /* Backward compatibility in 3.5.x */
     if (strpos($string, '@FIELDS@') !== false) {
-        $fields_list = PMA_DBI_get_columns($GLOBALS['db'], $GLOBALS['table']);
+        $string = strtr($string, array('@FIELDS@' => '@COLUMNS@')); 
+    }
 
-        $field_names = array();
-        foreach ($fields_list as $field) {
-            if (!is_null($escape)) {
-                $field_names[] = $escape($field['Field']);
+    /* Fetch columns list if required */
+    if (strpos($string, '@COLUMNS@') !== false) {
+        $columns_list = PMA_DBI_get_columns($GLOBALS['db'], $GLOBALS['table']);
+
+        $column_names = array();
+        foreach ($columns_list as $column) {
+            if (! is_null($escape)) {
+                $column_names[] = $escape($column['Field']);
             } else {
-                $field_names[] = $field['Field'];
+                $column_names[] = $field['Field'];
             }
         }
 
-        $replace['@FIELDS@'] = implode(',', $field_names);
+        $replace['@COLUMNS@'] = implode(',', $column_names);
     }
 
     /* Do the replacement */
diff --git a/libraries/config/ConfigFile.class.php b/libraries/config/ConfigFile.class.php
index 87c10b39d1..c1b01ec3de 100644
--- a/libraries/config/ConfigFile.class.php
+++ b/libraries/config/ConfigFile.class.php
@@ -414,7 +414,7 @@ class ConfigFile
         }
         $verbose = $this->get("Servers/$id/verbose");
         if (!empty($verbose)) {
-            return $verbose;
+            return htmlspecialchars($verbose);
         }
         $host = $this->get("Servers/$id/host");
         return empty($host) ? 'localhost' : $host;