diff --git a/ChangeLog b/ChangeLog
index dd68d236da..f59e546950 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,8 @@ phpMyAdmin - ChangeLog
 - bug #3957 Cookies must be enabled past this point
 - bug #3956 "Browse foreign values" search filter / page selector not working
 - bug #3579 NOW() function incorrectly selected (partial regression)
+- [security] Javascript execution vulnerability in Create view,
+  reported by Maxim Rupp (see PMASA-2013-6)
 
 4.0.2.0 (2013-05-24)
 - bug #3902 Cannot browse when table name contains keyword "call"
diff --git a/view_create.php b/view_create.php
index d8781295d8..cd2ec3b616 100644
--- a/view_create.php
+++ b/view_create.php
@@ -114,7 +114,8 @@ if (isset($_REQUEST['createview'])) {
             $response->addJSON(
                 'message',
                 PMA_Message::error(
-                    "<i>$sql_query</i><br /><br />" . PMA_DBI_getError()
+                    "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
+                    . PMA_DBI_getError()
                 )
             );
             $response->isSuccess(false);