bug #4598 [security] XSS in multi submit

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

ChangeLog

@@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog
 - bug #4578 [security] XSS vulnerability in table print view
 - bug #4579 [security] XSS vulnerability in zoom search page
 - bug #4594 [security] Path traversal in file inclusion of GIS factory
+- bug #4598 [security] XSS in multi submit
 
 4.0.10.5 (2014-10-21)
 - bug #4562 [security] XSS in debug SQL output

libraries/mult_submits.inc.php

@@ -170,12 +170,14 @@ if (!empty($submit_mult) && !empty($what)) {
     foreach ($selected AS $idx => $sval) {
         switch ($what) {
         case 'row_delete':
-            $full_query .= 'DELETE FROM ' . PMA_Util::backquote($db) . '.' . PMA_Util::backquote($table)
+            $full_query .= 'DELETE FROM '
+                . PMA_Util::backquote(htmlspecialchars($db))
+                . '.' . PMA_Util::backquote(htmlspecialchars($table))
                 // Do not append a "LIMIT 1" clause here
                 // (it's not binlog friendly).
                 // We don't need the clause because the calling panel permits
                 // this feature only when there is a unique index.
-                . ' WHERE ' . urldecode($sval)
+                . ' WHERE ' . htmlspecialchars(urldecode($sval))
                 . ';<br />';
             break;
         case 'drop_db':