diff --git a/ChangeLog b/ChangeLog
index 61b51eccfa..6e32a2b9f6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,8 @@
 phpMyAdmin - ChangeLog
 ======================
 
-4.8.1 (not yet released)
+4.8.0.1 (not yet released)
+- issue        [security] Multiple CSRF vulnerabilities, See PMASA-2018-02
 
 4.8.0 (2018-04-07)
 - issue #12946 Allow to export JSON with unescaped unicode chars
diff --git a/js/db_operations.js b/js/db_operations.js
index 5a8e95d579..b65733d896 100644
--- a/js/db_operations.js
+++ b/js/db_operations.js
@@ -134,6 +134,7 @@ AJAX.registerOnload('db_operations.js', function () {
      */
     $(document).on('click', '#drop_db_anchor.ajax', function (event) {
         event.preventDefault();
+        var $link = $(this);
         /**
          * @var question    String containing the question to be asked for confirmation
          */
@@ -142,10 +143,8 @@ AJAX.registerOnload('db_operations.js', function () {
             PMA_messages.strDoYouReally,
             'DROP DATABASE `' + escapeHtml(PMA_commonParams.get('db') + '`')
         );
-        var params = {
-            'is_js_confirmed': '1',
-            'ajax_request': true
-        };
+        var params = getJSConfirmCommonParam(this, $link.getPostData());
+
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
             PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
             $.post(url, params, function (data) {
diff --git a/js/tbl_operations.js b/js/tbl_operations.js
index 2763e0263c..59b8c534e7 100644
--- a/js/tbl_operations.js
+++ b/js/tbl_operations.js
@@ -218,6 +218,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
 
     $(document).on('click', '#drop_tbl_anchor.ajax', function (event) {
         event.preventDefault();
+        var $link = $(this);
         /**
          * @var question    String containing the question to be asked for confirmation
          */
@@ -230,7 +231,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
             var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
 
-            var params = getJSConfirmCommonParam(this);
+            var params = getJSConfirmCommonParam(this, $link.getPostData());
 
             $.post(url, params, function (data) {
                 if (typeof data !== 'undefined' && data.success === true) {
@@ -289,6 +290,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
 
     $(document).on('click', '#truncate_tbl_anchor.ajax', function (event) {
         event.preventDefault();
+        var $link = $(this);
         /**
          * @var question    String containing the question to be asked for confirmation
          */
@@ -300,7 +302,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
             PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
 
-            var params = getJSConfirmCommonParam(this);
+            var params = getJSConfirmCommonParam(this, $link.getPostData());
 
             $.post(url, params, function (data) {
                 if ($('.sqlqueryresults').length !== 0) {
diff --git a/libraries/classes/Operations.php b/libraries/classes/Operations.php
index e62038a572..d7277edb8b 100644
--- a/libraries/classes/Operations.php
+++ b/libraries/classes/Operations.php
@@ -1559,10 +1559,11 @@ class Operations
      */
     public function getDeleteDataOrTablelink(array $url_params, $syntax, $link, $htmlId)
     {
-        return  '<li><a '
-            . 'href="sql.php' . Url::getCommon($url_params) . '"'
-            . ' id="' . $htmlId . '" class="ajax">'
-            . $link . '</a>'
+        return '<li>' . Util::linkOrButton(
+                'sql.php' . Url::getCommon($url_params),
+                $link,
+                array('id' => $htmlId, 'class' => 'ajax')
+            )
             . Util::showMySQLDocu($syntax)
             . '</li>';
     }
diff --git a/sql.php b/sql.php
index 13eb168e03..056497fd3b 100644
--- a/sql.php
+++ b/sql.php
@@ -69,8 +69,8 @@ if (! isset($err_url)) {
 // Coming from a bookmark dialog
 if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
     $sql_query = $_POST['bkm_fields']['bkm_sql_query'];
-} elseif (isset($_GET['sql_query'])) {
-    $sql_query = $_GET['sql_query'];
+} elseif (isset($_POST['sql_query'])) {
+    $sql_query = $_POST['sql_query'];
 }
 
 // This one is just to fill $db