diff --git a/libraries/rte/rte_events.lib.php b/libraries/rte/rte_events.lib.php
index e9517bef35..11ea27bc32 100644
--- a/libraries/rte/rte_events.lib.php
+++ b/libraries/rte/rte_events.lib.php
@@ -445,14 +445,23 @@ function PMA_EVN_getEditorForm($mode, $operation, $item)
     return $retval;
 }
 
-function PMA_EVN_getQueryFromRequest() // FIXME: need better error checking here
+/**
+ * Composes the query necessary to create an event from an HTTP request.
+ *
+ * @return  string  The CREATE EVENT query.
+ */
+function PMA_EVN_getQueryFromRequest()
 {
-    global $_REQUEST, $cfg, $db, $errors, $event_status;
+    global $_REQUEST, $db, $errors, $event_status, $event_type, $event_interval;
 
     $query = 'CREATE ';
-    if (! empty($_REQUEST['item_definer']) && strpos($_REQUEST['item_definer'], '@') !== false) {
-        $arr = explode('@', $_REQUEST['item_definer']);
-        $query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
+    if (! empty($_REQUEST['item_definer'])) {
+        if (strpos($_REQUEST['item_definer'], '@') !== false) {
+            $arr = explode('@', $_REQUEST['item_definer']);
+            $query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
+        } else {
+            $errors[] = __('The definer must be in the "username@hostname" format');
+        }
     }
     $query .= 'EVENT ';
     if (! empty($_REQUEST['item_name'])) {
@@ -461,17 +470,30 @@ function PMA_EVN_getQueryFromRequest() // FIXME: need better error checking here
         $errors[] = __('You must provide an event name');
     }
     $query .= 'ON SCHEDULE ';
-    if ($_REQUEST['item_type'] == 'RECURRING') {
-        $query .= 'EVERY ' . $_REQUEST['item_interval_value'] . ' ';
-        $query .= $_REQUEST['item_interval_field'] . ' ';
-        if (! empty($_REQUEST['item_starts'])) {
-            $query .= "STARTS '" . $_REQUEST['item_starts'] . "' ";
-        }
-        if (! empty($_REQUEST['item_ends'])) {
-            $query .= "ENDS '" . $_REQUEST['item_ends'] . "' ";
+    if (! empty($_REQUEST['item_type']) && in_array($_REQUEST['item_type'], $event_type)) {
+        if ($_REQUEST['item_type'] == 'RECURRING') {
+            if (! empty($_REQUEST['item_interval_value'])
+            && !empty($_REQUEST['item_interval_field'])
+            && in_array($_REQUEST['item_interval_field'], $event_interval)) {
+                $query .= 'EVERY ' . intval($_REQUEST['item_interval_value']) . ' ' . $_REQUEST['item_interval_field'] . ' ';
+            } else {
+                $errors[] = __('You must provide a valid interval value for the event.');
+            }
+            if (! empty($_REQUEST['item_starts'])) {
+                $query .= "STARTS '" . PMA_sqlAddSlashes($_REQUEST['item_starts']) . "' ";
+            }
+            if (! empty($_REQUEST['item_ends'])) {
+                $query .= "ENDS '" . PMA_sqlAddSlashes($_REQUEST['item_ends']) . "' ";
+            }
+        } else {
+            if (! empty($_REQUEST['item_execute_at'])) {
+                $query .= "AT '" . PMA_sqlAddSlashes($_REQUEST['item_execute_at']) . "' ";
+            } else {
+                $errors[] = __('You must provide a valid execution time for the event.');
+            }
         }
     } else {
-        $query .= "AT '" . $_REQUEST['item_execute_at'] . "' ";
+        $errors[] = __('You must provide a valid type for the event.');
     }
     $query .= 'ON COMPLETION ';
     if (empty($_REQUEST['item_preserve'])) {
@@ -492,7 +514,8 @@ function PMA_EVN_getQueryFromRequest() // FIXME: need better error checking here
     } else {
         $errors[] = __('You must provide an event definition.');
     }
+
     return $query;
-}
+} // end PMA_EVN_getQueryFromRequest()
 
 ?>
diff --git a/libraries/rte/rte_routines.lib.php b/libraries/rte/rte_routines.lib.php
index 8f96d6ad60..481fc9d0f9 100644
--- a/libraries/rte/rte_routines.lib.php
+++ b/libraries/rte/rte_routines.lib.php
@@ -492,7 +492,6 @@ function PMA_RTN_handleEditor()
  * and 'Change routine type' functionalities when JS is disabled.
  *
  * @return  array    Data necessary to create the routine editor.
- *
  */
 function PMA_RTN_getRoutineDataFromRequest()
 {
@@ -649,16 +648,19 @@ function PMA_RTN_getRoutineDataFromRequest()
 /**
  * Composes the query necessary to create a routine from an HTTP request.
  *
- * @return  string    The CREATE [ROUTINE | PROCEDURE] query.
- *
+ * @return  string  The CREATE [ROUTINE | PROCEDURE] query.
  */
 function PMA_RTN_getQueryFromRequest() {
-    global $_REQUEST, $cfg, $errors, $param_sqldataaccess;
+    global $_REQUEST, $cfg, $errors, $param_sqldataaccess, $param_opts_num;
 
     $query = 'CREATE ';
-    if (! empty($_REQUEST['routine_definer']) && strpos($_REQUEST['routine_definer'], '@') !== false) {
-        $arr = explode('@', $_REQUEST['routine_definer']);
-        $query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
+    if (! empty($_REQUEST['routine_definer'])) {
+        if (strpos($_REQUEST['routine_definer'], '@') !== false) {
+            $arr = explode('@', $_REQUEST['routine_definer']);
+            $query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
+        } else {
+            $errors[] = __('The definer must be in the "username@hostname" format');
+        }
     }
     if ($_REQUEST['routine_type'] == 'FUNCTION' || $_REQUEST['routine_type'] == 'PROCEDURE') {
         $query .= $_REQUEST['routine_type'] . ' ';
@@ -713,7 +715,7 @@ function PMA_RTN_getQueryFromRequest() {
                 if (! empty($_REQUEST['routine_param_opts_num'][$i])) {
                     if (isset($cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_param_type'][$i])])) {
                         $group = $cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_param_type'][$i])];
-                        if ($group == 'FUNC_NUMBER') {
+                        if ($group == 'FUNC_NUMBER' && in_array($_REQUEST['routine_param_opts_num'][$i], $param_opts_num)) {
                             $params .= ' ' . strtoupper($_REQUEST['routine_param_opts_num'][$i]);
                         }
                     }
@@ -730,11 +732,15 @@ function PMA_RTN_getQueryFromRequest() {
     }
     $query .= " (" . $params . ") ";
     if ($_REQUEST['routine_type'] == 'FUNCTION') {
-        $query .= "RETURNS {$_REQUEST['routine_returntype']}";
+        if (! empty($_REQUEST['routine_returntype']) && in_array($_REQUEST['routine_returntype'], $cfg['Functions'])) {
+            $query .= "RETURNS {$_REQUEST['routine_returntype']}";
+        } else {
+            $errors[] = __('You must provide a valid return type for the routine.');
+        }
         if (! empty($_REQUEST['routine_returnlength'])
             && !preg_match('@^(DATE|DATETIME|TIME|TINYBLOB|TINYTEXT|BLOB|TEXT|MEDIUMBLOB|MEDIUMTEXT|LONGBLOB|LONGTEXT)$@i',
                             $_REQUEST['routine_returntype'])) {
-            $query .= "(" . $_REQUEST['routine_returnlength'] . ")";
+            $query .= "(" . intval($_REQUEST['routine_returnlength']) . ")";
         } else if (empty($_REQUEST['routine_returnlength'])
             && preg_match('@^(ENUM|SET|VARCHAR|VARBINARY)$@i', $_REQUEST['routine_returntype'])) {
             if (! $warned_about_length) {
@@ -754,7 +760,7 @@ function PMA_RTN_getQueryFromRequest() {
         if (! empty($_REQUEST['routine_returnopts_num'])) {
             if (isset($cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_returntype'])])) {
                 $group = $cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_returntype'])];
-                if ($group == 'FUNC_NUMBER') {
+                if ($group == 'FUNC_NUMBER' && in_array($_REQUEST['routine_returnopts_num'], $param_opts_num)) {
                     $query .= ' ' . strtoupper($_REQUEST['routine_returnopts_num']);
                 }
             }
@@ -762,14 +768,14 @@ function PMA_RTN_getQueryFromRequest() {
         $query .= ' ';
     }
     if (! empty($_REQUEST['routine_comment'])) {
-        $query .= "COMMENT '{$_REQUEST['routine_comment']}' ";
+        $query .= "COMMENT '" . PMA_sqlAddslashes($_REQUEST['routine_comment']) . "' ";
     }
     if (isset($_REQUEST['routine_isdeterministic'])) {
         $query .= 'DETERMINISTIC ';
     } else {
         $query .= 'NOT DETERMINISTIC ';
     }
-    if (! empty($_REQUEST['routine_sqldataaccess']) && in_array($_REQUEST['routine_sqldataaccess'], $param_sqldataaccess, true)) {
+    if (! empty($_REQUEST['routine_sqldataaccess']) && in_array($_REQUEST['routine_sqldataaccess'], $param_sqldataaccess)) {
         $query .= $_REQUEST['routine_sqldataaccess'] . ' ';
     }
     if (! empty($_REQUEST['routine_securitytype'])) {
@@ -782,6 +788,7 @@ function PMA_RTN_getQueryFromRequest() {
     } else {
         $errors[] = __('You must provide a routine definition.');
     }
+
     return $query;
 } // end PMA_RTN_getQueryFromRequest()
 
diff --git a/libraries/rte/rte_triggers.lib.php b/libraries/rte/rte_triggers.lib.php
index cf1509ef02..9259f72485 100644
--- a/libraries/rte/rte_triggers.lib.php
+++ b/libraries/rte/rte_triggers.lib.php
@@ -332,13 +332,23 @@ function PMA_TRI_getEditorForm($mode, $item)
     return $retval;
 }
 
-function PMA_TRI_getQueryFromRequest() {
-    global $_REQUEST, $cfg, $db, $errors, $action_timings, $event_manipulations;
+/**
+ * Composes the query necessary to create a trigger from an HTTP request.
+ *
+ * @return  string  The CREATE TRIGGER query.
+ */
+function PMA_TRI_getQueryFromRequest()
+{
+    global $_REQUEST, $db, $errors, $action_timings, $event_manipulations;
 
     $query = 'CREATE ';
-    if (! empty($_REQUEST['item_definer']) && strpos($_REQUEST['item_definer'], '@') !== false) {
-        $arr = explode('@', $_REQUEST['item_definer']);
-        $query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
+    if (! empty($_REQUEST['item_definer'])) {
+        if (strpos($_REQUEST['item_definer'], '@') !== false) {
+            $arr = explode('@', $_REQUEST['item_definer']);
+            $query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
+        } else {
+            $errors[] = __('The definer must be in the "username@hostname" format');
+        }
     }
     $query .= 'TRIGGER ';
     if (! empty($_REQUEST['item_name'])) {
@@ -349,12 +359,12 @@ function PMA_TRI_getQueryFromRequest() {
     if (! empty($_REQUEST['item_timing']) && in_array($_REQUEST['item_timing'], $action_timings)) {
         $query .= $_REQUEST['item_timing'] . ' ';
     } else {
-        $query .= 'BEFORE ';
+        $errors[] = __('You must provide a valid timing for the trigger');
     }
     if (! empty($_REQUEST['item_event']) && in_array($_REQUEST['item_event'], $event_manipulations)) {
         $query .= $_REQUEST['item_event'] . ' ';
     } else {
-        $query .= 'INSERT ';
+        $errors[] = __('You must provide a valid event for the trigger');
     }
     $query .= 'ON ';
     if (! empty($_REQUEST['item_table']) && in_array($_REQUEST['item_table'], PMA_DBI_get_tables($db))) {
@@ -368,7 +378,8 @@ function PMA_TRI_getQueryFromRequest() {
     } else {
         $errors[] = __('You must provide a trigger definition.');
     }
+
     return $query;
-}
+} // end PMA_TRI_getQueryFromRequest()
 
 ?>