diff --git a/ChangeLog b/ChangeLog
index 653e6ae3ad..01f681a190 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -132,6 +132,9 @@ phpMyAdmin - ChangeLog
 - bug #3497151 [interface] Duplicate inline query edit box
 - bug #3504567 [mime] Description of the transformation missing in the tooltip
 
+3.4.11.1 (2012-08-12)
+- [security] Fixed XSS vulnerabilities, see PMASA-2012-4
+
 3.4.11.0 (2012-04-14)
 - bug #3486970 [import] Exception on XML import
 - bug #3488777 [navi] $cfg['ShowTooltipAliasTB'] and blank names in navigation
diff --git a/js/db_structure.js b/js/db_structure.js
index b87c42210e..3e1a5b0185 100644
--- a/js/db_structure.js
+++ b/js/db_structure.js
@@ -276,7 +276,7 @@ $(document).ready(function() {
         /**
          * @var question    String containing the question to be asked for confirmation
          */
-        var question = 'TRUNCATE ' + curr_table_name;
+        var question = 'TRUNCATE ' + escapeHtml(curr_table_name);
 
         $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function(url) {
 
diff --git a/tbl_create.php b/tbl_create.php
index 63cd26a1da..7caade9ea7 100644
--- a/tbl_create.php
+++ b/tbl_create.php
@@ -272,7 +272,9 @@ if (isset($_REQUEST['do_save_data'])) {
             $new_table_string .= '<td align="center"> <input type="checkbox" id="checkbox_tbl_" name="selected_tbl[]" value="'.htmlspecialchars($table).'" /> </td>' . "\n";
 
             $new_table_string .= '<th>';
-            $new_table_string .= '<a href="sql.php' . PMA_generate_common_url($tbl_url_params) . '">'. $table . '</a>';
+            $new_table_string .= '<a href="sql.php'
+                . PMA_generate_common_url($tbl_url_params) . '">'
+                . htmlspecialchars($table) . '</a>';
 
             if (PMA_Tracker::isActive()) {
                 $truename = str_replace(' ', '&nbsp;', htmlspecialchars($table));