diff --git a/js/src/console.js b/js/src/console.js
index 4e1c4d725f..1b1acd4e48 100644
--- a/js/src/console.js
+++ b/js/src/console.js
@@ -1364,7 +1364,7 @@ var ConsoleDebug = {
     appendQueryExtraInfo: function (query, $elem) {
         if ('error' in query) {
             $elem.append(
-                $('<div>').html(query.error)
+                $('<div>').append($('<span class="text-danger">').text(query.error))
             );
         }
         $elem.append(this.formatBackTrace(query.trace));
diff --git a/libraries/classes/Query/Utilities.php b/libraries/classes/Query/Utilities.php
index 5b9beae877..6766ecebe8 100644
--- a/libraries/classes/Query/Utilities.php
+++ b/libraries/classes/Query/Utilities.php
@@ -13,6 +13,7 @@ use function array_slice;
 use function debug_backtrace;
 use function explode;
 use function htmlspecialchars;
+use function htmlspecialchars_decode;
 use function intval;
 use function md5;
 use function sprintf;
@@ -181,11 +182,11 @@ class Utilities
         $dbgInfo = [];
 
         if ($result === false && $errorMessage !== null) {
-            $dbgInfo['error'] = '<span class="text-danger">'
-                . htmlspecialchars($errorMessage) . '</span>';
+            // because Utilities::formatError is applied in DbiMysqli
+            $dbgInfo['error'] = htmlspecialchars_decode($errorMessage);
         }
 
-        $dbgInfo['query'] = htmlspecialchars($query);
+        $dbgInfo['query'] = $query;
         $dbgInfo['time'] = $time;
         // Get and slightly format backtrace, this is used
         // in the javascript console.