diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
index f2abaf36cd..7ff1497411 100644
--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@@ -499,14 +499,14 @@ function PMA_getSqlQueryForDisplayPrivTable($db, $table, $username, $hostname)
         return "SELECT * FROM `mysql`.`db`"
             . " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
             . " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
-            . " AND '" . Util::unescapeMysqlWildcards($db) . "'"
+            . " AND '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
             . " LIKE `Db`;";
     }
     return "SELECT `Table_priv`"
         . " FROM `mysql`.`tables_priv`"
         . " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
         . " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
-        . " AND `Db` = '" . Util::unescapeMysqlWildcards($db) . "'"
+        . " AND `Db` = '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
         . " AND `Table_name` = '" . Util::sqlAddSlashes($table) . "';";
 }
 
diff --git a/test/libraries/PMA_server_privileges_test.php b/test/libraries/PMA_server_privileges_test.php
index d07a5cc920..2e6a4d505c 100644
--- a/test/libraries/PMA_server_privileges_test.php
+++ b/test/libraries/PMA_server_privileges_test.php
@@ -539,6 +539,20 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
             $sql,
             $ret
         );
+
+        // SQL escaping
+        $db = "db' AND";
+        $table = "pma_table";
+        $ret = PMA_getSqlQueryForDisplayPrivTable(
+            $db, $table, $username, $hostname
+        );
+        $this->assertEquals(
+            "SELECT `Table_priv` FROM `mysql`.`tables_priv` "
+            . "WHERE `User` = 'pma_username' AND "
+            . "`Host` = 'pma_hostname' AND `Db` = 'db\' AND' AND "
+            . "`Table_name` = 'pma_table';",
+            $ret
+        );
     }
 
     /**