From dca22c5046aa16899042592b40a0af7b5c4f1fc7 Mon Sep 17 00:00:00 2001
From: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date: Fri, 10 Aug 2012 16:04:54 +0200
Subject: [PATCH] [security] properly escape name of newly created table, see
 PMASA-2012-4

---
 tbl_create.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tbl_create.php b/tbl_create.php
index 63cd26a1da..7caade9ea7 100644
--- a/tbl_create.php
+++ b/tbl_create.php
@@ -272,7 +272,9 @@ if (isset($_REQUEST['do_save_data'])) {
             $new_table_string .= '<td align="center"> <input type="checkbox" id="checkbox_tbl_" name="selected_tbl[]" value="'.htmlspecialchars($table).'" /> </td>' . "\n";
 
             $new_table_string .= '<th>';
-            $new_table_string .= '<a href="sql.php' . PMA_generate_common_url($tbl_url_params) . '">'. $table . '</a>';
+            $new_table_string .= '<a href="sql.php'
+                . PMA_generate_common_url($tbl_url_params) . '">'
+                . htmlspecialchars($table) . '</a>';
 
             if (PMA_Tracker::isActive()) {
                 $truename = str_replace(' ', '&nbsp;', htmlspecialchars($table));