diff --git a/js/functions.js b/js/functions.js
index 13b81468d6..b6a46a39c2 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -243,6 +243,24 @@ function escapeHtml(unsafe) {
     }
 }
 
+function escapeJsString(unsafe) {
+    if (typeof(unsafe) != 'undefined') {
+        return unsafe
+            .toString()
+            .replace("\000", '')
+            .replace('\\', '\\\\')
+            .replace('\'', '\\\'')
+            .replace("'", "\\\'")
+            .replace('"', '\"')
+            .replace(""", "\"")
+            .replace("\n", '\n')
+            .replace("\r", '\r')
+            .replace(/<\/script/gi, '</\' + \'script')
+    } else {
+        return false;
+    }
+}
+
 function PMA_sprintf() {
     return sprintf.apply(this, arguments);
 }
diff --git a/js/normalization.js b/js/normalization.js
index 196e83aed9..50ad3ed39f 100644
--- a/js/normalization.js
+++ b/js/normalization.js
@@ -638,7 +638,7 @@ AJAX.registerOnload('normalization.js', function() {
                 '</ol>';
             $("#newCols").html(confirmStr);
             $('.tblFooters').html('<input type="submit" value="' + PMA_messages.strCancel + '" onclick="$(\'#newCols\').html(\'\');$(\'#extra input[type=checkbox]\').removeAttr(\'checked\')"/>' +
-                '<input type="submit" value="' + PMA_messages.strGo + '" onclick="moveRepeatingGroup(\'' + repeatingCols + '\')"/>');
+                '<input type="submit" value="' + PMA_messages.strGo + '" onclick="moveRepeatingGroup(\'' + escapeJsString(escapeHtml(repeatingCols)) + '\')"/>');
         }
     });
     $("#mainContent p").on("click", "#createPrimaryKey", function(event) {