diff --git a/ChangeLog b/ChangeLog
index 0472c666a6..9f1635c3ac 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -49,6 +49,7 @@ VerboseMultiSubmit, ReplaceHelpImg
 - bug [GUI] Invalid HTML code on transformation_overview.php
 - bug #3522930 [browse] Missing validation in Ajax mode
 - bug Fix popup message on build SQL of import
+- bug #3523499 [core] Make X-WebKit-CSP work better
 
 3.5.1.0 (2012-05-03)
 - bug #3510784 [edit] Limit clause ignored when sort order is remembered
diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php
index 38756be6f7..0f265d43c8 100644
--- a/libraries/header_http.inc.php
+++ b/libraries/header_http.inc.php
@@ -22,8 +22,8 @@ $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
 /* Prevent against ClickJacking by allowing frames only from same origin */
 if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
     header('X-Frame-Options: SAMEORIGIN');
-    header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'; img-src \'self\' data:; script-src \'self\' http://www.phpmyadmin.net');
-    header('X-WebKit-CSP: default-src \'self\' \'unsafe-inline\'; img-src \'self\' data:; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' http://www.phpmyadmin.net');
+    header("X-Content-Security-Policy: allow 'self'; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:; script-src 'self' http://www.phpmyadmin.net");
+    header("X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script");
 }
 PMA_no_cache_header();
 if (!defined('IS_TRANSFORMATION_WRAPPER')) {