From 0547dafd9b306c6fd42ccc5a5dd6bb2ede2b2a65 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Wed, 6 Dec 2006 17:39:42 +0000
Subject: [PATCH] bug #1603660, incorrect escaping

---
 ChangeLog                | 4 ++++
 libraries/common.lib.php | 2 +-
 libraries/import.lib.php | 3 +++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 6c238df78..781d3058c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@ phpMyAdmin - ChangeLog
 $Id$
 $HeadURL$
 
+2006-12-06 Marc Delisle  <lem9@users.sourceforge.net>
+    * libraries/import.lib.php, /common.lib.php: bug #1603660, 
+      incorrect escaping of ">"
+
 2006-12-05 Marc Delisle  <lem9@users.sourceforge.net>
     * server_privileges.php: Grant all privileges on wildcard name: we should
       really grant on username\_ instead of username_
diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index fc975ee83..009ea6e4b 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -1318,7 +1318,7 @@ window.parent.updateTableTitle('<?php echo $uni_tbl; ?>', '<?php echo PMA_jsForm
                  /* SQL-Parser-Analyzer */
                 $query_base = preg_replace("@((\015\012)|(\015)|(\012))+@", $new_line, $query_base);
             } else {
-                $query_base = htmlspecialchars($local_query);
+                $query_base = $local_query;
             }
 
             // Parse SQL if needed
diff --git a/libraries/import.lib.php b/libraries/import.lib.php
index 32a2056b7..6e5a89ece 100644
--- a/libraries/import.lib.php
+++ b/libraries/import.lib.php
@@ -176,6 +176,9 @@ function PMA_importRunQuery($sql = '', $full = '', $controluser = false)
                         $sql_query_disabled = TRUE;
                     }
                 }
+                if (! empty($sql_query)) {
+                    $sql_query = htmlspecialchars($sql_query);
+                }
             }
         } // end do query (no skip)
     } // end buffer exists