[security] XSS: Insufficient output sanitizing in bookmarks

libraries/common.lib.php

@@ -305,7 +305,7 @@ function PMA_formatSql($parsed_sql, $unparsed_sql = '')
     // well, not quite
     // first check for the SQL parser having hit an error
     if (PMA_SQP_isError()) {
-        return $parsed_sql;
+        return htmlspecialchars($parsed_sql['raw']); 
     }
     // then check for an array
     if (!is_array($parsed_sql)) {