From 954c57da6971d6d359da2442deb6f6c859cc40e5 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Wed, 6 Dec 2006 17:32:12 +0000
Subject: [PATCH] bug #1603660, incorrect escaping

---
 ChangeLog                | 4 ++++
 libraries/common.lib.php | 2 +-
 libraries/import.lib.php | 3 +++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 2d9caaa88..9ce27c3ed 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@ phpMyAdmin - ChangeLog
 $Id$
 $Source$
 
+2006-12-06 Marc Delisle  <lem9@users.sourceforge.net>
+    * libraries/import.lib.php, /common.lib.php: bug #1603660, 
+      incorrect escaping of ">"
+
 2006-12-05 Marc Delisle  <lem9@users.sourceforge.net>
     * server_privileges.php: Grant all privileges on wildcard name: we should
       really grant on username\_ instead of username_
diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index 77e0741fe..21a42d89c 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -1572,7 +1572,7 @@ window.parent.updateTableTitle('<?php echo $uni_tbl; ?>', '<?php echo PMA_jsForm
                  /* SQL-Parser-Analyzer */
                 $query_base = preg_replace("@((\015\012)|(\015)|(\012))+@", $new_line, $query_base);
             } else {
-                $query_base = htmlspecialchars($local_query);
+                $query_base = $local_query;
             }
 
             // Parse SQL if needed
diff --git a/libraries/import.lib.php b/libraries/import.lib.php
index 778ae5c14..f37f47066 100644
--- a/libraries/import.lib.php
+++ b/libraries/import.lib.php
@@ -171,6 +171,9 @@ function PMA_importRunQuery($sql = '', $full = '')
                         $sql_query_disabled = TRUE;
                     }
                 }
+                if (! empty($sql_query)) {
+                    $sql_query = htmlspecialchars($sql_query);
+                }
             }
         } // end do query (no skip)
     } // end buffer exists