Fix escaping of SQL query and errors for debug console

Signed-off-by: William Desportes <williamdes@wdes.fr>

1 files changed, 4 insertions, 3 deletions

diff --git a/libraries/classes/Query/Utilities.php b/libraries/classes/Query/Utilities.php
index 5b9beae877..6766ecebe8 100644
--- a/libraries/classes/Query/Utilities.php
+++ b/libraries/classes/Query/Utilities.php
@@ -13,6 +13,7 @@ use function array_slice;
 use function debug_backtrace;
 use function explode;
 use function htmlspecialchars;
+use function htmlspecialchars_decode;
 use function intval;
 use function md5;
 use function sprintf;
@@ -181,11 +182,11 @@ class Utilities
         $dbgInfo = [];
 
         if ($result === false && $errorMessage !== null) {
-            $dbgInfo['error'] = '<span class="text-danger">'
-                . htmlspecialchars($errorMessage) . '</span>';
+            // because Utilities::formatError is applied in DbiMysqli
+            $dbgInfo['error'] = htmlspecialchars_decode($errorMessage);
         }
 
-        $dbgInfo['query'] = htmlspecialchars($query);
+        $dbgInfo['query'] = $query;
         $dbgInfo['time'] = $time;
         // Get and slightly format backtrace, this is used
         // in the javascript console.