never rush a checkin - its allways trouble

1 files changed, 608 insertions, 688 deletions

diff --git a/server_privileges.php b/server_privileges.php
index 8f014b42a0..4437698603 100644
--- a/server_privileges.php
+++ b/server_privileges.php
@@ -2,107 +2,48 @@
 /* $Id$ */
 // vim: expandtab sw=4 ts=4 sts=4:
 
-if (! defined('PMA_NO_VARIABLES_IMPORT')) {
-    define('PMA_NO_VARIABLES_IMPORT', true);
-}
-require_once './libraries/common.lib.php';
+require_once('./libraries/common.lib.php');
 
 /**
  * Does the common work
  */
 $js_to_run = 'server_privileges.js';
-require './libraries/server_common.inc.php';
-
-
-/**
- * Checks if the user is allowed to do what he tries to...
- */
-if (!$is_superuser) {
-    require './libraries/server_links.inc.php';
-    echo '<h2>' . "\n"
-       . ($GLOBALS['cfg']['MainPageIconic'] ? '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 'b_usrlist.png" alt="" />' : '')
-       . $GLOBALS['strPrivileges'] . "\n"
-       . '</h2>' . "\n"
-       . $GLOBALS['strNoPrivileges'] . "\n";
-    require_once './libraries/footer.inc.php';
-}
+require('./libraries/server_common.inc.php');
 
 
 /**
  * Checks if a dropdown box has been used for selecting a database / table
  */
-if (isset($_REQUEST['pred_dbname']) && strlen($_REQUEST['pred_dbname'])) {
-    $dbname = $_REQUEST['pred_dbname'];
-    unset($_REQUEST['pred_dbname']);
-} elseif (isset($_REQUEST['dbname']) && strlen($_REQUEST['dbname'])) {
-    $dbname = $_REQUEST['dbname'];
-    unset($_REQUEST['dbname']);
-} else {
-    $dbname = '';
+if (isset($pred_dbname) && strlen($pred_dbname)) {
+    $dbname = $pred_dbname;
+    unset($pred_dbname);
 }
-
-if (isset($_REQUEST['pred_tablename']) && strlen($_REQUEST['pred_tablename'])) {
-    $tablename = $_REQUEST['pred_tablename'];
-    unset($_REQUEST['pred_tablename']);
-} else {
-    $tablename = '';
+if (isset($pred_tablename) && strlen($pred_tablename)) {
+    $tablename = $pred_tablename;
+    unset($pred_tablename);
 }
 
-/**
- * check if given $dbname is a wildcard or not
- */
-//if (preg_match('/\\\\(?:_|%)/i', $dbname)) {
-//if (preg_match('/(?<!\\\\)(?:_|%)/i', $dbname)) {
-if (strlen($dbname) && (
-     strpos('\\_', $dbname) !== false
-  || strpos('\\%', $dbname) !== false)) {
-    $dbname_is_wildcard = true;
-} else {
-    $dbname_is_wildcard = false;
-}
-
-/**
- * array PMA_getTableRights()
- *
- * returns array with all table privilegs
- *
- * note: in MySQL 5.0.3 we get "Create View', 'Show view';
- * the View for Create is spelled with uppercase V
- * the view for Show is spelled with lowercase v
- * and there is a space between the words
- *
- * @return array table privilegs
- */
-function PMA_getTablePrivilegs()
-{
-    $av_grants = PMA_DBI_fetch_value(
-        'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
-        0, 'Type');
-    return explode("','", substr($av_grants, 5, -2));
+// check if given $dbanem is a wildcard or not
+if ( isset( $dbname ) ) {
+    //if ( preg_match( '/\\\\(?:_|%)/i', $dbname ) ) {
+    if ( preg_match( '/(?<!\\\\)(?:_|%)/i', $dbname ) ) {
+        $dbname_is_wildcard = true;
+    } else {
+        $dbname_is_wildcard = false;
+    }
 }
 
 /**
- * void PMA_addUSerTablePrivs(&$user_privs)
- *
- * adds user table privs to given user privilegs array $user_privs
- *
- * @param   array &$user_privs user privilegs
+ * Checks if the user is allowed to do what he tries to...
  */
-function PMA_addUSerTablePrivs(&$user_privs)
-{
-    if (empty($user_privs) || ! isset($user_privs['Table_priv'])) {
-        return;
-    }
-
-    $av_grants = PMA_getTablePrivilegs();
-    $users_grants = explode(',', $user_privs['Table_priv']);
-
-    foreach ($av_grants as $current_grant) {
-        $user_privs[$current_grant . '_priv'] =
-            in_array($current_grant, $users_grants) ? 'Y' : 'N';
-    }
-
-    unset($user_privs['Table_priv']);
+if (!$is_superuser) {
+    require('./libraries/server_links.inc.php');
+    echo '<h2>' . "\n"
+       . ($GLOBALS['cfg']['MainPageIconic'] ? '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 'b_usrlist.png" alt="" />' : '')
+       . $GLOBALS['strPrivileges'] . "\n"
+       . '</h2>' . "\n"
+       . $GLOBALS['strNoPrivileges'] . "\n";
+    require_once('./libraries/footer.inc.php');
 }
 
 /**
@@ -111,10 +52,9 @@ function PMA_addUSerTablePrivs(&$user_privs)
  * @param   string   the user's initial
  * @return  string   the generated condition
  */
-function PMA_RangeOfUsers($initial = '')
-{
-    // strtolower() is used because the User field
-    // might be BINARY, so LIKE would be case sensitive
+function PMA_RangeOfUsers($initial = '') {
+// strtolower() is used because the User field
+// might be BINARY, so LIKE would be case sensitive
     if (!empty($initial)) {
         $ret = " WHERE " . PMA_convert_using('User')
          . " LIKE " . PMA_convert_using($initial . '%', 'quoted')
@@ -136,7 +76,7 @@ function PMA_RangeOfUsers($initial = '')
  *
  * @return  array
  */
-function PMA_extractPrivInfo($row = '', $enableHTML = false)
+function PMA_extractPrivInfo($row = '', $enableHTML = FALSE)
 {
     $grants = array(
         array('Select_priv', 'SELECT', $GLOBALS['strPrivDescSelect']),
@@ -174,10 +114,24 @@ function PMA_extractPrivInfo($row = '', $enableHTML = false)
         $grants[] = array('Execute_priv', 'EXECUTE', $GLOBALS['strPrivDescExecute5']);
     }
 
-    PMA_addUSerTablePrivs($row);
-
+    if (!empty($row) && isset($row['Table_priv'])) {
+        $res = PMA_DBI_query(
+            'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
+            $GLOBALS['userlink'] );
+        $row1 = PMA_DBI_fetch_assoc($res);
+        PMA_DBI_free_result($res);
+        $av_grants = explode ('\',\'', substr($row1['Type'], 5, strlen($row1['Type']) - 7));
+        unset($row1);
+        $users_grants = explode(',', $row['Table_priv']);
+        foreach ($av_grants as $current_grant) {
+            $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
+        }
+        unset($current_grant);
+        unset($av_grants);
+        unset($users_grants);
+    }
     $privs = array();
-    $allPrivileges = true;
+    $allPrivileges = TRUE;
     foreach ($grants as $current_grant) {
         if ((!empty($row) && isset($row[$current_grant[0]])) || (empty($row) && isset($GLOBALS[$current_grant[0]]))) {
             if ((!empty($row) && $row[$current_grant[0]] == 'Y') || (empty($row) && ($GLOBALS[$current_grant[0]] == 'Y' || (is_array($GLOBALS[$current_grant[0]]) && count($GLOBALS[$current_grant[0]]) == $GLOBALS['column_count'] && empty($GLOBALS[$current_grant[0] . '_none']))))) {
@@ -194,7 +148,7 @@ function PMA_extractPrivInfo($row = '', $enableHTML = false)
                 }
                 $privs[] = $priv_string . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
             } else {
-                $allPrivileges = false;
+                $allPrivileges = FALSE;
             }
         }
     }
@@ -218,36 +172,27 @@ function PMA_extractPrivInfo($row = '', $enableHTML = false)
 /**
  * Displays on which column(s) a table-specific privilege is granted
  */
-function PMA_display_column_privs($spaces, $columns, $row, $name_for_select,
-    $priv_for_header, $name, $name_for_dfn, $name_for_current)
-{
-    $spaces .= '    ';
-    echo $spaces . '<div class="item" id="div_item_' . $name . '">' . "\n"
-       . $spaces . '    <label for="select_' . $name . '_priv">' . "\n"
-       . $spaces . '        <tt><dfn title="' . $name_for_dfn . '">'
-       . $priv_for_header . '</dfn></tt>' . "\n"
-       . $spaces . '    </label>' . "\n"
-       . $spaces . '    <select id="select_' . $name . '_priv" name="'
-       . $name_for_select . '[]" multiple="multiple">' . "\n";
-
-    foreach ($columns as $current_column => $current_column_privileges) {
-        echo $spaces . '        <option value="' . htmlspecialchars($current_column) . '"';
-        if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {
-            echo ' selected="selected"';
+function PMA_display_column_privs($spaces, $columns, $row, $name_for_select, $priv_for_header, $name, $name_for_dfn, $name_for_current) {
+
+        echo $spaces . '    <div class="item" id="div_item_' . $name . '">' . "\n"
+           . $spaces . '        <label for="select_' . $name . '_priv">' . "\n"
+           . $spaces . '            <tt><dfn title="' . $name_for_dfn . '">' . $priv_for_header . '</dfn></tt>' . "\n"
+           . $spaces . '        </label>' . "\n"
+           . $spaces . '        <select id="select_' . $name . '_priv" name="' . $name_for_select . '[]" multiple="multiple">' . "\n";
+
+        foreach ($columns as $current_column => $current_column_privileges) {
+            echo $spaces . '            <option value="' . htmlspecialchars($current_column) . '"';
+            if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {
+                echo ' selected="selected"';
+            }
+            echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";
         }
-        echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";
-    }
 
-    echo $spaces . '    </select>' . "\n"
-       . $spaces . '    <i>' . $GLOBALS['strOr'] . '</i>' . "\n"
-       . $spaces . '    <label for="checkbox_' . $name_for_select . '_none">'
-       . '<input type="checkbox"'
-       . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"')
-       . ' name="' . $name_for_select . '_none"'
-       . ' id="checkbox_' . $name_for_select . '_none"'
-       . ' title="' . $GLOBALS['strNone'] . '" />'
-       . $GLOBALS['strNone'] . '</label>' . "\n"
-       . $spaces . '</div>' . "\n";
+        echo $spaces . '        </select>' . "\n"
+           . $spaces . '        <i>' . $GLOBALS['strOr'] . '</i>' . "\n"
+           . $spaces . '        <label for="checkbox_' . $name_for_select . '_none"><input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $name_for_select . '_none" id="checkbox_' . $name_for_select . '_none" title="' . $GLOBALS['strNone'] . '" />'
+           . $GLOBALS['strNone'] . '</label>' . "\n"
+           . $spaces . '    </div>' . "\n";
 } // end function
 
 /**
@@ -263,50 +208,54 @@ function PMA_display_column_privs($spaces, $columns, $row, $name_for_select,
  *
  * @return  void
  */
-function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent = 0)
+function PMA_displayPrivTable($db = '*', $table = '*', $submit = TRUE, $indent = 0)
 {
     if ($db == '*') {
         $table = '*';
     }
-    $spaces = str_repeat('    ', $indent);
+    $spaces = str_repeat( '    ', $indent );
 
-    if (isset($_REQUEST['username'])) {
+    if (isset($GLOBALS['username'])) {
+        $username = $GLOBALS['username'];
+        $hostname = $GLOBALS['hostname'];
         if ($db == '*') {
             $sql_query =
                  'SELECT * FROM `mysql`.`user`'
                 .' WHERE ' . PMA_convert_using('User')
-                .' = ' . PMA_convert_using(PMA_sqlAddslashes($_REQUEST['username']), 'quoted')
+                .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
                 .' AND ' . PMA_convert_using('Host')
-                .' = ' . PMA_convert_using($_REQUEST['hostname'], 'quoted') . ';';
+                .' = ' . PMA_convert_using($hostname, 'quoted') . ';';
         } elseif ($table == '*') {
             $sql_query =
                 'SELECT * FROM `mysql`.`db`'
                 .' WHERE ' . PMA_convert_using('`User`')
-                .' = ' . PMA_convert_using(PMA_sqlAddslashes($_REQUEST['username']), 'quoted')
+                .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
                 .' AND ' . PMA_convert_using('`Host`')
-                .' = ' . PMA_convert_using($_REQUEST['hostname'], 'quoted')
-                .' AND ' .  PMA_convert_using(PMA_unescape_mysql_wildcards($db), 'quoted')
-                .' LIKE ' . PMA_convert_using('`Db`') . ';';
+                .' = ' . PMA_convert_using($hostname, 'quoted')
+                .' AND ' .  PMA_convert_using( PMA_unescape_mysql_wildcards( $db ), 'quoted' )
+                .' LIKE ' . PMA_convert_using( '`Db`' ) . ';';
         } else {
             $sql_query =
                 'SELECT `Table_priv`'
                 .' FROM `mysql`.`tables_priv`'
                 .' WHERE ' . PMA_convert_using('`User`')
-                .' = ' . PMA_convert_using(PMA_sqlAddslashes($_REQUEST['username']), 'quoted')
+                .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
                 .' AND ' .PMA_convert_using('`Host`')
-                .' = ' . PMA_convert_using($_REQUEST['hostname'], 'quoted')
+                .' = ' . PMA_convert_using( $hostname, 'quoted' )
                 .' AND ' .PMA_convert_using('`Db`')
-                .' = ' . PMA_convert_using(PMA_unescape_mysql_wildcards($db), 'quoted')
+                .' = ' . PMA_convert_using( PMA_unescape_mysql_wildcards( $db ), 'quoted' )
                 .' AND ' . PMA_convert_using('`Table_name`')
                 .' = ' . PMA_convert_using($table, 'quoted') . ';';
         }
-        $row = PMA_DBI_fetch_single_row($sql_query);
+        $res = PMA_DBI_query($sql_query);
+        $row = PMA_DBI_fetch_assoc($res);
+        PMA_DBI_free_result($res);
     }
     if (empty($row)) {
         if ($table == '*') {
             if ($db == '*') {
                 $sql_query = 'SHOW COLUMNS FROM `mysql`.`user`;';
-            } else {
+            } elseif ($table == '*') {
                 $sql_query = 'SHOW COLUMNS FROM `mysql`.`db`;';
             }
             $res = PMA_DBI_query($sql_query);
@@ -323,18 +272,35 @@ function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent =
         }
     }
     if (isset($row['Table_priv'])) {
-        PMA_addUSerTablePrivs($row);
+        $res = PMA_DBI_query(
+            'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
+            $GLOBALS['userlink'] );
+        // note: in MySQL 5.0.3 we get "Create View', 'Show view';
+        // the View for Create is spelled with uppercase V
+        // the view for Show is spelled with lowercase v
+        // and there is a space between the words
+
+        $row1 = PMA_DBI_fetch_assoc($res);
+        PMA_DBI_free_result($res);
+        $av_grants = explode ('\',\'', substr($row1['Type'], strpos($row1['Type'], '(') + 2, strpos($row1['Type'], ')') - strpos($row1['Type'], '(') - 3));
+        unset($res, $row1);
+        $users_grants = explode(',', $row['Table_priv']);
+
+        foreach ($av_grants as $current_grant) {
+            $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
+        }
+        unset($row['Table_priv'], $current_grant, $av_grants, $users_grants);
 
         // get collumns
-        $res = PMA_DBI_try_query('SHOW COLUMNS FROM `' . PMA_unescape_mysql_wildcards($db) . '`.`' . $table . '`;');
+        $res = PMA_DBI_try_query('SHOW COLUMNS FROM `' . PMA_unescape_mysql_wildcards( $db ) . '`.`' . $table . '`;');
         $columns = array();
-        if ($res) {
+        if ( $res ) {
             while ($row1 = PMA_DBI_fetch_row($res)) {
                 $columns[$row1[0]] = array(
-                    'Select' => false,
-                    'Insert' => false,
-                    'Update' => false,
-                    'References' => false
+                    'Select' => FALSE,
+                    'Insert' => FALSE,
+                    'Update' => FALSE,
+                    'References' => FALSE
                 );
             }
             PMA_DBI_free_result($res);
@@ -342,27 +308,27 @@ function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent =
         unset($res, $row1);
     }
     // t a b l e - s p e c i f i c    p r i v i l e g e s
-    if (! empty($columns)) {
+    if ( ! empty( $columns ) ) {
         $res = PMA_DBI_query(
             'SELECT `Column_name`, `Column_priv`'
             .' FROM `mysql`.`columns_priv`'
             .' WHERE ' . PMA_convert_using('`User`')
-            .' = ' . PMA_convert_using(PMA_sqlAddslashes($_REQUEST['username']), 'quoted')
+            .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
             .' AND ' . PMA_convert_using('`Host`')
-            .' = ' . PMA_convert_using($_REQUEST['hostname'], 'quoted')
+            .' = ' . PMA_convert_using($hostname, 'quoted')
             .' AND ' . PMA_convert_using('`Db`')
-            .' = ' . PMA_convert_using(PMA_unescape_mysql_wildcards($db), 'quoted')
+            .' = ' . PMA_convert_using( PMA_unescape_mysql_wildcards( $db ), 'quoted')
             .' AND ' . PMA_convert_using('`Table_name`')
             .' = ' . PMA_convert_using($table, 'quoted') . ';');
 
         while ($row1 = PMA_DBI_fetch_row($res)) {
             $row1[1] = explode(',', $row1[1]);
             foreach ($row1[1] as $current) {
-                $columns[$row1[0]][$current] = true;
+                $columns[$row1[0]][$current] = TRUE;
             }
         }
         PMA_DBI_free_result($res);
-        unset($res, $row1, $current);
+        unset( $res, $row1, $current );
 
         echo $spaces . '<input type="hidden" name="grant_count" value="' . count($row) . '" />' . "\n"
            . $spaces . '<input type="hidden" name="column_count" value="' . count($columns) . '" />' . "\n"
@@ -510,7 +476,7 @@ function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent =
            . $spaces . '    <p><small><i>' . $GLOBALS['strEnglishPrivileges'] . '</i></small></p>' . "\n"
            . $spaces . '    <fieldset>' . "\n"
            . $spaces . '        <legend>' . $GLOBALS['strData'] . '</legend>' . "\n";
-        foreach ($privTable[0] as $priv)
+        foreach ( $privTable[0] as $priv )
         {
             echo $spaces . '        <div class="item">' . "\n"
                . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0] . '_priv" value="Y" ' . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '') . 'title="' . $priv[2] . '"/>' . "\n"
@@ -520,7 +486,7 @@ function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent =
         echo $spaces . '    </fieldset>' . "\n"
            . $spaces . '    <fieldset>' . "\n"
            . $spaces . '        <legend>' . $GLOBALS['strStructure'] . '</legend>' . "\n";
-        foreach ($privTable[1] as $priv)
+        foreach ( $privTable[1] as $priv )
         {
             echo $spaces . '        <div class="item">' . "\n"
                . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0] . '_priv" value="Y" ' . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '') . 'title="' . $priv[2] . '"/>' . "\n"
@@ -530,7 +496,7 @@ function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent =
         echo $spaces . '    </fieldset>' . "\n"
            . $spaces . '    <fieldset>' . "\n"
            . $spaces . '        <legend>' . $GLOBALS['strAdministration'] . '</legend>' . "\n";
-        foreach ($privTable[2] as $priv)
+        foreach ( $privTable[2] as $priv )
         {
             echo $spaces . '        <div class="item">' . "\n"
                . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0] . '_priv" value="Y" ' . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '') . 'title="' . $priv[2] . '"/>' . "\n"
@@ -590,11 +556,10 @@ function PMA_displayPrivTable($db = '*', $table = '*', $submit = true, $indent =
  *
  * @return  void
  */
-function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
-{
-    $spaces = str_repeat('    ', $indent);
+function PMA_displayLoginInformationFields($mode = 'new', $indent = 0 ) {
+    $spaces = str_repeat( '    ', $indent);
 
-    // Get maximum user/host name column lengths from mysql table structure
+    // Get user/host name lengths
     $fields_info = PMA_DBI_get_fields('mysql', 'user');
     $username_length = 16;
     $hostname_length = 41;
@@ -613,10 +578,10 @@ function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
             }
         }
     }
-    unset($fields_info, $v, $key, $val);
+    unset($fields_info);
 
-    if (isset($_REQUEST['username']) && strlen($_REQUEST['username']) === 0) {
-        $_REQUEST['pred_username'] = 'any';
+    if ( isset( $GLOBALS['username'] ) && strlen( $GLOBALS['username'] ) === 0 ) {
+        $GLOBALS['pred_username'] = 'any';
     }
     echo $spaces . '<fieldset id="fieldset_add_user_login">' . "\n"
        . $spaces . '<legend>' . $GLOBALS['strLoginInformation'] . '</legend>' . "\n"
@@ -627,11 +592,11 @@ function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
        . $spaces . '<span class="options">' . "\n"
        . $spaces . '    <select name="pred_username" id="select_pred_username" title="' . $GLOBALS['strUserName'] . '"' . "\n"
        . $spaces . '        onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"
-       . $spaces . '        <option value="any"' . ((isset($_REQUEST['pred_username']) && $_REQUEST['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyUser'] . '</option>' . "\n"
-       . $spaces . '        <option value="userdefined"' . ((!isset($_REQUEST['pred_username']) || $_REQUEST['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
+       . $spaces . '        <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyUser'] . '</option>' . "\n"
+       . $spaces . '        <option value="userdefined"' . ((!isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
        . $spaces . '    </select>' . "\n"
        . $spaces . '</span>' . "\n"
-       . $spaces . '<input type="text" name="username" maxlength="' . $username_length . '" title="' . $GLOBALS['strUserName'] . '"' . (empty($_REQUEST['username']) ? '' : ' value="' . (isset($GLOBALS['new_username']) ? $GLOBALS['new_username'] : $_REQUEST['username']) . '"') . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
+       . $spaces . '<input type="text" name="username" maxlength="' . $username_length . '" title="' . $GLOBALS['strUserName'] . '"' . (empty($GLOBALS['username']) ? '' : ' value="' . (isset($GLOBALS['new_username']) ? $GLOBALS['new_username'] : $GLOBALS['username']) . '"') . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
        . $spaces . '</div>' . "\n"
        . $spaces . '<div class="item">' . "\n"
        . $spaces . '<label for="select_pred_hostname">' . "\n"
@@ -639,10 +604,12 @@ function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
        . $spaces . '</label>' . "\n"
        . $spaces . '<span class="options">' . "\n"
        . $spaces . '    <select name="pred_hostname" id="select_pred_hostname" title="' . $GLOBALS['strHost'] . '"' . "\n";
-
-    $thishost = PMA_DBI_fetch_value('SELECT USER();');
-    if (!empty($thishost)) {
-        $thishost = str_replace("'", '', substr($thishost, (strrpos($thishost, '@') + 1)));
+    $res = PMA_DBI_query('SELECT USER();');
+    $row = PMA_DBI_fetch_row($res);
+    PMA_DBI_free_result($res);
+    unset($res);
+    if (!empty($row[0])) {
+        $thishost = str_replace("'", '', substr($row[0], (strrpos($row[0], '@') + 1)));
         if ($thishost == 'localhost' || $thishost == '127.0.0.1') {
             unset($thishost);
         }
@@ -650,33 +617,34 @@ function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
     echo $spaces . '    onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '
        . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')
        . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";
+    unset($row);
 
-    // when we start editing a user, $_REQUEST['pred_hostname'] is not defined
-    if (!isset($_REQUEST['pred_hostname']) && isset($_REQUEST['hostname'])) {
-        switch (strtolower($_REQUEST['hostname'])) {
+    // when we start editing a user, $GLOBALS['pred_hostname'] is not defined
+    if (!isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {
+        switch (strtolower($GLOBALS['hostname'])) {
             case 'localhost':
             case '127.0.0.1':
-                $_REQUEST['pred_hostname'] = 'localhost';
+                $GLOBALS['pred_hostname'] = 'localhost';
                 break;
             case '%':
-                $_REQUEST['pred_hostname'] = 'any';
+                $GLOBALS['pred_hostname'] = 'any';
                 break;
             default:
-                $_REQUEST['pred_hostname'] = 'userdefined';
+                $GLOBALS['pred_hostname'] = 'userdefined';
                 break;
         }
     }
-    echo $spaces . '        <option value="any"' . ((isset($_REQUEST['pred_hostname']) && $_REQUEST['pred_hostname'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyHost'] . '</option>' . "\n"
-       . $spaces . '        <option value="localhost"' . ((isset($_REQUEST['pred_hostname']) && $_REQUEST['pred_hostname'] == 'localhost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strLocalhost'] . '</option>' . "\n";
+    echo $spaces . '        <option value="any"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyHost'] . '</option>' . "\n"
+       . $spaces . '        <option value="localhost"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strLocalhost'] . '</option>' . "\n";
     if (!empty($thishost)) {
-        echo $spaces . '        <option value="thishost"' . ((isset($_REQUEST['pred_hostname']) && $_REQUEST['pred_hostname'] == 'thishost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strThisHost'] . '</option>' . "\n";
+        echo $spaces . '        <option value="thishost"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strThisHost'] . '</option>' . "\n";
     }
     unset($thishost);
-    echo $spaces . '        <option value="hosttable"' . ((isset($_REQUEST['pred_hostname']) && $_REQUEST['pred_hostname'] == 'hosttable') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseHostTable'] . '</option>' . "\n"
-       . $spaces . '        <option value="userdefined"' . ((isset($_REQUEST['pred_hostname']) && $_REQUEST['pred_hostname'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
+    echo $spaces . '        <option value="hosttable"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseHostTable'] . '</option>' . "\n"
+       . $spaces . '        <option value="userdefined"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
        . $spaces . '    </select>' . "\n"
        . $spaces . '</span>' . "\n"
-       . $spaces . '<input type="text" name="hostname" maxlength="' . $hostname_length . '" value="' . (isset($_REQUEST['hostname']) ? $_REQUEST['hostname'] : '') . '" title="' . $GLOBALS['strHost'] . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
+       . $spaces . '<input type="text" name="hostname" maxlength="' . $hostname_length . '" value="' . ( isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '' ) . '" title="' . $GLOBALS['strHost'] . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
        . $spaces . '</div>' . "\n"
        . $spaces . '<div class="item">' . "\n"
        . $spaces . '<label for="select_pred_password">' . "\n"
@@ -687,11 +655,11 @@ function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
        . $spaces . '            onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"
        . ($mode == 'change' ? $spaces . '            <option value="keep" selected="selected">' . $GLOBALS['strKeepPass'] . '</option>' . "\n" : '')
        . $spaces . '        <option value="none"';
-    if (isset($_REQUEST['username']) && $mode != 'change') {
+    if ( isset( $GLOBALS['username'] ) && $mode != 'change' ) {
         echo '  selected="selected"';
     }
     echo $spaces . '>' . $GLOBALS['strNoPassword'] . '</option>' . "\n"
-       . $spaces . '        <option value="userdefined"' . (isset($_REQUEST['username']) ? '' : ' selected="selected"') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
+       . $spaces . '        <option value="userdefined"' . ( isset( $GLOBALS['username'] ) ? '' : ' selected="selected"') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
        . $spaces . '    </select>' . "\n"
        . $spaces . '</span>' . "\n"
        . $spaces . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . $GLOBALS['strPassword'] . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
@@ -716,144 +684,30 @@ function PMA_displayLoginInformationFields($mode = 'new', $indent = 0)
        . $spaces . '</fieldset>' . "\n";
 } // end of the 'PMA_displayUserAndHostFields()' function
 
-/**
- * string PMA_getPrivCondition(string $username, string $hostname[,
- *            string $db = null[, string $table = null]])
- *
- * returns (simplified):
- * WEHRE `User` = '$username'
- *   AND `Host` = '$hostname'
- * [  AND `Db` = '$db']
- * [  AND `Table_name` = '$table'];
- *
- * @param   string  $username   user name
- * @param   string  $hostname   host name
- * @return  string              user host WHERE condition
- */
-function PMA_getPrivCondition($username, $hostname, $db = null, $table = null)
-{
-    $return =
-        ' WHERE ' . PMA_convert_using('`User`')
-        .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
-        .' AND ' . PMA_convert_using('`Host`')
-        .' = ' . PMA_convert_using($hostname, 'quoted');
-
-    if ( null !== $db ) {
-        $return .=
-            ' AND ' . PMA_convert_using('`Db`')
-            .' = ' . PMA_convert_using($db, 'quoted');
-    }
-    if ( null !== $table ) {
-        $return .=
-            ' AND ' . PMA_convert_using('`Table_name`')
-            .' = ' . PMA_convert_using($table, 'quoted');
-    }
-
-    return $return . ';';
-}
-
-/**
- * string PMA_getDbTable(string $db, string $table)
- *
- * escaping a wildcard character in a GRANT is only accepted at the global
- * or database level, not at table level; this is why I remove
- * the escaping character
- * Note: in the phpMyAdmin list of Database-specific privileges,
- *  we will have for example
- *  test\_db  SELECT (this one is for privileges on a db level)
- *  test_db   USAGE  (this one is for table-specific privileges)
- *
- * It looks curious but reflects the way MySQL works
- *
- * @param   string  $db     database name
- * @param   string  $table  table name
- */
-function PMA_getDbTable($db, $table)
-{
-    if (strlen($db)) {
-        if (strlen($table)) {
-            $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($db));
-            $db_and_table .= '.' . PMA_backquote($table);
-        } else {
-            $db_and_table = PMA_backquote($db) . '.*';
-        }
-    } else {
-        $db_and_table = '*.*';
-    }
-
-    return $db_and_table;
-}
-
-/**
- * returns WITH privileg options
- *
- * @param   array   $privs  privilegs to include
- * @return  string  WITH privilegs
- */
-function PMA_checkWithPrivs(&$privs)
-{
-    $with = '';
-
-    if (isset($privs['Grant_priv']) && $privs['Grant_priv'] == 'Y') {
-        $with .= ' GRANT OPTION';
-    }
-
-    if (PMA_MYSQL_INT_VERSION >= 40002) {
-        if (isset($privs['max_questions'])) {
-            // avoid negative values
-            $privs['max_questions'] =
-                max(0, (int) $privs['max_questions']);
-            $with .= ' MAX_QUERIES_PER_HOUR ' . $privs['max_questions'];
-        }
-        if (isset($privs['max_connections'])) {
-            $privs['max_connections'] =
-                max(0, (int) $privs['max_connections']);
-            $with .= ' MAX_CONNECTIONS_PER_HOUR ' . $privs['max_connections'];
-        }
-        if (isset($privs['max_updates'])) {
-            $privs['max_updates'] =
-                max(0, (int) $privs['max_updates']);
-            $with .= ' MAX_UPDATES_PER_HOUR ' . $privs['max_updates'];
-        }
-    }
-
-    if (PMA_MYSQL_INT_VERSION >= 50003) {
-        if (isset($privs['max_user_connections'])) {
-            $privs['max_user_connections'] =
-                max(0, (int) $privs['max_user_connections']);
-            $with .= ' MAX_USER_CONNECTIONS ' . $privs['max_user_connections'];
-        }
-    }
-
-    if (strlen($with)) {
-        $with = ' WITH' . $with . ' ';
-    }
-
-    return $with;
-}
 
 /**
  * Changes / copies a user, part I
- *
- * chek if given user exists
  */
-$mysql_user = array();
-if (!empty($_REQUEST['change_copy'])) {
-    $user_host_condition = PMA_getPrivCondition($_REQUEST['old_username'],
-        $_REQUEST['old_hostname']);
-    $mysql_user = PMA_DBI_fetch_single_row(
-        'SELECT * FROM `mysql`.`user` ' . $user_host_condition);
-    if (!$mysql_user) {
-        $mysql_user = array();
+if (!empty($change_copy)) {
+    $user_host_condition =
+        ' WHERE ' . PMA_convert_using('User')
+        .' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')
+        .' AND ' . PMA_convert_using('Host')
+        .' = ' . PMA_convert_using($old_hostname, 'quoted') . ';';
+    $res = PMA_DBI_query('SELECT * FROM `mysql`.`user` ' . $user_host_condition);
+    if (!$res) {
         $message = $GLOBALS['strNoUsersFound'];
-        unset($_REQUEST['change_copy']);
+        unset($change_copy);
     } else {
+        $row = PMA_DBI_fetch_assoc($res);
+        extract($row, EXTR_OVERWRITE);
         // Recent MySQL versions have the field "Password" in mysql.user,
         // so the previous extract creates $Password but this script
         // uses $password
-        if (!isset($mysql_user['Password']) && isset($mysql_user['password'])) {
-            $mysql_user['Password'] =& $mysql_user['password'];
+        if (!isset($password) && isset($Password)) {
+            $password=$Password;
         }
+        PMA_DBI_free_result($res);
         $queries = array();
     }
 }
@@ -863,91 +717,124 @@ if (!empty($_REQUEST['change_copy'])) {
  * Adds a user
  *   (Changes / copies a user, part II)
  */
-if (!empty($_REQUEST['adduser_submit']) || !empty($_REQUEST['change_copy'])) {
+if (!empty($adduser_submit) || !empty($change_copy)) {
     unset($sql_query);
-    if ($_REQUEST['pred_username'] == 'any') {
-        $_REQUEST['username'] = '';
+    if ($pred_username == 'any') {
+        $username = '';
     }
-    switch ($_REQUEST['pred_hostname']) {
+    switch ($pred_hostname) {
         case 'any':
-            $_REQUEST['hostname'] = '%';
+            $hostname = '%';
             break;
         case 'localhost':
-            $_REQUEST['hostname'] = 'localhost';
+            $hostname = 'localhost';
             break;
         case 'hosttable':
-            $_REQUEST['hostname'] = '';
+            $hostname = '';
             break;
         case 'thishost':
-            $_REQUEST['hostname'] = PMA_DBI_fetch_value('SELECT USER();');
-            $_REQUEST['hostname'] = substr($_REQUEST['hostname'],
-                (strrpos($_REQUEST['hostname'], '@') + 1));
+            $res = PMA_DBI_query('SELECT USER();');
+            $row = PMA_DBI_fetch_row($res);
+            PMA_DBI_free_result($res);
+            unset($res);
+            $hostname = substr($row[0], (strrpos($row[0], '@') + 1));
+            unset($row);
             break;
     }
-    $user_exists = PMA_DBI_fetch_value(
-        'SELECT COUNT(*) FROM `mysql`.`user`'
-        . PMA_getPrivCondition($_REQUEST['username'], $_REQUEST['hostname']));
-    if ($user_exists) {
-        $message = sprintf($GLOBALS['strUserAlreadyExists'],
-            "[i]'" . $_REQUEST['username'] . "'@'" . $_REQUEST['hostname'] . "'[/i]");
-        // display add user page again
-        $_REQUEST['adduser'] = true;
+    $res = PMA_DBI_query(
+        'SELECT \'foo\' FROM `mysql`.`user`'
+        .' WHERE ' . PMA_convert_using('User')
+        .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
+        .' AND ' . PMA_convert_using('Host')
+        .' = ' . PMA_convert_using($hostname, 'quoted') . ';',
+        null, PMA_DBI_QUERY_STORE);
+    if (PMA_DBI_num_rows($res) == 1) {
+        PMA_DBI_free_result($res);
+        $message = sprintf($GLOBALS['strUserAlreadyExists'], '[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');
+        $adduser = 1;
     } else {
+        PMA_DBI_free_result($res);
+
         if (50002 <= PMA_MYSQL_INT_VERSION) {
             // MySQL 5 requires CREATE USER before any GRANT on this user can done
-            $create_user_real = 'CREATE USER \''
-                . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\''
-                . $_REQUEST['hostname'] . '\'';
+            $create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';
         }
 
         $real_sql_query =
             'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''
-            . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\''
-            . $_REQUEST['hostname'] . '\'';
-        if ($_REQUEST['pred_password'] != 'none'
-          && $_REQUEST['pred_password'] != 'keep') {
-            $sql_query = $real_sql_query . ' IDENTIFIED BY \'*****\'';
-            $real_sql_query .= ' IDENTIFIED BY \'' . $_REQUEST['pma_pw'] . '\'';
-            if (isset($create_user_real)) {
-                $create_user_show = $create_user_real . ' IDENTIFIED BY \'*****\'';
-                $create_user_real .= ' IDENTIFIED BY \'' . $_REQUEST['pma_pw'] . '\'';
+            . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';
+        if ($pred_password != 'none' && $pred_password != 'keep') {
+            $pma_pw_hidden = '';
+            for ($i = 0; $i < strlen($pma_pw); $i++) {
+                $pma_pw_hidden .= '*';
+            }
+            $sql_query = $real_sql_query . ' IDENTIFIED BY \'' . $pma_pw_hidden . '\'';
+            $real_sql_query .= ' IDENTIFIED BY \'' . $pma_pw . '\'';
+            if ( isset( $create_user_real ) ) {
+                $create_user_show = $create_user_real . ' IDENTIFIED BY \'' . $pma_pw_hidden . '\'';
+                $create_user_real .= ' IDENTIFIED BY \'' . $pma_pw . '\'';
             }
         } else {
-            if ($_REQUEST['pred_password'] == 'keep'
-              && !empty($mysql_user['Password'])) {
-                $real_sql_query .= ' IDENTIFIED BY PASSWORD \''
-                    . $mysql_user['Password'] . '\'';
-                if (isset($create_user_real)) {
-                    $create_user_real .= ' IDENTIFIED BY PASSWORD \''
-                        . $mysql_user['Password'] . '\'';
+            if ($pred_password == 'keep' && !empty($password)) {
+                $real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
+                if ( isset( $create_user_real ) ) {
+                    $create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
                 }
             }
             $sql_query = $real_sql_query;
-            if (isset($create_user_real)) {
+            if ( isset( $create_user_real ) ) {
                 $create_user_show = $create_user_real;
             }
         }
-
-        $with = PMA_checkWithPrivs($mysql_user);
-        $real_sql_query .= $with . ';';
-        $sql_query .= $with . ';';
-        if (isset($create_user_real)) {
+        // FIXME: similar code appears twice in this script
+        if ((isset($Grant_priv) && $Grant_priv == 'Y') || (PMA_MYSQL_INT_VERSION >= 40002 && (isset($max_questions) || isset($max_connections) || isset($max_updates) || isset($max_user_connections)))) {
+            $real_sql_query .= 'WITH';
+            $sql_query .= 'WITH';
+            if (isset($Grant_priv) && $Grant_priv == 'Y') {
+                $real_sql_query .= ' GRANT OPTION';
+                $sql_query .= ' GRANT OPTION';
+            }
+            if (PMA_MYSQL_INT_VERSION >= 40002) {
+                if (isset($max_questions)) {
+                    // avoid negative values
+                    $max_questions = max(0, (int)$max_questions);
+                    $real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
+                    $sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
+                }
+                if (isset($max_connections)) {
+                    $max_connections = max(0, (int)$max_connections);
+                    $real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
+                    $sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
+                }
+                if (isset($max_updates)) {
+                    $max_updates = max(0, (int)$max_updates);
+                    $real_sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
+                    $sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
+                }
+            }
+            if (PMA_MYSQL_INT_VERSION >= 50003) {
+                if (isset($max_user_connections)) {
+                    $max_user_connections = max(0, (int)$max_user_connections);
+                    $real_sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
+                    $sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
+                }
+            }
+        }
+        if ( isset( $create_user_real ) ) {
             $create_user_real .= ';';
             $create_user_show .= ';';
         }
-        unset($with);
-
-        if (empty($_REQUEST['change_copy'])) {
-            if (isset($create_user_real)) {
-                PMA_DBI_try_query($create_user_real)
-                    or PMA_mysqlDie(PMA_DBI_getError(), $create_user_show);
+        $real_sql_query .= ';';
+        $sql_query .= ';';
+        if (empty($change_copy)) {
+            if ( isset( $create_user_real ) ) {
+                PMA_DBI_try_query($create_user_real) or PMA_mysqlDie(PMA_DBI_getError(), $create_user_show);
                 $sql_query = $create_user_show . $sql_query;
             }
-            PMA_DBI_try_query($real_sql_query)
-                or PMA_mysqlDie(PMA_DBI_getError(), $sql_query);
+            PMA_DBI_try_query($real_sql_query) or PMA_mysqlDie(PMA_DBI_getError(), $sql_query);
             $message = $GLOBALS['strAddUserMessage'];
         } else {
-            if (isset($create_user_real)) {
+            if ( isset( $create_user_real ) ) {
                 $queries[]             = $create_user_real;
             }
             $queries[]             = $real_sql_query;
@@ -955,15 +842,12 @@ if (!empty($_REQUEST['adduser_submit']) || !empty($_REQUEST['change_copy'])) {
             // $queries_for_display, at the same position occupied
             // by the real query in $queries
             $tmp_count = count($queries);
-            if (isset($create_user_real)) {
+            if ( isset( $create_user_real ) ) {
                 $queries_for_display[$tmp_count - 2] = $create_user_show;
             }
             $queries_for_display[$tmp_count - 1] = $sql_query;
         }
-        unset($real_sql_query);
-        if (isset($create_user_real)) {
-            unset($create_user_show, $create_user_real);
-        }
+        unset($res, $real_sql_query);
     }
 }
 
@@ -971,31 +855,39 @@ if (!empty($_REQUEST['adduser_submit']) || !empty($_REQUEST['change_copy'])) {
 /**
  * Changes / copies a user, part III
  */
-if (!empty($_REQUEST['change_copy'])) {
-    $user_host_condition = PMA_getPrivCondition($_REQUEST['old_username'],
-        $_REQUEST['old_hostname']);
-    $res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition);
+if (!empty($change_copy)) {
+    $user_host_condition =
+        ' WHERE ' . PMA_convert_using('User')
+        .' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')
+        .' AND ' . PMA_convert_using('Host')
+        .' = ' . PMA_convert_using($old_hostname, 'quoted') . ';';
+    $res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition );
     while ($row = PMA_DBI_fetch_assoc($res)) {
         $queries[] =
             'GRANT ' . join(', ', PMA_extractPrivInfo($row))
-            . ' ON `' . $row['Db'] . '`.* TO \''
-            . PMA_sqlAddslashes($_REQUEST['username']) . "'@'"
-            . $_REQUEST['hostname'] . "'"
-            . ($row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';');
+            .' ON `' . $row['Db'] . '`.*'
+            .' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\''
+            . ( $row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';' );
     }
     PMA_DBI_free_result($res);
-
     $res = PMA_DBI_query(
         'SELECT `Db`, `Table_name`, `Table_priv`'
         .' FROM `mysql`.`tables_priv`' . $user_host_condition,
-        $GLOBALS['userlink'], PMA_DBI_QUERY_STORE);
+        $GLOBALS['userlink'], PMA_DBI_QUERY_STORE );
     while ($row = PMA_DBI_fetch_assoc($res)) {
 
         $res2 = PMA_DBI_QUERY(
             'SELECT `Column_name`, `Column_priv`'
-            . ' FROM `mysql`.`columns_priv`'
-            . PMA_getPrivCondition($_REQUEST['old_username'],
-                $_REQUEST['old_hostname'], $row['Db'], $row['Table_name']),
+            .' FROM `mysql`.`columns_priv`'
+            .' WHERE ' . PMA_convert_using('User')
+            .' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')
+            .' AND ' . PMA_convert_using('`Host`')
+            .' = ' . PMA_convert_using($old_hostname, 'quoted')
+            .' AND ' . PMA_convert_using('`Db`')
+            .' = ' . PMA_convert_using($row['Db'], 'quoted')
+            .' AND ' . PMA_convert_using('`Table_name`')
+            .' = ' . PMA_convert_using($row['Table_name'], 'quoted')
+            .';',
             null, PMA_DBI_QUERY_STORE);
 
         $tmp_privs1 = PMA_extractPrivInfo($row);
@@ -1006,7 +898,6 @@ if (!empty($_REQUEST['change_copy'])) {
             'References' => array()
         );
 
-        $tmp_array = array();
         while ($row2 = PMA_DBI_fetch_assoc($res2)) {
             $tmp_array = explode(',', $row2['Column_priv']);
             if (in_array('Select', $tmp_array)) {
@@ -1021,121 +912,173 @@ if (!empty($_REQUEST['change_copy'])) {
             if (in_array('References', $tmp_array)) {
                 $tmp_privs2['References'][] = $row2['Column_name'];
             }
+            unset($tmp_array);
         }
-        PMA_DBI_free_result($res2);
-
-        if (count($tmp_privs2['Select']) && !in_array('SELECT', $tmp_privs1)) {
+        if (count($tmp_privs2['Select']) > 0 && !in_array('SELECT', $tmp_privs1)) {
             $tmp_privs1[] = 'SELECT (`' . join('`, `', $tmp_privs2['Select']) . '`)';
         }
-        if (count($tmp_privs2['Insert']) && !in_array('INSERT', $tmp_privs1)) {
+        if (count($tmp_privs2['Insert']) > 0 && !in_array('INSERT', $tmp_privs1)) {
             $tmp_privs1[] = 'INSERT (`' . join('`, `', $tmp_privs2['Insert']) . '`)';
         }
-        if (count($tmp_privs2['Update']) && !in_array('UPDATE', $tmp_privs1)) {
+        if (count($tmp_privs2['Update']) > 0 && !in_array('UPDATE', $tmp_privs1)) {
             $tmp_privs1[] = 'UPDATE (`' . join('`, `', $tmp_privs2['Update']) . '`)';
         }
-        if (count($tmp_privs2['References']) && !in_array('REFERENCES', $tmp_privs1)) {
+        if (count($tmp_privs2['References']) > 0 && !in_array('REFERENCES', $tmp_privs1)) {
             $tmp_privs1[] = 'REFERENCES (`' . join('`, `', $tmp_privs2['References']) . '`)';
         }
+        unset($tmp_privs2);
         $queries[] =
             'GRANT ' . join(', ', $tmp_privs1)
-            . ' ON `' . $row['Db'] . '`.`' . $row['Table_name'] . '` TO \''
-            . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\''
-            . $_REQUEST['hostname'] . '\''
+            . ' ON `' . $row['Db'] . '`.`' . $row['Table_name']
+            . '` TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\''
             . (in_array('Grant', explode(',', $row['Table_priv'])) ? ' WITH GRANT OPTION;' : ';');
     }
-    PMA_DBI_free_result($res);
-    unset($res, $res2, $row2, $tmp_array, $tmp_privs2, $tmp_privs1, $row,
-        $user_host_condition);
 }
 
 
 /**
  * Updates privileges
  */
-if (!empty($_REQUEST['update_privs'])) {
-    $db_and_table = PMA_getDbTable($dbname, $tablename);
+if (!empty($update_privs)) {
+    // escaping a wildcard character in a GRANT is only accepted at the global
+    // or database level, not at table level; this is why I remove
+    // the escaping character
+    // Note: in the phpMyAdmin list of Database-specific privileges,
+    //  we will have for example
+    //  test\_db  SELECT (this one is for privileges on a db level)
+    //  test_db   USAGE  (this one is for table-specific privileges)
+    //
+    // It looks curious but reflects the way MySQL works
+
+    if (! isset($dbname) || ! strlen($dbname)) {
+        $db_and_table = '*.*';
+    } else {
+        if ( isset( $tablename ) && strlen($tablename) ) {
+            $db_and_table = PMA_backquote( PMA_unescape_mysql_wildcards( $dbname ) ) . '.';
+            $db_and_table .= PMA_backquote( $tablename );
+        } else {
+            $db_and_table = PMA_backquote( $dbname ) . '.';
+            $db_and_table .= '*';
+        }
+    }
 
     $sql_query0 =
         'REVOKE ALL PRIVILEGES ON ' . $db_and_table
-        . ' FROM \'' . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\''
-        . $_REQUEST['hostname'] . '\';';
-    if (!isset($mysql_user['Grant_priv']) || $mysql_user['Grant_priv'] != 'Y') {
+        . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\';';
+    if (!isset($Grant_priv) || $Grant_priv != 'Y') {
         $sql_query1 =
             'REVOKE GRANT OPTION ON ' . $db_and_table
-            . ' FROM \'' . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\''
-            . $_REQUEST['hostname'] . '\';';
+            . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\';';
     }
     $sql_query2 =
         'GRANT ' . join(', ', PMA_extractPrivInfo())
         . ' ON ' . $db_and_table
-        . ' TO \'' . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\''
-        . $_REQUEST['hostname'] . '\'';
-
-    $sql_query2 .= PMA_checkWithPrivs($mysql_user) . ';';
-
-    if (!PMA_DBI_try_query($sql_query0)) {
-        // this query may fail, but this does not matter :o)
+        . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';
+
+        // FIXME: similar code appears twice in this script
+    if ( ( isset($Grant_priv) && $Grant_priv == 'Y')
+      || ( ( ! isset($dbname) || ! strlen($dbname) ) && PMA_MYSQL_INT_VERSION >= 40002
+        && ( isset($max_questions) || isset($max_connections)
+          || isset($max_updates) || isset($max_user_connections))))
+    {
+        $sql_query2 .= 'WITH';
+        if (isset($Grant_priv) && $Grant_priv == 'Y') {
+            $sql_query2 .= ' GRANT OPTION';
+        }
+        if (PMA_MYSQL_INT_VERSION >= 40002) {
+            if (isset($max_questions)) {
+                $max_questions = max(0, (int)$max_questions);
+                $sql_query2 .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
+            }
+            if (isset($max_connections)) {
+                $max_connections = max(0, (int)$max_connections);
+                $sql_query2 .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
+            }
+            if (isset($max_updates)) {
+                $max_updates = max(0, (int)$max_updates);
+                $sql_query2 .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
+            }
+        }
+        if (PMA_MYSQL_INT_VERSION >= 50003) {
+            if (isset($max_user_connections)) {
+                $max_user_connections = max(0, (int)$max_user_connections);
+                $sql_query2 .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
+            }
+        }
+    }
+    $sql_query2 .= ';';
+    if (!PMA_DBI_try_query($sql_query0)) { // this query may fail, but this does not matter :o)
         unset($sql_query0);
     }
-    if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) {
-        // this one may fail, too...
+    if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) { // this one may fail, too...
         unset($sql_query1);
     }
     PMA_DBI_query($sql_query2);
     $sql_query = (isset($sql_query0) ? $sql_query0 . ' ' : '')
                . (isset($sql_query1) ? $sql_query1 . ' ' : '')
                . $sql_query2;
-    $message = sprintf($GLOBALS['strUpdatePrivMessage'], '\'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\'');
-    unset($sql_query2, $db_and_table);
+    $message = sprintf($GLOBALS['strUpdatePrivMessage'], '\'' . $username . '\'@\'' . $hostname . '\'');
 }
 
 
 /**
  * Revokes Privileges
  */
-if (!empty($_REQUEST['revokeall'])) {
+if (!empty($revokeall)) {
 
-    $db_and_table = PMA_getDbTable($dbname, $tablename);
+    if ( ! isset($dbname) || ! strlen($dbname) ) {
+        $db_and_table = '*.*';
+    } else {
+        if ( ! isset( $tablename ) || ! strlen($tablename) ) {
+            $db_and_table = PMA_backquote( $dbname ) . '.';
+            $db_and_table .= '*';
+        } else {
+            $db_and_table = PMA_backquote( PMA_unescape_mysql_wildcards( $dbname ) ) . '.';
+            $db_and_table .= PMA_backquote( $tablename );
+        }
+    }
 
     $sql_query0 =
         'REVOKE ALL PRIVILEGES ON ' . $db_and_table
-        . ' FROM \'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\';';
+        . ' FROM \'' . $username . '\'@\'' . $hostname . '\';';
     $sql_query1 =
         'REVOKE GRANT OPTION ON ' . $db_and_table
-        . ' FROM \'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\';';
+        . ' FROM \'' . $username . '\'@\'' . $hostname . '\';';
     PMA_DBI_query($sql_query0);
     if (!PMA_DBI_try_query($sql_query1)) { // this one may fail, too...
         unset($sql_query1);
     }
     $sql_query = $sql_query0 . (isset($sql_query1) ? ' ' . $sql_query1 : '');
-    $message = sprintf($GLOBALS['strRevokeMessage'], '\'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\'');
-    if (strlen($tablename)) {
-        unset($tablename);
-    } else {
+    $message = sprintf($GLOBALS['strRevokeMessage'], '\'' . $username . '\'@\'' . $hostname . '\'');
+    if ( ! isset($tablename) || ! strlen($tablename) ) {
         unset($dbname);
+    } else {
+        unset($tablename);
     }
-
-    unset($sql_query0, $db_and_table);
 }
 
 
 /**
  * Updates the password
  */
-if (!empty($_REQUEST['change_pw'])) {
-    if ($_REQUEST['$nopass'] == 1) {
-        $sql_query = 'SET PASSWORD FOR \'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\' = \'\';';
+if (!empty($change_pw)) {
+    if ($nopass == 1) {
+        $sql_query = 'SET PASSWORD FOR \'' . $username . '\'@\'' . $hostname . '\' = \'\';';
         PMA_DBI_query($sql_query);
-        $message = sprintf($GLOBALS['strPasswordChanged'], '\'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\'');
-    } elseif (empty($_REQUEST['pma_pw']) || empty($_REQUEST['pma_pw2'])) {
+        $message = sprintf($GLOBALS['strPasswordChanged'], '\'' . $username . '\'@\'' . $hostname . '\'');
+    } elseif (empty($pma_pw) || empty($pma_pw2)) {
         $message = $GLOBALS['strPasswordEmpty'];
-    } elseif ($_REQUEST['pma_pw'] != $_REQUEST['pma_pw2']) {
+    } elseif ($pma_pw != $pma_pw2) {
         $message = $GLOBALS['strPasswordNotSame'];
     } else {
-        $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\'' . $_REQUEST['hostname'] . '\' = PASSWORD(\'' . PMA_sqlAddslashes($_REQUEST['pma_pw']) . '\')';
-        $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($_REQUEST['username']) . '\'@\'' . $_REQUEST['hostname'] . '\' = PASSWORD(\'*****\')';
+        $hidden_pw = '';
+        for ($i = 0; $i < strlen($pma_pw); $i++) {
+            $hidden_pw .= '*';
+        }
+        $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\' = PASSWORD(\'' . PMA_sqlAddslashes($pma_pw) . '\')';
+        $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\' = PASSWORD(\'' . $hidden_pw . '\')';
         PMA_DBI_try_query($local_query) or PMA_mysqlDie(PMA_DBI_getError(), $sql_query);
-        $message = sprintf($GLOBALS['strPasswordChanged'], '\'' . $_REQUEST['username'] . '\'@\'' . $_REQUEST['hostname'] . '\'');
+        $message = sprintf($GLOBALS['strPasswordChanged'], '\'' . $username . '\'@\'' . $hostname . '\'');
     }
 }
 
@@ -1146,36 +1089,31 @@ if (!empty($_REQUEST['change_pw'])) {
  */
 $user_host_separator = chr(27);
 
-if (!empty($_REQUEST['delete']) || (!empty($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)) {
-    if (!empty($_REQUEST['change_copy'])) {
-        $_REQUEST['selected_usr'] =
-            array($_REQUEST['old_username'] . $user_host_separator . $_REQUEST['old_hostname']);
+if (!empty($delete) || (!empty($change_copy) && $mode < 4)) {
+    if (!empty($change_copy)) {
+        $selected_usr = array($old_username . $user_host_separator . $old_hostname);
     } else {
         $queries = array();
     }
-    foreach ($_REQUEST['selected_usr'] as $each_selected_user) {
-        list($this_user, $this_host) = explode($user_host_separator, $each_selected_user);
-        $this_user_host = "'" . PMA_sqlAddslashes($this_user) . "'@'" . $this_host . "'";
-        $queries[] = '# ' . sprintf($GLOBALS['strDeleting'], $this_user_host) . ' ...';
-        if (PMA_MYSQL_INT_VERSION >= 50002) {
-            $queries[] = 'DROP USER ' . $this_user_host . ';';
+    for ($i = 0; isset($selected_usr[$i]); $i++) {
+        list($this_user, $this_host) = explode($user_host_separator, $selected_usr[$i]);
+        $queries[] = '# ' . sprintf($GLOBALS['strDeleting'], '\'' . $this_user . '\'@\'' . $this_host . '\'') . ' ...';
+        if ( PMA_MYSQL_INT_VERSION >= 50002 ) {
+            $queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';
         } else {
-            if ($_REQUEST['mode'] == 2) {
+            if ($mode == 2) {
                 // The SHOW GRANTS query may fail if the user has not been loaded
                 // into memory
-                $res = PMA_DBI_try_query('SHOW GRANTS FOR ' . $this_user_host . ';');
+                $res = PMA_DBI_try_query('SHOW GRANTS FOR \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';');
                 if ($res) {
-                    $queries[] = 'REVOKE ALL PRIVILEGES ON *.* FROM ' . $this_user_host . ';';
+                    $queries[] = 'REVOKE ALL PRIVILEGES ON *.* FROM \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';
                     while ($row = PMA_DBI_fetch_row($res)) {
-                        $this_table = substr($row[0], (strpos($row[0], 'ON') + 3),
-                            (strpos($row[0], ' TO ') - strpos($row[0], 'ON') - 3));
+                        $this_table = substr($row[0], (strpos($row[0], 'ON') + 3), (strpos($row[0], ' TO ') - strpos($row[0], 'ON') - 3));
                         if ($this_table != '*.*') {
-                            $queries[] = 'REVOKE ALL PRIVILEGES ON ' . $this_table
-                                . ' FROM ' . $this_user_host . ';';
+                            $queries[] = 'REVOKE ALL PRIVILEGES ON ' . $this_table . ' FROM \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';
 
                             if (strpos($row[0], 'WITH GRANT OPTION')) {
-                                $queries[] = 'REVOKE GRANT OPTION ON ' . $this_table
-                                    . ' FROM ' . $this_user_host . ';';
+                                $queries[] = 'REVOKE GRANT OPTION ON ' . $this_table . ' FROM \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';
                             }
                         }
                         unset($this_table);
@@ -1184,16 +1122,19 @@ if (!empty($_REQUEST['delete']) || (!empty($_REQUEST['change_copy']) && $_REQUES
                 }
                 unset($res);
             }
-            if (PMA_MYSQL_INT_VERSION >= 40101) {
-                $queries[] = 'DROP USER ' . $this_user_host . ';';
+            if ( PMA_MYSQL_INT_VERSION >= 40101 ) {
+                $queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';
             } else {
-                $queries[] = 'DELETE FROM `mysql`.`user`'
-                    . PMA_getPrivCondition($this_user, $this_host);
+                $queries[] = 'DELETE FROM `mysql`.`user` WHERE ' . PMA_convert_using('User') . ' = ' . PMA_convert_using(PMA_sqlAddslashes($this_user), 'quoted') . ' AND ' . PMA_convert_using('Host') . ' = ' . PMA_convert_using($this_host, 'quoted') . ';';
             }
-            if ($_REQUEST['mode'] != 2) {
+            if ($mode != 2) {
                 // If we REVOKE the table grants, we should not need to modify the
                 // `mysql`.`db`, `mysql`.`tables_priv` and `mysql`.`columns_priv` tables manually...
-                $user_host_condition = PMA_getPrivCondition($this_user, $this_host);
+                $user_host_condition =
+                    ' WHERE ' . PMA_convert_using('User')
+                    . ' = ' . PMA_convert_using(PMA_sqlAddslashes($this_user), 'quoted')
+                    . ' AND ' . PMA_convert_using('Host')
+                    . ' = ' . PMA_convert_using($this_host, 'quoted') . ';';
                 $queries[] = 'DELETE FROM `mysql`.`db`' . $user_host_condition;
                 $queries[] = 'DELETE FROM `mysql`.`tables_priv`' . $user_host_condition;
                 $queries[] = 'DELETE FROM `mysql`.`columns_priv`' . $user_host_condition;
@@ -1201,16 +1142,16 @@ if (!empty($_REQUEST['delete']) || (!empty($_REQUEST['change_copy']) && $_REQUES
         }
         if (!empty($drop_users_db)) {
             $queries[] = 'DROP DATABASE IF EXISTS ' . PMA_backquote($this_user) . ';';
-            $GLOBALS['reload'] = true;
+            $GLOBALS['reload'] = TRUE;
             PMA_reloadNavigation();
         }
     }
-    if (empty($_REQUEST['change_copy'])) {
+    if (empty($change_copy)) {
         if (empty($queries)) {
-            $show_error_header = true;
+            $show_error_header = TRUE;
             $message = $GLOBALS['strDeleteNoUsersSelected'];
         } else {
-            if ($_REQUEST['mode'] == 3) {
+            if ($mode == 3) {
                 $queries[] = '# ' . $GLOBALS['strReloadingThePrivileges'] . ' ...';
                 $queries[] = 'FLUSH PRIVILEGES;';
             }
@@ -1221,8 +1162,8 @@ if (!empty($_REQUEST['delete']) || (!empty($_REQUEST['change_copy']) && $_REQUES
             }
             $sql_query = join("\n", $queries);
             $message = $GLOBALS['strUsersDeleted'];
-            unset($queries);
         }
+        unset($queries);
     }
 }
 
@@ -1230,7 +1171,7 @@ if (!empty($_REQUEST['delete']) || (!empty($_REQUEST['change_copy']) && $_REQUES
 /**
  * Changes / copies a user, part V
  */
-if (!empty($_REQUEST['change_copy'])) {
+if (!empty($change_copy)) {
     $tmp_count = 0;
     foreach ($queries as $sql_query) {
         if ($sql_query{0} != '#') {
@@ -1251,7 +1192,7 @@ if (!empty($_REQUEST['change_copy'])) {
 /**
  * Reloads the privilege tables into memory
  */
-if (!empty($_REQUEST['flush_privileges'])) {
+if (!empty($flush_privileges)) {
     $sql_query = 'FLUSH PRIVILEGES;';
     PMA_DBI_query($sql_query);
     $message = $GLOBALS['strPrivilegesReloaded'];
@@ -1260,20 +1201,17 @@ if (!empty($_REQUEST['flush_privileges'])) {
 
 /**
  * Displays the links
- *
- * $_REQUEST['checkprivs'] come from 'Rights'-tab in database pages
- * $_REQUEST['viewing_mode'] come from 'Rights'-tab in database pages
  */
-if (isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'db') {
-     $db = $_REQUEST['checkprivs'];
+if (isset($viewing_mode) && $viewing_mode == 'db') {
+     $db = $checkprivs;
      $url_query .= '&amp;goto=db_operations.php';
-     $url_params['goto'] = 'db_operations.php';
 
      // Gets the database structure
      $sub_part = '_structure';
-     require './libraries/db_details_db_info.inc.php';
+     require('./libraries/db_details_db_info.inc.php');
+     echo "\n";
 } else {
-    require './libraries/server_links.inc.php';
+    require('./libraries/server_links.inc.php');
 }
 
 
@@ -1285,11 +1223,8 @@ $link_edit = '<a href="server_privileges.php?' . $GLOBALS['url_query']
     .'&amp;hostname=%s'
     .'&amp;dbname=%s'
     .'&amp;tablename=%s">';
-if ($GLOBALS['cfg']['PropertiesIconic']) {
-    $link_edit .= '<img class="icon"'
-        . ' src="' . $GLOBALS['pmaThemeImage'] . 'b_usredit.png" width="16"'
-        . ' height="16" alt="' . $GLOBALS['strEditPrivileges'] . '"'
-        . ' title="' . $GLOBALS['strEditPrivileges'] . '" />';
+if ( $GLOBALS['cfg']['PropertiesIconic'] ) {
+    $link_edit .= '<img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_usredit.png" width="16" height="16" alt="' . $GLOBALS['strEditPrivileges'] . '" title="' . $GLOBALS['strEditPrivileges'] . '" />';
 } else {
     $link_edit .= $GLOBALS['strEditPrivileges'];
 }
@@ -1301,11 +1236,8 @@ $link_revoke = '<a href="server_privileges.php?' . $GLOBALS['url_query']
     .'&amp;dbname=%s'
     .'&amp;tablename=%s'
     .'&amp;revokeall=1">';
-if ($GLOBALS['cfg']['PropertiesIconic']) {
-    $link_revoke .= '<img class="icon"'
-        . ' src="' . $GLOBALS['pmaThemeImage'] . 'b_usrdrop.png" width="16"'
-        . ' height="16" alt="' . $GLOBALS['strRevoke'] . '"'
-        . ' title="' . $GLOBALS['strRevoke'] . '" />';
+if ( $GLOBALS['cfg']['PropertiesIconic'] ) {
+    $link_revoke .= '<img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_usrdrop.png" width="16" height="16" alt="' . $GLOBALS['strRevoke'] . '" title="' . $GLOBALS['strRevoke'] . '" />';
 } else {
     $link_revoke .= $GLOBALS['strRevoke'];
 }
@@ -1314,19 +1246,14 @@ $link_revoke .= '</a>';
 /**
  * Displays the page
  */
-if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen($_REQUEST['checkprivs']))) {
-    if (! isset($_REQUEST['username'])) {
+if ( empty( $adduser ) && ( ! isset( $checkprivs ) || ! strlen($checkprivs) ) ) {
+    if ( ! isset( $username ) ) {
         // No username is given --> display the overview
         echo '<h2>' . "\n"
-           . ($GLOBALS['cfg']['MainPageIconic']
-                ? '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 'b_usrlist.png" alt="" />'
-                : '')
+           . ($GLOBALS['cfg']['MainPageIconic'] ? '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 'b_usrlist.png" alt="" />' : '')
            . $GLOBALS['strUserOverview'] . "\n"
            . '</h2>' . "\n";
 
-        /**
-         * @todo why not SELECT * ???
-         */
         $sql_query =
             'SELECT `User`,' .
             '       `Host`,' .
@@ -1360,7 +1287,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
 
         $sql_query .= '  FROM `mysql`.`user`';
 
-        $sql_query .= (isset($_REQUEST['initial']) ? PMA_RangeOfUsers($_REQUEST['initial']) : '');
+        $sql_query .= (isset($initial) ? PMA_RangeOfUsers($initial) : '');
 
         $sql_query .= ' ORDER BY `User` ASC, `Host` ASC;';
         $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
@@ -1396,11 +1323,9 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
             );
 
             $db_rights_sqls = array();
-            foreach ($tables_to_search_for_users as $table_search_in) {
-                if (in_array($table_search_in, $tables)) {
-                    $db_rights_sqls[] =
-                        'SELECT DISTINCT `User`, `Host`'
-                         . ' FROM `mysql`.`' . $table_search_in . '` ' . (isset($_REQUEST['initial']) ? PMA_RangeOfUsers($_REQUEST['initial']) : '');
+            foreach ( $tables_to_search_for_users as $table_search_in ) {
+                if ( in_array( $table_search_in, $tables ) ) {
+                    $db_rights_sqls[] = 'SELECT DISTINCT `User`, `Host` FROM `mysql`.`' . $table_search_in . '` ' . (isset($initial) ? PMA_RangeOfUsers($initial) : '');
                 }
             }
 
@@ -1409,73 +1334,73 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                 'Host'      => '%',
                 'Password'  => '?',
                 'Grant_priv' => 'N',
-                'privs'     => array('USAGE'),
+                'privs'     => array( 'USAGE' ),
             );
 
+            // for all initials, even non A-Z
+            $array_initials = array();
             // for the rights
             $db_rights = array();
 
-            // do not use UNION DISTINCT, as it's not allowed before
+            // do not use UNION DISTINCT, as it's not allowed before 
             // MySQL 4.0.17, and because "it does nothing" (cf manual)
-            if (PMA_MYSQL_INT_VERSION >= 40000) {
-                $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
+            if ( PMA_MYSQL_INT_VERSION >= 40000 ) {
+                $db_rights_sql = '(' . implode( ') UNION (', $db_rights_sqls ) . ')'
                     .' ORDER BY `User` ASC, `Host` ASC';
 
-                $db_rights_result = PMA_DBI_query($db_rights_sql);
+                $db_rights_result = PMA_DBI_query( $db_rights_sql );
 
-                while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
-                    $db_rights_row = array_merge($user_defaults, $db_rights_row);
+                while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {
+                    $db_rights_row = array_merge( $user_defaults, $db_rights_row );
                     $db_rights[$db_rights_row['User']][$db_rights_row['Host']] =
                         $db_rights_row;
                 }
             } else {
-                foreach ($db_rights_sqls as $db_rights_sql) {
-                    $db_rights_result = PMA_DBI_query($db_rights_sql);
+                foreach ( $db_rights_sqls as $db_rights_sql ) {
+                    $db_rights_result = PMA_DBI_query( $db_rights_sql );
 
-                    while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
-                        $db_rights_row = array_merge($user_defaults, $db_rights_row);
+                    while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {
+                        $db_rights_row = array_merge( $user_defaults, $db_rights_row );
                         $db_rights[$db_rights_row['User']][$db_rights_row['Host']] =
                             $db_rights_row;
                     }
                 }
             }
-            PMA_DBI_free_result($db_rights_result);
-            unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
-            ksort($db_rights);
+            PMA_DBI_free_result( $db_rights_result );
+            unset( $db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row );
+            ksort( $db_rights );
 
             /**
              * Displays the initials
              */
-            // for all initials, even non A-Z
-            $array_initials = PMA_DBI_fetch_result(
-                'SELECT DISTINCT UPPER(LEFT(' . PMA_convert_using('User') . ',1))'
-                    . ' FROM `user` ORDER BY `User` ASC',
-                0, 0);
 
-            // initialize to false the letters A-Z
+            // initialize to FALSE the letters A-Z
             for ($letter_counter = 1; $letter_counter < 27; $letter_counter++) {
-                if (isset($array_initials[chr($letter_counter + 64)])) {
-                    $array_initials[chr($letter_counter + 64)] = true;
-                } else {
-                    $array_initials[chr($letter_counter + 64)] = false;
+                if ( ! isset( $array_initials[chr($letter_counter + 64)] ) ) {
+                    $array_initials[chr($letter_counter + 64)] = FALSE;
                 }
             }
 
+            $initials = PMA_DBI_try_query('SELECT DISTINCT UPPER(LEFT(' . PMA_convert_using('User') . ',1)) FROM `user` ORDER BY `User` ASC', null, PMA_DBI_QUERY_STORE);
+            while (list($tmp_initial) = PMA_DBI_fetch_row($initials)) {
+                $array_initials[$tmp_initial] = TRUE;
+            }
+
             // Display the initials, which can be any characters, not
             // just letters. For letters A-Z, we add the non-used letters
             // as greyed out.
 
-            uksort($array_initials, "strnatcasecmp");
+            uksort( $array_initials, "strnatcasecmp" );
 
             echo '<table cellspacing="5"><tr>';
             foreach ($array_initials as $tmp_initial => $initial_was_found) {
                 if ($initial_was_found) {
-                    echo '<td><a href="server_privilegs.php?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";
+                    echo '<td><a href="' . $PHP_SELF . '?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";
                 } else {
                     echo '<td>' . $tmp_initial . '</td>';
                 }
             }
-            echo '<td><a href="server_privilegs.php?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . $GLOBALS['strShowAll'] . ']</a></td>' . "\n";
+            echo '<td><a href="' . $PHP_SELF . '?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . $GLOBALS['strShowAll'] . ']</a></td>' . "\n";
             echo '</tr></table>';
 
             /**
@@ -1483,18 +1408,17 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
             * (if less than 50 users, display them immediately)
             */
 
-            if (isset($_REQUEST['initial']) || isset($_REQUEST['showall'])
-              || PMA_DBI_num_rows($res) < 50) {
+            if (isset($initial) || isset($showall) || PMA_DBI_num_rows($res) < 50) {
 
-                while ($row = PMA_DBI_fetch_assoc($res)) {
-                    $row['privs'] = PMA_extractPrivInfo($row, true);
+                while ( $row = PMA_DBI_fetch_assoc( $res ) ) {
+                    $row['privs'] = PMA_extractPrivInfo( $row, true );
                     $db_rights[$row['User']][$row['Host']] = $row;
                 }
-                @PMA_DBI_free_result($res);
-                unset($res);
+                @PMA_DBI_free_result( $res );
+                unset( $res );
 
                 echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"
-                   . PMA_generate_common_hidden_inputs()
+                   . PMA_generate_common_hidden_inputs('', '', 1)
                    . '    <table id="tableuserrights" class="data">' . "\n"
                    . '    <thead>' . "\n"
                    . '        <tr><td></td>' . "\n"
@@ -1502,32 +1426,22 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                    . '            <th>' . $GLOBALS['strHost'] . '</th>' . "\n"
                    . '            <th>' . $GLOBALS['strPassword'] . '</th>' . "\n"
                    . '            <th>' . $GLOBALS['strGlobalPrivileges'] . ' '
-                   . PMA_showHint($GLOBALS['strEnglishPrivileges']) . '</th>' . "\n"
+                   . PMA_showHint(  $GLOBALS['strEnglishPrivileges'] ) . '</th>' . "\n"
                    . '            <th>' . $GLOBALS['strGrantOption'] . '</th>' . "\n"
-                   . '            ' . ($GLOBALS['cfg']['PropertiesIconic']
-                        ? '<td></td>'
-                        : '<th>' . $GLOBALS['strAction'] . '</th>')
-                   . "\n";
+                   . '            ' . ($GLOBALS['cfg']['PropertiesIconic'] ? '<td></td>' : '<th>' . $GLOBALS['strAction'] . '</th>') . "\n";
                 echo '        </tr>' . "\n";
                 echo '    </thead>' . "\n";
                 echo '    <tbody>' . "\n";
                 $odd_row = true;
                 $index_checkbox = -1;
-                foreach ($db_rights as $user) {
+                foreach ( $db_rights as $user ) {
                     $index_checkbox++;
-                    ksort($user);
-                    foreach ($user as $host) {
+                    ksort( $user );
+                    foreach ( $user as $host ) {
                         $index_checkbox++;
-                        echo '        <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
-                           . '            <td><input type="checkbox" name="selected_usr[]"'
-                           . ' id="checkbox_sel_users_' . $index_checkbox . '"'
-                           . ' value="' . str_replace(chr(27), '&#27;',
-                                    htmlentities($host['User'] . $user_host_separator . $host['Host'])) . '"'
-                           . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' /></td>' . "\n"
-                           . '            <td><label for="checkbox_sel_users_' . $index_checkbox . '">'
-                           . (empty($host['User']) ? '<span style="color: #FF0000">'
-                           . $GLOBALS['strAny'] . '</span>' : htmlspecialchars($host['User']))
-                           . '</label></td>' . "\n"
+                        echo '        <tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n"
+                           . '            <td><input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_' . $index_checkbox . '" value="' . str_replace( chr(27), '&#27;', htmlentities($host['User'] . $user_host_separator . $host['Host'] ) ) . '"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' /></td>' . "\n"
+                           . '            <td><label for="checkbox_sel_users_' . $index_checkbox . '">' . (empty($host['User']) ? '<span style="color: #FF0000">' . $GLOBALS['strAny'] . '</span>' : htmlspecialchars($host['User'])) . '</label></td>' . "\n"
                            . '            <td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";
                         echo '            <td>';
                         switch ($host['Password']) {
@@ -1544,46 +1458,46 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                         } // end switch
                         echo '</td>' . "\n"
                            . '            <td><tt>' . "\n"
-                           . '                ' . implode(',' . "\n" . '            ', $host['privs']) . "\n"
+                           . '                ' . implode( ',' . "\n" . '            ', $host['privs'] ) . "\n"
                            . '                </tt></td>' . "\n"
                            . '            <td>' . ($host['Grant_priv'] == 'Y' ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . '</td>' . "\n"
                            . '            <td align="center">';
-                        printf($link_edit, urlencode($host['User']),
-                            urlencode($host['Host']), '', '');
+                        printf( $link_edit, urlencode( $host['User'] ),
+                            urlencode( $host['Host'] ), '', ''  );
                         echo '</td>' . "\n"
                            . '        </tr>' . "\n";
                         $odd_row = ! $odd_row;
                     }
                 }
 
-                unset($user, $host, $odd_row);
+                unset( $user, $host, $odd_row );
                 echo '    </tbody></table>' . "\n"
                    .'<img class="selectallarrow"'
                    .' src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png"'
                    .' width="38" height="22"'
                    .' alt="' . $GLOBALS['strWithChecked'] . '" />' . "\n"
                    .'<a href="./server_privileges.php?' . $GLOBALS['url_query'] .  '&amp;checkall=1"'
-                   .' onclick="if (markAllRows(\'usersForm\')) return false;">'
+                   .' onclick="if ( markAllRows(\'usersForm\') ) return false;">'
                    . $GLOBALS['strCheckAll'] . '</a>' . "\n"
                    .'/' . "\n"
                    .'<a href="server_privileges.php?' . $GLOBALS['url_query'] .  '"'
-                   .' onclick="if (unMarkAllRows(\'usersForm\')) return false;">'
+                   .' onclick="if ( unMarkAllRows(\'usersForm\') ) return false;">'
                    . $GLOBALS['strUncheckAll'] . '</a>' . "\n";
 
                 // add/delete user fieldset
                 echo '    <fieldset id="fieldset_add_user">' . "\n"
                    . '        <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
-                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' . "\n" : '')
+                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' . "\n" : '' )
                    . '            ' . $GLOBALS['strAddUser'] . '</a>' . "\n"
                    . '    </fieldset>' . "\n"
                    . '    <fieldset id="fieldset_delete_user">'
                    . '        <legend>' . "\n"
-                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usrdrop.png" width="16" height="16" alt="" />' . "\n" : '')
+                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usrdrop.png" width="16" height="16" alt="" />' . "\n" : '' )
                    . '            ' . $GLOBALS['strRemoveSelectedUsers'] . '' . "\n"
                    . '        </legend>' . "\n";
-
+                   
                 // before MySQL 4.1.1, we offer some choices for the delete
-                // mode, but for 4.1.1+, it will be done with REVOKEing the
+                // mode, but for 4.1.1+, it will be done with REVOKEing the 
                 // privileges then a DROP USER (even no REVOKE at all
                 // for MySQL 5), so no need to offer so many options
                 if (PMA_MYSQL_INT_VERSION < 40101) {
@@ -1602,7 +1516,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                  } else {
                      echo '        <input type="hidden" name="mode" value="2" />' . "\n"
                      . '( ' . $GLOBALS['strRevokeAndDelete'] . ' )<br />' . "\n";
-                 }
+                 }    
 
                  echo '        <input type="checkbox" title="' . $GLOBALS['strDropUsersDb'] . '" name="drop_users_db" id="checkbox_drop_users_db" />' . "\n"
                    . '        <label for="checkbox_drop_users_db" title="' . $GLOBALS['strDropUsersDb'] . '">' . "\n"
@@ -1617,7 +1531,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                 unset ($row);
                 echo '    <fieldset id="fieldset_add_user">' . "\n"
                    . '        <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
-                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' . "\n" : '')
+                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' . "\n" : '' )
                    . '            ' . $GLOBALS['strAddUser'] . '</a>' . "\n"
                    . '    </fieldset>' . "\n";
             } // end if (display overview)
@@ -1633,62 +1547,62 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
         // A user was selected -> display the user's properties
 
         echo '<h2>' . "\n"
-           . ($GLOBALS['cfg']['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 'b_usredit.png" width="16" height="16" alt="" />' : '')
-           . $GLOBALS['strUser'] . ' <i><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;username=' . urlencode($_REQUEST['username']) . '&amp;hostname=' . urlencode($_REQUEST['hostname']) . '">\'' . htmlspecialchars($_REQUEST['username']) . '\'@\'' . htmlspecialchars($_REQUEST['hostname']) . '\'</a></i>' . "\n";
-        if (strlen($dbname)) {
-            if ($dbname_is_wildcard) {
-                echo '    - ' . $GLOBALS['strDatabases'];
+           . ($GLOBALS['cfg']['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 'b_usredit.png" width="16" height="16" alt="" />' : '' )
+           . $GLOBALS['strUser'] . ' <i><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;username=' . urlencode($username) . '&amp;hostname=' . urlencode($hostname) . '">\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'</a></i>' . "\n";
+        if ( isset( $dbname ) && strlen($dbname) ) {
+            if ( $dbname_is_wildcard ) {
+            echo '    - ' . $GLOBALS['strDatabases'];
             } else {
-                echo '    - ' . $GLOBALS['strDatabase'];
+            echo '    - ' . $GLOBALS['strDatabase'];
             }
             echo ' <i><a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . $GLOBALS['url_query'] . '&amp;db=' . urlencode($dbname) . '&amp;reload=1">' . htmlspecialchars($dbname) . '</a></i>' . "\n";
-            if (strlen($tablename)) {
+            if ( isset( $tablename ) && strlen($tablename) ) {
                 echo '    - ' . $GLOBALS['strTable'] . ' <i><a href="' . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query'] . '&amp;db=' . urlencode($dbname) . '&amp;table=' . urlencode($tablename) . '&amp;reload=1">' . htmlspecialchars($tablename) . '</a></i>' . "\n";
             }
         }
         echo ' : ' . $GLOBALS['strEditPrivileges'] . '</h2>' . "\n";
-        $res = PMA_DBI_query('SELECT \'foo\' FROM `mysql`.`user` WHERE ' . PMA_convert_using('User') . ' = ' . PMA_convert_using(PMA_sqlAddslashes($_REQUEST['username']), 'quoted') . ' AND ' . PMA_convert_using('Host') . ' = ' . PMA_convert_using($_REQUEST['hostname'], 'quoted') . ';', null, PMA_DBI_QUERY_STORE);
-        $user_does_not_exists = (PMA_DBI_num_rows($res) < 1);
+        $res = PMA_DBI_query('SELECT \'foo\' FROM `mysql`.`user` WHERE ' . PMA_convert_using('User') . ' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted') . ' AND ' . PMA_convert_using('Host') . ' = ' . PMA_convert_using($hostname, 'quoted') . ';', null, PMA_DBI_QUERY_STORE);
+        $user_does_not_exists = (PMA_DBI_num_rows( $res ) < 1);
         PMA_DBI_free_result($res);
         unset($res);
-        if ($user_does_not_exists) {
+        if ( $user_does_not_exists ) {
             echo $GLOBALS['strUserNotFound'];
             PMA_displayLoginInformationFields();
             //require_once('./libraries/footer.inc.php');
         }
-        echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n";
-
-        $post_params = array('username' => $_REQUEST['username'],
-            'hostname' => $_REQUEST['hostname']);
-        if (strlen($dbname)) {
-            $post_params['dbname'] = $dbname;
-            if (strlen($tablename)) {
-                $post_params['tablename'] = $tablename;
+        echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"
+           . PMA_generate_common_hidden_inputs('', '', 3)
+           . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
+           . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n";
+        if ( isset( $dbname ) && strlen($dbname) ) {
+            echo '<input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '" />' . "\n";
+            if ( isset( $tablename ) && strlen($tablename) ) {
+                echo ' <input type="hidden" name="tablename" value="' . htmlspecialchars($tablename) . '" />' . "\n";
             }
         }
-        echo PMA_generate_common_hidden_inputs($post_params);
-
-        PMA_displayPrivTable((strlen($dbname) ? $dbname : '*'),
-            ((strlen($dbname) && strlen($tablename)) ? $tablename : '*'),
-            true, 3);
+        PMA_displayPrivTable((( ! isset( $dbname ) || ! strlen($dbname) ) ? '*' : $dbname),
+            ((( ! isset( $dbname ) || ! strlen($dbname) ) || ( ! isset( $tablename ) || ! strlen($tablename) )) ? '*' : $tablename),
+            TRUE, 3);
         echo '</form>' . "\n";
 
-        if ((! strlen($tablename)) && ! $dbname_is_wildcard) {
+        if ( ( ! isset( $tablename ) || ! strlen($tablename) ) && empty( $dbname_is_wildcard ) ) {
 
             // no table name was given, display all table specific rights
             // but only if $dbname contains no wildcards
 
             // table header
             echo '<form action="server_privileges.php" method="post">' . "\n"
-               . PMA_generate_common_hidden_inputs(array('username' => $_REQUEST['username'], 'hostname' => $_REQUEST['hostname']))
+               . PMA_generate_common_hidden_inputs('', '', 6)
+               . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
+               . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
                . '<fieldset>' . "\n"
-               . '<legend>' . (strlen($dbname) ? $GLOBALS['strTblPrivileges'] : $GLOBALS['strDbPrivileges']) . '</legend>' . "\n"
+               . '<legend>' . (( ! isset( $dbname ) || ! strlen($dbname) ) ? $GLOBALS['strDbPrivileges'] : $GLOBALS['strTblPrivileges']) . '</legend>' . "\n"
                . '<table class="data">' . "\n"
                . '<thead>' . "\n"
-               . '<tr><th>' . (strlen($dbname) ? $GLOBALS['strTable'] : $GLOBALS['strDatabase']) . '</th>' . "\n"
+               . '<tr><th>' . (( ! isset( $dbname ) || ! strlen($dbname) ) ? $GLOBALS['strDatabase'] : $GLOBALS['strTable']) . '</th>' . "\n"
                . '    <th>' . $GLOBALS['strPrivileges'] . '</th>' . "\n"
                . '    <th>' . $GLOBALS['strGrantOption'] . '</th>' . "\n"
-               . '    <th>' . (strlen($dbname) ? $GLOBALS['strColumnPrivileges'] : $GLOBALS['strTblPrivileges']) . '</th>' . "\n"
+               . '    <th>' . (( ! isset( $dbname ) || ! strlen($dbname) ) ? $GLOBALS['strTblPrivileges'] : $GLOBALS['strColumnPrivileges']) . '</th>' . "\n"
                . '    <th colspan="2">' . $GLOBALS['strAction'] . '</th>' . "\n"
                . '</tr>' . "\n"
                . '</thead>' . "\n"
@@ -1696,16 +1610,16 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
 
             $user_host_condition =
                 ' WHERE ' . PMA_convert_using('`User`')
-                . ' = ' . PMA_convert_using(PMA_sqlAddslashes($_REQUEST['username']), 'quoted')
+                . ' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
                 . ' AND ' . PMA_convert_using('`Host`')
-                . ' = ' . PMA_convert_using($_REQUEST['hostname'], 'quoted');
+                . ' = ' . PMA_convert_using($hostname, 'quoted');
 
             // table body
             // get data
 
             // we also want privielgs for this user not in table `db` but in other table
             $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
-            if (! strlen($dbname)) {
+            if ( ( ! isset( $dbname ) || ! strlen($dbname) ) ) {
 
                 // no db name given, so we want all privs for the given user
 
@@ -1714,8 +1628,8 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                 );
 
                 $db_rights_sqls = array();
-                foreach ($tables_to_search_for_users as $table_search_in) {
-                    if (in_array($table_search_in, $tables)) {
+                foreach ( $tables_to_search_for_users as $table_search_in ) {
+                    if ( in_array( $table_search_in, $tables ) ) {
                         $db_rights_sqls[] = '
                             SELECT DISTINCT `Db`
                                    FROM `mysql`.`' . $table_search_in . '`
@@ -1726,48 +1640,48 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                 $user_defaults = array(
                     'Db'          => '',
                     'Grant_priv'  => 'N',
-                    'privs'       => array('USAGE'),
+                    'privs'       => array( 'USAGE' ),
                     'Table_privs' => true,
                 );
 
                 // for the rights
                 $db_rights = array();
 
-                if (PMA_MYSQL_INT_VERSION >= 40000) {
-                    $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
+                if ( PMA_MYSQL_INT_VERSION >= 40000 ) {
+                    $db_rights_sql = '(' . implode( ') UNION (', $db_rights_sqls ) . ')'
                         .' ORDER BY `Db` ASC';
 
-                    $db_rights_result = PMA_DBI_query($db_rights_sql);
+                    $db_rights_result = PMA_DBI_query( $db_rights_sql );
 
-                    while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
-                        $db_rights_row = array_merge($user_defaults, $db_rights_row);
+                    while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {
+                        $db_rights_row = array_merge( $user_defaults, $db_rights_row );
                         // only Db names in the table `mysql`.`db` uses wildcards
                         // as we are in the db specific rights display we want
                         // all db names escaped, also from other sources
                         $db_rights_row['Db'] = PMA_escape_mysql_wildcards(
-                            $db_rights_row['Db']);
+                            $db_rights_row['Db'] );
                         $db_rights[$db_rights_row['Db']] = $db_rights_row;
                     }
                 } else {
-                    foreach ($db_rights_sqls as $db_rights_sql) {
-                        $db_rights_result = PMA_DBI_query($db_rights_sql);
+                    foreach ( $db_rights_sqls as $db_rights_sql ) {
+                        $db_rights_result = PMA_DBI_query( $db_rights_sql );
 
-                        while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
-                            $db_rights_row = array_merge($user_defaults, $db_rights_row);
+                        while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {
+                            $db_rights_row = array_merge( $user_defaults, $db_rights_row );
                             $db_rights[$db_rights_row['Db']] = $db_rights_row;
                         }
                     }
                 }
-                PMA_DBI_free_result($db_rights_result);
-                unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
+                PMA_DBI_free_result( $db_rights_result );
+                unset( $db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row );
 
                 $sql_query = 'SELECT * FROM `mysql`.`db`' . $user_host_condition . ' ORDER BY `Db` ASC';
-                $res = PMA_DBI_query($sql_query);
-                unset($sql_query);
+                $res = PMA_DBI_query( $sql_query );
+                unset( $sql_query );
 
-                while ($row = PMA_DBI_fetch_assoc($res)) {
-                    if (isset($db_rights[$row['Db']])) {
-                        $db_rights[$row['Db']] = array_merge($db_rights[$row['Db']], $row);
+                while ( $row = PMA_DBI_fetch_assoc( $res ) ) {
+                    if ( isset( $db_rights[$row['Db']] ) ) {
+                        $db_rights[$row['Db']] = array_merge( $db_rights[$row['Db']], $row );
                     } else {
                         $db_rights[$row['Db']] = $row;
                     }
@@ -1775,8 +1689,8 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                     // so we can drop this db rights
                     $db_rights[$row['Db']]['can_delete'] = true;
                 }
-                PMA_DBI_free_result($res);
-                unset($row, $res);
+                PMA_DBI_free_result( $res );
+                unset( $row, $res );
 
             } else {
 
@@ -1785,15 +1699,15 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
 
                 $user_host_condition .=
                     ' AND ' . PMA_convert_using('`Db`')
-                    .' LIKE ' . PMA_convert_using($dbname, 'quoted');
+                    .' LIKE ' . PMA_convert_using( $dbname, 'quoted' );
 
                 $tables_to_search_for_users = array(
                     'columns_priv',
                 );
 
                 $db_rights_sqls = array();
-                foreach ($tables_to_search_for_users as $table_search_in) {
-                    if (in_array($table_search_in, $tables)) {
+                foreach ( $tables_to_search_for_users as $table_search_in ) {
+                    if ( in_array( $table_search_in, $tables ) ) {
                         $db_rights_sqls[] = '
                             SELECT DISTINCT `Table_name`
                                    FROM `mysql`.`' . $table_search_in . '`
@@ -1804,35 +1718,35 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                 $user_defaults = array(
                     'Table_name'  => '',
                     'Grant_priv'  => 'N',
-                    'privs'       => array('USAGE'),
+                    'privs'       => array( 'USAGE' ),
                     'Column_priv' => true,
                 );
 
                 // for the rights
                 $db_rights = array();
 
-                if (PMA_MYSQL_INT_VERSION >= 40000) {
-                    $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
+                if ( PMA_MYSQL_INT_VERSION >= 40000 ) {
+                    $db_rights_sql = '(' . implode( ') UNION (', $db_rights_sqls ) . ')'
                         .' ORDER BY `Table_name` ASC';
 
-                    $db_rights_result = PMA_DBI_query($db_rights_sql);
+                    $db_rights_result = PMA_DBI_query( $db_rights_sql );
 
-                    while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
-                        $db_rights_row = array_merge($user_defaults, $db_rights_row);
+                    while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {
+                        $db_rights_row = array_merge( $user_defaults, $db_rights_row );
                         $db_rights[$db_rights_row['Table_name']] = $db_rights_row;
                     }
                 } else {
-                    foreach ($db_rights_sqls as $db_rights_sql) {
-                        $db_rights_result = PMA_DBI_query($db_rights_sql);
+                    foreach ( $db_rights_sqls as $db_rights_sql ) {
+                        $db_rights_result = PMA_DBI_query( $db_rights_sql );
 
-                        while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
-                            $db_rights_row = array_merge($user_defaults, $db_rights_row);
+                        while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {
+                            $db_rights_row = array_merge( $user_defaults, $db_rights_row );
                             $db_rights[$db_rights_row['Table_name']] = $db_rights_row;
                         }
                     }
                 }
-                PMA_DBI_free_result($db_rights_result);
-                unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
+                PMA_DBI_free_result( $db_rights_result );
+                unset( $db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row );
 
                 $sql_query =
                     'SELECT `Table_name`,'
@@ -1842,59 +1756,58 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                     .' FROM `mysql`.`tables_priv`'
                     . $user_host_condition
                     .' ORDER BY `Table_name` ASC;';
-                $res = PMA_DBI_query($sql_query);
-                unset($sql_query);
+                $res = PMA_DBI_query( $sql_query );
+                unset( $sql_query );
 
-                while ($row = PMA_DBI_fetch_assoc($res)) {
-                    if (isset($db_rights[$row['Table_name']])) {
-                        $db_rights[$row['Table_name']] = array_merge($db_rights[$row['Table_name']], $row);
+                while ( $row = PMA_DBI_fetch_assoc( $res ) ) {
+                    if ( isset( $db_rights[$row['Table_name']] ) ) {
+                        $db_rights[$row['Table_name']] = array_merge( $db_rights[$row['Table_name']], $row );
                     } else {
                         $db_rights[$row['Table_name']] = $row;
                     }
                 }
-                PMA_DBI_free_result($res);
-                unset($row, $res);
+                PMA_DBI_free_result( $res );
+                unset( $row, $res );
             }
-            ksort($db_rights);
+            ksort( $db_rights );
 
             // display rows
-            if (count($db_rights) < 1) {
+            if ( count( $db_rights ) < 1 ) {
                 echo '<tr class="odd">' . "\n"
                    . '    <td colspan="6"><center><i>' . $GLOBALS['strNone'] . '</i></center></td>' . "\n"
                    . '</tr>' . "\n";
             } else {
                 $odd_row = true;
                 $found_rows = array();
-                //while ($row = PMA_DBI_fetch_assoc($res)) {
-                foreach ($db_rights as $row) {
-                    $found_rows[] = strlen($dbname) ? $row['Table_name'] : $row['Db'];
+                //while ( $row = PMA_DBI_fetch_assoc( $res ) ) {
+                foreach ( $db_rights as $row ) {
+                    $found_rows[] = ( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $row['Table_name'];
 
-                    echo '<tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
-                       . '    <td>' . htmlspecialchars(strlen($dbname) ? $row['Table_name'] : $row['Db']) . '</td>' . "\n"
+                    echo '<tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n"
+                       . '    <td>' . htmlspecialchars(( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $row['Table_name']) . '</td>' . "\n"
                        . '    <td><tt>' . "\n"
-                       . '        ' . join(',' . "\n" . '            ', PMA_extractPrivInfo($row, true)) . "\n"
+                       . '        ' . join(',' . "\n" . '            ', PMA_extractPrivInfo($row, TRUE)) . "\n"
                        . '        </tt></td>' . "\n"
-                       . '    <td>' . (((! strlen($dbname) && $row['Grant_priv'] == 'Y') || (strlen($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . '</td>' . "\n"
+                       . '    <td>' . (((( ! isset( $dbname ) || ! strlen($dbname) ) && $row['Grant_priv'] == 'Y') || (isset($dbname) && strlen($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . '</td>' . "\n"
                        . '    <td>';
-                    if (! empty($row['Table_privs']) || ! empty ($row['Column_priv'])) {
+                    if ( ! empty( $row['Table_privs'] ) || ! empty ( $row['Column_priv'] ) ) {
                         echo $GLOBALS['strYes'];
                     } else {
                         echo $GLOBALS['strNo'];
                     }
                     echo '</td>' . "\n"
                        . '    <td>';
-                    printf($link_edit, urlencode($_REQUEST['username']),
-                        urlencode($_REQUEST['hostname']),
-                        urlencode(strlen($dbname) ? $dbname : $row['Db']),
-                        (strlen($dbname) ? urlencode($row['Table_name']) : ''));
+                    printf( $link_edit, urlencode( $username ),
+                        urlencode( $hostname ),
+                        urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $dbname ),
+                        urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? '' : $row['Table_name'] ) );
                     echo '</td>' . "\n"
                        . '    <td>';
-                    if (! empty($row['can_delete']) || isset($row['Table_name'])
-                      && strlen($row['Table_name'])) {
-                        printf($link_revoke, urlencode($_REQUEST['username']),
-                            urlencode($_REQUEST['hostname']),
-                            urlencode(strlen($dbname) ? $dbname : $row['Db']),
-                            (strlen($dbname) ? urlencode($row['Table_name']) : ''));
+                    if ( ! empty( $row['can_delete'] ) || isset( $row['Table_name'] ) && strlen($row['Table_name']) ) {
+                        printf( $link_revoke, urlencode( $username ),
+                            urlencode( $hostname ),
+                            urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $dbname ),
+                            urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? '' : $row['Table_name'] ) );
                     }
                     echo '</td>' . "\n"
                        . '</tr>' . "\n";
@@ -1905,16 +1818,16 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
             echo '</tbody>' . "\n"
                . '</table>' . "\n";
 
-            if (! strlen($dbname)) {
+            if ( ! isset( $dbname ) || ! strlen($dbname) ) {
 
                 // no database name was give, display select db
 
-                if (! empty($found_rows)) {
+                if ( ! empty( $found_rows ) ) {
                     $pred_db_array = array_diff(
-                        PMA_DBI_fetch_result('SHOW DATABASES;'),
-                        $found_rows);
+                        PMA_DBI_fetch_result( 'SHOW DATABASES;' ),
+                        $found_rows );
                 } else {
-                    $pred_db_array =PMA_DBI_fetch_result('SHOW DATABASES;');
+                    $pred_db_array =PMA_DBI_fetch_result( 'SHOW DATABASES;' );
                 }
 
                 echo '    <label for="text_dbname">' . $GLOBALS['strAddPrivilegesOnDb'] . ':</label>' . "\n";
@@ -1922,14 +1835,14 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                     echo '    <select name="pred_dbname" onchange="this.form.submit();">' . "\n"
                        . '        <option value="" selected="selected">' . $GLOBALS['strUseTextField'] . ':</option>' . "\n";
                     foreach ($pred_db_array as $current_db) {
-                        $current_db = PMA_escape_mysql_wildcards($current_db);
-                        echo '        <option value="' . htmlspecialchars($current_db) . '">'
-                            . htmlspecialchars($current_db) . '</option>' . "\n";
+                        $current_db = PMA_escape_mysql_wildcards( $current_db );
+                        echo '        <option value="' . htmlspecialchars( $current_db ) . '">'
+                            . htmlspecialchars( $current_db ) . '</option>' . "\n";
                     }
                     echo '    </select>' . "\n";
                 }
                 echo '    <input type="text" id="text_dbname" name="dbname" />' . "\n"
-                    .PMA_showHint($GLOBALS['strEscapeWildcards']);
+                    .PMA_showHint( $GLOBALS['strEscapeWildcards'] );
             } else {
                 echo '    <input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '"/>' . "\n"
                    . '    <label for="text_tablename">' . $GLOBALS['strAddPrivilegesOnTbl'] . ':</label>' . "\n";
@@ -1941,7 +1854,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                         }
                     }
                     PMA_DBI_free_result($res);
-                    unset($res, $row);
+                    unset( $res, $row );
                     if (!empty($pred_tbl_array)) {
                         echo '    <select name="pred_tablename" onchange="this.form.submit();">' . "\n"
                            . '        <option value="" selected="selected">' . $GLOBALS['strUseTextField'] . ':</option>' . "\n";
@@ -1962,9 +1875,11 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                . '</form>' . "\n";
         }
 
-        if (! strlen($dbname) && ! $user_does_not_exists) {
+        if ( ( ! isset( $dbname ) || ! strlen($dbname) ) && ! $user_does_not_exists ) {
             echo '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"
-               . PMA_generate_common_hidden_inputs(array('username' => $_REQUEST['username'], 'hostname' => $_REQUEST['hostname']))
+               . PMA_generate_common_hidden_inputs('', '', 3)
+               . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
+               . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
                . '<fieldset id="fieldset_change_password">' . "\n"
                . '    <legend>' . $GLOBALS['strChangePassword'] . '</legend>' . "\n"
                . '    <table class="data">' . "\n"
@@ -1975,12 +1890,12 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                . '    <tr class="even noclick">' . "\n"
                . '        <td><input type="radio" name="nopass" value="0" id="radio_nopass_0" onclick="document.getElementById(\'pw_pma_pw\').focus();" /></td>' . "\n"
                . '        <td><label for="radio_nopass_0">' . $GLOBALS['strPassword'] . ':</label></td>' . "\n"
-               . '        <td><input type="password" name="pma_pw" id="pw_pma_pw" onchange="if (this.value != \'\') radio_nopass_0.checked = true; else radio_nopass_1.checked = true;" /></td>' . "\n"
+               . '        <td><input type="password" name="pma_pw" id="pw_pma_pw" onchange="nopass[1].checked = true;" /></td>' . "\n"
                . '    </tr>' . "\n"
                . '    <tr class="odd noclick">' . "\n"
                . '        <td></td>' . "\n"
                . '        <td><label for="pw_pma_pw2">' . $GLOBALS['strReType'] . ':</label></td>' . "\n"
-               . '        <td><input type="password" name="pma_pw2" id="pw_pma_pw2" onchange="if (this.value != \'\') radio_nopass_0.checked = true; else radio_nopass_1.checked = true;" /></td>' . "\n"
+               . '        <td><input type="password" name="pma_pw2" id="pw_pma_pw2" onchange="nopass[1].checked = true;" /></td>' . "\n"
                . '    </tr>' . "\n"
                . '    </table>' . "\n"
                . '</fieldset>' . "\n"
@@ -1989,10 +1904,12 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                . '</fieldset>' . "\n"
                . '</form>' . "\n"
                . '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"
-               . PMA_generate_common_hidden_inputs(array('old_username' => $_REQUEST['username'], 'old_hostname' => $_REQUEST['hostname']))
+               . PMA_generate_common_hidden_inputs('', '', 3)
+               . '<input type="hidden" name="old_username" value="' . htmlspecialchars($username) . '" />' . "\n"
+               . '<input type="hidden" name="old_hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
                . '<fieldset id="fieldset_change_copy_user">' . "\n"
                . '    <legend>' . $GLOBALS['strChangeCopyUser'] . '</legend>' . "\n";
-            PMA_displayLoginInformationFields('change', 3);
+            PMA_displayLoginInformationFields('change', 3 );
             echo '    <fieldset>' . "\n"
                . '        <legend>' . $GLOBALS['strChangeCopyMode'] . '</legend>' . "\n"
                . '        <input type="radio" name="mode" value="4" id="radio_mode_4" checked="checked" /><label for="radio_mode_4">' . "\n"
@@ -2015,17 +1932,17 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                . '</form>' . "\n";
         }
     }
-} elseif (!empty($_REQUEST['adduser'])) {
+} elseif (!empty($adduser)) {
     // Add a new user
     $GLOBALS['url_query'] .= '&amp;adduser=1';
     echo '<h2>' . "\n"
-       . ($GLOBALS['cfg']['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' : '')
+       . ($GLOBALS['cfg']['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' : '' )
        . '    ' . $GLOBALS['strAddUser'] . "\n"
        . '</h2>' . "\n"
        . '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post" onsubmit="return checkAddUser(this);">' . "\n"
-       . PMA_generate_common_hidden_inputs();
+       . PMA_generate_common_hidden_inputs('', '', 1);
     PMA_displayLoginInformationFields('new', 2);
-    PMA_displayPrivTable('*', '*', false, 1);
+    PMA_displayPrivTable('*', '*', FALSE, 1);
     echo '    <fieldset id="fieldset_add_user_footer" class="tblFooters">' . "\n"
        . '        <input type="submit" name="adduser_submit" value="' . $GLOBALS['strGo'] . '" />' . "\n"
        . '    </fieldset>' . "\n"
@@ -2034,8 +1951,8 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
     // check the privileges for a particular database.
     echo '<table id="tablespecificuserrights" class="data">' . "\n"
        . '<caption class="tblHeaders">' . "\n"
-       . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usrcheck.png" width="16" height="16" alt="" />' . "\n" : '')
-       . '    ' . sprintf($GLOBALS['strUsersHavingAccessToDb'], '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url(array('db' => $_REQUEST['checkprivs'])) . '">' .  htmlspecialchars($_REQUEST['checkprivs']) . '</a>') . "\n"
+       . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usrcheck.png" width="16" height="16" alt="" />' . "\n" : '' )
+       . '    ' . sprintf($GLOBALS['strUsersHavingAccessToDb'], '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url($checkprivs) . '">' .  htmlspecialchars($checkprivs) . '</a>') . "\n"
        . '</caption>' . "\n"
        . '<thead>' . "\n"
        . '    <tr><th>' . $GLOBALS['strUser'] . '</th>' . "\n"
@@ -2047,8 +1964,10 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
        . '    </tr>' . "\n"
        . '</thead>' . "\n"
        . '<tbody>' . "\n";
-    $odd_row = true;
-    unset($row, $row1, $row2);
+    $odd_row = TRUE;
+    unset($row);
+    unset($row1);
+    unset($row2);
     // now, we build the table...
     if (PMA_MYSQL_INT_VERSION >= 40000) {
         // Starting with MySQL 4.0.0, we may use UNION SELECTs and this makes
@@ -2082,7 +2001,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
             .   PMA_convert_using('`Db`') . ' AS `Db`, '
             .   $list_of_privileges
             .' FROM `mysql`.`db`'
-            .' WHERE ' . PMA_convert_using($_REQUEST['checkprivs'], 'quoted')
+            .' WHERE ' . PMA_convert_using( $checkprivs, 'quoted' )
             .' LIKE ' . PMA_convert_using('`Db`')
             .' AND NOT (' . $list_of_compared_privileges. ')) '
             .'UNION '
@@ -2098,7 +2017,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
         $res = PMA_DBI_query($sql_query);
         $row = PMA_DBI_fetch_assoc($res);
         if ($row) {
-            $found = true;
+            $found = TRUE;
         }
     } else {
         // With MySQL 3, we need 2 seperate queries here.
@@ -2107,7 +2026,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
         $row1 = PMA_DBI_fetch_assoc($res1);
         $sql_query =
             'SELECT * FROM `mysql`.`db`'
-            .' WHERE \'' . $_REQUEST['checkprivs'] . '\''
+            .' WHERE \'' . $checkprivs . '\''
             .'   LIKE `Db`'
             .'  AND NOT (`Select_priv` = \'N\''
             .'   AND `Insert_priv` = \'N\''
@@ -2121,11 +2040,11 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
         $res2 = PMA_DBI_query($sql_query);
         $row2 = PMA_DBI_fetch_assoc($res2);
         if ($row1 || $row2) {
-            $found = true;
+            $found = TRUE;
         }
     } // end if (PMA_MYSQL_INT_VERSION >= 40000) ... else ...
     if ($found) {
-        while (true) {
+        while (TRUE) {
             // prepare the current user
             if (PMA_MYSQL_INT_VERSION >= 40000) {
                 $current_privileges = array();
@@ -2152,7 +2071,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                     $row2 = PMA_DBI_fetch_assoc($res2);
                 }
             }
-            echo '    <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
+            echo '    <tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n"
                . '        <td';
             if (count($current_privileges) > 1) {
                 echo ' rowspan="' . count($current_privileges) . '"';
@@ -2169,7 +2088,7 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                    . '            ';
                 if (!isset($current['Db']) || $current['Db'] == '*') {
                     echo $GLOBALS['strGlobal'];
-                } elseif ($current['Db'] == PMA_escape_mysql_wildcards($_REQUEST['checkprivs'])) {
+                } elseif ( $current['Db'] == PMA_escape_mysql_wildcards( $checkprivs ) ) {
                     echo $GLOBALS['strDbSpecific'];
                 } else {
                     echo $GLOBALS['strWildcard'], ': <tt>' . htmlspecialchars($current['Db']) . '</tt>';
@@ -2178,17 +2097,17 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
                    . '        </td>' . "\n"
                    . '        <td>' . "\n"
                    . '            <tt>' . "\n"
-                   . '                ' . join(',' . "\n" . '                ', PMA_extractPrivInfo($current, true)) . "\n"
+                   . '                ' . join(',' . "\n" . '                ', PMA_extractPrivInfo($current, TRUE)) . "\n"
                    . '            </tt>' . "\n"
                    . '        </td>' . "\n"
                    . '        <td>' . "\n"
                    . '            ' . ($current['Grant_priv'] == 'Y' ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . "\n"
                    . '        </td>' . "\n"
                    . '        <td>' . "\n";
-                printf($link_edit, urlencode($current_user),
-                    urlencode($current_host),
-                    urlencode(! isset($current['Db']) || $current['Db'] == '*' ? '' : $current['Db']),
-                    '');
+                printf( $link_edit, urlencode( $current_user ),
+                    urlencode( $current_host ),
+                    urlencode( ! isset( $current['Db'] ) || $current['Db'] == '*' ? '' : $current['Db'] ),
+                    '' );
                 echo '</td>' . "\n"
                    . '    </tr>' . "\n";
             }
@@ -2206,12 +2125,13 @@ if (empty($_REQUEST['adduser']) && (! isset($_REQUEST['checkprivs']) || ! strlen
     }
     echo '</tbody>' . "\n"
        . '</table>' . "\n";
-} // end if (empty($adduser) && empty($_REQUEST['checkprivs'])) ... elseif ... else ...
+} // end if (empty($adduser) && empty($checkprivs)) ... elseif ... else ...
 
 
 /**
  * Displays the footer
  */
-require_once './libraries/footer.inc.php';
+echo "\n\n";
+require_once('./libraries/footer.inc.php');
 
 ?>