Improvements in URL redirector

- do not concatenate message to allow better translation
- avoid possbile XSS

1 files changed, 2 insertions, 2 deletions

diff --git a/url.php b/url.php
index 764b81cb73..ea61c35dae 100644
--- a/url.php
+++ b/url.php
@@ -25,11 +25,11 @@ if (! PMA_isValid($_GET['url'])
         //  external site.
         echo "<script type='text/javascript'>
                 window.onload=function(){
-                    window.location='" . $_GET['url'] . "';
+                    window.location='" . htmlspecialchars($_GET['url']) . "';
                 }
             </script>";
         // Display redirecting msg on screen.
-        echo __('Taking you to ') . ($_GET['url']);
+        printf(__('Taking you to %s.'), htmlspecialchars($_GET['url']));
     } else {
         header('Location: ' . $cfg['PmaAbsoluteUri']);
     }