diff --git a/lib/db.php b/lib/db.php
index 1f0593b0804..42bd04e9880 100644
--- a/lib/db.php
+++ b/lib/db.php
@@ -299,7 +299,7 @@ class OC_DB {
// Die if we have an error (error means: bad query, not 0 results!)
if( PEAR::isError($result)) {
$entry = 'DB Error: "'.$result->getMessage().'"
';
- $entry .= 'Offending command was: '.$query.'
';
+ $entry .= 'Offending command was: '.htmlentities($query).'
';
OC_Log::write('core', $entry,OC_Log::FATAL);
error_log('DB error: '.$entry);
die( $entry );
@@ -309,7 +309,7 @@ class OC_DB {
$result=self::$connection->prepare($query);
}catch(PDOException $e) {
$entry = 'DB Error: "'.$e->getMessage().'"
';
- $entry .= 'Offending command was: '.$query.'
';
+ $entry .= 'Offending command was: '.htmlentities($query).'
';
OC_Log::write('core', $entry,OC_Log::FATAL);
error_log('DB error: '.$entry);
die( $entry );