diff --git a/libraries/core.lib.php b/libraries/core.lib.php
index d529ec884a..bcb96cf4b9 100644
--- a/libraries/core.lib.php
+++ b/libraries/core.lib.php
@@ -1058,6 +1058,24 @@ function PMA_sanitizeMySQLHost($name)
     return $name;
 }
 
+/**
+ * Sanitizes MySQL username
+ *
+ * * strips part behind null byte
+ *
+ * @param string $name User given username
+ *
+ * @return string
+ */
+function PMA_sanitizeMySQLUser($name)
+{
+    $position = strpos($name, chr(0));
+    if ($position !== false) {
+        return substr($name, 0, $position);
+    }
+    return $name;
+}
+
 /**
  * Safe unserializer wrapper
  *
diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php
index b560e6fc8f..11146f25d4 100644
--- a/libraries/plugins/auth/AuthenticationCookie.php
+++ b/libraries/plugins/auth/AuthenticationCookie.php
@@ -301,7 +301,7 @@ class AuthenticationCookie extends AuthenticationPlugin
             }
 
             // The user just logged in
-            $GLOBALS['PHP_AUTH_USER'] = $_REQUEST['pma_username'];
+            $GLOBALS['PHP_AUTH_USER'] = PMA_sanitizeMySQLUser($_REQUEST['pma_username']);
             $GLOBALS['PHP_AUTH_PW']   = $_REQUEST['pma_password'];
             if ($GLOBALS['cfg']['AllowArbitraryServer']
                 && isset($_REQUEST['pma_servername'])
diff --git a/libraries/plugins/auth/AuthenticationHttp.php b/libraries/plugins/auth/AuthenticationHttp.php
index 36958a3261..95f689a0ff 100644
--- a/libraries/plugins/auth/AuthenticationHttp.php
+++ b/libraries/plugins/auth/AuthenticationHttp.php
@@ -163,6 +163,9 @@ class AuthenticationHttp extends AuthenticationPlugin
             unset($usr_pass);
         }
 
+        // sanitize username
+        $PHP_AUTH_USER = PMA_sanitizeMySQLUser($PHP_AUTH_USER);
+
         // User logged out -> ensure the new username is not the same
         $old_usr = isset($_REQUEST['old_usr']) ? $_REQUEST['old_usr'] : '';
         if (!empty($old_usr)