diff --git a/ChangeLog b/ChangeLog
index 03db5618be..79078303df 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -106,7 +106,8 @@ underscore
 - bug #3828 MariaDB reported as MySQL
 - bug #3854 Incorrect header for Safari 6.0
 - bug #3705 Attempt to open trigger for edit gives NULL
-- Use HTML5 DOCTYPE
+- Use HTML5 DOCTYPE 
+- [security] Self-XSS on GIS visualisation page, reported by Janek Vind
 
 3.5.7.0 (2013-02-15)
 - bug #3779 [core] Problem with backslash in enum fields
diff --git a/tbl_gis_visualization.php b/tbl_gis_visualization.php
index 4293254e9e..d60ea4dd80 100644
--- a/tbl_gis_visualization.php
+++ b/tbl_gis_visualization.php
@@ -196,7 +196,7 @@ if ($svg_support) {
 
     <div style="clear:both;">&nbsp;</div>
 
-    <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
+    <div id="placeholder" style="width:<?php echo htmlspecialchars($visualizationSettings['width']); ?>px;height:<?php echo htmlspecialchars($visualizationSettings['height']); ?>px;">
         <?php echo $visualization; ?>
     </div>
     <div id="openlayersmap"></div>