TYPO3 Core

class.db_list_extra.inc

// Adding "New record" icon:
            if (!$GLOBALS['SOBE']->modTSconfig['properties']['noCreateRecordsLink'])     {
                $theCtrlPanel[]='<a href="#" onclick="'.htmlspecialchars('return jumpExt(\'' . htmlspecialchars($this->backPath . 'db_new.php?id='.$this->id).'\');').'">'.
                                '<img'.t3lib_iconWorks::skinImg($this->backPath,'gfx/new_el.gif','width="11" height="12"').' title="'.$LANG->getLL('newRecordGeneral',1).'" alt="" />'.
                                '</a>';
            }

nested htmlspecialchars!

return jumpExt(\'' . htmlspecialchars($this->backPath . '... // NOT here anymore!

see for example:

$theCtrlPanel[]='<a href="#" onclick="'.htmlspecialchars('return jumpExt(\''.$this->backPath.'move_el.php?table=pages&uid='.$row['uid'].'\');').'">'.

(issue imported from #M5082)