Program: CWE-79
Project: CVE-2016-5732
Buggy source:
<?php use PMA\libraries\Message;
use PMA\libraries\Util; ?>
<div id="partitions">
    <fieldset>
        <legend><?= __('Partitions')
            , Util::showMySQLDocu('partitioning'); ?>
        </legend>
        <?php if (empty($partitions)): ?>
            <?= Message::notice(__('No partitioning defined!'))->getDisplay(); ?>
        <?php else: ?>
            <p>
                <?= __('Partitioned by:');?>
                <code><?= htmlspecialchars($partitionMethod) , '(' , htmlspecialchars($partitionExpression) , ' )'; ?></code>
            </p>
            <?php if ($hasSubPartitions): ?>
                <p>
                    <?= __('Sub partitioned by:'); ?>
                    <code><?= htmlspecialchars($subPartitionMethod) , '(' , htmlspecialchars($subPartitionExpression) , ' )'; ?></code>
                <p>
            <?php endif; ?>
            <table>
                <thead>
                    <tr>
                        <th colspan="2">#</th>
                        <th><?= __('Name'); ?></th>
                        <?php if ($hasDescription): ?>
                            <th><?= __('Expression'); ?></th>
                        <?php endif; ?>
                        <th><?= __('Rows'); ?></th>
                        <th><?= __('Data length'); ?></th>
                        <th><?= __('Index length'); ?></th>
                        <th><?= __('Comment'); ?></th>
                        <th colspan="<?= $rangeOrList ? '7' : '6'; ?>">
                            <?= __('Action'); ?>
                        </th>
                    </tr>
                </thead>
                <tbody>
                <?php $odd = true; ?>
                <?php foreach ($partitions as $partition): ?>
                    <tr class="noclick <?= ($odd ? 'odd' : 'even') , ($hasSubPartitions ? ' marked' : '') ?>">
                        <?php if ($hasSubPartitions): ?>
                            <td><?= $partition->getOrdinal(); ?></td>
                            <td></td>
                        <?php else: ?>
                            <td colspan="2"><?= $partition->getOrdinal(); ?></td>
                        <?php endif; ?>
                        <th><?= htmlspecialchars($partition->getName()); ?></th>
                        <?php if ($hasDescription): ?>
                            <td>
                                <code>
                                    <?= htmlspecialchars($partition->getExpression())
                                        , ($partition->getMethod() == 'LIST' ? ' IN (' : ' < ')
                                        , htmlspecialchars($partition->getDescription())
                                        , ($partition->getMethod() == 'LIST' ? ')' : '');
                                    ?>
                                </code>
                            </td>
                        <?php endif; ?>
                        <td class="value"><?= $partition->getRows(); ?></td>
                        <td class="value"><?php
                            list($value, $unit) = Util::formatByteDown(
                                $partition->getDataLength(), 3, 1
                            );
                            ?>
                            <span><?= $value; ?></span>
                            <span class="unit"><?= $unit; ?></span>
                        </td>
                        <td class="value"><?php
                            list($value, $unit) = Util::formatByteDown(
                                $partition->getIndexLength(), 3, 1
                            );
                            ?>
                            <span><?= $value; ?></span>
                            <span class="unit"><?= $unit; ?></span>
                        </td>
                        <td><?= $partition->getComment(); ?></td>
                        <?php foreach ($actionIcons as $action => $icon): ?>
                            <td>
                                <a  href="tbl_structure.php<?= $url_query; ?>&amp;partition_maintenance=1&amp;sql_query=<?= urlencode(
                                        "ALTER TABLE " . Util::backquote($table) . $action . " PARTITION " . $partition->getName()
                                    ) ?>"
                                    id="partition_action_<?= $action; ?>"
                                    name="partition_action_<?= $action; ?>"
                                    class="ajax"
                                >
                                    <?= $icon; ?>
                                </a>
                            </td>
                        <?php endforeach; ?>

                        <?php if ($hasSubPartitions): ?>
                            <?php foreach ($partition->getSubPartitions() as $subParition): ?>
                                <tr class="noclick <?= $odd ? 'odd' : 'even' ?>">
                                    <td></td>
                                    <td><?= $subParition->getOrdinal(); ?></td>
                                    <td><?= htmlspecialchars($subParition->getName()); ?></td>
                                    <?php if ($hasDescription): ?>
                                        <td></td>
                                    <?php endif; ?>
                                    <td class="value"><?= $subParition->getRows(); ?></td>
                                    <td class="value"><?php
                                        list($value, $unit) = Util::formatByteDown(
                                            $subParition->getDataLength(), 3, 1
                                        );
                                        ?>
                                        <span><?= $value; ?></span>
                                        <span class="unit"><?= $unit; ?></span>
                                    </td>
                                    <td class="value"><?php
                                        list($value, $unit) = Util::formatByteDown(
                                            $subParition->getIndexLength(), 3, 1
                                        );
                                        ?>
                                        <span><?= $value; ?></span>
                                        <span class="unit"><?= $unit; ?></span>
                                    </td>
                                    <td><?= $subParition->getComment(); ?></td>
                                    <td colspan="<?= $rangeOrList ? '7' : '6'; ?>"></td>
                                </tr>
                            <?php endforeach; ?>
                        <?php endif; ?>
                    </tr>
                    <?php $odd = ! $odd; ?>
                <?php endforeach; ?>
                </tbody>
            </table>
        <?php endif; ?>
    </fieldset>
    <fieldset class="tblFooters print_ignore">
        <form action="tbl_structure.php" method="post">
            <?= PMA_URL_getHiddenInputs($db, $table); ?>
            <input type="hidden" name="edit_partitioning" value="true" />
            <?php if (empty($partitions)): ?>
                <input type="submit" name="edit_partitioning" value="<?= __('Partition table'); ?>" />
            <?php else: ?>
                <?= Util::linkOrButton($removeUrl, __('Remove partitioning'), ['class' => 'button ajax', 'id' => 'remove_partitioning'])?>
                <input type="submit" name="edit_partitioning" value="<?= __('Edit partitioning'); ?>" />
            <?php endif; ?>
        </form>
    </fieldset>
</div>


Fixed version (ground truth):
<?php use PMA\libraries\Message;
use PMA\libraries\Util; ?>
<div id="partitions">
    <fieldset>
        <legend><?= __('Partitions')
            , Util::showMySQLDocu('partitioning'); ?>
        </legend>
        <?php if (empty($partitions)): ?>
            <?= Message::notice(__('No partitioning defined!'))->getDisplay(); ?>
        <?php else: ?>
            <p>
                <?= __('Partitioned by:');?>
                <code><?= htmlspecialchars($partitionMethod) , '(' , htmlspecialchars($partitionExpression) , ' )'; ?></code>
            </p>
            <?php if ($hasSubPartitions): ?>
                <p>
                    <?= __('Sub partitioned by:'); ?>
                    <code><?= htmlspecialchars($subPartitionMethod) , '(' , htmlspecialchars($subPartitionExpression) , ' )'; ?></code>
                <p>
            <?php endif; ?>
            <table>
                <thead>
                    <tr>
                        <th colspan="2">#</th>
                        <th><?= __('Name'); ?></th>
                        <?php if ($hasDescription): ?>
                            <th><?= __('Expression'); ?></th>
                        <?php endif; ?>
                        <th><?= __('Rows'); ?></th>
                        <th><?= __('Data length'); ?></th>
                        <th><?= __('Index length'); ?></th>
                        <th><?= __('Comment'); ?></th>
                        <th colspan="<?= $rangeOrList ? '7' : '6'; ?>">
                            <?= __('Action'); ?>
                        </th>
                    </tr>
                </thead>
                <tbody>
                <?php $odd = true; ?>
                <?php foreach ($partitions as $partition): ?>
                    <tr class="noclick <?= ($odd ? 'odd' : 'even') , ($hasSubPartitions ? ' marked' : '') ?>">
                        <?php if ($hasSubPartitions): ?>
                            <td><?= $partition->getOrdinal(); ?></td>
                            <td></td>
                        <?php else: ?>
                            <td colspan="2"><?= $partition->getOrdinal(); ?></td>
                        <?php endif; ?>
                        <th><?= htmlspecialchars($partition->getName()); ?></th>
                        <?php if ($hasDescription): ?>
                            <td>
                                <code>
                                    <?= htmlspecialchars($partition->getExpression())
                                        , ($partition->getMethod() == 'LIST' ? ' IN (' : ' < ')
                                        , htmlspecialchars($partition->getDescription())
                                        , ($partition->getMethod() == 'LIST' ? ')' : '');
                                    ?>
                                </code>
                            </td>
                        <?php endif; ?>
                        <td class="value"><?= $partition->getRows(); ?></td>
                        <td class="value"><?php
                            list($value, $unit) = Util::formatByteDown(
                                $partition->getDataLength(), 3, 1
                            );
                            ?>
                            <span><?= $value; ?></span>
                            <span class="unit"><?= $unit; ?></span>
                        </td>
                        <td class="value"><?php
                            list($value, $unit) = Util::formatByteDown(
                                $partition->getIndexLength(), 3, 1
                            );
                            ?>
                            <span><?= $value; ?></span>
                            <span class="unit"><?= $unit; ?></span>
                        </td>
                        <td><?= htmlspecialchars($partition->getComment()); ?></td>
                        <?php foreach ($actionIcons as $action => $icon): ?>
                            <td>
                                <a  href="tbl_structure.php<?= $url_query; ?>&amp;partition_maintenance=1&amp;sql_query=<?= urlencode(
                                        "ALTER TABLE " . Util::backquote($table) . $action . " PARTITION " . $partition->getName()
                                    ) ?>"
                                    id="partition_action_<?= $action; ?>"
                                    name="partition_action_<?= $action; ?>"
                                    class="ajax"
                                >
                                    <?= $icon; ?>
                                </a>
                            </td>
                        <?php endforeach; ?>

                        <?php if ($hasSubPartitions): ?>
                            <?php foreach ($partition->getSubPartitions() as $subParition): ?>
                                <tr class="noclick <?= $odd ? 'odd' : 'even' ?>">
                                    <td></td>
                                    <td><?= $subParition->getOrdinal(); ?></td>
                                    <td><?= htmlspecialchars($subParition->getName()); ?></td>
                                    <?php if ($hasDescription): ?>
                                        <td></td>
                                    <?php endif; ?>
                                    <td class="value"><?= $subParition->getRows(); ?></td>
                                    <td class="value"><?php
                                        list($value, $unit) = Util::formatByteDown(
                                            $subParition->getDataLength(), 3, 1
                                        );
                                        ?>
                                        <span><?= $value; ?></span>
                                        <span class="unit"><?= $unit; ?></span>
                                    </td>
                                    <td class="value"><?php
                                        list($value, $unit) = Util::formatByteDown(
                                            $subParition->getIndexLength(), 3, 1
                                        );
                                        ?>
                                        <span><?= $value; ?></span>
                                        <span class="unit"><?= $unit; ?></span>
                                    </td>
                                    <td><?= $subParition->getComment(); ?></td>
                                    <td colspan="<?= $rangeOrList ? '7' : '6'; ?>"></td>
                                </tr>
                            <?php endforeach; ?>
                        <?php endif; ?>
                    </tr>
                    <?php $odd = ! $odd; ?>
                <?php endforeach; ?>
                </tbody>
            </table>
        <?php endif; ?>
    </fieldset>
    <fieldset class="tblFooters print_ignore">
        <form action="tbl_structure.php" method="post">
            <?= PMA_URL_getHiddenInputs($db, $table); ?>
            <input type="hidden" name="edit_partitioning" value="true" />
            <?php if (empty($partitions)): ?>
                <input type="submit" name="edit_partitioning" value="<?= __('Partition table'); ?>" />
            <?php else: ?>
                <?= Util::linkOrButton($removeUrl, __('Remove partitioning'), ['class' => 'button ajax', 'id' => 'remove_partitioning'])?>
                <input type="submit" name="edit_partitioning" value="<?= __('Edit partitioning'); ?>" />
            <?php endif; ?>
        </form>
    </fieldset>
</div>