Program: CWE-79
Project: CVE-2016-5704
Buggy source:
<div id="tablestatistics">
    <?php $odd_row = false; ?>
    <fieldset>
        <legend><?= __('Information'); ?></legend>
        <p> <strong> <?= __('Table comments: ') ?> </strong>
            <?= isset($showtable['TABLE_COMMENT']) ? $showtable['TABLE_COMMENT'] : '';?>
        </p>
        <a id="showusage"></a>

        <?php if (! $tbl_is_view && ! $db_is_system_schema): ?>
            <table id="tablespaceusage" class="data">
                <caption class="tblHeaders"><?= __('Space usage'); ?></caption>
                <tbody>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Data'); ?></th>
                        <td class="value"><?= $data_size; ?></td>
                        <td class="unit"><?= $data_unit; ?></td>
                    </tr>

                <?php if (isset($index_size)): ?>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Index'); ?></th>
                        <td class="value"><?= $index_size; ?></td>
                        <td class="unit"><?= $index_unit; ?></td>
                    </tr>
                <?php endif; ?>

                <?php if (isset($free_size)): ?>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Overhead'); ?></th>
                        <td class="value"><?= $free_size; ?></td>
                        <td class="unit"><?= $free_unit; ?></td>
                    </tr>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Effective'); ?></th>
                        <td class="value"><?= $effect_size; ?></td>
                        <td class="unit"><?= $effect_unit; ?></td>
                    </tr>
                <?php endif; ?>

                <?php if (isset($tot_size) && $mergetable == false): ?>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Total'); ?></th>
                        <td class="value"><?= $tot_size; ?></td>
                        <td class="unit"><?= $tot_unit; ?></td>
                    </tr>
                <?php endif; ?>

                <!-- Optimize link if overhead -->
                <?php if (isset($free_size)
                            && ($tbl_storage_engine == 'MYISAM'
                            || $tbl_storage_engine == 'ARIA'
                            || $tbl_storage_engine == 'MARIA'
                            || $tbl_storage_engine == 'BDB')): ?>
                    <tr class="tblFooters">
                        <td colspan="3" class="center">
                            <a href="sql.php<?= $url_query; ?>&pos=0&amp;sql_query=<?= urlencode(
                                    'OPTIMIZE TABLE ' . PMA\libraries\Util::backquote($GLOBALS['table'])); ?>">
                                <?= PMA\libraries\Util::getIcon('b_tbloptimize.png', __('Optimize table')); ?>
                            </a>
                        </td>
                    </tr>
                <?php endif; ?>
                </tbody>
            </table>
        <?php endif; ?>
        <?= PMA\libraries\Template::get('table/structure/row_stats_table')->render(
              array(
                  'showtable' => $showtable,
                  'tbl_collation' => $tbl_collation,
                  'is_innodb' => $is_innodb,
                  'mergetable' => $mergetable,
                  'avg_size' => (isset ($avg_size) ? $avg_size : ''),
                  'avg_unit' => (isset ($avg_unit) ? $avg_unit : '')
              )
            )
        ?>
    </fieldset>
</div>


Fixed version (ground truth):
<div id="tablestatistics">
    <?php $odd_row = false; ?>
    <fieldset>
        <legend><?= __('Information'); ?></legend>
        <p> <strong> <?= __('Table comments: ') ?> </strong>
            <?= isset($showtable['TABLE_COMMENT']) ? htmlspecialchars($showtable['TABLE_COMMENT']) : '';?>
        </p>
        <a id="showusage"></a>

        <?php if (! $tbl_is_view && ! $db_is_system_schema): ?>
            <table id="tablespaceusage" class="data">
                <caption class="tblHeaders"><?= __('Space usage'); ?></caption>
                <tbody>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Data'); ?></th>
                        <td class="value"><?= $data_size; ?></td>
                        <td class="unit"><?= $data_unit; ?></td>
                    </tr>

                <?php if (isset($index_size)): ?>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Index'); ?></th>
                        <td class="value"><?= $index_size; ?></td>
                        <td class="unit"><?= $index_unit; ?></td>
                    </tr>
                <?php endif; ?>

                <?php if (isset($free_size)): ?>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Overhead'); ?></th>
                        <td class="value"><?= $free_size; ?></td>
                        <td class="unit"><?= $free_unit; ?></td>
                    </tr>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Effective'); ?></th>
                        <td class="value"><?= $effect_size; ?></td>
                        <td class="unit"><?= $effect_unit; ?></td>
                    </tr>
                <?php endif; ?>

                <?php if (isset($tot_size) && $mergetable == false): ?>
                    <tr class="<?= (($odd_row = !$odd_row) ? 'odd' : 'even'); ?>">
                        <th class="name"><?= __('Total'); ?></th>
                        <td class="value"><?= $tot_size; ?></td>
                        <td class="unit"><?= $tot_unit; ?></td>
                    </tr>
                <?php endif; ?>

                <!-- Optimize link if overhead -->
                <?php if (isset($free_size)
                            && ($tbl_storage_engine == 'MYISAM'
                            || $tbl_storage_engine == 'ARIA'
                            || $tbl_storage_engine == 'MARIA'
                            || $tbl_storage_engine == 'BDB')): ?>
                    <tr class="tblFooters">
                        <td colspan="3" class="center">
                            <a href="sql.php<?= $url_query; ?>&pos=0&amp;sql_query=<?= urlencode(
                                    'OPTIMIZE TABLE ' . PMA\libraries\Util::backquote($GLOBALS['table'])); ?>">
                                <?= PMA\libraries\Util::getIcon('b_tbloptimize.png', __('Optimize table')); ?>
                            </a>
                        </td>
                    </tr>
                <?php endif; ?>
                </tbody>
            </table>
        <?php endif; ?>
        <?= PMA\libraries\Template::get('table/structure/row_stats_table')->render(
              array(
                  'showtable' => $showtable,
                  'tbl_collation' => $tbl_collation,
                  'is_innodb' => $is_innodb,
                  'mergetable' => $mergetable,
                  'avg_size' => (isset ($avg_size) ? $avg_size : ''),
                  'avg_unit' => (isset ($avg_unit) ? $avg_unit : '')
              )
            )
        ?>
    </fieldset>
</div>