Hi,
please have a look at the latest MAINT_2_9_0 which includes a protection
for attacks via a crafted URL on error.php. This protection means that
these error messages (just a few error messages are displayed via
error.php) won't be displayed correctly if a user did not choose a utf-8
language (older MySQL servers).
Marc