error.php in PhpMyAdmin 3.3.8.1 and other versions before 3.4.0-beta1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing \@\ characters as demonstrated using \a@url@page\.