diff --git a/src/includes/common.php b/src/includes/common.php
index e1d8285..9051ea2 100644
--- a/src/includes/common.php
+++ b/src/includes/common.php
@@ -143,6 +143,9 @@ class Config
 
 	public static function set($key, $value)
 	{
+		if ($key == "prefix" && $value !== "" && !preg_match("/^[a-zA-Z0-9_]+$/", $value)) {
+			throw new Exception("Incorrect table prefix. Can contain only latin letters, digits and underscore character.");
+		}
 		self::$config[$key] = $value;
 	}
 
diff --git a/src/setup.php b/src/setup.php
index a3c1b04..794e3af 100644
--- a/src/setup.php
+++ b/src/setup.php
@@ -80,7 +80,7 @@ if(!$ver)
 			Config::set('prefix', trim(_post('prefix')));
 		}
 		if(!testConnect($error)) {
-			exitMessage("Database connection error: $error");
+			exitMessage("Database connection error: ". htmlspecialchars($error));
 		}
 		if(!is_writable('./db/config.php')) {
 			exitMessage("Config file ('db/config.php') is not writable.");
@@ -232,11 +232,11 @@ elseif($ver == $lastVer)
 else
 {
 	if(!in_array($ver, array('1.1','1.2','1.3.0','1.3.1'))) {
-		exitMessage("Can not update. Unsupported database version ($ver).");
+		exitMessage("Can not update. Unsupported database version (". htmlspecialchars($ver). ").");
 	}
 	if(!isset($_POST['update'])) {
-		exitMessage("Update database v$ver
-		<form name=frm method=post><input type=hidden name=update value=1><input type=hidden name=tz value=-1><input type=submit value=' Update '></form>
+		exitMessage("Update database v". htmlspecialchars($ver).
+		"<form name=frm method=post><input type=hidden name=update value=1><input type=hidden name=tz value=-1><input type=submit value=' Update '></form>
 		<script type=\"text/javascript\">var tz = -1 * (new Date()).getTimezoneOffset(); document.frm.tz.value = tz;</script>
 		");
 	}
@@ -360,10 +360,16 @@ function testConnect(&$error)
 	return 1;
 }
 
+function debugExceptionHandler($e)
+{
+	echo '<br><b>Error:</b> \''. htmlspecialchars($e->getMessage()) .'\' in <i>'. htmlspecialchars($e->getFile()) .':'. $e->getLine() . '</i>'.
+		"\n<pre>". htmlspecialchars($e->getTraceAsString()) . "</pre>\n";
+	exit;
+}
+
 function myExceptionHandler($e)
 {
-	echo '<br><b>Fatal Error:</b> \''. $e->getMessage() .'\' in <i>'. $e->getFile() .':'. $e->getLine() . '</i>'.
-		"\n<pre>". $e->getTraceAsString() . "</pre>\n";
+	echo '<br><b>Error:</b> '. htmlspecialchars($e->getMessage()) ;
 	exit;
 }