Cross-site scripting (XSS) ΒΆ
When phpMyAdmin shows a piece of user data, e.g. something inside a user's database, all html special chars have to be escaped. When this escaping is missing somewhere a malicious user might fill a database with specially crafted content to trick an other user of that database into executing something. This could for example be a piece of JavaScript code that would do any number of nasty things.
phpMyAdmin tries to escape all userdata before it is rendered into html for the browser.
See also