diff --git a/src/api/database-test.php b/src/api/database-test.php
index e57d6ec4..986038af 100644
--- a/src/api/database-test.php
+++ b/src/api/database-test.php
@@ -18,7 +18,7 @@ switch ($_SERVER['REQUEST_METHOD']) {
             $dsn = 'mysql:host=' . $_POST['DATABASE_HOST'] . ';dbname=' . $_POST['DATABASE_NAME'] . ';port=3306;charset=utf8';
             $pdo = new \PDO(
                 $dsn,
-                $_POST['DATABASE_USER'],
+                Sanitiser::getText($_POST['DATABASE_USER']),
                 $_POST['DATABASE_PASSWORD']
             );