diff --git a/multisite_search.module b/multisite_search.module
index 74b4c41..7b6c931 100644
--- a/multisite_search.module
+++ b/multisite_search.module
@@ -286,10 +286,19 @@ function multisite_search_form_site(&$form_state, $site_id = NULL) {
   if ($site_id) {
     $form['delete'] = array('#type' => 'submit', '#value' => t('Delete'));
   }
+  $form['#validate'] = array('multisite_search_form_site_validate');
   
   return $form;
 }
 
+function multisite_search_form_site_validate($form, &$form_state) {
+  // Validate the table prefix. This prevents SQL injection vulnerability
+  // Only allow [A-Z] [0-9] and _ and .
+  if (!preg_match('/^[a-zA-Z0-9_\.]*$/', $form_state['values']['table_prefix'])) {
+    form_set_error('table_prefix', t('Site table prefix must be of the form <em>dbname.</em> , <em>tbl_prefix_</em> , or <em>dbname.tbl_prefix_</em> .'));
+  }
+}
+
 function multisite_search_form_site_submit($form, &$form_state) {
   if ($form_state['values']['site_id']) {
     // update existing site