diff -Naurp mysql-5.0.84/client/mysql.cc mysql-5.0.84.oden/client/mysql.cc
--- mysql-5.0.84/client/mysql.cc	2009-07-07 14:53:24.000000000 +0200
+++ mysql-5.0.84.oden/client/mysql.cc	2009-07-25 15:00:11.000000000 +0200
@@ -3371,9 +3371,12 @@ print_table_data_html(MYSQL_RES *result)
   {
     while((field = mysql_fetch_field(result)))
     {
-      tee_fprintf(PAGER, "<TH>%s</TH>", (field->name ? 
-					 (field->name[0] ? field->name : 
-					  " &nbsp; ") : "NULL"));
+      tee_fputs("<TH>", PAGER);
+      if (field->name && field->name[0])
+        xmlencode_print(field->name, field->name_length);
+      else
+        tee_fputs(field->name ? " &nbsp; " : "NULL", PAGER);
+      tee_fputs("</TH>", PAGER);
     }
     (void) tee_fputs("</TR>", PAGER);
   }
@@ -3384,7 +3387,7 @@ print_table_data_html(MYSQL_RES *result)
     for (uint i=0; i < mysql_num_fields(result); i++)
     {
       (void) tee_fputs("<TD>", PAGER);
-      safe_put_field(cur[i],lengths[i]);
+      xmlencode_print(cur[i], lengths[i]);
       (void) tee_fputs("</TD>", PAGER);
     }
     (void) tee_fputs("</TR>", PAGER);
diff -Naurp mysql-5.0.84/mysql-test/r/mysql.result mysql-5.0.84.oden/mysql-test/r/mysql.result
--- mysql-5.0.84/mysql-test/r/mysql.result	2009-07-07 16:04:17.000000000 +0200
+++ mysql-5.0.84.oden/mysql-test/r/mysql.result	2009-07-25 15:01:09.000000000 +0200
@@ -199,4 +199,5 @@ COUNT (*)
 COUNT (*)
 1
 ERROR 2005 (HY000) at line 1: Unknown MySQL server host 'invalid_hostname' (errno)
+<TABLE BORDER=1><TR><TH>&lt;</TH></TR><TR><TD>&lt; &amp; &gt;</TD></TR></TABLE>
 End of 5.0 tests
diff -Naurp mysql-5.0.84/mysql-test/t/mysql.test mysql-5.0.84.oden/mysql-test/t/mysql.test
--- mysql-5.0.84/mysql-test/t/mysql.test	2009-07-07 16:03:49.000000000 +0200
+++ mysql-5.0.84.oden/mysql-test/t/mysql.test	2009-07-25 15:00:11.000000000 +0200
@@ -356,4 +356,9 @@ remove_file $MYSQLTEST_VARDIR/tmp/bug310
 --exec $MYSQL --default-character-set=binary test -e "CONNECT test invalid_hostname" 2>&1
 --exec $MYSQL --default-character-set=binary test -e "DELIMITER //" 2>&1
 
+#
+# Bug #27884: mysql --html does not quote HTML special characters in output
+#
+--exec $MYSQL --html test -e "select '< & >' as \`<\`"
+--echo
 --echo End of 5.0 tests