diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index c6647017a6a..b5832858353 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -194,6 +194,7 @@ function GETPOST($paramname,$check='',$method=0)
     		// '../' is dangerous because it allows dir transversals
 		    if (preg_match('/"/',$out)) $out='';
 			else if (preg_match('/\.\.\//',$out)) $out='';
+			else if (preg_match('/(\s)*|(%20)*/',$out)) $out='';
 		}
 		elseif ($check == 'special')
 		{