diff --git a/admin/security_center.php b/admin/security_center.php
index a289a52168..fc5ae73493 100644
--- a/admin/security_center.php
+++ b/admin/security_center.php
@@ -91,7 +91,25 @@
 
 if (isset($_GET['extra_where']) && $_GET['extra_where'] !== '')
 {
-  $where_clauses[] = $_GET['extra_where'];
+  $extra_where = trim($_GET['extra_where']);
+
+  // Only accept simple, safe conditions on the login attempts table (la).
+  // Allow comparisons like:
+  //   la.field = 'value'
+  //   la.field LIKE 'value%'
+  // and simple AND/OR chaining of those conditions.
+  // This rejects arbitrary SQL (UNION, JOIN, subqueries, comments, semicolons, etc.)
+  $clause_pattern = "/^\s*(?:la\\.[A-Za-z0-9_]+\\s*(?:=|!=|<>|<|>|<=|>=|LIKE)\\s*'[^']*'\\s*)(?:\\s+(?:AND|OR)\\s+(?:la\\.[A-Za-z0-9_]+\\s*(?:=|!=|<>|<|>|<=|>=|LIKE)\\s*'[^']*'\\s*))*$/i";
+
+  if (preg_match($clause_pattern, $extra_where))
+  {
+    $where_clauses[] = $extra_where;
+  }
+  else
+  {
+    // Unsafe extra_where ignored to prevent SQL injection attempts
+    $page['warnings'][] = l10n('Ignored unsafe filter parameter');
+  }
 }
 
 $where_sql = count($where_clauses) > 0 ? 'WHERE '.implode("\n  AND ", $where_clauses) : '';