diff --git a/common/dbcore.cpp b/common/dbcore.cpp
index 9c4d856cf..1e5143e5e 100644
--- a/common/dbcore.cpp
+++ b/common/dbcore.cpp
@@ -158,9 +158,10 @@ bool DBcore::RunQuery(const std::string& query, std::string* errbuf, MYSQL_RES**
 void DBcore::DoEscapeString(std::string& outString, const char* frombuf, uint32 fromlen) {
 //	No good reason to lock the DB, we only need it in the first place to check char encoding.
 //	LockMutex lock(&MDatabase);
-	char* tobuf = new char[sizeof(frombuf)*fromlen*2]();
+	char* tobuf = new char[fromlen*2+1]();
 	unsigned long length = mysql_real_escape_string(&mysql, tobuf, frombuf, fromlen);
 	outString.assign(tobuf,length);
+	outString.resize(length);
 	safe_delete_array(tobuf);
 }