diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index cd7b93a549f..73bd64694ef 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -53,6 +53,8 @@ env.filters["json"] = json.dumps
 # 1 week cache for asset bundles as advised by Google Page Speed
 BUNDLE_MAXAGE = 60 * 60 * 24 * 7
 
+DBNAME_PATTERN = '^[a-zA-Z0-9][a-zA-Z0-9_.-]+$'
+
 #----------------------------------------------------------
 # Odoo Web helpers
 #----------------------------------------------------------
@@ -625,6 +627,7 @@ class Database(http.Controller):
         d['list_db'] = odoo.tools.config['list_db']
         d['langs'] = odoo.service.db.exp_list_lang()
         d['countries'] = odoo.service.db.exp_list_countries()
+        d['pattern'] = DBNAME_PATTERN
         # databases list
         d['databases'] = []
         try:
@@ -646,6 +649,8 @@ class Database(http.Controller):
     @http.route('/web/database/create', type='http', auth="none", methods=['POST'], csrf=False)
     def create(self, master_pwd, name, lang, password, **post):
         try:
+            if not re.match(DBNAME_PATTERN, name):
+                raise Exception(_('Invalid database name. Only alphanumerical characters, underscore, hyphen and dot are allowed.'))
             # country code could be = "False" which is actually True in python
             country_code = post.get('country_code') or False
             dispatch_rpc('db', 'create_database', [master_pwd, name, bool(post.get('demo')), lang, password, post['login'], country_code])
@@ -658,6 +663,8 @@ class Database(http.Controller):
     @http.route('/web/database/duplicate', type='http', auth="none", methods=['POST'], csrf=False)
     def duplicate(self, master_pwd, name, new_name):
         try:
+            if not re.match(DBNAME_PATTERN, new_name):
+                raise Exception(_('Invalid database name. Only alphanumerical characters, underscore, hyphen and dot are allowed.'))
             dispatch_rpc('db', 'duplicate_database', [master_pwd, name, new_name])
             return http.local_redirect('/web/database/manager')
         except Exception, e:
diff --git a/addons/web/views/database_manager.html b/addons/web/views/database_manager.html
index 7cef4678e8d..b2edbfd78dd 100644
--- a/addons/web/views/database_manager.html
+++ b/addons/web/views/database_manager.html
@@ -61,7 +61,7 @@
     <div class="row">
       <div class="col-md-12">
         <label for="name" class="control-label">Database Name</label>
-        <input id="name" type="text" name="name" class="form-control" required="required" autocomplete="off"/>
+        <input id="name" type="text" name="name" class="form-control" required="required" autocomplete="off" pattern="{{ pattern }}" title="Only alphanumerical characters, underscore, hyphen and dot are allowed"/>
       </div>
     </div>
   </div>
@@ -208,7 +208,7 @@
             </div>
             <div class="form-group">
               <label for="name" class="control-label">Database Name</label>
-              <input id="name" type="text" name="name" class="form-control" required="required"/>
+              <input id="name" type="text" name="name" class="form-control" required="required" pattern="{{ pattern }}" title="Only alphanumerical characters, underscore, hyphen and dot are allowed"/>
             </div>
             <div class="form-group">
                 <label for="copy">This database might have been moved or copied.</label>
@@ -281,7 +281,7 @@
             </div>
             <div class="form-group">
               <label for="new_name" class="control-label">New Name</label>
-              <input id="new_name" type="text" name="new_name" class="form-control" required="required"/>
+              <input id="new_name" type="text" name="new_name" class="form-control" required="required" pattern="{{ pattern }}" title="Only alphanumerical characters, underscore, hyphen and dot are allowed"/>
             </div>
           </div>
           <div class="modal-footer">