--- main/php_gtk_object.c
+++ main/php_gtk_object.c
@@ -365,7 +365,7 @@ GtkArg *php_gtk_hash_as_args(zval *hash,
 
 		err = gtk_object_arg_get_info(type, arg[i].name, &info);
 		if (!info) {
-			php_error(E_WARNING, err);
+			php_error(E_WARNING, "%s", err);
 			g_free(err);
 			g_free(arg);
 			return NULL;
@@ -378,7 +378,7 @@ GtkArg *php_gtk_hash_as_args(zval *hash,
 			g_snprintf(buf, 255, "argument '%s': expected type %s, found %s",
 					   arg[i].name, gtk_type_name(arg[i].type),
 					   php_gtk_zval_type_name(*item));
-			php_error(E_WARNING, buf);
+			php_error(E_WARNING, "%s", buf);
 			g_free(arg);
 			return NULL;
 		}
@@ -407,7 +407,7 @@ int php_gtk_args_from_hash(GtkArg *args,
 				g_snprintf(buf, 511, "argument %d: expected %s, %s found", i+1,
 						   gtk_type_name(args[i].type),
 						   php_gtk_zval_type_name(*item));
-			php_error(E_WARNING, buf);
+			php_error(E_WARNING, "%s", buf);
 			return 0;
 		}
 	}
--- main/php_gtk_util.c
+++ main/php_gtk_util.c
@@ -368,7 +368,7 @@ static int parse_arg(int arg_num, zval *
 			sprintf(buf, "%s() expects argument %d to be %s, %s given",
 					get_active_function_name(TSRMLS_C), arg_num, expected_type,
 					php_gtk_zval_type_name(*arg));
-			php_error(E_WARNING, buf);
+			php_error(E_WARNING, "%s", buf);
 		}
 		return 0;
 	}
@@ -425,7 +425,7 @@ static int parse_va_args(int argc, zval
 					argc < min_argc ? min_argc : max_argc,
 					(argc < min_argc ? min_argc : max_argc) == 1 ? "" : "s",
 					argc);
-			php_error(E_WARNING, buf);
+			php_error(E_WARNING, "%s", buf);
 		}
 		return 0;
 	}