diff --git a/wp-admin/includes/class-wp-media-list-table.php b/wp-admin/includes/class-wp-media-list-table.php
index 828cd8c0f3..4de086ab22 100644
--- a/wp-admin/includes/class-wp-media-list-table.php
+++ b/wp-admin/includes/class-wp-media-list-table.php
@@ -64,7 +64,7 @@ class WP_Media_List_Table extends WP_List_Table {
 			if ( !empty($_GET['post_mime_type']) && wp_match_mime_types($mime_type, $_GET['post_mime_type']) )
 				$class = ' class="current"';
 			if ( !empty( $num_posts[$mime_type] ) )
-				$type_links[$mime_type] = "<a href='upload.php?post_mime_type=$mime_type'$class>" . sprintf( translate_nooped_plural( $label[2], $num_posts[$mime_type] ), number_format_i18n( $num_posts[$mime_type] )) . '</a>';
+				$type_links[$mime_type] = '<a href="upload.php?post_mime_type=' . urlencode( $mime_type ) . '"' . $class . '>' . sprintf( translate_nooped_plural( $label[2], $num_posts[$mime_type] ), number_format_i18n( $num_posts[$mime_type] )) . '</a>';
 		}
 		$type_links['detached'] = '<a href="upload.php?detached=1"' . ( $this->detached ? ' class="current"' : '' ) . '>' . sprintf( _nx( 'Unattached <span class="count">(%s)</span>', 'Unattached <span class="count">(%s)</span>', $total_orphans, 'detached files' ), number_format_i18n( $total_orphans ) ) . '</a>';
 
diff --git a/wp-includes/post.php b/wp-includes/post.php
index 8b1a19833e..60e24f3823 100644
--- a/wp-includes/post.php
+++ b/wp-includes/post.php
@@ -2329,27 +2329,37 @@ function get_post_mime_types() {
  * @param string|array $real_mime_types post_mime_type values
  * @return array array(wildcard=>array(real types))
  */
-function wp_match_mime_types($wildcard_mime_types, $real_mime_types) {
+function wp_match_mime_types( $wildcard_mime_types, $real_mime_types ) {
 	$matches = array();
-	if ( is_string($wildcard_mime_types) )
-		$wildcard_mime_types = array_map('trim', explode(',', $wildcard_mime_types));
-	if ( is_string($real_mime_types) )
-		$real_mime_types = array_map('trim', explode(',', $real_mime_types));
+	if ( is_string( $wildcard_mime_types ) ) {
+		$wildcard_mime_types = array_map( 'trim', explode( ',', $wildcard_mime_types ) );
+	}
+	if ( is_string( $real_mime_types ) ) {
+		$real_mime_types = array_map( 'trim', explode( ',', $real_mime_types ) );
+	}
+
+	$patternses = array();
 	$wild = '[-._a-z0-9]*';
+
 	foreach ( (array) $wildcard_mime_types as $type ) {
-		$type = str_replace('*', $wild, $type);
-		$patternses[1][$type] = "^$type$";
+		$regex = str_replace( '__wildcard__', $wild, preg_quote( str_replace( '*', '__wildcard__', $type ) ) );
+		$patternses[1][$type] = "^$regex$";
 		if ( false === strpos($type, '/') ) {
-			$patternses[2][$type] = "^$type/";
-			$patternses[3][$type] = $type;
+			$patternses[2][$type] = "^$regex/";
+			$patternses[3][$type] = $regex;
 		}
 	}
-	asort($patternses);
-	foreach ( $patternses as $patterns )
-		foreach ( $patterns as $type => $pattern )
-			foreach ( (array) $real_mime_types as $real )
-				if ( preg_match("#$pattern#", $real) && ( empty($matches[$type]) || false === array_search($real, $matches[$type]) ) )
+	asort( $patternses );
+
+	foreach ( $patternses as $patterns ) {
+		foreach ( $patterns as $type => $pattern ) {
+			foreach ( (array) $real_mime_types as $real ) {
+				if ( preg_match( "#$pattern#", $real ) && ( empty( $matches[$type] ) || false === array_search( $real, $matches[$type] ) ) ) {
 					$matches[$type][] = $real;
+				}
+			}
+		}
+	}
 	return $matches;
 }