From bb69fee584bc28c32038d70b386c25d07c0caa9f Mon Sep 17 00:00:00 2001
From: Robert Sesek <rsesek@bluestatic.org>
Date: Sun, 23 Oct 2005 21:18:41 +0000
Subject: [PATCH] Need to htmlspecialchars() the query string in an error

---
 db_mysql.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db_mysql.php b/db_mysql.php
index 0afcfed..d824e5f 100644
--- a/db_mysql.php
+++ b/db_mysql.php
@@ -288,7 +288,7 @@ class DB_MySQL
 			$style['code'] = 'font-family: \'Courier New\', Courier, mono; font-size: 11px;';
 			
 			$message_prepped = "<blockquote>\n<p>";
-			$message_prepped .= "\n\t&raquo; <strong>Query:</strong>\n<br /> <pre style=\"$style[code]\">" . $this->query_str ."</pre>\n<br />";
+			$message_prepped .= "\n\t&raquo; <strong>Query:</strong>\n<br /> <pre style=\"$style[code]\">" . htmlspecialchars($this->query_str) ."</pre>\n<br />";
 			$message_prepped .= "\n\t&raquo; <strong>Error Number:</strong> <span style=\"$style[code]\">" . $this->error_no . "</span>\n<br />";
 			$message_prepped .= "\n\t&raquo; <strong>Error Message:</strong> <span style=\"$style[code]\">" . $this->error_str . "</span>\n<br />";
 			$message_prepped .= "\n\t&raquo; <strong>Additional Notes:</strong> <span style=\"$style[code]\">" . $message . "</span>\n<br />";
-- 
2.43.5