| Index: trunk/phase3/includes/api/ApiQueryBacklinks.php |
| — | — | @@ -141,7 +141,7 @@ |
| 142 | 142 | $titleWhere = ''; |
| 143 | 143 | foreach($this->redirTitles as $t) |
| 144 | 144 | $titleWhere .= ($titleWhere != '' ? " OR " : '') . |
| 145 | | - "({$this->bl_title} = '{$t->getDBKey()}'" . |
| | 145 | + "({$this->bl_title} = ".$db->addQuotes($t->getDBKey()). |
| 146 | 146 | ($this->hasNS ? " AND {$this->bl_ns} = '{$t->getNamespace()}'" : "") . |
| 147 | 147 | ")"; |
| 148 | 148 | $this->addWhere($titleWhere); |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -444,6 +444,7 @@ |
| 445 | 445 | * Added action=emailuser to send an email to a user |
| 446 | 446 | * (bug 14471) Use HTMLTidy and generate limit report in action=parse |
| 447 | 447 | * (bug 14459) Added prependtext and appendtext parameters to action=edit |
| | 448 | +* (bug 14526) Unescaped SQL in list=backlinks |
| 448 | 449 | |
| 449 | 450 | === Languages updated in 1.13 === |
| 450 | 451 | |