1 files changed, 4 insertions, 4 deletions
diff --git a/all.php b/all.php
index 44bc6f4..ac0fa16 100644
--- a/all.php
+++ b/all.php
@@ -66,17 +66,17 @@ function report ($db)
         $sql = sprintf(
             "SELECT DISTINCT name
              FROM rpm
-             WHERE SUBSTRING(name,1,1)='%s'
+             WHERE SUBSTRING(name,1,1) = %s
              ORDER BY name",
-            substr($what, 1, 1)
+            $db->quote(substr($what, 1, 1))
         );
     } else {
         $sql = sprintf(
             "SELECT DISTINCT name
              FROM acls
-             WHERE owner='%s'
+             WHERE owner = %s
              ORDER BY name",
-            $what
+            $db->quote($what)
         );
     }
     //echo "<p>SQL=$sql</p>";