escape html characters in db_query() error output

diff --git a/db.php b/db.php
index 35985815baf795b42cd1a2f313f5ea3a0c298bfd..c72bbd9dfab89ac7f78bcfc3a8c6007ab1dc52a7 100644 (file)
--- a/db.php
+++ b/db.php
@@ -55,12 +55,14 @@ function db_query($link, $query) {
        if (DB_TYPE == "pgsql") {
                $result = pg_query($link, $query);
                if (!$result) {
+                       $query = htmlspecialchars($query); // just in case
                        die("Query <i>$query</i> failed: " . pg_last_error($link));                     
                }
                return $result;
        } else if (DB_TYPE == "mysql") {
                $result = mysql_query($query, $link);
                if (!$result) {
+                       $query = htmlspecialchars($query);
                        die("Query <i>$query</i> failed: " . mysql_error($link));
                }
                return $result;