escape title when auto-updated from channel

diff --git a/functions.php b/functions.php
index 378e123f25da94c8913a010d4b4dc3dcab7629d4..962b03e8fffa2588c2289d4abd093c96f0b3ef28 100644 (file)
--- a/functions.php
+++ b/functions.php
@@ -91,7 +91,7 @@
                        $orig_icon_url = db_fetch_result($result, 0, "icon_url");
 
                        if (!$registered_title) {
-                               $feed_title = $rss->channel["title"];
+                               $feed_title = db_escape_string($rss->channel["title"]);
                                db_query($link, "UPDATE ttrss_feeds SET title = '$feed_title' WHERE id = '$feed'");
                        }