#227548 by Heine, AjK: misuse of db_escape_string(), when db_escape_t…

…able() should have been used
mikl · Feb 27, 2008 · 021f59b · 021f59b
1 parent 1567cce
commit 021f59b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/node/node.module b/modules/node/node.module
@@ -1,5 +1,5 @@
 <?php
-// $Id: node.module,v 1.947.2.2 2008-02-13 14:10:22 goba Exp $
+// $Id: node.module,v 1.947.2.3 2008-02-27 17:12:58 goba Exp $
 
 /**
  * @file
@@ -716,7 +716,7 @@ function node_load($param = array(), $revision = NULL, $reset = NULL) {
   elseif (is_array($param)) {
     // Turn the conditions into a query.
     foreach ($param as $key => $value) {
-      $cond[] = 'n.'. db_escape_string($key) ." = '%s'";
+      $cond[] = 'n.'. db_escape_table($key) ." = '%s'";
       $arguments[] = $value;
     }
     $cond = implode(' AND ', $cond);