Fix SQL injection bug

diff --git a/includes/SpecialMaintenance.php b/includes/SpecialMaintenance.php
index 6f74bd5..3166c5a 100644 (file)
--- a/includes/SpecialMaintenance.php
+++ b/includes/SpecialMaintenance.php
@@ -269,7 +269,7 @@ function wfSpecialMissingLanguageLinks() {
 
        $sql = "SELECT cur_title FROM $cur " .
          "WHERE cur_namespace=0 AND cur_is_redirect=0 " .
-         "AND cur_title NOT LIKE '%/%' AND cur_text NOT LIKE '%[[{$thelang}:%' " .
+         "AND cur_title NOT LIKE '%/%' AND cur_text NOT LIKE '%[[" . wfStrencode( $thelang ) . ":%' " .
          "LIMIT {$offset}, {$limit}";
 
        $res = $dbr->query( $sql, $fname );