080a160c7b9595d516c9c70e83689a09b60839d0
galt
  Mon Jun 3 12:16:53 2013 -0700
fix SQL Injection
diff --git src/hg/lib/cartDb.c src/hg/lib/cartDb.c
index d7c13c4..fdecba5 100644
--- src/hg/lib/cartDb.c
+++ src/hg/lib/cartDb.c
@@ -54,33 +54,33 @@
 lineFileClose(&lf);
 slReverse(&list);
 return list;
 }
 
 struct cartDb *cartDbLoadWhere(struct sqlConnection *conn, char *table, char *where)
 /* Load all cartDb from table that satisfy where clause. The
  * where clause may be NULL in which case whole table is loaded
  * Dispose of this with cartDbFreeList(). */
 {
 struct cartDb *list = NULL, *el;
 struct dyString *query = dyStringNew(256);
 struct sqlResult *sr;
 char **row;
 
-dyStringPrintf(query, "select * from %s", table);
+sqlDyStringPrintf(query, "select * from %s", table);
 if (where != NULL)
-    dyStringPrintf(query, " where %s", where);
+    dyStringPrintf(query, " where %s", where); // the where clause must be checked by caller for sqli
 sr = sqlGetResult(conn, query->string);
 while ((row = sqlNextRow(sr)) != NULL)
     {
     el = cartDbLoad(row);
     slAddHead(&list, el);
     }
 slReverse(&list);
 sqlFreeResult(&sr);
 dyStringFree(&query);
 return list;
 }
 
 struct cartDb *cartDbCommaIn(char **pS, struct cartDb *ret)
 /* Create a cartDb out of a comma separated string. 
  * This will fill in ret if non-null, otherwise will