080a160c7b9595d516c9c70e83689a09b60839d0
galt
  Mon Jun 3 12:16:53 2013 -0700
fix SQL Injection
diff --git src/hg/lib/hgExp.c src/hg/lib/hgExp.c
index 6d60a0a..f50bfda 100644
--- src/hg/lib/hgExp.c
+++ src/hg/lib/hgExp.c
@@ -46,31 +46,31 @@
 char query[256], nameBuf[128];
 int maxLen = 0, len;
 
 if (!hTableExists(database, table))
     db = "hgFixed";
 conn = sqlConnect(db);
 /* Read into array and figure out longest name. */
 AllocArray(names, expCount);
 for (i=0; i<expCount; ++i)
     {
     int ix = expIds[i];
     if (ix == -1)
         names[i] = NULL;
     else
 	{
-	safef(query, sizeof(query), "select name from %s where id = %d", 
+	sqlSafef(query, sizeof(query), "select name from %s where id = %d", 
 	    table, expIds[i]);
 	if ((name = sqlQuickQuery(conn, query, nameBuf, sizeof(nameBuf))) == NULL)
 	    name = "unknown";
 	else
 	    name += skipSize;
 	names[i] = cloneString(name);
 	len = strlen(name);
 	if (len > maxLen) maxLen = len;
 	}
     }
 sqlDisconnect(&conn);
 
 /* Right justify names. */
 for (i=0; i<expCount; ++i)
     {
@@ -133,39 +133,39 @@
 
 boolean hgExpLoadVals(struct sqlConnection *lookupConn,
 	struct sqlConnection *dataConn,
 	char *lookupTable, char *name, char *dataTable,
 	int *retValCount, float **retVals)
 /* Load up and return expression bed record.  Return NULL
  * if none of given name exist. */
 {
 char query[256];
 char expName[64];
 struct sqlResult *sr;
 char **row;
 boolean ok = FALSE;
 if (!sameWord(lookupTable, "null"))
     {
-    safef(query, sizeof(query), "select value from %s where name = '%s'", 
+    sqlSafef(query, sizeof(query), "select value from %s where name = '%s'", 
 	  lookupTable, name);
     if (sqlQuickQuery(lookupConn, query, expName, sizeof(expName)) == NULL)
 	return FALSE;
-    safef(query, sizeof(query), "select expScores from %s where name = '%s'",
+    sqlSafef(query, sizeof(query), "select expScores from %s where name = '%s'",
 	  dataTable, expName);
     }
 else
-    safef(query, sizeof(query), "select expScores from %s where name = '%s'",
+    sqlSafef(query, sizeof(query), "select expScores from %s where name = '%s'",
 	  dataTable, name);    
 sr = sqlGetResult(dataConn, query);
 if ((row = sqlNextRow(sr)) != NULL)
     {
     sqlFloatDynamicArray(row[0], retVals, retValCount);
     ok = TRUE;
     }
 sqlFreeResult(&sr);
 return ok;
 }
 
 
 static void hexOne(double val)
 /* Convert val 0.0-1.0 to hex 00 to FF */
 {