cde03431a6a4f1f6eb256b3e0c2521c2dd77869b
galt
  Wed May 4 14:16:12 2016 -0700
Oops sql injection fixes.

diff --git src/hg/hgc/hgc.c src/hg/hgc/hgc.c
index 3ffff67..6efff4b 100644
--- src/hg/hgc/hgc.c
+++ src/hg/hgc/hgc.c
@@ -1165,55 +1165,55 @@
 slReverse(&bedList);
 showBedTopScorers(bedList, item, start, maxScorers);
 }
 
 void getBedTopScorers(struct sqlConnection *conn, struct trackDb *tdb,
                    char *table, char *item, int start, int bedSize)
 /* This function determines if showTopScorers is set in trackDb and also */
 /* if the filterTopScorers setting is on. Then it passes the relevant */
 /* settings to showBedTopScorersInWindow() so that the top N scoring */
 /* items in the window are listed on the details page */
 {
 char *showTopScorers = trackDbSetting(tdb, "showTopScorers");
 char *filterTopScorers = trackDbSetting(tdb,"filterTopScorers");
 boolean doFilterTopScorers = FALSE;
 char *words[3];
-char query[512];
+char cartVar[512];
 int filterTopScoreCt = 0;
 char *filterTopScoreTable = NULL;
 
-safef(query, sizeof query, "%s.%s", table, "filterTopScorersOn");
+safef(cartVar, sizeof cartVar, "%s.%s", table, "filterTopScorersOn");
 if (filterTopScorers != NULL)
     {
     if (chopLine(cloneString(filterTopScorers), words) == 3)
         {
         doFilterTopScorers = sameString(words[0], "on");
         filterTopScoreCt = atoi(words[1]);
         filterTopScoreTable = words[2];
         }
     }
 
 if (bedSize >= 5 && showTopScorers != NULL)
     {
     /* list top-scoring elements in window */
     int maxScorers = sqlUnsigned(showTopScorers);
-    doFilterTopScorers = cartCgiUsualBoolean(cart, query, doFilterTopScorers);
+    doFilterTopScorers = cartCgiUsualBoolean(cart, cartVar, doFilterTopScorers);
     if (doFilterTopScorers && hTableExists(database, filterTopScoreTable))
         {
         /* limit to those in the top N, from table */
-        safef(query, sizeof query, "%s.%s", table, "filterTopScorersCt");
-        filterTopScoreCt = cartCgiUsualInt(cart, query, filterTopScoreCt);
+        safef(cartVar, sizeof cartVar, "%s.%s", table, "filterTopScorersCt");
+        filterTopScoreCt = cartCgiUsualInt(cart, cartVar, filterTopScoreCt);
         }
     else
         /* show all */
         filterTopScoreTable = NULL;
     showBedTopScorersInWindow(conn, tdb, item, start, maxScorers,
                                 filterTopScoreTable, filterTopScoreCt);
     }
 }
 
 void linkToOtherBrowser(char *otherDb, char *chrom, int start, int end);
 void linkToOtherBrowserExtra(char *otherDb, char *chrom, int start, int end, char *extra);
 
 static void printCompareGenomeLinks(struct trackDb *tdb,char *name)
 /* if "compareGenomeLinks" exists then a table of the same name in n different databases is sought.
    if a row exist in the other db table matching the current item, then a link is printed */
@@ -14767,31 +14767,31 @@
 		pslStart = psl->tStart;
 	    slAddHead(&pslList, psl);
 	    i++;
 	    }
 	slReverse(&pslList);
         if (i > 0)
 	    {
 	    printf("<H3>Primers:</H3>\n");
 	    printAlignments(pslList, pslStart, "htcCdnaAli", "all_sts_primer", stsPrimer);
 	    sqlFreeResult(&sr1);
 	    }
 	slFreeList(&pslList);
 	stsInfoRatFree(&infoRow);
 
 	/* Find sts in clone sequece alignment info */
-        safef(query1, sizeof(query1), "qName = '%s'", stsClone);
+        sqlSafefFrag(query1, sizeof(query1), "qName = '%s'", stsClone);
 	sr2 = hRangeQuery(conn1, "all_sts_primer", seqName, start, end, query1,
 			  &hasBin);
 	i = 0;
 	pslStart = 0;
 	while ((row = sqlNextRow(sr2)) != NULL )
             {
 	    psl = pslLoad(row+hasBin);
 	    fflush(stdout);
 	    if ((sameString(psl->tName, seqName)) && (abs(psl->tStart - start) < 1000))
 		pslStart = psl->tStart;
 	    slAddHead(&pslList, psl);
 	    i++;
 	    }
 	slReverse(&pslList);
         if (i > 0)