Index: openacs-4/packages/acs-templating/tcl/list-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/list-procs.tcl,v diff -u -r1.89 -r1.90 --- openacs-4/packages/acs-templating/tcl/list-procs.tcl 17 Jul 2018 13:32:18 -0000 1.89 +++ openacs-4/packages/acs-templating/tcl/list-procs.tcl 25 Jul 2018 01:35:53 -0000 1.90 @@ -1000,7 +1000,7 @@ } set quoted_ids [list] foreach one_id $ids { - lappend quoted_ids "'[DoubleApos $one_id]'" + lappend quoted_ids [::ns_dbquotevalue $one_id] } return [join $quoted_ids ","] } Index: openacs-4/packages/acs-templating/tcl/paginator-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/paginator-procs.tcl,v diff -u -r1.32 -r1.33 --- openacs-4/packages/acs-templating/tcl/paginator-procs.tcl 11 Jun 2018 22:04:00 -0000 1.32 +++ openacs-4/packages/acs-templating/tcl/paginator-procs.tcl 25 Jul 2018 01:35:53 -0000 1.33 @@ -747,7 +747,7 @@ # necessarily limited to integer keys set quoted_ids [list] foreach one_id $ids { - lappend quoted_ids "'[DoubleApos $one_id]'" + lappend quoted_ids [::ns_dbquotevalue $one_id] } set in_list [join $quoted_ids ","] if { ! [regsub CURRENT_PAGE_SET $query $in_list query] } { @@ -819,7 +819,7 @@ # necessarily limited to integer keys set quoted_ids [list] foreach one_id $ids { - lappend quoted_ids "'[DoubleApos $one_id]'" + lappend quoted_ids [::ns_dbquotevalue $one_id] } set in_list [join $quoted_ids ","] if { ! [regsub CURRENT_PAGE_SET $query $in_list query] } { Index: openacs-4/packages/acs-templating/tcl/richtext-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/richtext-procs.tcl,v diff -u -r1.63 -r1.64 --- openacs-4/packages/acs-templating/tcl/richtext-procs.tcl 1 May 2018 09:34:09 -0000 1.63 +++ openacs-4/packages/acs-templating/tcl/richtext-procs.tcl 25 Jul 2018 01:35:53 -0000 1.64 @@ -579,8 +579,8 @@ Handle richtext transformations using a standardized naming convention. } { - return "'[DoubleApos [list [template::util::richtext::get_property content $value] \ - [template::util::richtext::get_property format $value]]]'" + return [::ns_dbquotevalue [list [template::util::richtext::get_property content $value] \ + [template::util::richtext::get_property format $value]]] } Index: openacs-4/packages/acs-templating/tcl/util-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/util-procs.tcl,v diff -u -r1.39 -r1.40 --- openacs-4/packages/acs-templating/tcl/util-procs.tcl 16 May 2018 11:50:02 -0000 1.39 +++ openacs-4/packages/acs-templating/tcl/util-procs.tcl 25 Jul 2018 01:35:53 -0000 1.40 @@ -607,11 +607,11 @@ ad_proc -public template::util::tcl_to_sql_list { lst } { Convert a Tcl list to a SQL list, for use with the "in" statement. - Uses DoubleApos (similar to ns_dbquotevalue) functionality to escape single quotes + Uses double single quotes (similar to ns_dbquotevalue) to escape single quotes } { if { [llength $lst] > 0 } { - # adding DoubleApos functionality for security reasons. + # replace single quotes by two single quotes regsub -all -- ' "$lst" '' lst2 set sql "'" append sql [join $lst2 "', '"]