fix SQL injection

diff --git a/DataObjects/Core_person.php b/DataObjects/Core_person.php
index 80187c3..0a499a4 100644 (file)
--- a/DataObjects/Core_person.php
+++ b/DataObjects/Core_person.php
@@ -1051,7 +1051,7 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
         // #2307 Search Country!!
         if (!empty($q['query']['in_country'])) {
             // DB_DataObject::debugLevel(1);
-            $inc = $q['query']['in_country'];
+            $inc = $this->escape($q['query']['in_country']);
             $this->whereAdd("$tn_p.countries LIKE '%{$inc}%'");
         }