SQL injection fix

events/common.py

@@ -82,15 +82,18 @@ class Lastact():
         # Update record.
         fields = "last_act_type, last_act_datetime"
         values = "'" + type + "', '" + str(datetime.now()) + "'"
+        parameters = ()
         if channel:
             fields = fields + ", last_act_channel"
             values = values + ", '" + channel + "'"
         if lastact:
             fields = fields + ", last_act"
-            values = values + ", '" + lastact + "'"
+            values = values + ", %s"
+            parameters = (lastact, )
         if auxiliary:
             fields = fields + ", last_act_auxiliary"
-            values = values + ", '" + auxiliary + "'"
-        self.db.run("UPDATE users SET (" + fields + ") = (" + values + ") WHERE name='" + name + "' AND network='" + self.network + "'")
+            values = values + ", %s"
+            parameters = parameters + (auxiliary, )
+        self.db.run("UPDATE users SET (" + fields + ") = (" + values + ") WHERE name='" + name + "' AND network='" + self.network + "'", parameters)