Attempt to fix sql injection flaw in CalApps controller