refs #1: Core upgrade: sql-injection patch