t#2439 protect against SQL injection in write-in field