silverstripe/sapphire — pull request #451 by chillu (2012-05-16 09:33:18+00:00)
Title: Improved security docs around DataList, SQLQuery

I figured since we're changing so many APIs, its going to be very easy for newcomers to cause some security holes in their code. Actually, I don't really know myself all the places which need escaping in `DataList`, and made some surprising discoveries on what I assumed to be "safe autoescaped input" (e.g. column names). This is a sensitive topic, so I'd appreciate somebody going through my changes with the fine comb.

Changed the escaping behaviour in a couple of places, where I added auto-escaping if the input was strictly defined as a column name (as opposed to "column name or composite SQL statement").