gallery/gallery3 — pull request #100 by shadlaws (2013-01-21 15:22:49+00:00)
Title: #1956 - Escape LIKE queries (for _ and %).

In MySQL queries, _ and % characters are treated as wildcards (similar to ? and *, respectively).
So, this: db::build()->where("name", "LIKE", "{$foo}%")
Should be escaped like this: db::build()->where("name", "LIKE", addcslashes($foo, "_%") . "%")
This commit corrects the five unescaped instances in the code.