LimeSurvey/LimeSurvey — pull request #118 by madflow (2013-09-01 19:19:17+00:00)
Title: Intermediate fix for "token" SQL Injection Vulnerability in access prote...

The token parameter in "controlled" surveys is not properly escaped and can be exploited for SQL injection attacks. I only tested this with latest HEAD version.

Steps to reproduce:

1. Create a survey
2. Make it access protected
3. Create a token (or not...)
4. Activate the survey

In the token submit form of the live survey input something like:

```token=1'; SELECT SLEEP(5)-- ```

or use sqlmap.

The pull request has been created with good intentions - but should be reviewed. I believe the whole script ```application/controllers/survey/index.php``` has other similar references.