Bug in SQL used to fetch from Alert table

Hi,

It seems that there's a bug in some SQL which relates to the Alerts table.

If a single quote character (') appears in the ENTITY column (and perhaps also the MMESSAGE column), things go a bit funny when you try to ask for the list of alarms. Also, the "Recent Alarms" list doesn't appear on the dashboard page.

I think that maybe a literal SQL statement is being built using a value fetched from the Alerts table - the presence of the single quote character messes with the SQL syntax, which causes MySQL to choke. Maybe use a bind variable instead?

To fix the problem I had to edit the database directly and remove the single quote characters from the data in the Alarms table.

thanks,
alec