fix sql injection hole in pacrypt if $CONF[encrypt] == mysql_encrypt (thanks to Filippo Cavallarin)

git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3@1319 a1433add-5e2c-0410-b055-b7f2511e0802

functions.inc.php

@@ -1189,6 +1189,7 @@ function pacrypt ($pw, $pw_db="")
     // this is apparently useful for pam_mysql etc.
     elseif ($CONF['encrypt'] == 'mysql_encrypt')
     {
+        $pw = escape_string($pw);
         if ($pw_db!="") {
             $salt=substr($pw_db,0,2);
             $res=db_query("SELECT ENCRYPT('".$pw."','".$salt."');");