completeLabels: use prepare() not query()

7 years ago · 731ecac530
parent ed5cd6eae5
commit 731ecac530
1 changed files with 1 additions and 1 deletions
--- a/classes/rpc.php
+++ b/classes/rpc.php
@ -334,7 +334,7 @@ class RPC extends Handler_Protected {
 	function completeLabels() {
 		$search = $_REQUEST["search"];

-		$sth = $this->pdo->query("SELECT DISTINCT caption FROM
+		$sth = $this->pdo->prepare("SELECT DISTINCT caption FROM
 				ttrss_labels2
 				WHERE owner_uid = ? AND
 				LOWER(caption) LIKE LOWER(?) ORDER BY caption