Index: branches/5.1.x/core/units/custom_fields/custom_fields_event_handler.php
===================================================================
diff -u -N -r12127 -r12657
--- branches/5.1.x/core/units/custom_fields/custom_fields_event_handler.php	(.../custom_fields_event_handler.php)	(revision 12127)
+++ branches/5.1.x/core/units/custom_fields/custom_fields_event_handler.php	(.../custom_fields_event_handler.php)	(revision 12657)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: custom_fields_event_handler.php 11892 2009-07-01 08:35:06Z alex $
+* @version	$Id: custom_fields_event_handler.php 12657 2009-10-04 20:07:31Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -11,6 +11,9 @@
 * or other free or open source software licenses.
 * See http://www.in-portal.net/license/ for copyright notices and details.
 */
+
+	defined('FULL_PATH') or die('restricted access!');
+
 	class CustomFieldsEventHandler extends kDBEventHandler {
 
 		/**
@@ -79,7 +82,7 @@
 			if (!$prefix) {
 				$sql = 'SELECT Prefix
 						FROM ' . TABLE_PREFIX . 'ItemTypes
-						WHERE ItemType = ' . $this->Application->GetVar('cf_type');
+						WHERE ItemType = ' . $this->Conn->qstr( $this->Application->GetVar('cf_type') );
 				$prefix = $this->Conn->GetOne($sql);
 			}
 
@@ -303,5 +306,4 @@
 		{
 			return strcasecmp($record_a['OptionTitle'], $record_b['OptionTitle']);
 		}
-	}
-?>
\ No newline at end of file
+	}
\ No newline at end of file