2 files changed, 8 insertions, 1 deletions
diff --git a/juick-www/src/main/java/com/juick/www/Utils.java b/juick-www/src/main/java/com/juick/www/Utils.java
index 8ab277db..3b1932d0 100644
--- a/juick-www/src/main/java/com/juick/www/Utils.java
+++ b/juick-www/src/main/java/com/juick/www/Utils.java
@@ -27,7 +27,8 @@ public class Utils {
 
 
     public static String encodeSphinx(String str) {
-        return str.replaceAll("@", "\\\\@");
+        return str.replaceAll("@", "\\\\@")
+                .replaceAll("\\'", "\\\\'");
     }
 
     /**
diff --git a/juick-www/src/test/java/com/juick/WebAppTests.java b/juick-www/src/test/java/com/juick/WebAppTests.java
index e74b694e..74be2c92 100644
--- a/juick-www/src/test/java/com/juick/WebAppTests.java
+++ b/juick-www/src/test/java/com/juick/WebAppTests.java
@@ -25,6 +25,7 @@ import com.gargoylesoftware.htmlunit.html.DomElement;
 import com.gargoylesoftware.htmlunit.html.HtmlPage;
 import com.juick.service.*;
 import com.juick.util.MessageUtils;
+import com.juick.www.Utils;
 import com.juick.www.WebApp;
 import com.mitchellbosecke.pebble.PebbleEngine;
 import com.mitchellbosecke.pebble.error.PebbleException;
@@ -414,4 +415,9 @@ public class WebAppTests {
         HtmlPage unreadThread = webClient.getPage(String.format("http://localhost:8080/ugnich/%d", mid));
         assertThat(unreadThread.querySelectorAll("#global a .badge").size(), is(0));
     }
+    @Test
+    public void escapeSqlTests() {
+        String sql = String.format("SELECT * FROM table WHERE data='%s'", Utils.encodeSphinx("';-- DROP TABLE table"));
+        assertThat(sql, is("SELECT * FROM table WHERE data='\\';-- DROP TABLE table\'"));
+    }
 }