? sites/default/files
? sites/default/settings.php
Index: includes/actions.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/actions.inc,v
retrieving revision 1.8
diff -u -p -r1.8 actions.inc
--- includes/actions.inc	31 Dec 2007 14:51:04 -0000	1.8
+++ includes/actions.inc	26 Jan 2008 16:38:12 -0000
@@ -238,7 +238,7 @@ function actions_function_lookup($hash) 
   }
 
   // Must be an instance; must check database.
-  $aid = db_result(db_query("SELECT aid FROM {actions} WHERE MD5(aid) = '%s' AND parameters != ''", $hash));
+  $aid = db_result(db_query("SELECT aid FROM {actions} WHERE MD5(aid) = '%s' AND parameters != '%s'", $hash, ''));
   return $aid;
 }
 
@@ -255,7 +255,7 @@ function actions_synchronize($actions_in
     $actions_in_code = actions_list();
   }
   $actions_in_db = array();
-  $result = db_query("SELECT * FROM {actions} WHERE parameters = ''");
+  $result = db_query("SELECT * FROM {actions} WHERE parameters = '%s'", '');
   while ($action = db_fetch_object($result)) {
     $actions_in_db[$action->callback] = array('aid' => $action->aid, 'description' => $action->description);
   }
Index: includes/cache.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/cache.inc,v
retrieving revision 1.16
diff -u -p -r1.16 cache.inc
--- includes/cache.inc	26 Nov 2007 16:19:37 -0000	1.16
+++ includes/cache.inc	26 Jan 2008 16:38:12 -0000
@@ -171,7 +171,7 @@ function cache_clear_all($cid = NULL, $t
         db_query("DELETE FROM {". $table ."}");
       }
       else {
-        db_query("DELETE FROM {". $table ."} WHERE cid LIKE '%s%%'", $cid);
+        db_query("DELETE FROM {". $table ."} WHERE cid LIKE '%s'", $cid ."%");
       }
     }
     else {
Index: includes/locale.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/locale.inc,v
retrieving revision 1.174
diff -u -p -r1.174 locale.inc
--- includes/locale.inc	9 Jan 2008 21:36:13 -0000	1.174
+++ includes/locale.inc	26 Jan 2008 16:38:15 -0000
@@ -1920,21 +1920,21 @@ function _locale_translate_seek() {
     // Compute LIKE section
     switch ($query['translation']) {
       case 'translated':
-        $where = "WHERE (t.translation LIKE '%%%s%%')";
+        $where = "WHERE (t.translation LIKE '%s')";
         $orderby = "ORDER BY t.translation";
-        $arguments[] = $query['string'];
+        $arguments[] = "%". $query['string'] ."%";
         break;
       case 'untranslated':
-        $where = "WHERE (s.source LIKE '%%%s%%' AND t.translation IS NULL)";
+        $where = "WHERE (s.source LIKE '%s' AND t.translation IS NULL)";
         $orderby = "ORDER BY s.source";
-        $arguments[] = $query['string'];
+        $arguments[] = "%". $query['string'] ."%";
         break;
       case 'all' :
       default:
-        $where = "WHERE (s.source LIKE '%%%s%%' OR t.translation LIKE '%%%s%%')";
+        $where = "WHERE (s.source LIKE '%s' OR t.translation LIKE '%s')";
         $orderby = '';
-        $arguments[] = $query['string'];
-        $arguments[] = $query['string'];
+        $arguments[] = "%". $query['string'] ."%";
+        $arguments[] = "%". $query['string'] ."%";
         break;
     }
     $grouplimit = '';
@@ -1946,8 +1946,8 @@ function _locale_translate_seek() {
     switch ($query['language']) {
       // Force search in source strings
       case "en":
-        $sql = $join ." WHERE s.source LIKE '%%%s%%' $grouplimit ORDER BY s.source";
-        $arguments = array($query['string']); // $where is not used, discard its arguments
+        $sql = $join ." WHERE s.source LIKE '%s' $grouplimit ORDER BY s.source";
+        $arguments = array("%". $query['string'] ."%"); // $where is not used, discard its arguments
         if (!empty($grouplimit)) {
           $arguments[] = $query['group'];
         }
@@ -2068,7 +2068,7 @@ function _locale_rebuild_js($langcode = 
 
   // Construct the array for JavaScript translations.
   // We sort on plural so that we have all plural forms before singular forms.
-  $result = db_query("SELECT s.lid, s.source, t.plid, t.plural, t.translation FROM {locales_source} s LEFT JOIN {locales_target} t ON s.lid = t.lid AND t.language = '%s' WHERE s.location LIKE '%%.js%%' AND s.textgroup = 'default' ORDER BY t.plural DESC", $language->language);
+  $result = db_query("SELECT s.lid, s.source, t.plid, t.plural, t.translation FROM {locales_source} s LEFT JOIN {locales_target} t ON s.lid = t.lid AND t.language = '%s' WHERE s.location LIKE '%s' AND s.textgroup = 'default' ORDER BY t.plural DESC", $language->language, '%.js%');
 
   $translations = $plurals = array();
   while ($data = db_fetch_object($result)) {
Index: includes/path.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/path.inc,v
retrieving revision 1.19
diff -u -p -r1.19 path.inc
--- includes/path.inc	4 Nov 2007 16:42:45 -0000	1.19
+++ includes/path.inc	26 Jan 2008 16:38:15 -0000
@@ -65,7 +65,7 @@ function drupal_lookup_path($action, $pa
         return $map[$path_language][$path];
       }
       // Get the most fitting result falling back with alias without language
-      $alias = db_result(db_query("SELECT dst FROM {url_alias} WHERE src = '%s' AND language IN('%s', '') ORDER BY language DESC", $path, $path_language));
+      $alias = db_result(db_query("SELECT dst FROM {url_alias} WHERE src = '%s' AND language IN('%s', '%s') ORDER BY language DESC", $path, $path_language, ''));
       $map[$path_language][$path] = $alias;
       return $alias;
     }
@@ -76,7 +76,7 @@ function drupal_lookup_path($action, $pa
       $src = '';
       if (!isset($map[$path_language]) || !($src = array_search($path, $map[$path_language]))) {
         // Get the most fitting result falling back with alias without language
-        if ($src = db_result(db_query("SELECT src FROM {url_alias} WHERE dst = '%s' AND language IN('%s', '') ORDER BY language DESC", $path, $path_language))) {
+        if ($src = db_result(db_query("SELECT src FROM {url_alias} WHERE dst = '%s' AND language IN('%s', '%s') ORDER BY language DESC", $path, $path_language, ''))) {
           $map[$path_language][$src] = $path;
         }
         else {
Index: modules/comment/comment.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/comment/comment.module,v
retrieving revision 1.617
diff -u -p -r1.617 comment.module
--- modules/comment/comment.module	25 Jan 2008 16:19:12 -0000	1.617
+++ modules/comment/comment.module	26 Jan 2008 16:38:20 -0000
@@ -732,7 +732,7 @@ function comment_save($edit) {
           $parent->thread = (string) rtrim((string) $parent->thread, '/');
 
           // Get the max value in _this_ thread.
-          $max = db_result(db_query("SELECT MAX(thread) FROM {comments} WHERE thread LIKE '%s.%%' AND nid = %d", $parent->thread, $edit['nid']));
+          $max = db_result(db_query("SELECT MAX(thread) FROM {comments} WHERE thread LIKE '%s' AND nid = %d", $parent->thread .".%", $edit['nid']));
 
           if ($max == '') {
             // First child of this parent.
Index: modules/filter/filter.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/filter/filter.module,v
retrieving revision 1.204
diff -u -p -r1.204 filter.module
--- modules/filter/filter.module	21 Jan 2008 15:08:24 -0000	1.204
+++ modules/filter/filter.module	26 Jan 2008 16:38:22 -0000
@@ -301,8 +301,8 @@ function filter_formats($index = NULL) {
     if (!$all) {
       $where = array();
       foreach ($user->roles as $rid => $role) {
-        $where[] = "roles LIKE '%%,%d,%%'";
-        $args[] = $rid;
+        $where[] = "roles LIKE '%s'";
+        $args[] = '%,'. (int) $rid .',%';
       }
       $query .= ' WHERE '. implode(' OR ', $where) .' OR format = %d';
       $args[] = variable_get('filter_default_format', 1);
Index: modules/node/node.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/node/node.admin.inc,v
retrieving revision 1.17
diff -u -p -r1.17 node.admin.inc
--- modules/node/node.admin.inc	28 Dec 2007 12:02:51 -0000	1.17
+++ modules/node/node.admin.inc	26 Jan 2008 16:38:23 -0000
@@ -466,7 +466,7 @@ function node_admin_nodes() {
   $result = pager_query(db_rewrite_sql('SELECT n.*, u.name FROM {node} n '. $filter['join'] .' INNER JOIN {users} u ON n.uid = u.uid '. $filter['where'] .' ORDER BY n.changed DESC'), 50, 0, NULL, $filter['args']);
 
   // Enable language column if locale is enabled or if we have any node with language
-  $count = db_result(db_query("SELECT COUNT(*) FROM {node} n WHERE language != ''"));
+  $count = db_result(db_query("SELECT COUNT(*) FROM {node} n WHERE language != '%s'", ''));
   $multilanguage = (module_exists('locale') || $count);
 
   $form['options'] = array('#type' => 'fieldset',
Index: modules/node/node.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/node/node.module,v
retrieving revision 1.941
diff -u -p -r1.941 node.module
--- modules/node/node.module	10 Jan 2008 15:57:10 -0000	1.941
+++ modules/node/node.module	26 Jan 2008 16:38:28 -0000
@@ -1150,7 +1150,7 @@ function node_search($op = 'search', $ke
 
     case 'status':
       $total = db_result(db_query('SELECT COUNT(*) FROM {node} WHERE status = 1'));
-      $remaining = db_result(db_query("SELECT COUNT(*) FROM {node} n LEFT JOIN {search_dataset} d ON d.type = 'node' AND d.sid = n.nid WHERE d.sid IS NULL OR d.reindex <> 0"));
+      $remaining = db_result(db_query("SELECT COUNT(*) FROM {node} n LEFT JOIN {search_dataset} d ON d.type = 'node' AND d.sid = n.nid WHERE d.sid IS NULL OR d.reindex != 0"));
       return array('remaining' => $remaining, 'total' => $total);
 
     case 'admin':
@@ -1758,7 +1758,7 @@ function node_update_index() {
   variable_set('node_cron_comments_scale', 1.0 / max(1, db_result(db_query('SELECT MAX(comment_count) FROM {node_comment_statistics}'))));
   variable_set('node_cron_views_scale', 1.0 / max(1, db_result(db_query('SELECT MAX(totalcount) FROM {node_counter}'))));
 
-  $result = db_query_range("SELECT n.nid FROM {node} n LEFT JOIN {search_dataset} d ON d.type = 'node' AND d.sid = n.nid WHERE d.sid IS NULL OR d.reindex <> 0 ORDER BY d.reindex ASC, n.nid ASC", 0, $limit);
+  $result = db_query_range("SELECT n.nid FROM {node} n LEFT JOIN {search_dataset} d ON d.type = 'node' AND d.sid = n.nid WHERE d.sid IS NULL OR d.reindex != 0 ORDER BY d.reindex ASC, n.nid ASC", 0, $limit);
 
   while ($node = db_fetch_object($result)) {
     _node_index_node($node);
Index: modules/path/path.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/path/path.admin.inc,v
retrieving revision 1.7
diff -u -p -r1.7 path.admin.inc
--- modules/path/path.admin.inc	8 Jan 2008 10:35:42 -0000	1.7
+++ modules/path/path.admin.inc	26 Jan 2008 16:38:29 -0000
@@ -15,13 +15,13 @@ function path_admin_overview($keys = NUL
   // Add the filter form above the overview table.
   $output = drupal_get_form('path_admin_filter_form', $keys);
   // Enable language column if locale is enabled or if we have any alias with language
-  $count = db_result(db_query("SELECT COUNT(*) FROM {url_alias} WHERE language != ''"));
+  $count = db_result(db_query("SELECT COUNT(*) FROM {url_alias} WHERE language != '%s'", ''));
   $multilanguage = (module_exists('locale') || $count);
 
   if ($keys) {
     // Replace wildcards with MySQL/PostgreSQL wildcards.
-    $keys = preg_replace('!\*+!', '%', $keys);
-    $sql = "SELECT * FROM {url_alias} WHERE dst LIKE '%%%s%%'";
+    $keys = "%". preg_replace('!\*+!', '%', $keys) ."%";
+    $sql = "SELECT * FROM {url_alias} WHERE dst LIKE '%s'";
   }
   else {
     $sql = 'SELECT * FROM {url_alias}';
Index: modules/profile/profile.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.admin.inc,v
retrieving revision 1.8
diff -u -p -r1.8 profile.admin.inc
--- modules/profile/profile.admin.inc	21 Jan 2008 15:20:43 -0000	1.8
+++ modules/profile/profile.admin.inc	26 Jan 2008 16:38:30 -0000
@@ -395,7 +395,7 @@ function profile_field_delete_submit($fo
  */
 function profile_admin_settings_autocomplete($string) {
   $matches = array();
-  $result = db_query_range("SELECT category FROM {profile_fields} WHERE LOWER(category) LIKE LOWER('%s%%')", $string, 0, 10);
+  $result = db_query_range("SELECT category FROM {profile_fields} WHERE LOWER(category) LIKE LOWER('%s')", $string ."%", 0, 10);
   while ($data = db_fetch_object($result)) {
     $matches[$data->category] = check_plain($data->category);
   }
Index: modules/profile/profile.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.module,v
retrieving revision 1.235
diff -u -p -r1.235 profile.module
--- modules/profile/profile.module	31 Dec 2007 08:54:37 -0000	1.235
+++ modules/profile/profile.module	26 Jan 2008 16:38:31 -0000
@@ -467,7 +467,7 @@ function profile_category_access($catego
     return TRUE;
   }
   else {
-    return db_result(db_query("SELECT COUNT(*) FROM {profile_fields} WHERE category = '%s' AND visibility <> %d", $category, PROFILE_HIDDEN));
+    return db_result(db_query("SELECT COUNT(*) FROM {profile_fields} WHERE category = '%s' AND visibility != %d", $category, PROFILE_HIDDEN));
   }
 }
 
Index: modules/profile/profile.pages.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.pages.inc,v
retrieving revision 1.2
diff -u -p -r1.2 profile.pages.inc
--- modules/profile/profile.pages.inc	8 Dec 2007 14:06:22 -0000	1.2
+++ modules/profile/profile.pages.inc	26 Jan 2008 16:38:31 -0000
@@ -46,8 +46,8 @@ function profile_browse() {
         $arguments[] = $value;
         break;
       case 'list':
-        $query = "v.value LIKE '%%%s%%'";
-        $arguments[] = $value;
+        $query = "v.value LIKE '%s'";
+        $arguments[] = "%". $value ."%";
         break;
       default:
         drupal_not_found();
@@ -110,7 +110,7 @@ function profile_browse() {
 function profile_autocomplete($field, $string) {
   $matches = array();
   if (db_result(db_query("SELECT COUNT(*) FROM {profile_fields} WHERE fid = %d AND autocomplete = 1", $field))) {
-    $result = db_query_range("SELECT value FROM {profile_values} WHERE fid = %d AND LOWER(value) LIKE LOWER('%s%%') GROUP BY value ORDER BY value ASC", $field, $string, 0, 10);
+    $result = db_query_range("SELECT value FROM {profile_values} WHERE fid = %d AND LOWER(value) LIKE LOWER('%s') GROUP BY value ORDER BY value ASC", $field, $string ."%", 0, 10);
     while ($data = db_fetch_object($result)) {
       $matches[$data->value] = check_plain($data->value);
     }
Index: modules/search/search.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/search/search.module,v
retrieving revision 1.250
diff -u -p -r1.250 search.module
--- modules/search/search.module	8 Jan 2008 10:35:42 -0000	1.250
+++ modules/search/search.module	26 Jan 2008 16:38:33 -0000
@@ -848,7 +848,7 @@ function _search_parse_query(&$word, &$s
     }
   }
   // Return matching snippet and number of added words
-  return array("d.data ". ($not ? 'NOT ' : '') ."LIKE '%% %s %%'", $num_new_scores, $num_valid_words);
+  return array("d.data ". ($not ? 'NOT ' : '') ."LIKE '%s'", "% ". $num_new_scores ." %", $num_valid_words);
 }
 
 /**
Index: modules/statistics/statistics.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/statistics/statistics.admin.inc,v
retrieving revision 1.6
diff -u -p -r1.6 statistics.admin.inc
--- modules/statistics/statistics.admin.inc	8 Jan 2008 10:35:42 -0000	1.6
+++ modules/statistics/statistics.admin.inc	26 Jan 2008 16:38:33 -0000
@@ -107,8 +107,8 @@ function statistics_top_visitors() {
  * Menu callback; presents the "referrer" page.
  */
 function statistics_top_referrers() {
-  $query = "SELECT url, COUNT(url) AS hits, MAX(timestamp) AS last FROM {accesslog} WHERE url NOT LIKE '%%%s%%' AND url <> '' GROUP BY url";
-  $query_cnt = "SELECT COUNT(DISTINCT(url)) FROM {accesslog} WHERE url <> '' AND url NOT LIKE '%%%s%%'";
+  $query = "SELECT url, COUNT(url) AS hits, MAX(timestamp) AS last FROM {accesslog} WHERE url NOT LIKE '%s' AND url != '%s' GROUP BY url";
+  $query_cnt = "SELECT COUNT(DISTINCT(url)) FROM {accesslog} WHERE url NOT LIKE '%s' AND url != '%s'";
   drupal_set_title(t('Top referrers in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))));
 
   $header = array(
@@ -118,7 +118,7 @@ function statistics_top_referrers() {
   );
 
   $query .= tablesort_sql($header);
-  $result = pager_query($query, 30, 0, $query_cnt, $_SERVER['HTTP_HOST']);
+  $result = pager_query($query, 30, 0, $query_cnt, "%". $_SERVER['HTTP_HOST'] ."%", '');
 
   $rows = array();
   while ($referrer = db_fetch_object($result)) {
Index: modules/statistics/statistics.pages.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/statistics/statistics.pages.inc,v
retrieving revision 1.2
diff -u -p -r1.2 statistics.pages.inc
--- modules/statistics/statistics.pages.inc	20 Oct 2007 21:57:50 -0000	1.2
+++ modules/statistics/statistics.pages.inc	26 Jan 2008 16:38:34 -0000
@@ -15,7 +15,7 @@ function statistics_node_tracker() {
         array('data' => t('User'), 'field' => 'u.name'),
         array('data' => t('Operations')));
 
-    $result = pager_query('SELECT a.aid, a.timestamp, a.url, a.uid, u.name FROM {accesslog} a LEFT JOIN {users} u ON a.uid = u.uid WHERE a.path LIKE \'node/%d%%\''. tablesort_sql($header), 30, 0, NULL, $node->nid);
+    $result = pager_query("SELECT a.aid, a.timestamp, a.url, a.uid, u.name FROM {accesslog} a LEFT JOIN {users} u ON a.uid = u.uid WHERE a.path LIKE '%s'". tablesort_sql($header), 30, 0, NULL, "node/". (int) $node->nid ."%");
     $rows = array();
     while ($log = db_fetch_object($result)) {
       $rows[] = array(
Index: modules/system/system.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.module,v
retrieving revision 1.580
diff -u -p -r1.580 system.module
--- modules/system/system.module	24 Jan 2008 10:46:54 -0000	1.580
+++ modules/system/system.module	26 Jan 2008 16:38:38 -0000
@@ -1308,7 +1308,7 @@ function system_actions_manage() {
   }
 
   $row = array();
-  $instances_present = db_fetch_object(db_query("SELECT aid FROM {actions} WHERE parameters != ''"));
+  $instances_present = db_fetch_object(db_query("SELECT aid FROM {actions} WHERE parameters != '%s'", ''));
   $header = array(
     array('data' => t('Action type'), 'field' => 'type'),
     array('data' => t('Description'), 'field' => 'description'),
Index: modules/taxonomy/taxonomy.pages.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/taxonomy/taxonomy.pages.inc,v
retrieving revision 1.9
diff -u -p -r1.9 taxonomy.pages.inc
--- modules/taxonomy/taxonomy.pages.inc	18 Jan 2008 16:23:57 -0000	1.9
+++ modules/taxonomy/taxonomy.pages.inc	26 Jan 2008 16:38:39 -0000
@@ -119,7 +119,7 @@ function taxonomy_autocomplete($vid, $st
   $last_string = trim(array_pop($array));
   $matches = array();
   if ($last_string != '') {
-    $result = db_query_range(db_rewrite_sql("SELECT t.tid, t.name FROM {term_data} t WHERE t.vid = %d AND LOWER(t.name) LIKE LOWER('%%%s%%')", 't', 'tid'), $vid, $last_string, 0, 10);
+    $result = db_query_range(db_rewrite_sql("SELECT t.tid, t.name FROM {term_data} t WHERE t.vid = %d AND LOWER(t.name) LIKE LOWER('%s')", 't', 'tid'), $vid, "%". $last_string ."%", 0, 10);
 
     $prefix = count($array) ? implode(', ', $array) .', ' : '';
 
Index: modules/user/user.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/user/user.module,v
retrieving revision 1.889
diff -u -p -r1.889 user.module
--- modules/user/user.module	22 Jan 2008 07:51:56 -0000	1.889
+++ modules/user/user.module	26 Jan 2008 16:38:42 -0000
@@ -568,13 +568,13 @@ function user_search($op = 'search', $ke
         $keys = preg_replace('!\*+!', '%', $keys);
         if (user_access('administer users')) {
           // Administrators can also search in the otherwise private email field.
-          $result = pager_query("SELECT name, uid, mail FROM {users} WHERE LOWER(name) LIKE LOWER('%%%s%%') OR LOWER(mail) LIKE LOWER('%%%s%%')", 15, 0, NULL, $keys, $keys);
+          $result = pager_query("SELECT name, uid, mail FROM {users} WHERE LOWER(name) LIKE LOWER('%s') OR LOWER(mail) LIKE LOWER('%s')", 15, 0, NULL, "%". $keys ."%", "%". $keys ."%");
           while ($account = db_fetch_object($result)) {
             $find[] = array('title' => $account->name .' ('. $account->mail .')', 'link' => url('user/'. $account->uid, array('absolute' => TRUE)));
           }
         }
         else {
-          $result = pager_query("SELECT name, uid FROM {users} WHERE LOWER(name) LIKE LOWER('%%%s%%')", 15, 0, NULL, $keys);
+          $result = pager_query("SELECT name, uid FROM {users} WHERE LOWER(name) LIKE LOWER('%s')", 15, 0, NULL, "%". $keys ."%");
           while ($account = db_fetch_object($result)) {
             $find[] = array('title' => $account->name, 'link' => url('user/'. $account->uid, array('absolute' => TRUE)));
           }
@@ -1649,7 +1649,7 @@ function user_roles($membersonly = FALSE
   );
 
   if (!empty($permission)) {
-    $result = db_query("SELECT r.* FROM {role} r INNER JOIN {permission} p ON r.rid = p.rid WHERE p.perm LIKE '%%%s%%' ORDER BY r.name", $permission);
+    $result = db_query("SELECT r.* FROM {role} r INNER JOIN {permission} p ON r.rid = p.rid WHERE p.perm LIKE '%s' ORDER BY r.name", "%". $permission ."%");
   }
   else {
     $result = db_query('SELECT * FROM {role} ORDER BY name');
@@ -1915,7 +1915,7 @@ function user_filters() {
   $filters['permission'] = array(
     'title' => t('permission'),
     'join' => 'LEFT JOIN {permission} p ON ur.rid = p.rid',
-    'where' => " ((p.perm IS NOT NULL AND p.perm LIKE '%%%s%%') OR u.uid = 1) ",
+    'where' => " ((p.perm IS NOT NULL AND p.perm LIKE '%s') OR u.uid = 1) ",
     'options' => $options,
   );
 
@@ -1947,6 +1947,7 @@ function user_build_filter_query() {
       if (user_access($value, $account)) {
         continue;
       }
+      $value = "%" . $value . "%";
     }
     $where[] = $filters[$key]['where'];
     $args[] = $value;
Index: modules/user/user.pages.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/user/user.pages.inc,v
retrieving revision 1.11
diff -u -p -r1.11 user.pages.inc
--- modules/user/user.pages.inc	8 Jan 2008 10:35:43 -0000	1.11
+++ modules/user/user.pages.inc	26 Jan 2008 16:38:42 -0000
@@ -12,7 +12,7 @@
 function user_autocomplete($string = '') {
   $matches = array();
   if ($string) {
-    $result = db_query_range("SELECT name FROM {users} WHERE LOWER(name) LIKE LOWER('%s%%')", $string, 0, 10);
+    $result = db_query_range("SELECT name FROM {users} WHERE LOWER(name) LIKE LOWER('%s')", $string ."%", 0, 10);
     while ($user = db_fetch_object($result)) {
       $matches[$user->name] = check_plain($user->name);
     }