#2 Username is passed unescaped to query

[Luigi Gangitano]

On line 436 of mod_accounting.c

case 'u':
query = ap_pstrcat( p, query, ptr, get_user( r
), NULL );
break;

value returned from get_user(r), i.e. the username is
passed to the query without escaping.

At least it should escape single and double quotes that
are usual in sql queries.