Fix for SQL injection on :limit and :offset should be backported

+1 from me for you!

+1 , nasty

More info about the problem on this blog post: http://blog.innerewut.de/2008/6/...

The facts we have:

• The problem is fixed in the abstract adapter for 2.1.0
• The problem is not fixed for the 2.0 or 1.2 branches
• The problem is not fixed for the mysql adapter for 2.1.0, but will be fixed when 2.1.1 is released. This is not such a huge issue as mysql stops more than one query being sent at once

So basically it's not a huge issue that the mysql adapter fix hasn't been released for the 2.1 branch, but no fix at all has been released for the other branches and so they are both vulnerable.

What's the criteria for a security issue being considered a "priority"? I run with postgres on the 2.0 branch, which means my application would be vulnerable if we were using user-specified offset/limit. Granted a very small number of people run postgres/sqlite compared to mysql, and presumably a smaller number still allow the user to specify limit/offset, but it seems this could affect somebody, and would be quite serious for them if they were targeted.

Anyway, I'd be happy to backport it, will report back with a patch.

Patches for 2-0-stable and 1-2-stable attached.