use raw db queries wherever query items could contain '%'

include/dba.php

@@ -134,6 +134,16 @@ function q($sql) {
 	return $ret;
 }}
 
+// raw db query, no arguments
+
+if(! function_exists('dbq')) { 
+function dbq($sql) {
+
+	global $db;
+	$ret = $db->q($sql);
+	return $ret;
+}}
+
 
 // Caller is responsible for ensuring that any integer arguments to 
 // dbesc_array are actually integers and not malformed strings containing

include/items.php

@@ -550,7 +550,7 @@ function item_store($arr) {
 
 	logger('item_store: ' . print_r($arr,true), LOGGER_DATA);
 
-	$r = q("INSERT INTO `item` (`" 
+	$r = dbq("INSERT INTO `item` (`" 
 			. implode("`, `", array_keys($arr)) 
 			. "`) VALUES ('" 
 			. implode("', '", array_values($arr))