Index: includes/session.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/session.inc,v
retrieving revision 1.36
diff -u -p -r1.36 session.inc
--- includes/session.inc	11 Nov 2006 22:41:20 -0000	1.36
+++ includes/session.inc	12 Nov 2006 12:52:58 -0000
@@ -128,11 +128,18 @@ function sess_count($timestamp = 0, $ano
  * Can also be called directly, either with the PHP session ID or another identifier
  * such as uid to end a specific user's session.
  *
- * @param  string $uid
- *   the user id
+ * @param  string $key
+ * @param  string $type
+ *   Possible values:
+ *     sid (default): the PHP session id
+ *     uid: the Drupal user id
  */
-function sess_destroy($uid) {
-  db_query('DELETE FROM {sessions} WHERE uid = %d', $uid);
+function sess_destroy($key, $type = 'sid') {
+  // validate $type strictly to avoid all chance of SQL injection
+  if (!in_array($type, array('sid', 'uid'))) {
+    $type = 'sid';
+  }
+  db_query("DELETE FROM {sessions} WHERE %s = '%s'", $type, $key);
 }
 
 function sess_gc($lifetime) {
Index: modules/user/user.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/user/user.module,v
retrieving revision 1.708
diff -u -p -r1.708 user.module
--- modules/user/user.module	11 Nov 2006 23:52:11 -0000	1.708
+++ modules/user/user.module	12 Nov 2006 12:52:58 -0000
@@ -148,7 +148,7 @@ function user_save($account, $array = ar
 
     // Delete a blocked user's sessions to kick them if they are online.
     if (isset($array['status']) && $array['status'] == 0) {
-      sess_destroy($account->uid);
+      sess_destroy($account->uid, 'uid');
     }
 
     // Refresh user object
@@ -1014,7 +1014,7 @@ function user_logout() {
   watchdog('user', t('Session closed for %name.', array('%name' => $user->name)));
 
   // Destroy the current session:
-  sess_destroy($user->uid);
+  session_destroy();
   module_invoke_all('user', 'logout', NULL, $user);
 
   // Load the anonymous user
@@ -1442,7 +1442,7 @@ function user_confirm_delete($name, $uid
  */
 function user_delete($edit, $uid) {
   $account = user_load(array('uid' => $uid));
-  sess_destroy($uid);
+  sess_destroy($uid, 'uid');
   db_query('DELETE FROM {users} WHERE uid = %d', $uid);
   db_query('DELETE FROM {users_roles} WHERE uid = %d', $uid);
   db_query('DELETE FROM {authmap} WHERE uid = %d', $uid);