diff --git a/includes/database/database.inc b/includes/database/database.inc
index 21b7c22..4352a1b 100644
--- a/includes/database/database.inc
+++ b/includes/database/database.inc
@@ -1851,6 +1851,11 @@ class DatabaseTransactionOutOfOrderException extends Exception { }
 class InvalidMergeQueryException extends Exception {}
 
 /**
+ * Exception thrown if an invalid query condition is specified.
+ */
+class InvalidQueryConditionOperatorException extends Exception {}
+
+/**
  * Exception thrown if an insert query specifies a field twice.
  *
  * It is not allowed to specify a field as default and insert field, this
diff --git a/includes/database/query.inc b/includes/database/query.inc
index c9c5a83..8467479 100644
--- a/includes/database/query.inc
+++ b/includes/database/query.inc
@@ -1705,6 +1705,13 @@ class DatabaseCondition implements QueryConditionInterface, Countable {
    * Implements QueryConditionInterface::condition().
    */
   public function condition($field, $value = NULL, $operator = NULL) {
+
+    // If something passed in an invalid character, throw exception and
+    // stop early, so we don't rely on a broken SQL statement.
+    if (stripos($operator, 'UNION') !== FALSE || strpbrk($operator, '[-\'"();') !== FALSE) {
+      throw new InvalidQueryConditionOperatorException('Invalid characters in query operator: ' . $operator);
+    }
+
     if (!isset($operator)) {
       if (is_array($value)) {
         $operator = 'IN';
diff --git a/modules/simpletest/tests/database_test.install b/modules/simpletest/tests/database_test.install
index 1136115..ece2463 100644
--- a/modules/simpletest/tests/database_test.install
+++ b/modules/simpletest/tests/database_test.install
@@ -217,5 +217,7 @@ function database_test_schema() {
     ),
   );
 
+  $schema['TEST_UPPERCASE'] = $schema['test'];
+
   return $schema;
 }
diff --git a/modules/simpletest/tests/database_test.test b/modules/simpletest/tests/database_test.test
index 59d2e5d..3d8b28a 100644
--- a/modules/simpletest/tests/database_test.test
+++ b/modules/simpletest/tests/database_test.test
@@ -27,6 +27,7 @@ class DatabaseTestCase extends DrupalWebTestCase {
     $schema['test_one_blob'] = drupal_get_schema('test_one_blob');
     $schema['test_two_blobs'] = drupal_get_schema('test_two_blobs');
     $schema['test_task'] = drupal_get_schema('test_task');
+    $schema['TEST_UPPERCASE'] = drupal_get_schema('TEST_UPPERCASE');
 
     $this->installTables($schema);
 
@@ -3458,6 +3459,67 @@ class DatabaseQueryTestCase extends DatabaseTestCase {
     $this->assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
   }
 
+  /**
+   * Tests SQL injection via condition operator.
+   */
+  public function testConditionOperatorArgumentsSQLInjection() {
+
+    $injection = "IS NOT NULL); INSERT INTO {test} (name) VALUES ('test12345678'); -- ";
+    try {
+      $result = db_select('test', 't')
+        ->fields('t')
+        ->condition('name', 1, $injection)
+        ->execute();
+      $this->fail('Should not be able to attempt SQL injection via condition operator.');
+    }
+    catch (InvalidQueryConditionOperatorException $e) {
+      $this->pass('SQL injection attempt via condition arguments should result in a database exception.');
+    }
+
+    // Test that the insert query that was used in the SQL injection attempt did
+    // not result in a row being inserted in the database.
+    $result = db_select('test')
+      ->condition('name', 'test12345678')
+      ->countQuery()
+      ->execute()
+      ->fetchField();
+    $this->assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
+
+    // Attempt SQLi via union query with no unsafe characters.
+    db_insert('test')
+      ->fields(array('name' => '123456'))
+      ->execute();
+
+    $injection = "= 1 UNION ALL SELECT password FROM user WHERE uid =";
+    try {
+      $result = db_select('test', 't')
+        ->fields('t', array('name', 'name'))
+        ->condition('name', 1, $injection)
+        ->execute();
+      $this->fail('Should not be able to attempt SQL injection via operator.');
+    }
+    catch (InvalidQueryConditionOperatorException $e) {
+      $this->pass('SQL injection attempt via condition arguments should result in a database exception.');
+    }
+
+    // Attempt SQLi via union query - uppercase tablename.
+    db_insert('TEST_UPPERCASE')
+      ->fields(array('name' => 'secrets'))
+      ->execute();
+
+    $injection = "IS NOT NULL) UNION ALL SELECT name FROM {TEST_UPPERCASE} -- ";
+    try {
+      $result = db_select('test', 't')
+        ->fields('t', array('name'))
+        ->condition('name', 1, $injection)
+        ->execute();
+      $this->fail('Should not be able to attempt SQL injection via operator.');
+    }
+    catch (InvalidQueryConditionOperatorException $e) {
+      $this->pass('SQL injection attempt via condition arguments should result in a database exception.');
+    }
+  }
+
 }
 
 /**