--- asset_wizard.inc	2008-04-15 11:43:28.000000000 +0200
+++ asset_wizard.inc	2008-04-15 11:55:50.000000000 +0200
@@ -481,13 +481,13 @@
     $crumbs[] = l('assets',$_GET['q'],array(),asset_build_query($query));
   
     // build directory list and filename options array
-    $sql = 'SELECT DISTINCT(a.aid) FROM {asset} a ';
+    $sql = 'SELECT DISTINCT(a.aid),a.filename FROM {asset} a ';
     $args = array();
     
     // for everyone but users with 'administer assets' access control, 
     // only get assets with proper permissions.
     if(user_access('administer assets')){
-      $sql .= 'WHERE a.dirname="%s" ';
+      $sql .= 'WHERE a.dirname=\'%s\' ';
       $args = array($dir);
     }
     else {
@@ -496,9 +496,9 @@
              . 'WHERE (a.uid = %d '
              . 'OR a.status = 1 '
              . 'OR (r.rid IN (%s) AND r.status = 1) ) '
-             . 'AND a.dirname="%s" ';
+             . 'AND a.dirname=\'%s\' ';
       $args = array($user->uid, join(array_keys($user->roles),','), $dir);
-      //$sql .= 'WHERE a.dirname="%s" ';
+      //$sql .= 'WHERE a.dirname=\'%s\' ';
       //$args = array($dir);
     }
     $sql.="ORDER BY a.filename";
@@ -802,25 +802,25 @@
   global $user;
   
   // build directory list and filename options array
-  $sql = 'SELECT DISTINCT(a.aid) FROM {asset} a ';
+  $sql = 'SELECT DISTINCT(a.aid),a.dirname FROM {asset} a ';
   $args = array();
   
   // for everyone but users with 'administer assets' access control, 
   // only get assets with proper permissions.
   if(user_access('administer assets')){
-    $sql .= 'WHERE a.dirname LIKE "%s%" ';
+    $sql .= 'WHERE a.dirname LIKE \'%s%\' ';
     $args = array($dir);
   }else{
     $sql .= 'LEFT JOIN {asset_role} r ON a.aid=r.aid '
            . 'WHERE (a.uid = %d '
            . 'OR a.status = 1 '
            . 'OR (r.rid IN (%s) AND r.status = 1) ) '
-           . 'AND a.dirname LIKE "%s%" ';
+           . 'AND a.dirname LIKE \'%s%\' ';
     $args = array($user->uid, join(array_keys($user->roles),','), $dir);
-    // $sql .= 'WHERE a.dirname="%s" ';
+    // $sql .= 'WHERE a.dirname=\'%s\' ';
     // $args = array($dir);
   }
-  $sql .= ' AND a.type = "directory" ORDER BY a.dirname ASC';
+  $sql .= ' AND a.type = \'directory\' ORDER BY a.dirname ASC';
   
   $result = db_query($sql, $args);
   $options = array();