Index: commands/sql/sql.drush.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/commands/sql/sql.drush.inc,v
retrieving revision 1.14
diff -u -r1.14 sql.drush.inc
--- commands/sql/sql.drush.inc	24 Apr 2009 04:54:16 -0000	1.14
+++ commands/sql/sql.drush.inc	24 Apr 2009 09:09:57 -0000
@@ -425,7 +425,7 @@
       // $cred .= '-U ' . $db_spec['username'] . ' ';
       break;
   }
-  return $cred;
+  return escapeshellcmd($cred);
 }
 
 function _drush_sql_get_invalid_url_msg($db_spec = NULL) {
Index: includes/environment.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/includes/environment.inc,v
retrieving revision 1.20
diff -u -r1.20 environment.inc
--- includes/environment.inc	18 Apr 2009 00:09:02 -0000	1.20
+++ includes/environment.inc	24 Apr 2009 09:09:57 -0000
@@ -479,7 +479,7 @@
          if (is_array($url)) {
            $url = $url['default'];
          }
-         $parts = parse_url($url);
+         $parts = parse_url(urldecode($url));
          $creds['driver'] = $parts['scheme'];
          $creds['user'] = $parts['user'];
          $creds['host'] = $parts['host'];