? join-quotes.patch
Index: includes/join.handlers.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/views/includes/join.handlers.inc,v
retrieving revision 1.1
diff -u -F^f -r1.1 join.handlers.inc
--- includes/join.handlers.inc	3 Apr 2008 00:22:26 -0000	1.1
+++ includes/join.handlers.inc	8 May 2008 21:01:30 -0000
@@ -49,7 +49,7 @@
  *       can only be used by realtime joins.
  *   - - field: Field or formula
  *   - - operator: defaults to =
- *   - - value: Must be set. If an array, operator will be defaulted to IN.
+ *   - - value: Must be set. If an array, operator will be forced to IN.
  *   - - numeric: If true, the value will not be surrounded in quotes.
  *   - extra type: How all the extras will be combined. Either AND or OR. Defaults to AND.
  */
@@ -108,10 +108,13 @@
             $join_table = $info['table'] . '.';
           }
 
-          // And now deal with the value and the operator
+          // And now deal with the value and the operator.  Set $q to
+          // a single-quote for non-numeric values and the
+          // empty-string for numeric values, then wrap all values in $q.
           $value = $info['value'];
+          $q = (empty($info['numeric']) ? "'" : '');
           if (is_array($value) && !empty($value)) {
-            $extra = "$join_table$info[field] IN ('". implode("','", $value) ."')";
+            $extra = "$join_table$info[field] IN ($q". implode("$q,$q", $value) ."$q)";
           }
           else {
             $operator = "=";
@@ -119,12 +122,7 @@
               $operator = $info['operator'];
             }
 
-            if (empty($info['numeric'])) {
-              $extra .= "$join_table$info[field] $operator '$value'";
-            }
-            else {
-              $extra .= "$join_table$info[field] $operator $value";
-            }
+            $extra .= "$join_table$info[field] $operator $q$value$q";
           }
           $extras[] = $extra;
         }