--- system.install.orig	2009-08-01 13:21:11.000000000 -0700
+++ system.install	2009-08-01 13:23:35.000000000 -0700
@@ -2170,7 +2170,7 @@
   while ($role = db_fetch_object($result)) {
     $renamed_permission = preg_replace('/administer access control/', 'administer permissions', $role->perm);
     if ($renamed_permission != $role->perm) {
-      $ret[] = update_sql("UPDATE {permission} SET perm = '$renamed_permission' WHERE rid = $role->rid");
+      $ret[] = update_sql("UPDATE {permission} SET perm = '" . db_escape_string($renamed_permission) . "' WHERE rid = $role->rid");
     }
   }
   return $ret;
@@ -2293,7 +2293,7 @@
     $renamed_permission = preg_replace('/(?<=^|,\ )edit\ ([a-zA-Z0-9_\-]+)\ content(?=,|$)/', 'edit any $1 content', $role->perm);
     $renamed_permission = preg_replace('/(?<=^|,\ )create\ polls(?=,|$)/', 'create poll content', $renamed_permission);
     if ($renamed_permission != $role->perm) {
-      $ret[] = update_sql("UPDATE {permission} SET perm = '$renamed_permission' WHERE rid = $role->rid");
+      $ret[] = update_sql("UPDATE {permission} SET perm = '" . db_escape_string($renamed_permission) . "' WHERE rid = $role->rid");
     }
   }
   return $ret;
@@ -2491,7 +2491,7 @@
     $renamed_permission = preg_replace('/(?<=^|,\ )edit\ book\ content(?=,|$)/', 'edit any book content', $renamed_permission);
     $renamed_permission = preg_replace('/(?<=^|,\ )administer\ locales(?=,|$)/', 'administer languages, translate interface', $renamed_permission);
     if ($renamed_permission != $role->perm) {
-      $ret[] = update_sql("UPDATE {permission} SET perm = '$renamed_permission' WHERE rid = $role->rid");
+      $ret[] = update_sql("UPDATE {permission} SET perm = '" . db_escape_string($renamed_permission) . "' WHERE rid = $role->rid");
     }
   }