Index: commands/sql/sql.drush.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/commands/sql/sql.drush.inc,v
retrieving revision 1.12
diff -u -r1.12 sql.drush.inc
--- commands/sql/sql.drush.inc	21 Apr 2009 13:33:25 -0000	1.12
+++ commands/sql/sql.drush.inc	22 Apr 2009 15:26:07 -0000
@@ -448,25 +448,25 @@
         $db_spec = _drush_sql_get_db_spec();
       }
 
-      $cred = ' -h' . $db_spec['host'] .
+      $cred = ' -h' . escapeshellcmd($db_spec['host']) .
          (empty($db_spec['port']) ? '' : ' -P' . $db_spec['port']) .
-         ' -u' . $db_spec['username'] .
-         (empty($db_spec['password']) ? '' : ' -p' . $db_spec['password']) . ' ' . $db_spec['database'];
+         ' -u' . escapeshellcmd($db_spec['username']) .
+         (empty($db_spec['password']) ? '' : ' -p' . escapeshellcmd($db_spec['password'])) . ' ' . escapeshellcmd($db_spec['database']);
       break;
   case 'pgsql':
       if (is_null($db_spec)) {
         $db_spec = _drush_sql_get_db_spec();
       }
 
-      $cred = $db_spec['database'] . ' ' .
-         (empty($db_spec['host']) || ($db_spec['host'] == "localhost") ? '' : '-h ' . $db_spec['host']) . ' ' .
+      $cred = escapeshellcmd($db_spec['database']) . ' ' .
+         (empty($db_spec['host']) || ($db_spec['host'] == "localhost") ? '' : '-h ' . escapeshellcmd($db_spec['host'])) . ' ' .
          (empty($db_spec['port']) ? '' : '-p' . $db_spec['port']) . ' ';
       // Adding '-U' will cause Postgres to prompt for a password, so disable this for now.
       // Use "sudo -u postgres drush sql ..." to access the database without a password,
       // presuming that "postgres" is the database superuser and you have
       // "local all all ident sameuser" in your Postgres pg_hba.conf file.
       // See: http://drupal.org/node/438828
-      // $cred .= '-U ' . $db_spec['username'] . ' ';
+      // $cred .= '-U ' . escapeshellcmd($db_spec['username']) . ' ';
       break;
   }
   return $cred;
Index: includes/environment.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/includes/environment.inc,v
retrieving revision 1.20
diff -u -r1.20 environment.inc
--- includes/environment.inc	18 Apr 2009 00:09:02 -0000	1.20
+++ includes/environment.inc	22 Apr 2009 15:26:07 -0000
@@ -481,10 +481,10 @@
          }
          $parts = parse_url($url);
          $creds['driver'] = $parts['scheme'];
-         $creds['user'] = $parts['user'];
-         $creds['host'] = $parts['host'];
-         $creds['pass'] = $parts['pass'];
-         $creds['name'] = trim($parts['path'], '/');
+         $creds['user'] = urldecode($parts['user']);
+         $creds['host'] = urldecode($parts['host']);
+         $creds['pass'] = urldecode($parts['pass']);
+         $creds['name'] = urldecode(trim($parts['path'], '/'));
        }
        break;
      case 7: