Index: commands/sql/sql.drush.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/commands/sql/sql.drush.inc,v
retrieving revision 1.8
diff -u -r1.8 sql.drush.inc
--- commands/sql/sql.drush.inc	17 Apr 2009 18:26:59 -0000	1.8
+++ commands/sql/sql.drush.inc	22 Apr 2009 09:04:03 -0000
@@ -347,10 +347,10 @@
     $db_spec = _drush_sql_get_db_spec();
   }
     
-  return ' -h' . $db_spec['host'] .
+  return ' -h' . escapeshellcmd($db_spec['host']) .
      (empty($db_spec['port']) ? '' : ' -P' . $db_spec['port']) .
      ' -u' . $db_spec['username'] .
-     (empty($db_spec['password']) ? '' : ' -p' . $db_spec['password']) . ' ' . $db_spec['database'];
+     (empty($db_spec['password']) ? '' : ' -p' . escapeshellcmd($db_spec['password'])) . ' ' . escapeshellcmd($db_spec['database']);
 }
 
 function _drush_sql_get_invalid_url_msg($db_spec = NULL) {
Index: includes/environment.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/includes/environment.inc,v
retrieving revision 1.20
diff -u -r1.20 environment.inc
--- includes/environment.inc	18 Apr 2009 00:09:02 -0000	1.20
+++ includes/environment.inc	22 Apr 2009 09:04:04 -0000
@@ -481,10 +481,10 @@
          }
          $parts = parse_url($url);
          $creds['driver'] = $parts['scheme'];
-         $creds['user'] = $parts['user'];
+         $creds['user'] = urldecode($parts['user']);
          $creds['host'] = $parts['host'];
-         $creds['pass'] = $parts['pass'];
-         $creds['name'] = trim($parts['path'], '/');
+         $creds['pass'] = urldecode($parts['pass']);
+         $creds['name'] = urldecode(trim($parts['path'], '/'));
        }
        break;
      case 7: