Index: webform.install
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/webform/webform.install,v
retrieving revision 1.40.2.26
diff -u -r1.40.2.26 webform.install
--- webform.install	18 Feb 2011 22:43:31 -0000	1.40.2.26
+++ webform.install	23 Feb 2011 22:17:13 -0000
@@ -791,7 +791,7 @@
 
   $result = db_query("SELECT * FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid");
   while ($role = db_fetch_object($result)) {
-    $role->perm = drupal_map_assoc(explode(', ', $role->perm));
+    $role->perm = drupal_map_assoc(explode(', ', db_escape_string($role->perm)));
     foreach ($updated_permissions as $old => $new) {
       if (isset($role->perm[$old])) {
         unset($role->perm[$old]);
@@ -893,7 +893,7 @@
   while ($role = db_fetch_object($result)) {
     $perms = explode(',', $role->perm);
     foreach ($perms as $id => $perm) {
-      $perms[$id] = trim($perm);
+      $perms[$id] = db_escape_string(trim($perm));
     }
     $ret[] = update_sql("UPDATE {permission} SET perm = '" . implode(', ', $perms) . "' WHERE rid = " . $role->rid);
   }