SQL Injection in protected_node_requirements()

The selection statement in protected_node_requirements() is vulnerable to SQL injection. I'm not filing this with the security team because all permissions are defined be modules, however it's possible that a permission might accidentally cause a problem.

    $likes = array();
    foreach ( $perms as $perm ) {
      $likes[] = "perm LIKE '%" . $perm . "%'";
    }
    $sql = "SELECT rid FROM {permission} WHERE " . implode( ' OR ', $likes );
    $roles = db_affected_rows( db_query( $sql ) );

Since perm is not escaped in any way, it's possible that a permission may inaccurately be matched or end the SQL statement accidentally (such as if the permission contains a single quote), causing a SQL error.

Instead this should be:

    $likes = array();
    foreach ($perms as $perm) {
      $likes[] = "perm LIKE '%%s%'";
    }
    $sql = "SELECT rid FROM {permission} WHERE " . implode(' OR ', $likes);
    $roles = db_affected_rows(db_query($sql, $perms));

There's also a function specifically for this kind of replacement, but I couldn't figure out how it would apply in this situation: http://api.drupal.org/db_placeholders.