1 files changed, 4 insertions, 3 deletions
diff --git a/wqflask/base/data_set.py b/wqflask/base/data_set.py
index 68f5e5ed..14e4055e 100755
--- a/wqflask/base/data_set.py
+++ b/wqflask/base/data_set.py
@@ -42,12 +42,13 @@ def create_dataset(dataset_name):
     #cursor = db_conn.cursor()
     print("dataset_name:", dataset_name)
 
-    dataset_type = g.db.execute("""
+    query = """
         SELECT DBType.Name
         FROM DBList, DBType
-        WHERE DBList.Name = %s and
+        WHERE DBList.Name = '%s' and
               DBType.Id = DBList.DBTypeId
-        """, (dataset_name)).fetchone().Name
+        """ % (escape(dataset_name))
+    dataset_type = g.db.execute(query).fetchone().Name
 
     #dataset_type = cursor.fetchone()[0]
     print("[blubber] dataset_type:", pf(dataset_type))