Merge lp:~eday/burrow/lp803237 into lp:burrow

[Eric Day]

Fixed bug #803237. More query string cleanup to do, will do full review later.

=== modified file 'burrow/backend/sqlite.py'
--- burrow/backend/sqlite.py	2011-06-10 21:36:49 +0000
+++ burrow/backend/sqlite.py	2011-06-29 20:44:31 +0000
@@ -97,8 +97,9 @@
             yield message
         if len(ids) == 0:
             return
-        query = 'DELETE FROM messages WHERE queue=%d AND name IN (%s)'
-        self.db.execute(query % (rowid, ','.join(ids)))
+        values = (rowid,) + tuple(ids)
+        query = 'DELETE FROM messages WHERE queue=? AND name IN (%s)'
+        self.db.execute(query % ','.join('?' * len(ids)), values)
         query = 'SELECT rowid FROM messages WHERE queue=? LIMIT 1'
         if len(self.db.execute(query, (rowid,)).fetchall()) == 0:
             query = 'DELETE FROM queues WHERE rowid=?'
@@ -142,8 +143,9 @@
         if comma == '':
             return
         values += (rowid,)
+        values += tuple(ids)
         query += ' WHERE queue=? AND name IN (%s)'
-        self.db.execute(query % ','.join(ids), values)
+        self.db.execute(query % ','.join('?' * len(ids)), values)
         self.notify(account, queue)
 
     def create_message(self, account, queue, message, body, attributes):