Also escape when value starts with a [ and validate the negative operation as well

diff --git a/CRM/Contact/BAO/Query.php b/CRM/Contact/BAO/Query.php
index fa4068402172232c0d37b6ca5e10a17d8a830da1..5cf62c9d94780343230490e0994bc6a8339afa03 100644 (file)
--- a/CRM/Contact/BAO/Query.php
+++ b/CRM/Contact/BAO/Query.php
@@ -4058,9 +4058,11 @@ WHERE  $smartGroupClause
       }
     }
     if (strpbrk($value, "[")) {
-      $value = "'{$value}'";
-      $op = "!{$op}";
-      $this->_where[$grouping][] = "contact_a.{$name} $op $value";
+      $value = CRM_Core_DAO::escapeString($value);
+      if (in_array("!{$op}", CRM_Core_DAO::acceptedSQLOperators(), TRUE)) {
+        $op = "!{$op}";
+        $this->_where[$grouping][] = "contact_a.{$name} $op $value";
+      }
     }
     else {
       CRM_Utils_Type::validate($value, 'Integer');