--- a/MPIWGStaff.py	Fri Jun 14 15:49:53 2013 +0200
+++ b/MPIWGStaff.py	Fri Jun 14 17:36:09 2013 +0200
@@ -20,7 +20,7 @@
 
 from Products.ZDBInterface.ZDBInterfaceFolder import ZDBInterfaceFolder
 
-from SrvTxtUtils import getInt, unicodify, utf8ify
+from SrvTxtUtils import getInt, unicodify, utf8ify, sqlName
 import MPIWGHelper
 
 #
@@ -587,14 +587,25 @@
         #REQUEST.response.redirect(self.REQUEST['HTTP_REFERER'])
     
 
-    def changeData(self,changeSet):
+    security.declareProtected('View management screens','changeData')
+    def changeData(self, changeSet):
         """changes the data in the database, changeset expects field --> value."""
+        fields = []
+        values = []
         for field in changeSet.keys():
             if hasattr(self.content, field):
                 logging.debug("Changing: %s"%field)
-                results = self.folder.executeZSQL("update personal_www set "+field+" = %s where key = %s", [changeSet.get(field),self.getKey().encode('utf-8')]);
-                logging.debug(results)
-   
+                fields.append('"'+sqlName(field)+'" = %s')
+                values.append(changeSet.get(field))
+                
+        if len(fields) == 0:
+            return
+        
+        query = "update personal_www set " + ', '.join(fields) + " where key = %s"
+        values.append(self.getKey().encode('utf-8'))
+        results = self.folder.executeZSQL(query, values)
+        logging.debug(results)
+                
         self.refresh_content()