Minimal version of Kevin's patch against CVE-2008-2236 (no additional variable $esc_f...