--- a/s4-blog.sh	Mon Jun 08 06:31:37 2020 +0900
+++ b/s4-blog.sh	Mon Jun 08 20:23:42 2020 +0900
@@ -25,7 +25,7 @@
 )
 blog_readable() {
   # $1=articleid $2=user
-  mode=`getgroupattr $grp regmode`
+  mode=`getgroupattr "$grp" regmode`
 }
 blog_getteam() {
   # $1=rowid of blog
@@ -49,9 +49,9 @@
   case $mode in
     admin)
       if $_isgroup; then
-	emails=`getgroupadminmails $blogowner`
+	emails=`getgroupadminmails "$blogowner"`
       else
-	emails=`collectemail $blogowner`
+	emails=`collectemail "$blogowner"`
       fi
       notifyto=`getpar notifyto`
       if [ -n "$notifyto" ]; then
@@ -61,7 +61,7 @@
     no)		emails="" ;;
     *) team=`blog_getteam "$blogid"`
        # team cannot get by `getvalbyid blog team "$blogid"`
-       emails=`TEAM=$team collectemail $blogowner` ;;
+       emails=`TEAM=$team collectemail "$blogowner"` ;;
   esac
   ## 2017-0210 Respond to the direct reply mark such as: >#1234
   replymark=`echo "$3"|nkf -w -Z0|grep '^ *>#'`
@@ -93,7 +93,7 @@
     [ x"$2" = x"$blogowner" ] && return # If author=blogowner, unnecessary
   fi
   test -z "$emails" && return
-  err notify: user=$user Admins=`getgroupadmins $blogowner` Mode=$mode Emails="[$emails]"
+  err notify: user=$user Admins=`getgroupadmins "$blogowner"` Mode=$mode Emails="[$emails]"
   quotedowner=`echo $blogowner | nkf -jM | tr -d '\n"'`
   MAIL_FROM=$noreply_from \
   SMAIL_TO="\"$quotedowner\" readers <$noreply>" \
@@ -158,7 +158,7 @@
   if ! $iswritable; then
     # err blogowner=$blogowner
     if $isgroup; then
-      regmode=`getgroupattr $blogowner regmode`
+      regmode=`getgroupattr "$blogowner" regmode`
       # err regmode=$regmode
       if [ x"$regmode" = x"moderated" ]; then
 	# if ! ismember $user $blogowner; then
@@ -838,6 +838,7 @@
     query <<-EOF > $bd/$rid/all-text-1stline-$rid.csv
 	.mode csv
 	.head 1
+	CREATE TEMPORARY TABLE IF NOT EXISTS tmp_q("user", "TEXT");
 	.import $outcsv tmp_q
 	SELECT * FROM tmp_q;
 	.mode list

--- a/s4-funcs.sh	Mon Jun 08 06:31:37 2020 +0900
+++ b/s4-funcs.sh	Mon Jun 08 20:23:42 2020 +0900
@@ -492,7 +492,7 @@
 )
 getgroupadminmails() {
   # $1=group
-  for i in $(getgroupadmins $1); do
+  for i in $(getgroupadmins "$1"); do
     email4group "$1" "$i" ;
   done
 }
@@ -2210,7 +2210,7 @@
 
   tf=$tmpd/title.$$ pf=$tmpd/profile.$$ bf=$tmpd/blogs.$$ sf=$tmpd/search.$$
   search_form "$search_form_args"	> $sf
-  printf "%s さん" "$gecos"		> $tf
+  printf "%s さん" "$gecos"|htmlescape	> $tf
   { echo "<div class=\"noprofimg\">"
     viewtable $formdir/user.def user $1
     echo "</div>"
@@ -2761,7 +2761,7 @@
 </table>
 `cgi_hidden grp $rowid`
 EOF
-  if [ x`getgroupattr $grp regmode` = x'moderated' -a -z "$ismem" ]; then
+  if [ x`getgroupattr "$grp" regmode` = x'moderated' -a -z "$ismem" ]; then
     echo "moderated (承認加入の)グループなので実際に参加できるのは
 グループ管理者が承認操作をした後になります。" | html p 'class="warn"'
   fi
@@ -3414,7 +3414,7 @@
       return ;;
   esac
   gid=$(query "select rowid from grp where gname=`sqlquote \"$t_grp\"`;")
-  rcpts="`getgroupadminmails $t_grp` $user"
+  rcpts="`getgroupadminmails "$t_grp"` $user"
   ## err admit: msgdir=$msgdir, rcpts="["$rcpts"]"
   body="グループ <a href=\"?grp+$gid\">$t_grp</a>
 に
@@ -3430,9 +3430,10 @@
   # $1=group $2=user $3=yes/no $4=email(if any $5=AsAdmin) 
   jss="joingrp-`date +%s`-`genrandom 12`"
   addsession $jss +${memoplimitdays}days
+  grpadmins=`getgroupadmins "$1"`
   query "replace into par values('$jss', 'group', 'string', `sqlquote \"$1\"`),
 ('$jss', 'adduser', 'string', `sqlquote \"$user\"`);"
-  smail "$(collectemail `getgroupadmins $1`)" "Join request to $1"<<EOF
+  smail "$(collectemail $grpadmins)" "Join request to $1"<<EOF
 $url
 $user さんから
 グループ $1
@@ -3469,7 +3470,7 @@
   elif [ x"$3" = x"yes" ] && ismember "$user" "$grp"; then
     : # Member can change own email address for the joining moderated group
   else				# adding user is $user itself
-    case `getgroupattr $1 regmode` in
+    case `getgroupattr "$1" regmode` in
       moderated)
 	joingrprequest "$@"	# Request only
 	return