diff --git a/addons/base_calendar/base_calendar.py b/addons/base_calendar/base_calendar.py
index 7ccd07351f0..1ff7777cf36 100644
--- a/addons/base_calendar/base_calendar.py
+++ b/addons/base_calendar/base_calendar.py
@@ -978,7 +978,7 @@ class calendar_event(osv.osv):
         if not context:
             context = {}
         for event_id in ids:
-            cr.execute('select id from %s  where recurrent_uid=%s' % (self._table, event_id))
+            cr.execute("select id from %s where recurrent_uid=%%s" % (self._table), (event_id,))
             r_ids = map(lambda x: x[0], cr.fetchall())
             self.unlink(cr, uid, r_ids, context=context)
         return True
@@ -1065,7 +1065,7 @@ class calendar_event(osv.osv):
             'rule_type': rrule_type,
             'id': id,
         })
-        cr.execute(qry, val) # Hopefully psycopg2 works with dicts. But, FIXME
+        cr.execute(qry % val)
         return True
 
     def _get_rulestring(self, cr, uid, ids, name, arg, context=None):
@@ -1438,7 +1438,8 @@ true, it will allow you to hide the event alarm information without removing it.
         res = super(calendar_event, self).search(cr, uid, args_without_date, \
                                  offset, limit, order, context, count)
 
-        return self.get_recurrent_ids(cr, uid, res, start_date, until_date, limit)
+        res = self.get_recurrent_ids(cr, uid, res, start_date, until_date, limit)
+        return res
 
     def write(self, cr, uid, ids, vals, context=None, check=True, update_check=True):
         """
@@ -1533,11 +1534,9 @@ true, it will allow you to hide the event alarm information without removing it.
         if fields and 'date' not in fields:
             fields.append('date')
 
-        real_ids = [item2 for item1, item2 in select]
-        event_values = dict([(res['id'], res) for res in super(calendar_event, self).read(cr, uid, real_ids, fields=fields, context=context, load=load)])
-
         for base_calendar_id, real_id in select:
-            res = event_values[real_id]
+            #REVET: Revision ID: olt@tinyerp.com-20100924131709-cqsd1ut234ni6txn
+            res = super(calendar_event, self).read(cr, uid, real_id, fields=fields, context=context, load=load)
             ls = base_calendar_id2real_id(base_calendar_id, with_date=res and res.get('duration', 0) or 0)
             if not isinstance(ls, (str, int, long)) and len(ls) >= 2:
                 res['date'] = ls[1]
diff --git a/addons/caldav/calendar.py b/addons/caldav/calendar.py
index d22fa98f6e4..068af56459f 100644
--- a/addons/caldav/calendar.py
+++ b/addons/caldav/calendar.py
@@ -63,11 +63,12 @@ def uid2openobjectid(cr, uidval, oomodel, rdate):
             return (False, None)
         qry = 'SELECT DISTINCT(id) FROM %s' % model_obj._table
         if rdate:
-            qry += " WHERE recurrent_id=%s"
-            cr.execute(qry, (rdate,))
+            qry += " where recurrent_id='%s'" % (rdate) #TOFIX: sql injection
+            cr.execute(qry)
             r_id = cr.fetchone()
             if r_id:
                 return (id, r_id[0])
+        
         cr.execute(qry)
         ids = map(lambda x: str(x[0]), cr.fetchall())
         if id in ids: