diff --git a/addons/base_calendar/base_calendar.py b/addons/base_calendar/base_calendar.py
index 1ff7777cf36..2a0b0cc60ad 100644
--- a/addons/base_calendar/base_calendar.py
+++ b/addons/base_calendar/base_calendar.py
@@ -1065,7 +1065,7 @@ class calendar_event(osv.osv):
             'rule_type': rrule_type,
             'id': id,
         })
-        cr.execute(qry % val)
+        cr.execute(qry, val) # Hopefully psycopg2 works with dicts. But, FIXME
         return True
 
     def _get_rulestring(self, cr, uid, ids, name, arg, context=None):
@@ -1682,7 +1682,7 @@ class calendar_todo(osv.osv):
         @param args: list of tuples of form [(‘name_of_the_field’, ‘operator’, value), ...].
         @param context: A standard dictionary for contextual values
         """
-
+        
         assert name == 'date'
         return self.write(cr, uid, id, { 'date_start': value }, context=context)
 
diff --git a/addons/caldav/calendar.py b/addons/caldav/calendar.py
index 068af56459f..883688c38f6 100644
--- a/addons/caldav/calendar.py
+++ b/addons/caldav/calendar.py
@@ -63,8 +63,8 @@ def uid2openobjectid(cr, uidval, oomodel, rdate):
             return (False, None)
         qry = 'SELECT DISTINCT(id) FROM %s' % model_obj._table
         if rdate:
-            qry += " where recurrent_id='%s'" % (rdate) #TOFIX: sql injection
-            cr.execute(qry)
+            qry += " WHERE recurrent_id=%s"
+            cr.execute(qry, (rdate,))
             r_id = cr.fetchone()
             if r_id:
                 return (id, r_id[0])