Index: src/common/latex.py
===================================================================
--- src/common/latex.py
+++ src/common/latex.py	2012-06-16 16:46:03.594729968 +0200
@@ -131,14 +131,21 @@
         # we triggered the blacklist, immediately return None
         return None
 
-    tmpfile = get_tmpfile_name()
+    tmpdir = ""
+    tmppng = ""
+    try:
+        tmpdir = mkdtemp(prefix="gajim")
+	tmppng = mkstemp(suffix=".png")
+    except Exception:
+	raise LatexError("could not securely create one or more temporary files for LaTeX conversion")
+        tmpfile = get_tmpfile_name(tmpdir)
 
     # build latex string
     write_latex(os.path.join(tmpfile + '.tex'), str_)
 
     # convert TeX to dvi
     exitcode = try_run(['latex', '--interaction=nonstopmode',
-                      tmpfile + '.tex'])
+                      tmpfile + '.tex'], tmpdir)
 
     if exitcode == 0:
         # convert dvi to png
@@ -149,7 +156,7 @@
         if exitcode:
             # dvipng failed, try convert
             exitcode = try_run(['convert'] + fg_str('hex') + ['-trim',
-                '-density', latex_png_dpi, tmpfile + '.dvi', tmpfile + '.png'])
+                '-density', latex_png_dpi, tmpfile + '.dvi', tmpfile + '.png'], tmpdir)
 
     # remove temp files created by us and TeX
     extensions = ['.tex', '.log', '.aux', '.dvi']
Index: src/common/logger.py
===================================================================
--- src/common/logger.py
+++ src/common/logger.py	2012-06-16 16:50:22.754490025 +0200
@@ -738,11 +738,12 @@
         except exceptions.PysqliteOperationalError, e:
             # Error trying to create a new jid_id. This means there is no log
             return None
-        where_sql = 'jid_id = %s' % jid_id
+        where_sql = 'jid_id = ?'
+	jid_tuple = (jid_id,)
         self.cur.execute('''
                 SELECT time FROM rooms_last_message_time
                 WHERE (%s)
-                ''' % (where_sql))
+                ''' % (where_sql), jid_tuple)
 
         results = self.cur.fetchone()
         if results is not None: