b2evolution 0.9.0.11 -- SQL injection security issue

if( !empty( $title ) )
{
$where .= " AND post_urltitle = '$title'";//$DB->quote($title) avoid sql injection
}


function quote($str)
{
if( $str === NULL )
return 'NULL';
else
return "'".mysql_real_escape_string($str)."'";
}