diff --git a/modules/upload.module b/modules/upload.module
index 5fb50b542a5281b32e2153b4a746997fc073123d..83a6cb4017a6d891a9ebc69e9ffa8637bb0268c0 100644
--- a/modules/upload.module
+++ b/modules/upload.module
@@ -91,7 +91,7 @@ function upload_download() {
 function upload_file_download($file) {
   if (user_access('view uploaded files')) {
     $file = file_create_path($file);
-    $result = db_query(db_rewrite_sql("SELECT f.nid, f.* from {files} f WHERE filepath = '%s", 'f'), $file);
+    $result = db_query(db_rewrite_sql("SELECT f.nid, f.* from {files} f WHERE filepath = '%s'", 'f'), $file);
     if ($file = db_fetch_object($result)) {
       $name = mime_header_encode($file->filename);
       // Serve images and text inline for the browser to display rather than download.
diff --git a/modules/upload/upload.module b/modules/upload/upload.module
index 5fb50b542a5281b32e2153b4a746997fc073123d..83a6cb4017a6d891a9ebc69e9ffa8637bb0268c0 100644
--- a/modules/upload/upload.module
+++ b/modules/upload/upload.module
@@ -91,7 +91,7 @@ function upload_download() {
 function upload_file_download($file) {
   if (user_access('view uploaded files')) {
     $file = file_create_path($file);
-    $result = db_query(db_rewrite_sql("SELECT f.nid, f.* from {files} f WHERE filepath = '%s", 'f'), $file);
+    $result = db_query(db_rewrite_sql("SELECT f.nid, f.* from {files} f WHERE filepath = '%s'", 'f'), $file);
     if ($file = db_fetch_object($result)) {
       $name = mime_header_encode($file->filename);
       // Serve images and text inline for the browser to display rather than download.