In fact, ',' was allowed both at registration and name change. I modified the frontend so it removes any commas found, until the backend is modified in this regard.

"It seems the GetDB() procedure as well as its calls should be rewritten thorough Savane so as to return a table instead of a string."

In my opinion, the problem is the fact that an user was able to enter a real name (or whatever field) with a comma.

I think the account creation process disallow that already. But maybe the "change name" page does not do the appropriate checks.

"It seems the GetDB() procedure as well as its calls should be rewritten thorough Savane so as to return a table instead of a string."

That could be something interesting to do. When I wrote GetDB, I just grabbed the way things were done in sv_cvs, the original backend. The point was to having more or less the same code reorganized. This step being achieved, we can perfectly improve it.
And I think that each time GetDB() is called, we transform it into a list with split(). So if GetDB() returning a list, that would be definitely cleaner and would avoid this bug.