applyconfig can create databases with any name

[marshallovski]

this is NOT a SQL injection. the code below just creates a database.
i checked it, and if we creating a new database named "DROP DATABASE `test`"
the code below simply creates a new database named "drop database test".
MUST be fixed in near future

$mysqli->real_query(sanitize(mysqli_real_escape_string($mysqli, "CREATE DATABASE IF NOT EXISTS `" . $dbcfg['repoxydb']['dbname'] . "`")));