[eluser]CroNiX[/eluser]
I can't really answer why it doesn't work in chrome. There are way to many variables to consider that we aren't privy to and most likely the problem is elsewhere in your code and not in the one function you are showing. Your DB data can be tainted as well since the site was recently hacked. I would't trust the db data until you verify it is totally free of bad data, which could be obscured (like percent 3c).
It won't do much good just to fix the one above query. You need to fix ALL of them sitewide. Your site is wide open to hacking because it doesn't look like you did much in terms of security.
ALL user data should be considered tainted from the get-go. That is anything coming from the url, like a segment, using form validation for all form fields to ensure the data is in the correct format, escaping all user input/variables being used in db queries, either manually or using active record, etc.
If you don't, you can expect this to happen again. The people who hacked your site already know it's vulnerable and might be still hacking it, or return to hack it again at a later date, or put the URL in a hacking forum for others to try to mess with.
Personally I'd take the site totally offline until you know it's secure and the existing data is not tainted.
