DB_escape_string

[icedlava]

Once they are parameterized we don't even need to worry about DB_escape_string.

My thoughts too.

I put in place a little function for handling this in a test branch of my local webERP as an experiment a while back. The function took the place of DB_query in scripts I was processing (leaving in place DB_query in other scripts until they were 'fixed').

One of the issues is of course used parameterized vars is that you can never capture the SQL query itself in full as webERP does now in some scripts.This would have impact in other areas such as the current way the audit trail script works.