DB_escape_string

[serakfalcon]

I was thinking about the implementation of this and did some digging, Doctrine DBAL (http://jwage.com/post/31080076112/doctri...tion-layer ) looks very 'webERP'-y,
you can do things like:

Code:

$qb = $conn->createQueryBuilder()
    ->select('u')
    ->from('users', 'u')
    ->where('u.id = :user_id')
    ->setParameter(':user_id', 1);

it supports MySQL, Oracle, Microsoft SQL Server, PostgreSQL, SAP Sybase SQL Anywhere, SQLite and Drizzle, and has a larger developer base than webERP so it's definitely good-quality code. If we're already rewriting the database code I would suggest using this instead.

---

So far we have the DB_bindquery and audit trail code (was the user id issue sorted?). We probably still need to look at how we end up prepping output for the browser.

Yeah, with the code I posted there's no trouble with the user id, it's just, if we used logging at the database level, we could catch any alteration of the database, which is why I suggested it, but then we can't be sure what user did it, so I think sticking with the status quo is best. It just means we have to be careful to include audit trail code in every API we write to access the database, that's all.