DB_escape_string

[icedlava]

Hi Tim,

Hi Jo, it seems to me that using prepared statements for a query such as "SELECT name FROM debtorsmaster WHERE debtorno='" . $DebtorNo . "'" in your AddCustomerContacts.php seems like overkill. My understanding is that prepared statements are good for repeated queries, but for a simple one off SELECT query such as this is the extra code complexity, and speed penalties worth it?

I went through the whole add contact script late last night in an attempt to use it as a demonstration in use of the bind vars and did not really make exceptions on where to use it or not.

But, yes, it is not necessary generally for SELECT to use prepared statements, when they are normally ideal for repeated queries.

However the key reason we are using them and bind variables for webERP is for security reasons. As such any data that comes in from a potentially untrusted source should be treated this way. If the $DebtorNo is not passed in by the user via form or $_GET var then perhaps it is unnecessary in this case.
For consistency sake I'd probably still use bind vars and perhaps at some stage just cater for them in DB_query. I don't believe the speed penalty would be significant, if any penalty at all for webERP in this case. The statement in the DB_query function is also immediately closed after passing the $result.

Keep in mind draft code I pushed still has some requirements (eg fix the audit code) and hopefully we can continue to improve on all aspects of what is there now.

Cheers,