DB_escape_string

[Uhuru]

Yes, agree except it is not parameterized queries per se that helps us - you could have parameterized queries without bind vars - but it's the bind vars we need to fix the issue.

We could as you say, escape all data, and be aware of data type when doing so and thereby get rid of the need for bind vars. This is a lot harder to do consistently taking into account data type, than it is using bind vars, and could leave us open to security incursions.

Hi Jo, It has always been a part of the philosophy of the project that as far as possible the code should easily define what is happening. It may be over familiarisation on my part but I find that something like:

$SQL = "SELECT foo from bar WHERE name ='Tim'";
$Result = DB_Query($SQL, $db); //Actually the $db is unnecessary as it is a global
while ($MyRow = DB_fetch_array($Result)) {
echo $MyRow['foo'];
}

nicely describes what is happening. I found the new code you did less obvious, but as I say it may be just over familiarisation.

This is why I have been urging Phil to look again at the code that serakfalkon has done for table views. IMHO that code better describes a table of data than the current mass of <td><th><th> etc tags. I think it makes the code more readable, not less.

Thanks
Tim