DB_escape_string

[Uhuru]

Did this really make it safer than Tim's simple mysqli_real_escape()?

Hi Exson, I can't take the credit for the DB_escape_string() function. I think it goes all the way back to Phil's original code. :-)

There is a lot of talk of security issues, but I know that many of the security companies regularly look at our code, and occasionally highlight vulnerabilities to Phil and me. Unless Phil knows of any outstanding then all these have been dealt with and withdrawn by the security companies. Of course nobody can say the code is 100% safe, but there are no known injection attack vulnerabilities to my knowledge. Hence the statement I have made before that the current code works from a security viewpoint. There are aspects where Phil's code has fallen behind, such as the quoted variables that serakfalcon mentioned, but those can be fixed in an hour or so. There are also occasions where some variables are not correctly 'unescaped' but again these are not hard to find and fix.

I appreciate there are certainly better ways to achieve what we already have, but I am concerned that it would as Exson has said be hugely invasive, and as was discussed yesterday be much less readable.

Thanks
Tim