DB_escape_string

[icedlava]

Just noting that I will be and have made fixes in the code base that do not use DB_escape_string but use mysql_real_escape_string instead.
Apparently we are only catering for mysql at the moment so this is not too affronting within the code and these fixes are marked 'temporary'.

The reason is because DB_escape_string is broken and using it will reintroduce htmlspecialchars into the database data again. The htmlspecialchars should not be called on data going into the database and when we use it it will cause issues elsewhere where entities are involved.

We can fix that function, but not before we evaluate what areas of the code rely on it currently to convert entities for displaying data, and also have other context relevant functions to prep the data for display or database use.

I will given time improve on my exising fixes and check to ensure mysqli_real_escape or mysql_real_escape is used as necessary but took safer option for quick fixes.

Cheers,