DB_escape_string

[Uhuru]

Well, just my 2 cents, but I think we need to use generally accepted, standard and up to date methods of handling database transactions in relation to security. I believe that will also ensure webERP has credibility as well as a secure code base.

Hi Jo, I follow the PHP and PHP-DEV mailing lists and recently there has been a lot of debate about the best way to go for this. Paramaterised queries undoubtedly have their proponents, but I am surprised you call it an accepted standard.

By opening and closing the prepared statement within the same function do we not lose the main benefit where there are repeated queries?

Tim