DB_escape_string

[icedlava]

If we make a point to say that all variables must be escaped, AND enclosed in single quotes the need for parametrized queries disappears, so that could be added as a new coding standard, or just use parameters & the parametrized queries.

Yes, agree except it is not parameterized queries per se that helps us - you could have parameterized queries without bind vars - but it's the bind vars we need to fix the issue.

We could as you say, escape all data, and be aware of data type when doing so and thereby get rid of the need for bind vars. This is a lot harder to do consistently taking into account data type, than it is using bind vars, and could leave us open to security incursions.