DB_escape_string

[icedlava]

This is already part of the coding standards (or certainly used to be). I know there are areas where variables are not enclosed in single quotes, these need to be corrected.

We are forgetting where this started.

We have in session.inc code that applies DB_escape_string to all session, post and get vars. This is wrong.

So, once we take this out, we need to adjust code elsewhere to compensate.

Going back to the original posts - this must be done contextually.

1. Datatabase transactions
2. Output data - to HTML, PDF, ajax or whatever

We are now supposed to be handling database transactions and thus we are trying to make it a little easier by using the DB_query function. We know we cannot just use mysqli_db_escape_string on the data - not good enough to prevent SQL injections for a start. We can use bind vars (not parameterized sql per se but it's the bind vars), PDO prepared statements, or we can escape and validate and quote, and ensure the character set is correct, for every set of data going into a database transaction - and to be absolutely correct we should adjust for string or integer for example.

We also have to yet find a consistent way of addressing point 2 - or ensure every person validates the data and then prepares it correctly prior to output otherwise we leave ourselves open to security issues and data integrity issues.

Just a quick summary so we know where we are.

Please correct if i've left anything out.

Thanks,