Index: trunk/lib/Auth_SQL.inc.php
===================================================================
--- trunk/lib/Auth_SQL.inc.php	(revision 103)
+++ trunk/lib/Auth_SQL.inc.php	(revision 111)
@@ -305,6 +305,6 @@
             SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . addslashes($username) . "'
-            AND BINARY userpass = '" . addslashes($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
+            AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
         ");
 
@@ -453,5 +453,5 @@
             $qid = DB::query("
                 SELECT 1 FROM " . $this->_params['db_table'] . "
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
                 AND DATE_ADD(last_login_datetime, INTERVAL '" . $this->_params['login_timeout'] . "' SECOND) > NOW()
                 AND DATE_ADD(last_access_datetime, INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND) > NOW()
@@ -572,5 +572,5 @@
 
         if ($this->getParam('blocking')) {
-            if (strlen(addslashes($reason)) > 255) {
+            if (strlen(DB::escapeString($reason)) > 255) {
                 // blocked_reason field is varchar(255).
                 App::logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
@@ -582,6 +582,6 @@
                 UPDATE " . $this->_params['db_table'] . " SET
                 blocked = 'true',
-                blocked_reason = '" . addslashes($reason) . "'
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                blocked_reason = '" . DB::escapeString($reason) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
             ");
         }
@@ -602,5 +602,5 @@
                 blocked = '',
                 blocked_reason = ''
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
             ");
         }
@@ -620,5 +620,5 @@
             SELECT 1
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . addslashes($username) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
         ");
         return (mysql_num_rows($qid) > 0);
@@ -638,5 +638,5 @@
             SELECT " . $this->_params['db_username_column'] . "
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
         if (list($username) = mysql_fetch_row($qid)) {
@@ -717,6 +717,6 @@
         DB::query("
             UPDATE " . $this->_params['db_table'] . "
-            SET userpass = '" . addslashes($this->encryptPassword($password)) . "'
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            SET userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
     }
@@ -739,5 +739,5 @@
         $qid = DB::query("
             SELECT * FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
         if (!$user_data = mysql_fetch_assoc($qid)) {
