Index: trunk/bin/file_importer.php
===================================================================
--- trunk/bin/file_importer.php	(revision 110)
+++ trunk/bin/file_importer.php	(revision 111)
@@ -43,12 +43,12 @@
 //                     added_datetime
 //                 ) VALUES (
-//                     '" . addslashes(0) . "',
-//                     '" . addslashes('hosting') . "',
-//                     '" . addslashes($file_date) . "',
-//                     '" . addslashes($amt[1]) . "',
-//                     '" . addslashes('Paid') . "',
-//                     '" . addslashes('') . "',
-//                     '" . addslashes($file_text) . "',
-//                     '" . addslashes($file_date) . "',
+//                     '" . DB::escapeString(0) . "',
+//                     '" . DB::escapeString('hosting') . "',
+//                     '" . DB::escapeString($file_date) . "',
+//                     '" . DB::escapeString($amt[1]) . "',
+//                     '" . DB::escapeString('Paid') . "',
+//                     '" . DB::escapeString('') . "',
+//                     '" . DB::escapeString($file_text) . "',
+//                     '" . DB::escapeString($file_date) . "',
 //                     NOW()
 //                 )
Index: trunk/bin/module_maker/form_template.cli.php
===================================================================
--- trunk/bin/module_maker/form_template.cli.php	(revision 110)
+++ trunk/bin/module_maker/form_template.cli.php	(revision 111)
@@ -28,5 +28,5 @@
 
 // Get DB table column info.
-$qid = DB::query("DESCRIBE " . addslashes($db_tbl));
+$qid = DB::query("DESCRIBE " . DB::escapeString($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
Index: trunk/bin/module_maker/list_template.cli.php
===================================================================
--- trunk/bin/module_maker/list_template.cli.php	(revision 110)
+++ trunk/bin/module_maker/list_template.cli.php	(revision 111)
@@ -41,5 +41,5 @@
 
 // Get DB table column info.
-$qid = DB::query("DESCRIBE " . addslashes($db_tbl));
+$qid = DB::query("DESCRIBE " . DB::escapeString($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
Index: trunk/bin/module_maker/module.cli.php
===================================================================
--- trunk/bin/module_maker/module.cli.php	(revision 110)
+++ trunk/bin/module_maker/module.cli.php	(revision 111)
@@ -141,5 +141,5 @@
 // Ensure requested table contains columns.
 // Get DB table column info.
-$qid = DB::query("DESCRIBE " . addslashes($db_tbl));
+$qid = DB::query("DESCRIBE " . DB::escapeString($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
Index: trunk/bin/module_maker/skel/admin.php
===================================================================
--- trunk/bin/module_maker/skel/admin.php	(revision 110)
+++ trunk/bin/module_maker/skel/admin.php	(revision 111)
@@ -146,5 +146,5 @@
         if (getFormdata('repeat', false)) {
             // Display edit function with next available ID.
-            $qid = DB::query("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . addslashes(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
+            $qid = DB::query("SELECT %PRIMARY_KEY% FROM %DB_TBL% WHERE %PRIMARY_KEY% > '" . DB::escapeString(getFormData('%PRIMARY_KEY%')) . "' ORDER BY %PRIMARY_KEY% ASC LIMIT 1");
             if (list($next_id) = mysql_fetch_row($qid)) {
                 App::dieURL($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $next_id);
@@ -217,5 +217,5 @@
         SELECT *
         FROM %DB_TBL%
-        WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+        WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'
     ");
     if (!$frm = mysql_fetch_assoc($qid)) {
@@ -259,5 +259,5 @@
         SELECT <##>
         FROM %DB_TBL%
-        WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+        WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'
     ");
     if (! list($name) = mysql_fetch_row($qid)) {
@@ -268,5 +268,5 @@
 
     // Delete the record.
-    DB::query("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'");
+    DB::query("DELETE FROM %DB_TBL% WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'");
 
     App::raiseMsg(sprintf(_("The %ITEM_TITLE% <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
@@ -336,5 +336,5 @@
     if (getFormData('filter_<##>', false)) {
         // Limit by filter.
-        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . addslashes(getFormData('filter_<##>')) . "'";
+        $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . " <##> = '" . DB::escapeString(getFormData('filter_<##>')) . "'";
     }
 
@@ -418,6 +418,6 @@
         DB::query("
             UPDATE %DB_TBL% SET
-                rank = '" . addslashes($new_rank) . "'
-            WHERE %PRIMARY_KEY% = '" . addslashes($id) . "'
+                rank = '" . DB::escapeString($new_rank) . "'
+            WHERE %PRIMARY_KEY% = '" . DB::escapeString($id) . "'
         ");
     }
Index: trunk/bin/module_maker/skel/public.php
===================================================================
--- trunk/bin/module_maker/skel/public.php	(revision 110)
+++ trunk/bin/module_maker/skel/public.php	(revision 111)
@@ -36,5 +36,5 @@
     $qid = DB::query("
         SELECT * FROM %DB_TBL%
-        WHERE %PRIMARY_KEY% = '" . addslashes(getFormData('%PRIMARY_KEY%')) . "'
+        WHERE %PRIMARY_KEY% = '" . DB::escapeString(getFormData('%PRIMARY_KEY%')) . "'
         AND publish = 'true'
         <##>AND (publish_date <= CURDATE() OR publish_date = '0000-00-00')
@@ -50,5 +50,5 @@
         UPDATE %DB_TBL%
         SET hit_count = hit_count + 1
-        WHERE %PRIMARY_KEY% = '" . addslashes(getFormData('%PRIMARY_KEY%')) . "'
+        WHERE %PRIMARY_KEY% = '" . DB::escapeString(getFormData('%PRIMARY_KEY%')) . "'
     ");
 
Index: trunk/bin/module_maker/sql.cli.php
===================================================================
--- trunk/bin/module_maker/sql.cli.php	(revision 110)
+++ trunk/bin/module_maker/sql.cli.php	(revision 111)
@@ -46,5 +46,5 @@
 
 // Get DB table column info.
-$qid = DB::query("DESCRIBE " . addslashes($db_tbl));
+$qid = DB::query("DESCRIBE " . DB::escapeString($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
@@ -70,5 +70,5 @@
         } else if ('set' == $type) {
             // Set types usually need to be converted to comma-delimited lists.
-            $c[$field] = "'\" . dbArrayToList(\$frm['$field']) . \"'";
+            $c[$field] = "'\" . escapedList(array_keys(\$frm['$field'])) . \"'";
         } else if ('featured' == $field || 'publish' == $field || preg_match("/enum\('true'\)/", $col[1])) {
             // Toggle types.
@@ -76,5 +76,5 @@
         } else if ('added_by_user_id' == $field || 'modified_by_user_id' == $field) {
             // Toggle types.
-            $c[$field] = "'\" . addslashes(\$auth->getVal('user_id')) . \"'";
+            $c[$field] = "'\" . DB::escapeString(\$auth->getVal('user_id')) . \"'";
         } else if ('added_datetime' == $field || 'modified_datetime' == $field) {
             // DB record insertion datetime.
@@ -82,5 +82,5 @@
         } else {
             // Default. Just insert data.
-            $c[$field] = "'\" . addslashes(\$frm['$field']) . \"'";
+            $c[$field] = "'\" . DB::escapeString(\$frm['$field']) . \"'";
         }
     }
@@ -135,5 +135,5 @@
     DB::query("
         UPDATE $db_tbl SET$key_eq_val
-        WHERE $primary_key = '" . addslashes(\$frm['$primary_key']) . "'
+        WHERE $primary_key = '" . DB::escapeString(\$frm['$primary_key']) . "'
     ");
 E_O_F;
@@ -148,5 +148,5 @@
 $delim = 'WHERE';
 if (!empty($primary_key)) {
-    $where_clause = "            $delim $primary_key = '\" . addslashes(\$frm['$primary_key']) . \"'\n";
+    $where_clause = "            $delim $primary_key = '\" . DB::escapeString(\$frm['$primary_key']) . \"'\n";
     $delim = 'AND';
 }
@@ -155,5 +155,5 @@
         continue;
     }
-    $where_clause .= "            $delim $k = '\" . addslashes(\$frm['$k']) . \"'\n";
+    $where_clause .= "            $delim $k = '\" . DB::escapeString(\$frm['$k']) . \"'\n";
     $delim = 'AND';
 }
@@ -183,9 +183,9 @@
 if (!isset($op) || 'search' == $op) {
 $search_skip_columns = array('added_datetime', 'added_by_user_id', 'modified_datetime', 'modified_by_user_id', 'publish', 'featured');
-$search_columns = $db_tbl . '.' . join(" LIKE '%\" . addslashes(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
+$search_columns = $db_tbl . '.' . join(" LIKE '%\" . DB::escapeString(\$qry_words[\$i]) . \"%'\n                    OR $db_tbl.", array_diff(array_keys($c), $search_skip_columns));
 echo <<<E_O_F
             \$where_clause .= (empty(\$where_clause) ? 'WHERE' : 'AND') . "
                 (
-                    $search_columns LIKE '%" . addslashes(\$qry_words[\$i]) . "%'
+                    $search_columns LIKE '%" . DB::escapeString(\$qry_words[\$i]) . "%'
                 )
             ";
Index: trunk/bin/module_maker/validation.cli.php
===================================================================
--- trunk/bin/module_maker/validation.cli.php	(revision 110)
+++ trunk/bin/module_maker/validation.cli.php	(revision 111)
@@ -28,5 +28,5 @@
 
 // Get DB table column info.
-$qid = DB::query("DESCRIBE " . addslashes($db_tbl));
+$qid = DB::query("DESCRIBE " . DB::escapeString($db_tbl));
 while ($row = mysql_fetch_row($qid)) {
     $cols[] = $row;
Index: trunk/lib/Auth_SQL.inc.php
===================================================================
--- trunk/lib/Auth_SQL.inc.php	(revision 110)
+++ trunk/lib/Auth_SQL.inc.php	(revision 111)
@@ -305,6 +305,6 @@
             SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . addslashes($username) . "'
-            AND BINARY userpass = '" . addslashes($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
+            AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
         ");
 
@@ -453,5 +453,5 @@
             $qid = DB::query("
                 SELECT 1 FROM " . $this->_params['db_table'] . "
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
                 AND DATE_ADD(last_login_datetime, INTERVAL '" . $this->_params['login_timeout'] . "' SECOND) > NOW()
                 AND DATE_ADD(last_access_datetime, INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND) > NOW()
@@ -572,5 +572,5 @@
 
         if ($this->getParam('blocking')) {
-            if (strlen(addslashes($reason)) > 255) {
+            if (strlen(DB::escapeString($reason)) > 255) {
                 // blocked_reason field is varchar(255).
                 App::logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
@@ -582,6 +582,6 @@
                 UPDATE " . $this->_params['db_table'] . " SET
                 blocked = 'true',
-                blocked_reason = '" . addslashes($reason) . "'
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                blocked_reason = '" . DB::escapeString($reason) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
             ");
         }
@@ -602,5 +602,5 @@
                 blocked = '',
                 blocked_reason = ''
-                WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
             ");
         }
@@ -620,5 +620,5 @@
             SELECT 1
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . addslashes($username) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
         ");
         return (mysql_num_rows($qid) > 0);
@@ -638,5 +638,5 @@
             SELECT " . $this->_params['db_username_column'] . "
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
         if (list($username) = mysql_fetch_row($qid)) {
@@ -717,6 +717,6 @@
         DB::query("
             UPDATE " . $this->_params['db_table'] . "
-            SET userpass = '" . addslashes($this->encryptPassword($password)) . "'
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            SET userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
     }
@@ -739,5 +739,5 @@
         $qid = DB::query("
             SELECT * FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . addslashes($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
         if (!$user_data = mysql_fetch_assoc($qid)) {
Index: trunk/lib/Hierarchy.inc.php
===================================================================
--- trunk/lib/Hierarchy.inc.php	(revision 110)
+++ trunk/lib/Hierarchy.inc.php	(revision 111)
@@ -197,10 +197,10 @@
                     title
                 ) VALUES (
-                    '" . addslashes($parent['node_type']) . "',
-                    '" . addslashes($parent['node_id']) . "',
-                    '" . addslashes($child_type) . "',
-                    '" . addslashes($child_id) . "',
-                    " . (is_null($relationship_type) ? "NULL" : "'" . addslashes($relationship_type) . "'") . ",
-                    '" . addslashes($title) . "'
+                    '" . DB::escapeString($parent['node_type']) . "',
+                    '" . DB::escapeString($parent['node_id']) . "',
+                    '" . DB::escapeString($child_type) . "',
+                    '" . DB::escapeString($child_id) . "',
+                    " . (is_null($relationship_type) ? "NULL" : "'" . DB::escapeString($relationship_type) . "'") . ",
+                    '" . DB::escapeString($title) . "'
                 )
             ");
@@ -245,6 +245,6 @@
         DB::query("
             DELETE FROM node_tbl
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
         ");
         App::logMsg(sprintf('deleteNode: Deleted node %s %s.', $child_type, $child_id), LOG_DEBUG, __FILE__, __LINE__);
@@ -311,7 +311,7 @@
             $qid = DB::query("
                 SELECT title FROM node_tbl
-                WHERE child_type = '" . addslashes($child_type) . "'
-                AND child_id = '" . addslashes($child_id) . "'
-                AND relationship_type " . (is_null($relationship_type) ? "IS NULL" : "= '" . addslashes($relationship_type) . "'") . "
+                WHERE child_type = '" . DB::escapeString($child_type) . "'
+                AND child_id = '" . DB::escapeString($child_id) . "'
+                AND relationship_type " . (is_null($relationship_type) ? "IS NULL" : "= '" . DB::escapeString($relationship_type) . "'") . "
             ");
             list($title) = mysql_fetch_row($qid);
@@ -321,7 +321,7 @@
         DB::query("
             DELETE FROM node_tbl
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
-            AND relationship_type " . (is_null($relationship_type) ? "IS NULL" : "= '" . addslashes($relationship_type) . "'") . "
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
+            AND relationship_type " . (is_null($relationship_type) ? "IS NULL" : "= '" . DB::escapeString($relationship_type) . "'") . "
         ");
         App::logMsg(sprintf('moveNode: Deleted node %s %s.', $child_type, $child_id), LOG_DEBUG, __FILE__, __LINE__);
@@ -359,5 +359,5 @@
                 $type_constraint = array($type_constraint);
             }
-            $in_clause = "AND parent_type IN ('" . join("','", array_map('addslashes', $type_constraint)) . "')";
+            $in_clause = "AND parent_type IN ('" . join("','", array_map(array('DB', 'escapeString'), $type_constraint)) . "')";
         }
 
@@ -365,8 +365,8 @@
             SELECT parent_type, parent_id
             FROM node_tbl
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
             $in_clause
-            " . addslashes($order) . "
+            " . DB::escapeString($order) . "
         ");
 
@@ -405,6 +405,6 @@
             SELECT child_type, child_id, title, subnode_quantity
             FROM node_tbl
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
         ");
 
@@ -448,5 +448,5 @@
                 $type_constraint = array($type_constraint);
             }
-            $in_clause = "AND child_type IN ('" . join("','", array_map('addslashes', $type_constraint)) . "')";
+            $in_clause = "AND child_type IN ('" . join("','", array_map(array('DB', 'escapeString'), $type_constraint)) . "')";
         }
 
@@ -454,8 +454,8 @@
             SELECT *
             FROM node_tbl
-            WHERE parent_type = '" . addslashes($child_type) . "'
-            AND parent_id = '" . addslashes($child_id) . "'
+            WHERE parent_type = '" . DB::escapeString($child_type) . "'
+            AND parent_id = '" . DB::escapeString($child_id) . "'
             $in_clause
-            " . addslashes($order) . "
+            " . DB::escapeString($order) . "
         ");
 
@@ -497,5 +497,5 @@
                 $type_constraint = array($type_constraint);
             }
-            $in_clause = "AND child_type IN ('" . join("','", array_map('addslashes', $type_constraint)) . "')";
+            $in_clause = "AND child_type IN ('" . join("','", array_map(array('DB', 'escapeString'), $type_constraint)) . "')";
         }
 
@@ -503,6 +503,6 @@
             SELECT COUNT(*)
             FROM node_tbl
-            WHERE parent_type = '" . addslashes($child_type) . "'
-            AND parent_id = '" . addslashes($child_id) . "'
+            WHERE parent_type = '" . DB::escapeString($child_type) . "'
+            AND parent_id = '" . DB::escapeString($child_id) . "'
             $in_clause
         ");
@@ -585,6 +585,6 @@
             SELECT parent_type, parent_id, child_type, child_id, title, subnode_quantity
             FROM node_tbl
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
         ");
         while ($row = mysql_fetch_assoc($qid)) {
@@ -644,15 +644,15 @@
             $qid = DB::query("
                 SELECT 1 FROM node_tbl
-                WHERE parent_type = '" . addslashes($parent_type) . "'
-                AND parent_id = '" . addslashes($parent_id) . "'
-                AND child_type = '" . addslashes($child_type) . "'
-                AND child_id = '" . addslashes($child_id) . "'
-                AND relationship_type " . (is_null($relationship_type) ? "IS NULL" : "= '" . addslashes($relationship_type) . "'") . "
+                WHERE parent_type = '" . DB::escapeString($parent_type) . "'
+                AND parent_id = '" . DB::escapeString($parent_id) . "'
+                AND child_type = '" . DB::escapeString($child_type) . "'
+                AND child_id = '" . DB::escapeString($child_id) . "'
+                AND relationship_type " . (is_null($relationship_type) ? "IS NULL" : "= '" . DB::escapeString($relationship_type) . "'") . "
             ");
         } else {
             $qid = DB::query("
                 SELECT 1 FROM node_tbl
-                WHERE child_type = '" . addslashes($child_type) . "'
-                AND child_id = '" . addslashes($child_id) . "'
+                WHERE child_type = '" . DB::escapeString($child_type) . "'
+                AND child_id = '" . DB::escapeString($child_id) . "'
             ");
         }
@@ -775,13 +775,13 @@
         DB::query("
             UPDATE node_tbl
-            SET subnode_quantity = subnode_quantity + '" . addslashes($num_children) . "'
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
+            SET subnode_quantity = subnode_quantity + '" . DB::escapeString($num_children) . "'
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
         ",false);
         $qid = DB::query("
             SELECT parent_type, parent_id
             FROM node_tbl
-            WHERE child_type = '" . addslashes($child_type) . "'
-            AND child_id = '" . addslashes($child_id) . "'
+            WHERE child_type = '" . DB::escapeString($child_type) . "'
+            AND child_id = '" . DB::escapeString($child_id) . "'
         ",false);
         while ((list($parent_type, $parent_id) = mysql_fetch_row($qid)) && $parent_id > 0) {
Index: trunk/lib/PageNumbers.inc.php
===================================================================
--- trunk/lib/PageNumbers.inc.php	(revision 110)
+++ trunk/lib/PageNumbers.inc.php	(revision 111)
@@ -190,5 +190,5 @@
     {
         if (is_numeric($this->first_item) && is_numeric($this->_per_page)) {
-            return ' LIMIT ' . addslashes($this->first_item) . ', ' . addslashes($this->_per_page) . ' ';
+            return ' LIMIT ' . DB::escapeString($this->first_item) . ', ' . DB::escapeString($this->_per_page) . ' ';
         } else {
             App::logMsg(sprintf('Could not find SQL to LIMIT by %s %s.', $this->first_item, $this->_per_page), LOG_WARNING, __FILE__, __LINE__);
Index: trunk/lib/RecordLock.inc.php
===================================================================
--- trunk/lib/RecordLock.inc.php	(revision 110)
+++ trunk/lib/RecordLock.inc.php	(revision 111)
@@ -156,5 +156,5 @@
             $qid = DB::query("
                 SELECT * FROM " . $this->getParam('db_table') . "
-                WHERE lock_id = '" . addslashes($record_table_or_lock_id) . "'
+                WHERE lock_id = '" . DB::escapeString($record_table_or_lock_id) . "'
             ");
         } else {
@@ -162,7 +162,7 @@
             $qid = DB::query("
                 SELECT * FROM " . $this->getParam('db_table') . "
-                WHERE record_table = '" . addslashes($record_table_or_lock_id) . "'
-                AND record_key = '" . addslashes($record_key) . "'
-                AND record_val = '" . addslashes($record_val) . "'
+                WHERE record_table = '" . DB::escapeString($record_table_or_lock_id) . "'
+                AND record_key = '" . DB::escapeString($record_key) . "'
+                AND record_val = '" . DB::escapeString($record_val) . "'
             ");
         }
@@ -199,5 +199,5 @@
 
         if (isset($this->data['lock_id'])) {
-            $qid = DB::query("SELECT * FROM " . $this->getParam('db_table') . " WHERE lock_id = '" . addslashes($this->data['lock_id']) . "'");
+            $qid = DB::query("SELECT * FROM " . $this->getParam('db_table') . " WHERE lock_id = '" . DB::escapeString($this->data['lock_id']) . "'");
             if ($lock = mysql_fetch_assoc($qid)) {
                 return ($lock['set_by_admin_id'] == $this->_auth->getVal('user_id'));
@@ -230,7 +230,7 @@
         DB::query("
             DELETE FROM " . $this->getParam('db_table') . "
-            WHERE record_table = '" . addslashes($record_table) . "'
-            AND record_key = '" . addslashes($record_key) . "'
-            AND record_val = '" . addslashes($record_val) . "'
+            WHERE record_table = '" . DB::escapeString($record_table) . "'
+            AND record_key = '" . DB::escapeString($record_key) . "'
+            AND record_val = '" . DB::escapeString($record_val) . "'
         ");
 
@@ -245,9 +245,9 @@
                 lock_datetime
             ) VALUES (
-                '" . addslashes($record_table) . "',
-                '" . addslashes($record_key) . "',
-                '" . addslashes($record_val) . "',
-                '" . addslashes($title) . "',
-                '" . addslashes($this->_auth->getVal('user_id')) . "',
+                '" . DB::escapeString($record_table) . "',
+                '" . DB::escapeString($record_key) . "',
+                '" . DB::escapeString($record_val) . "',
+                '" . DB::escapeString($title) . "',
+                '" . DB::escapeString($this->_auth->getVal('user_id')) . "',
                 NOW()
             )
@@ -274,5 +274,5 @@
         DB::query("
             DELETE FROM " . $this->getParam('db_table') . "
-            WHERE lock_id = '" . addslashes($this->data['lock_id']) . "'
+            WHERE lock_id = '" . DB::escapeString($this->data['lock_id']) . "'
         ");
 
@@ -292,5 +292,5 @@
         if (isset($user_id)) {
             // Delete specific user's locks.
-            DB::query("DELETE FROM " . $this->getParam('db_table') . " WHERE set_by_admin_id = '" . addslashes($user_id) . "'");
+            DB::query("DELETE FROM " . $this->getParam('db_table') . " WHERE set_by_admin_id = '" . DB::escapeString($user_id) . "'");
             App::logMsg(sprintf('Record locks owned by %s %s have been deleted', $this->_auth->getVal('auth_name'), $this->_auth->getUsername($user_id)), LOG_DEBUG, __FILE__, __LINE__);
         } else {
Index: trunk/lib/RecordVersion.inc.php
===================================================================
--- trunk/lib/RecordVersion.inc.php	(revision 110)
+++ trunk/lib/RecordVersion.inc.php	(revision 111)
@@ -182,11 +182,11 @@
                 version_datetime
             ) VALUES (
-                '" . addslashes($record_table) . "',
-                '" . addslashes($record_key) . "',
-                '" . addslashes($record_val) . "',
-                '" . addslashes(gzcompress(serialize($record), 9)) . "',
-                '" . addslashes($title) . "',
-                '" . addslashes($notes) . "',
-                '" . addslashes($this->_auth->getVal('user_id')) . "',
+                '" . DB::escapeString($record_table) . "',
+                '" . DB::escapeString($record_key) . "',
+                '" . DB::escapeString($record_val) . "',
+                '" . DB::escapeString(gzcompress(serialize($record), 9)) . "',
+                '" . DB::escapeString($title) . "',
+                '" . DB::escapeString($notes) . "',
+                '" . DB::escapeString($this->_auth->getVal('user_id')) . "',
                 NOW()
             )
@@ -210,5 +210,5 @@
         $qid = DB::query("
             SELECT * FROM " . $this->getParam('db_table') . "
-            WHERE version_id = '" . addslashes($version_id) . "'
+            WHERE version_id = '" . DB::escapeString($version_id) . "'
         ");
         if (!$record = mysql_fetch_assoc($qid)) {
@@ -227,5 +227,5 @@
 
         // SQLize the keys of the specified versioned record.
-        $replace_keys = join(",\n", array_map('addslashes', array_keys($data)));
+        $replace_keys = join(",\n", array_map(array('DB', 'escapeString'), array_keys($data)));
 
         // SQLize the keys of the values of the specified versioned record. (These are more complex because we need to account for SQL null values.)
@@ -233,5 +233,5 @@
         $comma = '';
         foreach ($data as $v) {
-            $replace_values .= is_null($v) ? "$comma\nNULL" : "$comma\n'" . addslashes($v) . "'";
+            $replace_values .= is_null($v) ? "$comma\nNULL" : "$comma\n'" . DB::escapeString($v) . "'";
             $comma = ',';
         }
@@ -268,7 +268,7 @@
         $qid = DB::query("
             SELECT COUNT(*) FROM " . $this->getParam('db_table') . "
-            WHERE record_table = '" . addslashes($record_table) . "'
-            AND record_key = '" . addslashes($record_key) . "'
-            AND record_val = '" . addslashes($record_val) . "'
+            WHERE record_table = '" . DB::escapeString($record_table) . "'
+            AND record_key = '" . DB::escapeString($record_key) . "'
+            AND record_val = '" . DB::escapeString($record_val) . "'
         ");
         list($v_count) = mysql_fetch_row($qid);
@@ -280,7 +280,7 @@
                 $qid = DB::query("
                     SELECT version_id FROM " . $this->getParam('db_table') . "
-                    WHERE record_table = '" . addslashes($record_table) . "'
-                    AND record_key = '" . addslashes($record_key) . "'
-                    AND record_val = '" . addslashes($record_val) . "'
+                    WHERE record_table = '" . DB::escapeString($record_table) . "'
+                    AND record_key = '" . DB::escapeString($record_key) . "'
+                    AND record_val = '" . DB::escapeString($record_val) . "'
                     ORDER BY version_datetime ASC
                     LIMIT " . ($v_count - $this->getParam('min_qty')) . "
@@ -297,7 +297,7 @@
                 $qid = DB::query("
                     SELECT version_id FROM " . $this->getParam('db_table') . "
-                    WHERE record_table = '" . addslashes($record_table) . "'
-                    AND record_key = '" . addslashes($record_key) . "'
-                    AND record_val = '" . addslashes($record_val) . "'
+                    WHERE record_table = '" . DB::escapeString($record_table) . "'
+                    AND record_key = '" . DB::escapeString($record_key) . "'
+                    AND record_val = '" . DB::escapeString($record_val) . "'
                     AND DATE_ADD(version_datetime, INTERVAL '" . $this->getParam('min_days') . "' DAY) < NOW()
                     ORDER BY version_datetime ASC
@@ -334,7 +334,7 @@
             SELECT version_id, saved_by_admin_id, version_datetime, version_title
             FROM " . $this->getParam('db_table') . "
-            WHERE record_table = '" . addslashes($record_table) . "'
-            AND record_key = '" . addslashes($record_key) . "'
-            AND record_val = '" . addslashes($record_val) . "'
+            WHERE record_table = '" . DB::escapeString($record_table) . "'
+            AND record_key = '" . DB::escapeString($record_key) . "'
+            AND record_val = '" . DB::escapeString($record_val) . "'
             ORDER BY version_datetime DESC
         ");
@@ -362,5 +362,5 @@
         $qid = DB::query("
             SELECT * FROM " . $this->getParam('db_table') . "
-            WHERE version_id = '" . addslashes($version_id) . "'
+            WHERE version_id = '" . DB::escapeString($version_id) . "'
         ");
         return mysql_fetch_assoc($qid);
@@ -381,5 +381,5 @@
         $qid = DB::query("
             SELECT * FROM " . $this->getParam('db_table') . "
-            WHERE version_id = '" . addslashes($version_id) . "'
+            WHERE version_id = '" . DB::escapeString($version_id) . "'
         ");
         $record = mysql_fetch_assoc($qid);
@@ -403,6 +403,6 @@
 
         $qid = DB::query("
-            SELECT * FROM " . addslashes($record_table) . "
-            WHERE " . addslashes($record_key) . " = '" . addslashes($record_val) . "'
+            SELECT * FROM " . DB::escapeString($record_table) . "
+            WHERE " . DB::escapeString($record_key) . " = '" . DB::escapeString($record_val) . "'
         ");
         if ($record = mysql_fetch_assoc($qid)) {
Index: trunk/lib/SortOrder.inc.php
===================================================================
--- trunk/lib/SortOrder.inc.php	(revision 110)
+++ trunk/lib/SortOrder.inc.php	(revision 111)
@@ -143,5 +143,5 @@
 
         if (!empty($this->_columns[strtolower($this->sort_by)][strtolower($this->order)])) {
-            return sprintf(' ORDER BY %s ', addslashes($this->_columns[strtolower($this->sort_by)][strtolower($this->order)]));
+            return sprintf(' ORDER BY %s ', DB::escapeString($this->_columns[strtolower($this->sort_by)][strtolower($this->order)]));
         } else {
             App::logMsg(sprintf('Could not find SQL to sort by %s %s.', $this->sort_by, $this->order), LOG_WARNING, __FILE__, __LINE__);
Index: trunk/lib/TemplateGlue.inc.php
===================================================================
--- trunk/lib/TemplateGlue.inc.php	(revision 110)
+++ trunk/lib/TemplateGlue.inc.php	(revision 111)
@@ -66,5 +66,5 @@
 function getSetEnumFieldValues($db_table, $db_col)
 {
-    $qid = DB::query("SHOW COLUMNS FROM " . addslashes($db_table) . " LIKE '" . addslashes($db_col) . "'",false);
+    $qid = DB::query("SHOW COLUMNS FROM " . DB::escapeString($db_table) . " LIKE '" . DB::escapeString($db_col) . "'",false);
 
     $row = mysql_fetch_row($qid);
Index: trunk/lib/Utilities.inc.php
===================================================================
--- trunk/lib/Utilities.inc.php	(revision 110)
+++ trunk/lib/Utilities.inc.php	(revision 111)
@@ -105,5 +105,5 @@
 /**
  * Returns text with stylistic modifications. Warning: this will break some HTML attibutes!
- * FIXME: Allow a string such as this to be passted: <a href="javascript:openPopup('/foo/bar.php')">Click here</a>
+ * TODO: Allow a string such as this to be passted: <a href="javascript:openPopup('/foo/bar.php')">Click here</a>
  *
  * @param  string   $txt  Text to clean.
@@ -463,23 +463,26 @@
 
 /**
- * Adds slashes to values of an array and converts the array to a
- * comma delimited list. If value provided is not an array or is empty
- * return nothing. This is useful for putting values coming in from
- * posted checkboxes into a SET column of a database.
- *
- * @param  array $array   Array to convert.
+ * Adds slashes to values of an array and converts the array to a comma
+ * delimited list. If value provided is a string return the string
+ * escaped.  This is useful for putting values coming in from posted
+ * checkboxes into a SET column of a database.
+ * 
+ *
+ * @param  array $in      Array to convert.
  * @return string         Comma list of array values.
  */
-function dbArrayToList($array)
-{
-    if (is_array($array) && !empty($array)) {
-        return join(',', array_map('addslashes', array_keys($array)));
-    }
-}
-
-/**
- * Converts a human string date into a SQL-safe date.
- * Dates nearing infinity use the date 2038-01-01 so conversion to unix time
- * format remain within valid range.
+function escapedList($in)
+{
+    if (is_array($in) && !empty($in)) {
+        return "'" . join("', '", array_map(array('DB', 'escapeString'), $in)) . "'";
+    } else {
+        return DB::escapeString($in);
+    }
+}
+
+/**
+ * Converts a human string date into a SQL-safe date.  Dates nearing
+ * infinity use the date 2038-01-01 so conversion to unix time format
+ * remain within valid range.
  *
  * @param  array $date     String date to convert.
Index: trunk/services/admins.php
===================================================================
--- trunk/services/admins.php	(revision 110)
+++ trunk/services/admins.php	(revision 111)
@@ -154,5 +154,5 @@
         if (getFormdata('repeat', false)) {
             // Display edit function with next available ID.
-            $qid = DB::query("SELECT admin_id FROM admin_tbl WHERE admin_id > '" . addslashes(getFormData('admin_id')) . "' ORDER BY admin_id ASC LIMIT 1");
+            $qid = DB::query("SELECT admin_id FROM admin_tbl WHERE admin_id > '" . DB::escapeString(getFormData('admin_id')) . "' ORDER BY admin_id ASC LIMIT 1");
             if (list($next_id) = mysql_fetch_row($qid)) {
                 App::dieURL($_SERVER['PHP_SELF'] . '?op=edit&admin_id=' . $next_id);
@@ -268,5 +268,5 @@
         SELECT *
         FROM admin_tbl
-        WHERE admin_id = '" . addslashes($id) . "'
+        WHERE admin_id = '" . DB::escapeString($id) . "'
     ");
     if (!$frm = mysql_fetch_assoc($qid)) {
@@ -325,5 +325,5 @@
     $qid = DB::query("
         SELECT username, user_type from admin_tbl
-        WHERE admin_id = '" . addslashes($id) . "'
+        WHERE admin_id = '" . DB::escapeString($id) . "'
     ");
     if (! list($name, $user_type) = mysql_fetch_row($qid)) {
@@ -347,5 +347,5 @@
     } else {
         // Delete the record.
-        DB::query("DELETE FROM admin_tbl WHERE admin_id = '" . addslashes($id) . "'");
+        DB::query("DELETE FROM admin_tbl WHERE admin_id = '" . DB::escapeString($id) . "'");
         App::raiseMsg(sprintf(_("The admin <strong>%s</strong> has been deleted."), $name), MSG_SUCCESS, __FILE__, __LINE__);
     }
@@ -373,10 +373,10 @@
             added_datetime
         ) VALUES (
-            '" . addslashes($frm['username']) . "',
-            '" . addslashes($frm['first_name']) . "',
-            '" . addslashes($frm['last_name']) . "',
-            '" . addslashes($frm['email']) . "',
-            '" . addslashes($frm['user_type']) . "',
-            '" . addslashes($auth->getVal('user_id')) . "',
+            '" . DB::escapeString($frm['username']) . "',
+            '" . DB::escapeString($frm['first_name']) . "',
+            '" . DB::escapeString($frm['last_name']) . "',
+            '" . DB::escapeString($frm['email']) . "',
+            '" . DB::escapeString($frm['user_type']) . "',
+            '" . DB::escapeString($auth->getVal('user_id')) . "',
             NOW()
         )
@@ -417,12 +417,12 @@
     DB::query("
         UPDATE admin_tbl SET
-            username = '" . addslashes($frm['username']) . "',
-            first_name = '" . addslashes($frm['first_name']) . "',
-            last_name = '" . addslashes($frm['last_name']) . "',
-            email = '" . addslashes($frm['email']) . "',
-            user_type = '" . addslashes($frm['user_type']) . "',
-            modified_by_user_id = '" . addslashes($auth->getVal('user_id')) . "',
+            username = '" . DB::escapeString($frm['username']) . "',
+            first_name = '" . DB::escapeString($frm['first_name']) . "',
+            last_name = '" . DB::escapeString($frm['last_name']) . "',
+            email = '" . DB::escapeString($frm['email']) . "',
+            user_type = '" . DB::escapeString($frm['user_type']) . "',
+            modified_by_user_id = '" . DB::escapeString($auth->getVal('user_id')) . "',
             modified_datetime = NOW()
-        WHERE admin_id = '" . addslashes($frm['admin_id']) . "'
+        WHERE admin_id = '" . DB::escapeString($frm['admin_id']) . "'
     ");
 
@@ -450,8 +450,8 @@
             $where_clause .= (empty($where_clause) ? 'WHERE' : 'AND') . "
                 (
-                    admin_tbl.username LIKE '%" . addslashes($qry_words[$i]) . "%'
-                    OR admin_tbl.first_name LIKE '%" . addslashes($qry_words[$i]) . "%'
-                    OR admin_tbl.last_name LIKE '%" . addslashes($qry_words[$i]) . "%'
-                    OR admin_tbl.email LIKE '%" . addslashes($qry_words[$i]) . "%'
+                    admin_tbl.username LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
+                    OR admin_tbl.first_name LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
+                    OR admin_tbl.last_name LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
+                    OR admin_tbl.email LIKE '%" . DB::escapeString($qry_words[$i]) . "%'
                 )
             ";
