Index: branches/1.1dev/lib/RecordVersion.inc.php
===================================================================
--- branches/1.1dev/lib/RecordVersion.inc.php	(revision 80)
+++ branches/1.1dev/lib/RecordVersion.inc.php	(revision 81)
@@ -58,10 +58,10 @@
                 version_datetime
             ) VALUES (
-                '" . addslashes($record_table) . "',
-                '" . addslashes($record_key) . "',
-                '" . addslashes($record_val) . "',
-                '" . addslashes(gzcompress(serialize($record), 9)) . "',
-                '" . addslashes($title) . "',
-                '" . addslashes($_admin->getVal('user_id')) . "',
+                '" . mysql_real_escape_string($record_table) . "',
+                '" . mysql_real_escape_string($record_key) . "',
+                '" . mysql_real_escape_string($record_val) . "',
+                '" . mysql_real_escape_string(gzcompress(serialize($record), 9)) . "',
+                '" . mysql_real_escape_string($title) . "',
+                '" . mysql_real_escape_string($_admin->getVal('user_id')) . "',
                 NOW()
             )
@@ -83,10 +83,10 @@
         $qid = dbQuery("
             SELECT * FROM version_tbl 
-            WHERE version_id = '" . addslashes($version_id) . "'
+            WHERE version_id = '" . mysql_real_escape_string($version_id) . "'
         ");
         $record = mysql_fetch_assoc($qid);
         $data = unserialize(gzuncompress($record['version_data']));
         
-        $qid = dbQuery("SHOW COLUMNS FROM " . addslashes($record['record_table']));
+        $qid = dbQuery("SHOW COLUMNS FROM " . mysql_real_escape_string($record['record_table']));
         while ($row = mysql_fetch_assoc($qid)) {
             $fields[] = $row['Field'];
@@ -102,7 +102,7 @@
         dbQuery("
             REPLACE INTO " . $record['record_table'] . " (
-                " . join(",\n", array_map('addslashes', array_keys($data))) . "
+                " . join(",\n", array_map('mysql_real_escape_string', array_keys($data))) . "
             ) VALUES (
-                '" . join("',\n'", array_map('addslashes', $data)) . "'
+                '" . join("',\n'", array_map('mysql_real_escape_string', $data)) . "'
             )
         ");
@@ -128,7 +128,7 @@
         $qid = dbQuery("
             SELECT COUNT(*) FROM version_tbl
-            WHERE record_table = '" . addslashes($record_table) . "'
-            AND record_key = '" . addslashes($record_key) . "'
-            AND record_val = '" . addslashes($record_val) . "'
+            WHERE record_table = '" . mysql_real_escape_string($record_table) . "'
+            AND record_key = '" . mysql_real_escape_string($record_key) . "'
+            AND record_val = '" . mysql_real_escape_string($record_val) . "'
         ");
         list($v_count) = mysql_fetch_row($qid);
@@ -139,7 +139,7 @@
                 $qid = dbQuery("
                     SELECT version_id FROM version_tbl
-                    WHERE record_table = '" . addslashes($record_table) . "'
-                    AND record_key = '" . addslashes($record_key) . "'
-                    AND record_val = '" . addslashes($record_val) . "'
+                    WHERE record_table = '" . mysql_real_escape_string($record_table) . "'
+                    AND record_key = '" . mysql_real_escape_string($record_key) . "'
+                    AND record_val = '" . mysql_real_escape_string($record_val) . "'
                     ORDER BY version_datetime ASC
                     LIMIT " . ($v_count - $this->record_version_min_qty) . "
@@ -156,7 +156,7 @@
                 $qid = dbQuery("
                     SELECT version_id FROM version_tbl
-                    WHERE record_table = '" . addslashes($record_table) . "'
-                    AND record_key = '" . addslashes($record_key) . "'
-                    AND record_val = '" . addslashes($record_val) . "'
+                    WHERE record_table = '" . mysql_real_escape_string($record_table) . "'
+                    AND record_key = '" . mysql_real_escape_string($record_key) . "'
+                    AND record_val = '" . mysql_real_escape_string($record_val) . "'
                     AND DATE_ADD(version_datetime, INTERVAL '" . $this->record_version_min_days . "' DAY) < NOW()
                     ORDER BY version_datetime ASC
@@ -191,12 +191,12 @@
             SELECT version_id, saved_by_admin_id, version_datetime, version_title
             FROM version_tbl
-            WHERE record_table = '" . addslashes($record_table) . "'
-            AND record_key = '" . addslashes($record_key) . "'
-            AND record_val = '" . addslashes($record_val) . "'
+            WHERE record_table = '" . mysql_real_escape_string($record_table) . "'
+            AND record_key = '" . mysql_real_escape_string($record_key) . "'
+            AND record_val = '" . mysql_real_escape_string($record_val) . "'
             ORDER BY version_datetime DESC
         ");
         while ($row = mysql_fetch_assoc($qid)) {
             // Get admin usernames.
-            $qid2 = dbQuery("SELECT username FROM admin_tbl WHERE admin_id = '" . addslashes($row['saved_by_admin_id']) . "'");
+            $qid2 = dbQuery("SELECT username FROM admin_tbl WHERE admin_id = '" . mysql_real_escape_string($row['saved_by_admin_id']) . "'");
             list($row['editor']) = mysql_fetch_row($qid2);
             $versions[] = $row;
@@ -221,5 +221,5 @@
         $qid = dbQuery("
             SELECT * FROM version_tbl 
-            WHERE version_id = '" . addslashes($version_id) . "'
+            WHERE version_id = '" . mysql_real_escape_string($version_id) . "'
         ");
         return mysql_fetch_assoc($qid);
@@ -238,5 +238,5 @@
         $qid = dbQuery("
             SELECT * FROM version_tbl 
-            WHERE version_id = '" . addslashes($version_id) . "'
+            WHERE version_id = '" . mysql_real_escape_string($version_id) . "'
         ");
         $record = mysql_fetch_assoc($qid);
@@ -258,6 +258,6 @@
     {
         $qid = dbQuery("
-            SELECT * FROM " . addslashes($record_table) . "
-            WHERE " . addslashes($record_key) . " = '" . addslashes($record_val) . "'
+            SELECT * FROM " . mysql_real_escape_string($record_table) . "
+            WHERE " . mysql_real_escape_string($record_key) . " = '" . mysql_real_escape_string($record_val) . "'
         ");
         if ($record = mysql_fetch_assoc($qid)) {
