note 66827 added to function.pg-escape-string

For those who escape their single quotes with a backslash (ie \') instead of two single quotes in a row (ie '') there has recently been a SERIOUS sql injection vulnerability that can be employed taking advantage of your chosen escaping method. More info here: http://www.postgresql.org/docs/techdocs.50 Even after the postgre update, you may still be limited to what you can do with your queries if you still insist on backslash escaping. It's a lesson to always use the PHP functions to do proper escaping instead of adhoc addslashes or magic quotes escaping. ---- Server IP: 64.71.164.2 Probable Submitter: 158.118.51.2 (proxied: 1.0 PROXY) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.pg-escape-string.php Edit -- http://master.php.net/note/edit/66827 Del: integrated -- http://master.php.net/note/delete/66827/integrated Del: useless -- http://master.php.net/note/delete/66827/useless Del: bad code -- http://master.php.net/note/delete/66827/bad+code Del: spam -- http://master.php.net/note/delete/66827/spam Del: non-english -- http://master.php.net/note/delete/66827/non-english Del: in docs -- http://master.php.net/note/delete/66827/in+docs Del: other reasons-- http://master.php.net/note/delete/66827 Reject -- http://master.php.net/note/reject/66827 Search -- http://master.php.net/manage/user-notes.php