note 14522 added to function.pg-exec.php

In response to sterling, if one calls urlencode before inserting a string into the database and urldecode after retrieving it, the security issue is taken care of. One also needs to force variables which should be ints to ints and so forth because once a variable of a type other than string is properly formatted, it is not possible for it to contain malicious data. http://www.php.net/manual/en/function.pg-exec.php