very helpful SirAdrian, thank you. So it seems as if it should be a standard practive to use $db->sql_prepare() as opposed to $db->escape_string() since the former seems to do a bit more "cleaning" of the user input. Are there any instances where this might not be the case? I ask this because I tend to see $db->escape_string() more frequently than $db->sql_prepare() in vb code (default and mods). Or is one no better than the other?
|