[Marco van Herwaarden]

When inserting into the database you should always sanitize 'untrustred' values. It don't mean that you always need to use escape_string.

As a rule of thumb:
- Integer values:
Will be mostly already have been sanitized by

PHP Code:

$vbulletin->input->clean_array_gpc('r', array('my_integer'=> TYPE_INT)); 


or something like that, so they don't need to be sanitized anymore. Otherwise sanitize them by using

PHP Code:

intval($my_integer) 


- Character string variables will 99% of the time need to go through escape_string when used in a query.