Dear everyone,

during my tries to get my previous problem (post: "quote manipulators") solved, I have run into(what I consider) a serious bug.

The method escape_string() does *not* correctly escape '"' characters. It produces "\ instead of \". After a long search on the net, I even figured this is a long standing unfixed bug. This could lead to *serious* security related problems if one relies on this function to properly escape user input. A user could indirectly access the database by entering a modified string.