Index: branches/2.8.x/CHANGELOG
===================================================================
--- branches/2.8.x/CHANGELOG	(revision 1867)
+++ branches/2.8.x/CHANGELOG	(revision 1868)
@@ -12,6 +12,8 @@
 ===============================================================================
 
 
+19 Feb-2013 Build 1868 Dietmar Woellbrink (Luisehahne)
+! change mysql_esc_string to WbDatabase::getInstance()->escapeStrinng() 
 19 Feb-2013 Build 1867 Dietmar Woellbrink (Luisehahne)
 ! fixed pagetree header
 19 Feb-2013 Build 1866 Dietmar Woellbrink (Luisehahne)
Index: branches/2.8.x/wb/admin/groups/save.inc.php
===================================================================
--- branches/2.8.x/wb/admin/groups/save.inc.php	(revision 1867)
+++ branches/2.8.x/wb/admin/groups/save.inc.php	(revision 1868)
@@ -56,7 +56,7 @@
 			$template_permissions = implode (',', $template_permissions);
 
 			// prepare empty record to add new group
-			$group_name = mysql_real_escape_string(strip_tags(trim($admin->get_post('name'))));
+			$group_name = $database->escapeString(strip_tags(trim($admin->get_post('name'))));
 //	print '<pre style="text-align: left;"><strong>function '.__FUNCTION__.'( '.''.' );</strong>  basename: '.basename(__FILE__).'  line: '.__LINE__.' -> <br />';
 //	print_r( $_POST ); print '</pre>';
 
Index: branches/2.8.x/wb/admin/pages/settings_save.php
===================================================================
--- branches/2.8.x/wb/admin/pages/settings_save.php	(revision 1867)
+++ branches/2.8.x/wb/admin/pages/settings_save.php	(revision 1868)
@@ -260,10 +260,10 @@
      . 'SET `parent`='.$parent.', '
      .     '`page_title`=\''.$page_title.'\', '
      .     '`tooltip`=\''.$page_title.'\', '
-     .     '`page_icon` =\''.mysql_real_escape_string($sPageIcon).'\', '
+     .     '`page_icon` =\''.$database->escapeString($sPageIcon).'\', '
      .     '`menu_title`=\''.$menu_title.'\', '
-     .     '`menu_icon_0` =\''.mysql_real_escape_string($sMenuIcon0).'\', '
-     .     '`menu_icon_1` =\''.mysql_real_escape_string($sMenuIcon1).'\', '
+     .     '`menu_icon_0` =\''.$database->escapeString($sMenuIcon0).'\', '
+     .     '`menu_icon_1` =\''.$database->escapeString($sMenuIcon1).'\', '
      .     '`menu`='.$menu.', '
      .     '`level`='.$level.', '
      .     '`page_trail`=\''.$page_trail.'\', '
@@ -299,13 +299,51 @@
 	$order->clean($old_parent);
 }
 
-/* BEGIN page "access file" code */
+// using standard function by core,
+function fix_page_trail($page_id) {
+    global $database,$admin,$target_url,$pagetree_url,$MESSAGE;
 
-// Create a new file in the /pages dir if title changed
-if(!is_writable(WB_PATH.PAGES_DIRECTORY.'/'))
+    $target_url = (isset($_POST['back_submit'])) ? $pagetree_url : $target_url;
+
+    // Work out level
+    $level = level_count($page_id);
+    // Work out root parent
+    $root_parent = root_parent($page_id);
+    // Work out page trail
+    $page_trail = get_page_trail($page_id);
+    // Update page with new level and link
+    $sql  = 'UPDATE `'.TABLE_PREFIX.'pages` SET ';
+    $sql .= '`root_parent` = '.$root_parent.', ';
+    $sql .= '`level` = '.$level.', ';
+    $sql .= '`page_trail` = "'.$page_trail.'" ';
+    $sql .= 'WHERE `page_id` = '.$page_id;
+
+    if($database->query($sql)) {
+    	$admin->print_success($MESSAGE['PAGES_SAVED_SETTINGS'], $target_url );
+    } else {
+    	$admin->print_error($database->get_error(), $target_url );
+    }
+}
+
+// Fix sub-pages page trail
+fix_page_trail($page_id);
+
+/**
+ * 
+ * BEGIN page "access file" code
+ * first check for existing pages directory
+ * if not exists try to create
+ * otherwise acess denied
+ * 
+ */
+$bCanCreateAcessFiles = is_writeable(WB_PATH);
+$bCanCreateAcessFiles = ( ( $bCanCreateAcessFiles==true ) ? make_dir(WB_PATH.PAGES_DIRECTORY) : false );
+if( !$bCanCreateAcessFiles )
 {
 	$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE'], $target_url);
 } else {
+// Create a new file in the /pages dir if title changed
+
     $old_filename = WB_PATH.PAGES_DIRECTORY.$old_link.PAGE_EXTENSION;
 
 	// First check if we need to create a new file
@@ -366,33 +404,4 @@
 	}
 }
 
-// using standard function by core,
-function fix_page_trail($page_id) {
-    global $database,$admin,$target_url,$pagetree_url,$MESSAGE;
-
-    $target_url = (isset($_POST['back_submit'])) ? $pagetree_url : $target_url;
-
-    // Work out level
-    $level = level_count($page_id);
-    // Work out root parent
-    $root_parent = root_parent($page_id);
-    // Work out page trail
-    $page_trail = get_page_trail($page_id);
-    // Update page with new level and link
-    $sql  = 'UPDATE `'.TABLE_PREFIX.'pages` SET ';
-    $sql .= '`root_parent` = '.$root_parent.', ';
-    $sql .= '`level` = '.$level.', ';
-    $sql .= '`page_trail` = "'.$page_trail.'" ';
-    $sql .= 'WHERE `page_id` = '.$page_id;
-
-    if($database->query($sql)) {
-    	$admin->print_success($MESSAGE['PAGES_SAVED_SETTINGS'], $target_url );
-    } else {
-    	$admin->print_error($database->get_error(), $target_url );
-    }
-}
-
-// Fix sub-pages page trail
-fix_page_trail($page_id);
-
 $admin->print_footer();
Index: branches/2.8.x/wb/admin/pages/add.php
===================================================================
--- branches/2.8.x/wb/admin/pages/add.php	(revision 1867)
+++ branches/2.8.x/wb/admin/pages/add.php	(revision 1868)
@@ -16,8 +16,18 @@
  */
 
 // Create new admin object and print admin header
-require('../../config.php');
-require_once(WB_PATH.'/framework/class.admin.php');
+//require('../../config.php');
+//require_once(WB_PATH.'/framework/class.admin.php');
+// Create new admin object and print admin header
+if(!defined('WB_URL'))
+{
+    $config_file = realpath('../../config.php');
+    if(file_exists($config_file) && !defined('WB_URL'))
+    {
+    	require($config_file);
+    }
+}
+if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
 // suppress to print the header, so no new FTAN will be set
 $admin = new admin('Pages', 'pages_add', false);
 if (!$admin->checkFTAN())
@@ -178,12 +188,7 @@
 $sql .= '`viewing_groups` = "'.$viewing_groups.'"';
 
 $database->query($sql);
-/*
-$query = "INSERT INTO ".TABLE_PREFIX."pages
-(page_title,menu_title,parent,template,target,position,visibility,searching,menu,language,admin_groups,viewing_groups,modified_when,modified_by) VALUES
-('$title','$title','$parent','$template','_top','$position','$visibility','1','1','$language','$admin_groups','$viewing_groups','".time()."','".$admin->get_user_id()."')";
-$database->query($query);
-*/
+
 if($database->is_error())
 {
 	$admin->print_error($database->get_error());
@@ -205,12 +210,11 @@
 $sql .= '`level` = '.$level.', ';
 $sql .= '`link` = "'.$link.'", ';
 $sql .= '`page_trail` = "'.$page_trail.'"';
-$sql .= (defined('PAGE_LANGUAGES') && PAGE_LANGUAGES)
+$sql .= ((defined('PAGE_LANGUAGES') && PAGE_LANGUAGES)
          && $field_set
          && ($language == DEFAULT_LANGUAGE)
-         && (file_exists(WB_PATH.'/modules/mod_multilingual/update_keys.php')
-         )
-         ? ', `page_code` = '.(int)$page_id.' ' : ' ';
+         && class_exists('m_MultiLingual_Lib')
+         ? ', `page_code` = '.(int)$page_id.' ' : ' ');
 $sql .= 'WHERE `page_id` = '.$page_id;
 $database->query($sql);
 /*
@@ -220,19 +224,11 @@
 {
 	$admin->print_error($database->get_error());
 }
-// Create a new file in the /pages dir
-create_access_file($filename, $page_id, $level);
 
-if(!file_exists($filename)) {
-	$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']);
-}
-
-// add position 1 to new page
+// add position 1 to new page section
 $position = 1;
 
 // Add new record into the sections table
-//$database->query("INSERT INTO ".TABLE_PREFIX."sections (page_id,position,module,block) VALUES ('$page_id','$position', '$module','1')");
-
 // Insert module into DB
 $sql  = 'INSERT INTO `'.TABLE_PREFIX.'sections` SET ';
 $sql .= '`page_id` = '.(int)$page_id.', ';
@@ -251,6 +247,13 @@
 	}
 }
 
+// Create a new file in the /pages dir
+create_access_file($filename, $page_id, $level);
+
+if(!file_exists($filename)) {
+	$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']);
+}
+
 // Check if there is a db error, otherwise say successful
 if($database->is_error()) {
 	$admin->print_error($database->get_error().' (sections)');
Index: branches/2.8.x/wb/admin/interface/version.php
===================================================================
--- branches/2.8.x/wb/admin/interface/version.php	(revision 1867)
+++ branches/2.8.x/wb/admin/interface/version.php	(revision 1868)
@@ -51,5 +51,5 @@
 
 // check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled)
 if(!defined('VERSION')) define('VERSION', '2.8.3');
-if(!defined('REVISION')) define('REVISION', '1867');
+if(!defined('REVISION')) define('REVISION', '1868');
 if(!defined('SP')) define('SP', '');
Index: branches/2.8.x/wb/admin/settings/save.php
===================================================================
--- branches/2.8.x/wb/admin/settings/save.php	(revision 1867)
+++ branches/2.8.x/wb/admin/settings/save.php	(revision 1868)
@@ -272,9 +272,9 @@
 
 	    if ( !in_array($value, $disallow_in_fields) && (isset($_POST[$setting_name]) || $passed == true) )
 	    {
-	        $value = trim($admin->add_slashes($value));
+	        $value = trim($database->escapeString($value));
 	        $sql = 'UPDATE `'.TABLE_PREFIX.'settings` ';
-	        $sql .= 'SET `value` = \''.($value).'\' '; // mysql_escape_string
+	        $sql .= 'SET `value` = \''.($value).'\' ';
 	        $sql .= 'WHERE `name` != \'wb_version\' ';
 	        $sql .= 'AND `name` = \''.$setting_name.'\' ';
 	        if (!$database->query($sql))
Index: branches/2.8.x/wb/admin/users/save.php
===================================================================
--- branches/2.8.x/wb/admin/users/save.php	(revision 1867)
+++ branches/2.8.x/wb/admin/users/save.php	(revision 1868)
@@ -182,24 +182,24 @@
             // Update the database
             if($password == "") {
                 $sql .= '`group_id`     = '.intval($group_id).', '.
-                        '`groups_id`    = \''.mysql_real_escape_string($groups_id).'\', '.
-                        '`username` = \''.mysql_real_escape_string($username).'\', '.
+                        '`groups_id`    = \''.$database->escapeString($groups_id).'\', '.
+                        '`username` = \''.$database->escapeString($username).'\', '.
                         '`active` = '.intval($active).', '.
-                        '`display_name` = \''.mysql_real_escape_string($display_name).'\', '.
-                        '`home_folder` = \''.mysql_real_escape_string($home_folder).'\', '.
-                        '`email` = \''.mysql_real_escape_string($email).'\' '.
+                        '`display_name` = \''.$database->escapeString($display_name).'\', '.
+                        '`home_folder` = \''.$database->escapeString($home_folder).'\', '.
+                        '`email` = \''.$database->escapeString($email).'\' '.
                         'WHERE `user_id` = '.intval($user_id).'';
 
             } else {
 
                 $sql .= '`group_id`     = '.intval($group_id).', '.
-                        '`groups_id`    = \''.mysql_real_escape_string($groups_id).'\', '.
-                        '`username` = \''.mysql_real_escape_string($username).'\', '.
+                        '`groups_id`    = \''.$database->escapeString($groups_id).'\', '.
+                        '`username` = \''.$database->escapeString($username).'\', '.
                         '`password` = \''.md5($password).'\', '.
                         '`active` = '.intval($active).', '.
-                        '`display_name` = \''.mysql_real_escape_string($display_name).'\', '.
-                        '`home_folder` = \''.mysql_real_escape_string($home_folder).'\', '.
-                        '`email` = \''.mysql_real_escape_string($email).'\' '.
+                        '`display_name` = \''.$database->escapeString($display_name).'\', '.
+                        '`home_folder` = \''.$database->escapeString($home_folder).'\', '.
+                        '`email` = \''.$database->escapeString($email).'\' '.
                         'WHERE `user_id` = '.intval($user_id).'';
 
             }
Index: branches/2.8.x/wb/admin/users/add.php
===================================================================
--- branches/2.8.x/wb/admin/users/add.php	(revision 1867)
+++ branches/2.8.x/wb/admin/users/add.php	(revision 1868)
@@ -156,23 +156,23 @@
             // Inser the user into the database
 			$sql  = 'INSERT INTO `'.TABLE_PREFIX.'users` SET '.
                     '`group_id`     = '.intval($group_id).', '.
-                    '`groups_id`    = \''.mysql_real_escape_string($groups_id).'\', '.
+                    '`groups_id`    = \''.$database->escapeString($groups_id).'\', '.
                     '`active`       = '.intval($active).', '.
-                    '`username`     = \''.mysql_real_escape_string($username).'\', '.
+                    '`username`     = \''.$database->escapeString($username).'\', '.
                     '`password`     = \''.md5($password).'\', '.
-                    '`confirm_code` = \''.mysql_real_escape_string($confirm_code).'\', '.
+                    '`confirm_code` = \''.$database->escapeString($confirm_code).'\', '.
                     '`confirm_timeout` = '.intval($confirm_timeout).', '.
-                    '`remember_key` = \''.mysql_real_escape_string($remember_key).'\', '.
+                    '`remember_key` = \''.$database->escapeString($remember_key).'\', '.
                     '`last_reset`   = '.intval($last_reset).', '.
-                    '`display_name` = \''.mysql_real_escape_string($display_name).'\', '.
-                    '`email`        = \''.mysql_real_escape_string($email).'\', '.
+                    '`display_name` = \''.$database->escapeString($display_name).'\', '.
+                    '`email`        = \''.$database->escapeString($email).'\', '.
                     '`timezone`     = '.intval($timezone).', '.
-                    '`date_format`  = \''.mysql_real_escape_string($date_format).'\', '.
-                    '`time_format`  = \''.mysql_real_escape_string($time_format).'\', '.
-                    '`language`     = \''.mysql_real_escape_string($language).'\', '.
-                    '`home_folder`  = \''.mysql_real_escape_string($home_folder).'\', '.
+                    '`date_format`  = \''.$database->escapeString($date_format).'\', '.
+                    '`time_format`  = \''.$database->escapeString($time_format).'\', '.
+                    '`language`     = \''.$database->escapeString($language).'\', '.
+                    '`home_folder`  = \''.$database->escapeString($home_folder).'\', '.
                     '`login_when`   = '.intval($login_when).', '.
-                    '`login_ip`     = \''.mysql_real_escape_string($login_ip).'\' '.
+                    '`login_ip`     = \''.$database->escapeString($login_ip).'\' '.
                     '';
             if($database->query($sql)) {
             	msgQueue::add($MESSAGE['USERS_ADDED'], true);
Index: branches/2.8.x/wb/admin/languages/uninstall.php
===================================================================
--- branches/2.8.x/wb/admin/languages/uninstall.php	(revision 1867)
+++ branches/2.8.x/wb/admin/languages/uninstall.php	(revision 1868)
@@ -65,7 +65,7 @@
 	$admin->print_error($MESSAGE['GENERIC_CANNOT_UNINSTALL_IN_USE']);
 } else {
 	$sql  = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
-	$sql .= 'WHERE`language`=\''.mysql_real_escape_string($code).'\'';
+	$sql .= 'WHERE`language`=\''.$database->escapeString($code).'\'';
 	if( $database->get_one($sql) ) {
 		$admin->print_error($MESSAGE['GENERIC_CANNOT_UNINSTALL_IN_USE']);
 	}
@@ -77,7 +77,7 @@
 } else {
 	// Remove entry from DB
 	$sql  = 'DELETE FROM `'.TABLE_PREFIX.'addons` ';
-	$sql .= 'WHERE `directory`=\''.mysql_real_escape_string($code).'\' ';
+	$sql .= 'WHERE `directory`=\''.$database->escapeString($code).'\' ';
 	$sql .=   'AND `type`=`type`=\'language\' ';
 	if( $database->query($sql) ) {
         // Print success message
Index: branches/2.8.x/wb/admin/addons/CopyTheme.php
===================================================================
--- branches/2.8.x/wb/admin/addons/CopyTheme.php	(revision 1867)
+++ branches/2.8.x/wb/admin/addons/CopyTheme.php	(revision 1868)
@@ -97,7 +97,7 @@
 	private function _SanitizeNewName($sName)
 	{
 		$sName = (trim($sName) == '' ? 'MyNewTheme' : $sName);
-		$sName = mysql_real_escape_string($sName);
+		$sName = $this->_oDb->escapeString($sName);
 		$iCount = '';
 		do {
 			$sSearch = $sName.($iCount ? ' '.$iCount : '');
@@ -260,11 +260,11 @@
 		     .     '`function`=\'theme\', '
 		     .     '`directory`=\''.$aVariables['directory'].'\', '
 		     .     '`name`=\''.$aVariables['name'].'\', '
-		     .     '`description`=\''.mysql_real_escape_string($aVariables['description']).'\', '
+		     .     '`description`=\''.$this->_oDb->escapeString($aVariables['description']).'\', '
 		     .     '`version`=\''.$aVariables['version'].'\', '
 		     .     '`platform`=\''.$aVariables['platform'].'\', '
-		     .     '`author`=\''.mysql_real_escape_string($aVariables['author']).'\', '
-		     .     '`license`=\''.mysql_real_escape_string($aVariables['license']).'\'';
+		     .     '`author`=\''.$this->_oDb->escapeString($aVariables['author']).'\', '
+		     .     '`license`=\''.$this->_oDb->escapeString($aVariables['license']).'\'';
 		if(!$this->_oDb->query($sql)) {
 
 			$sMsg = $this->_aLang['GENERIC_NOT_UPGRADED'].' ['.$this->_sNewThemeDir.'/info.php]';
Index: branches/2.8.x/wb/account/save_confirm.php
===================================================================
--- branches/2.8.x/wb/account/save_confirm.php	(revision 1867)
+++ branches/2.8.x/wb/account/save_confirm.php	(revision 1868)
@@ -26,9 +26,9 @@
 require_once(dirname(__FILE__).'/AccountSignup.php');
 AccountSignup::deleteOutdatedConfirmations();
 
-$sPassword = mysql_escape_string($wb->StripCodeFromText($wb->get_post('new_password_1')));
-$sLoginName = mysql_escape_string($wb->StripCodeFromText($wb->get_post('new_loginname')));
-$sConfirmationId = mysql_escape_string($wb->StripCodeFromText($wb->get_post('confirm_code')));
+$sPassword = $database->escapeString($wb->StripCodeFromText($wb->get_post('new_password_1')));
+$sLoginName = $database->escapeString($wb->StripCodeFromText($wb->get_post('new_loginname')));
+$sConfirmationId = $database->escapeString($wb->StripCodeFromText($wb->get_post('confirm_code')));
 
 $bSendRegistrationMailtoUser = false;
 $bSendRegistrationMailtoAdmin = false;
Index: branches/2.8.x/wb/account/email.php
===================================================================
--- branches/2.8.x/wb/account/email.php	(revision 1867)
+++ branches/2.8.x/wb/account/email.php	(revision 1868)
@@ -46,7 +46,7 @@
     			if(!$wb->validate_email($email)){
     				$error[] = ($MESSAGE['USERS_INVALID_EMAIL']);
     			} else {
-        			$email = mysql_escape_string($email);
+        			$email = $database->escapeString($email);
                     // Update the database
         			$sql = "UPDATE `".TABLE_PREFIX."users` SET `email` = '".$email."' WHERE `user_id` = ".$wb->get_user_id();
         			$database->query($sql);
Index: branches/2.8.x/wb/modules/wysiwyg/save.php
===================================================================
--- branches/2.8.x/wb/modules/wysiwyg/save.php	(revision 1867)
+++ branches/2.8.x/wb/modules/wysiwyg/save.php	(revision 1868)
@@ -45,7 +45,7 @@
 	$searchfor = '@(<[^>]*=\s*")('.preg_quote($sMediaUrl).')([^">]*".*>)@siU';
     $content = preg_replace($searchfor, '$1{SYSVAR:MEDIA_REL}$3', $content);
 	// searching in $text will be much easier this way
-    $content = mysql_real_escape_string ($content);
+    $content = WbDatabase::getInstance()->escapeString ($content);
 	$text = umlauts_to_entities(strip_tags($content), strtoupper(DEFAULT_CHARSET), 0);
 	$sql  = 'UPDATE `'.TABLE_PREFIX.'mod_wysiwyg` ';
 	$sql .= 'SET `content`=\''.$content.'\', `text`=\''.$text.'\' ';
Index: branches/2.8.x/wb/modules/form/view.php
===================================================================
--- branches/2.8.x/wb/modules/form/view.php	(revision 1867)
+++ branches/2.8.x/wb/modules/form/view.php	(revision 1868)
@@ -82,9 +82,9 @@
 
 		$label_id = 'wb_'.preg_replace('/[^a-z0-9]/i', '_', $key).$field_id;
 		if(in_array($key, $params[1])) {
-			$key = '<input class="frm-field_checkbox" type="checkbox" id="'.$label_id.'" name="field'.$field_id.'['.$idx.']" value="'.$key.'" />'.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$key.'</lable>'.$seperator;
+			$key = '<input class="frm-field_checkbox" type="checkbox" id="'.$label_id.'" name="field'.$field_id.'['.$idx.']" value="'.$key.'" />'.PHP_EOL.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$key.'</lable>'.$seperator;
 		} else {
-			$key = '<input class="frm-field_checkbox" type="checkbox" id="'.$label_id.'" name="field'.$field_id.'['.$idx.']" value="'.$key.'" />'.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$key.'</label>'.$seperator;
+			$key = '<input class="frm-field_checkbox" type="checkbox" id="'.$label_id.'" name="field'.$field_id.'['.$idx.']" value="'.$key.'" />'.PHP_EOL.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$key.'</label>'.$seperator;
 		}
 	}
 }
@@ -96,9 +96,9 @@
 		$seperator = $params[2];
 		$label_id = 'wb_'.preg_replace('/[^a-z0-9]/i', '_', $n).$field_id;
 		if($n == $params[3]) {
-			$n = '<input class="frm-field_checkbox" type="radio" id="'.$label_id.'" name="field'.$field_id.'" value="'.$n.'" checked="checked" />'.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$n.'</label>'.$seperator;
+			$n = '<input class="frm-field_checkbox" type="radio" id="'.$label_id.'" name="field'.$field_id.'" value="'.$n.'" checked="checked" />'.PHP_EOL.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$n.'</label>'.$seperator;
 		} else {
-			$n = '<input class="frm-field_checkbox" type="radio" id="'.$label_id.'" name="field'.$field_id.'" value="'.$n.'" />'.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$n.'</label>'.$seperator;
+			$n = '<input class="frm-field_checkbox" type="radio" id="'.$label_id.'" name="field'.$field_id.'" value="'.$n.'" />'.PHP_EOL.'<label for="'.$label_id.'" class="frm-checkbox_label">'.$n.'</label>'.$seperator;
 		}
 	}
 }
@@ -201,8 +201,10 @@
 				$vars = array('{TITLE}', '{REQUIRED}');
 				if (($field['type'] == "radio") || ($field['type'] == "checkbox")) {
 					$field_title = $field['title'];
-				} else {
-					$field_title = '<label for="field'.$field_id.'">'.$field['title'].'</label>';
+				} elseif($field['type'] == 'heading') {
+					$field_title = PHP_EOL.'<label>'.$field['title'].'</label>'.PHP_EOL;
+				}else {
+					$field_title = PHP_EOL.'<label for="field'.$field_id.'">'.$field['title'].'</label>'.PHP_EOL;
 				}
 				$values = array($field_title);
 				if ($field['required'] == 1) {
Index: branches/2.8.x/wb/modules/form/frontend.css
===================================================================
--- branches/2.8.x/wb/modules/form/frontend.css	(revision 1867)
+++ branches/2.8.x/wb/modules/form/frontend.css	(revision 1868)
@@ -1,5 +1,7 @@
 .frm-required { color :#ff0000; }
 .frm-field_title { font-size :12px; width :25%; vertical-align :top; white-space :nowrap; text-align :right; }
+.field_heading,
+.frm-field_heading { border-bottom: 1px ridge; font-weight: bold; }
 .frm-textfield { font-size :12px; width :90%; }
 .frm-textarea { font-size :12px; width :100%; height :100px; }
 .frm-field_heading { font-size :12px; font-weight :bold; border-bottom-width :2px; border-bottom-style :solid; border-bottom-color :#666666; padding-top :10px; color :#666666; }
@@ -20,4 +22,4 @@
 .previewPrintTop img { padding-left :16px; }
 fieldset { border :none; }
 .frm-thankyou { font-size :1em; }
-.frm-tbody {  }
\ No newline at end of file
+.frm-tbody {  }		
\ No newline at end of file
Index: branches/2.8.x/wb/modules/form/modify.php
===================================================================
--- branches/2.8.x/wb/modules/form/modify.php	(revision 1867)
+++ branches/2.8.x/wb/modules/form/modify.php	(revision 1868)
@@ -203,7 +203,7 @@
 $page = 1;
 if(isset($_GET['page']) && is_numeric(trim($_GET['page'])))
 {
-	$page = intval(mysql_real_escape_string($_GET['page']));
+	$page = intval($database->escapeString($_GET['page']));
 }
 
 // How many adjacent pages should be shown on each side?
Index: branches/2.8.x/wb/modules/output_filter/tool.php
===================================================================
--- branches/2.8.x/wb/modules/output_filter/tool.php	(revision 1867)
+++ branches/2.8.x/wb/modules/output_filter/tool.php	(revision 1868)
@@ -48,8 +48,8 @@
 					  '`email_filter`='.$data['email_filter'].', '.
 					  '`sys_rel`='.$data['sys_rel'].', '.
 					  '`mailto_filter`='.$data['mailto_filter'].', '.
-					  '`at_replacement`=\''.mysql_real_escape_string($data['at_replacement']).'\', '.
-					  '`dot_replacement`=\''.mysql_real_escape_string($data['dot_replacement']).'\'';
+					  '`at_replacement`=\''.$database->escapeString($data['at_replacement']).'\', '.
+					  '`dot_replacement`=\''.$database->escapeString($data['dot_replacement']).'\'';
 			if($database->query($sql)) {
 			//anything ok
 				$msgOk = $MESSAGE['RECORD_MODIFIED_SAVED'];
Index: branches/2.8.x/wb/modules/news/add.php
===================================================================
--- branches/2.8.x/wb/modules/news/add.php	(revision 1867)
+++ branches/2.8.x/wb/modules/news/add.php	(revision 1868)
@@ -24,7 +24,7 @@
 }
 /* -------------------------------------------------------- */
 
-$header = '<table cellpadding=\"0\" cellspacing=\"0\" class=\"loop-header\">'."\n";
+$header = '<table class=\"loop-header\">'."\n";
 $post_loop = '<tr class=\"post-top\">
 <td class=\"post-title\"><a href=\"[LINK]\">[TITLE]</a></td>
 <td class=\"post-date\">[PUBLISHED_DATE], [PUBLISHED_TIME]</td>
@@ -36,7 +36,7 @@
 </td>
 </tr>';
 $footer = '</table>
-<table cellpadding="0" cellspacing="0" class="page-header" style="display: [DISPLAY_PREVIOUS_NEXT_LINKS]">
+<table class="page-header" style="display: [DISPLAY_PREVIOUS_NEXT_LINKS]">
 <tr>
 <td class="page-left">[PREVIOUS_PAGE_LINK]</td>
 <td class="page-center">[OF]</td>
@@ -59,7 +59,7 @@
 <a href=\"[BACK]\">[TEXT_BACK]</a>';
 $comments_header = addslashes('<br /><br />
 <h2>[TEXT_COMMENTS]</h2>
-<table cellpadding="2" cellspacing="0" class="comment-header">');
+<table class="comment-header">');
 $comments_loop = addslashes('<tr>
 <td class="comment_title">[TITLE]</td>
 <td class="comment_info">[TEXT_BY] [DISPLAY_NAME] [TEXT_ON] [DATE] [TEXT_AT] [TIME]</td>
Index: branches/2.8.x/wb/modules/news/comment_page.php
===================================================================
--- branches/2.8.x/wb/modules/news/comment_page.php	(revision 1867)
+++ branches/2.8.x/wb/modules/news/comment_page.php	(revision 1868)
@@ -61,7 +61,7 @@
 	$values = array(POST_TITLE, $MOD_NEWS['TEXT_COMMENT']);
 	echo str_replace($vars, $values, ($settings['comments_page']));
 	?>
-	<form name="comment" action="<?php echo WB_URL.'/modules/news/submit_comment.php?page_id='.PAGE_ID.'&amp;section_id='.SECTION_ID.'&amp;post_id='.POST_ID; ?>" method="post">
+	<form action="<?php echo WB_URL.'/modules/news/submit_comment.php?page_id='.PAGE_ID.'&amp;section_id='.SECTION_ID.'&amp;post_id='.POST_ID; ?>" method="post">
 	<?php if(ENABLED_ASP) { // add some honeypot-fields
 	?>
 	<input type="hidden" name="submitted_when" value="<?php $t=time(); echo $t; $_SESSION['submitted_when']=$t; ?>" />
Index: branches/2.8.x/wb/modules/news/save_post.php
===================================================================
--- branches/2.8.x/wb/modules/news/save_post.php	(revision 1867)
+++ branches/2.8.x/wb/modules/news/save_post.php	(revision 1868)
@@ -18,53 +18,27 @@
 	function createNewsAccessFile($newLink, $oldLink, $page_id, $section_id, $post_id)
 	{
 		global $admin, $MESSAGE;
+		$sError = '';
 		$sPagesPath = WB_PATH.PAGES_DIRECTORY;
 		$sPostsPath = $sPagesPath.'/posts';
-	// create /posts/ - directory if not exists
-		if(!file_exists($sPostsPath)) {
-			if(is_writable($sPagesPath)) {
-				make_dir(WB_PATH.PAGES_DIRECTORY.'/posts/');
-			}else {
-				$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']);
-			}
-		}
-	// check if /posts/ - dir is writable
-		if(!is_writable($sPostsPath.'/')) {
-			$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']);
-		}
+		$sBackUrl = ADMIN_URL.'/pages/modify.php?page_id='.$page_id;
 	// delete old accessfile if link has changed
 		if(($newLink != $oldLink) && (is_writable($sPostsPath.$oldLink.PAGE_EXTENSION))) {
 			if(!unlink($sPostsPath.$oldLink.PAGE_EXTENSION)) {
-				$admin->print_error($MESSAGE['PAGES_CANNOT_DELETE_ACCESS_FILE'].' - '.$oldLink);
+				$admin->print_error($MESSAGE['PAGES_CANNOT_DELETE_ACCESS_FILE'].' - '.$oldLink,$sBackUrl);
 			}
 		}
 	// all ok, now create new accessfile
 		$newFile = $sPagesPath.$newLink.PAGE_EXTENSION;
 		// $backSteps = preg_replace('/^'.preg_quote(WB_PATH).'/', '', $sPostsPath);
-		$backSteps = preg_replace('@^'.preg_quote(WB_PATH).'@', '', $sPostsPath);
-		$backSteps = str_repeat( '../', substr_count($backSteps, '/'));
-		$content =
-			'<?php'."\n".
-			'// *** This file is generated by WebsiteBaker Ver.'.WB_VERSION."\n".
-			'// *** Creation date: '.date('c')."\n".
-			'// *** Do not modify this file manually'."\n".
-			'// *** WB will rebuild this file from time to time!!'."\n".
-			'// *************************************************'."\n".
-			"\t".'$page_id      = '.$page_id.';'."\n".
-			"\t".'$section_id   = '.$section_id.';'."\n".
-			"\t".'$post_id      = '.$post_id.';'."\n".
-			"\t".'$post_section = '.$section_id.';'."\n".
-//			"\t".'define(\'POST_SECTION\', '.$section_id.');'."\n".
-//			"\t".'define(\'POST_ID\',      '.$post_id.');'."\n".
-			"\t".'require(\''.$backSteps.'index.php\');'."\n".
-			'// *************************************************'."\n";
-		if( file_put_contents($newFile, $content) !== false ) {
-		// Chmod the file
-			change_mode($newFile);
-		}else {
-			$admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE'],ADMIN_URL.'/pages/modify.php?page_id='.$page_id);
-			// $admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE'].': '.$newFile);
-
+				$aOptionalCommands = array(
+				         '$section_id   = '.$section_id,
+				         '$post_id      = '.$post_id ,
+				         '$post_section = '.$section_id
+				);
+		if(	($sError = create_access_file($newFile, $page_id, 0, $aOptionalCommands))!==true ) 
+		{
+			$admin->print_error($sError,$sBackUrl );
 		}
 	} // end of function createNewsAccessFile
 /* ************************************************************************** */
@@ -95,7 +69,7 @@
 	if($admin->get_post('title') == '' AND $admin->get_post('url') == '') {
         $recallUrl = WB_URL.'/modules/news/modify_post.php?page_id='.$page_id.
 		             '&section_id='.$section_id.'&post_id='.$admin->getIDKEY($post_id);
-		$admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], $recallUrl);
+		$admin->print_error($MESSAGE['GENERIC_FILL_IN_ALL'], $recallUrl);
 	}else {
 		$title      = $admin->get_post_escaped('title');
 		$short      = $admin->get_post_escaped('short');
@@ -112,8 +86,6 @@
 	require(WB_PATH.'/framework/functions.php');
 // Work-out what the link should be
 	$newLink = '/posts/'.page_filename($title).PAGE_SPACER.$post_id;
-// create new accessfile
-	createNewsAccessFile($newLink, $oldLink, $page_id, $section_id, $post_id);
 // get publisedwhen and publisheduntil
 	$publishedwhen = jscalendar_to_timestamp($admin->get_post_escaped('publishdate'));
 	if($publishedwhen == '' || $publishedwhen < 1) { $publishedwhen=0; }
@@ -133,7 +105,10 @@
 	$sql .=     '`posted_when`='.time().', ';
 	$sql .=     '`posted_by`='.(int)$admin->get_user_id().' ';
 	$sql .= 'WHERE `post_id`='.(int)$post_id;
-	$database->query($sql);
+	if( $database->query($sql) ) { 
+		// create new accessfile
+		createNewsAccessFile($newLink, $oldLink, $page_id, $section_id, $post_id);
+	}
 // Check if there is a db error, otherwise say successful
 	if($database->is_error()) {
 		$recallUrl = WB_URL.'/modules/news/modify_post.php?page_id='.$page_id.
Index: branches/2.8.x/wb/modules/news/submit_comment.php
===================================================================
--- branches/2.8.x/wb/modules/news/submit_comment.php	(revision 1867)
+++ branches/2.8.x/wb/modules/news/submit_comment.php	(revision 1868)
@@ -26,7 +26,7 @@
 */
 
 require_once(WB_PATH.'/framework/class.wb.php');
-$wb = new wb;
+if( !(isset($wb) && is_object($wb)) ) { $wb = new wb(); }
 include_once (WB_PATH.'/framework/functions.php');
 /*
 $post_id = (int)$_GET['post_id'];