--- a/msitegen.inc.php	Sat Dec 07 15:17:10 2013 +0200
+++ b/msitegen.inc.php	Sat Dec 07 15:17:43 2013 +0200
@@ -460,56 +460,34 @@
 }
 
 
-function stGetSQLParam($type, $value)
+function stDBPrepareSQLUpdate($dbh, $table, $cond, $pairs)
 {
-  global $db;
-  switch ($type)
+  $sql = array();
+  foreach ($pairs as $name => $attr)
   {
-    case "d":
-      return intval($value);
-
-    case "s":
-      return $db->quote($value);
-
-    case "b":
-      return intval($value) ? 1 : 0;
-
-    case "D":
-      return intval(stGetRequestItem($value));
-
-    case "S":
-      return $db->quote(stGetRequestItem($value));
-
-    case "Q":
-      return $db->quote(stGetRequestItem($value));
-
-    case "B":
-      return intval(stGetRequestItem($value)) ? 1 : 0;
+    $sql[] = $name."=".stDBGetSQLParam($dbh, $attr, $name);
   }
+  return
+    "UPDATE ".$table." SET ".implode(",", $sql).
+    ($cond != "" ? " ".$cond : "");
 }
 
 
-function stPrepareSQL()
+function stDBPrepareSQL($dbh)
 {
   $argc = func_num_args();
   $argv = func_get_args();
-  if ($argc < 1)
-  {
-    error_log("Invalid stPrepareSQL() call, no arguments!");
-    return FALSE;
-  }
 
-  $fmt = $argv[0];
+  $fmt = $argv[1];
   $len = strlen($fmt);
   $sql = "";
-  $argn = 1;
-  $pos = 0;
-  while ($pos < $len)
+  $argn = 2;
+  for ($pos = 0; $pos < $len; $pos++)
   {
     if ($fmt[$pos] == "%")
     {
       if ($argn < $argc)
-        $sql .= stGetSQLParam($fmt[++$pos], $argv[$argn++]);
+        $sql .= stGetSQLParam($dbh, $fmt[++$pos], $argv[$argn++]);
       else
       {
         error_log("Invalid SQL statement format string '".$fmt.
@@ -519,30 +497,46 @@
     }
     else
       $sql .= $fmt[$pos];
-    $pos++;
   }
 
   return $sql;
 }
 
 
-function stPrepareSQLUpdate($table, $cond, $pairs)
+function stPrepareSQL()
 {
-  $sql = array();
-  foreach ($pairs as $name => $attr)
+  global $db;
+  $argc = func_num_args();
+  $argv = func_get_args();
+
+  $fmt = $argv[0];
+  $len = strlen($fmt);
+  $sql = "";
+  $argn = 1;
+  for ($pos = 0; $pos < $len; $pos++)
   {
-    $sql[] = $name."=".stGetSQLParam($attr, $name);
+    if ($fmt[$pos] == "%")
+    {
+      if ($argn < $argc)
+        $sql .= stGetSQLParam($db, $fmt[++$pos], $argv[$argn++]);
+      else
+      {
+        error_log("Invalid SQL statement format string '".$fmt.
+          "', not enough parameters specified (".$argn." of ".$argc.")");
+        return FALSE;
+      }
+    }
+    else
+      $sql .= $fmt[$pos];
   }
-  return
-    "UPDATE ".$table." SET ".implode(",", $sql).
-    ($cond != "" ? " ".$cond : "");
+
+  return $sql;
 }
 
 
-function stExecSQL($sql)
+function stDBExecSQL($dbh, $sql)
 {
-  global $db;
-  if (($res = $db->query($sql)) !== FALSE)
+  if (($res = $dbh->query($sql)) !== FALSE)
     return $res;
   else
   {
@@ -553,13 +547,10 @@
 }
 
 
-function stFetchSQL($sql)
+function stDBFetchSQL($dbh, $sql)
 {
-  global $db;
-  if (($res = $db->query($sql)) !== FALSE)
-  {
+  if (($res = $dbh->query($sql)) !== FALSE)
     return $res->fetch();
-  }
   else
   {
     stLogSQLError($sql);
@@ -569,13 +560,10 @@
 }
 
 
-function stFetchSQLColumn($sql, $column = 0)
+function stDBFetchSQLColumn($dbh, $sql, $column = 0)
 {
-  global $db;
-  if (($res = $db->query($sql)) !== FALSE)
-  {
+  if (($res = $dbh->query($sql)) !== FALSE)
     return $res->fetchColumn($column);
-  }
   else
   {
     stLogSQLError($sql);
@@ -585,7 +573,31 @@
 }
 
 
+function stPrepareSQLUpdate($table, $cond, $pairs)
 {
+  global $db;
+  return stDBPrepareSQLUpdate($db, $table, $cond, $pairs);
+}
+
+
+function stExecSQL($dbh, $sql)
+{
+  global $db;
+  return stDBExecSQL($db, $sql);
+}
+
+
+function stFetchSQL($dbh, $sql)
+{
+  global $db;
+  return stDBFetchSQL($db, $sql);
+}
+
+
+function stFetchSQLColumn($sql, $column = 0)
+{
+  global $db;
+  return stDBFetchSQLColumn($db, $sql, $column);
 }