# 
# 
# patch "hostconfig.dist"
#  from [be6b29f695f2970cac77f6bf76fb59219c699261]
#    to [314a6edd35df9dda2f0af2399cc3f677fc57d7a3]
# 
# patch "schema.sql"
#  from [88d60e294727d99f361429ec3f63fddece7fb67b]
#    to [7ac9ff4513b78347c54178c96cae5d09604716e5]
# 
# patch "usher.cc"
#  from [0c60b2b5903f873210ebeb5b18cf97122641b291]
#    to [302a743841e9c811a94d383359b9a53e55900042]
# 
# patch "www/admin-description_backend.php"
#  from [35aaa14b1ed2fd7b061c029208d095f3ed520a58]
#    to [77be066f94469962dee95ebcbe852d3f7ef3bfc0]
# 
# patch "www/admin-files_backend.php"
#  from [ef16f5dbaffe7f400e6b75126f7707abb5d5f9af]
#    to [8109ee3be651cbd4d693b930060403c1a7149a46]
# 
# patch "www/admin-permissions_backend.php"
#  from [9dfe7767585351057995a7131f324748ec3136d1]
#    to [fe7eeb8b0b6ad5f905dc314e51aee3e505852ed2]
# 
# patch "www/admin-resources_backend.php"
#  from [d1f490cc113924a005b87acd0228eb369e29cea6]
#    to [c25e06b302ff66e55ecee79a85765f2e90339d2e]
# 
# patch "www/admin-source_control_backend.php"
#  from [bd5a63243bd701e1d25546eba8f7df5d4c809103]
#    to [bad920c2af82c62f49e8e8c8b1a2404aa635ee27]
# 
# patch "www/common-ctrl.php"
#  from [3d09cb8656535448914e20f5507f887fad56d0ee]
#    to [525cce75f5c6b70486c58ac270facaa835e247f1]
# 
# patch "www/common-resource.php"
#  from [bb89b43d6a10482146c02944a319179a2e60a85e]
#    to [fbb14c31a5b356f9199190f90cee387a3c9a247d]
# 
# patch "www/common.php"
#  from [80a3b636f5be49cace64be55e4d2460717184eba]
#    to [d98b06834662916a0798150dcb656a36f0801149]
# 
# patch "www/index.php"
#  from [dbdcfb046def381d796adc242fc9044f45be52d8]
#    to [9c415a134ece496a7a2015c8fb3e2e6e7f9d58a9]
# 
# patch "www/login.php"
#  from [2411034b91d3b8441676c2ca0d559b32682027f5]
#    to [53f3fcfe78d47e975b16cc3237465f91688225fe]
# 
# patch "www/proj-ctrl.php"
#  from [95c69963bab767abfea870515cf888496987000a]
#    to [4174270cbc77848dd88cd09efec5f3f010c46ea3]
# 
# patch "www/project.php"
#  from [3260a28bfd208039e33b8637a1ec5a5c4ee85dba]
#    to [02a98d34f5ed4b461542afedd2e846f980fe1731]
# 
============================================================
--- hostconfig.dist	be6b29f695f2970cac77f6bf76fb59219c699261
+++ hostconfig.dist	314a6edd35df9dda2f0af2399cc3f677fc57d7a3
@@ -1,5 +1,6 @@
 userpass "username" "password"
-dbstring "dbname=DBNAME"
+adodb_path "/usr/share/adodb/adodb.inc.php" 
+dbstring "postgres://dbuser:address@hidden/dbname"
 admin "127.0.0.5:12345"
 
 hostkey "address@hidden"
============================================================
--- schema.sql	88d60e294727d99f361429ec3f63fddece7fb67b
+++ schema.sql	7ac9ff4513b78347c54178c96cae5d09604716e5
@@ -1,7 +1,10 @@
 
-CREATE TABLE users ( username varchar(80), password varchar(80) );
+CREATE TABLE users ( username varchar(80), 
+		     password varchar(80),
+			primary key (username) );
 
-CREATE TABLE projects ( name varchar(80) );
+CREATE TABLE projects ( name varchar(80),
+			primary key (name) );
 
 CREATE TABLE permissions ( username varchar(80),
 			project varchar(80),
@@ -10,10 +13,12 @@
 			homepage smallint,
 			access smallint,
 			server smallint,
-			description smallint );
+			description smallint,
+			primary key (username, project) );
 
 CREATE TABLE resources ( project varchar(80),
 			name varchar(80),
 			type varchar(80),
-			data varchar(160)
+			data varchar(160),
+			primary key (project)
 			);
============================================================
--- usher.cc	0c60b2b5903f873210ebeb5b18cf97122641b291
+++ usher.cc	302a743841e9c811a94d383359b9a53e55900042
@@ -141,6 +141,91 @@
   errstr(std::string const & s, int e): name(s), err(e) {}
 };
 
+set<string> get_project_names_postgres(string const & user,
+                                       string const & pass,
+                                       string const & host,
+                                       string const & db,
+                                       vector<string> const & opts)
+{
+  string dbstring;
+  if (!user.empty()) {
+    dbstring += ("user="+user);
+  }
+  if (!pass.empty()) {
+    dbstring += (dbstring.empty()?"":" ") + ("password='"+pass+"'");
+  }
+  if (!host.empty()) {
+    dbstring += (dbstring.empty()?"":" ") + ("host="+host);
+  }
+  if (!db.empty()) {
+    dbstring += (dbstring.empty()?"":" ") + ("dbname="+db);
+  }
+  for(vector<string>::const_iterator i = opts.begin(); i != opts.end(); ++i) {
+    if(dbstring.size())
+      dbstring += " ";
+    dbstring += *i;
+  }
+  set<string> names;
+  pqxx::connection conn(dbstring);
+  pqxx::work w(conn, "trx");
+  pqxx::result r = w.exec("SELECT name FROM projects");
+  for(unsigned int i = 0; i < r.size(); ++i) {
+    string n = r[i][0].c_str();
+    if(!n.empty())
+      names.insert(n);
+  }
+  w.commit();
+  return names;
+}
+
+// dbstring looks like:
+// $driver://$username:address@hidden/$database?options[=value]
+set<string> get_project_names()
+{
+  string str(dbstring);
+  string driver, user, pass, host, db;
+  vector<string> opts;
+
+  size_t off = str.find("://");
+  driver = str.substr(0, off);
+  str = str.substr(off+3);
+  off = str.find_first_of(":@/");
+  if (str[off] == ':' || str[off] == '@') {
+    user = str.substr(0, off);
+    char c = str[off];
+    str = str.substr(off+1);
+    if (c == ':') {
+      off = str.find("@");
+      pass = str.substr(0, off);
+      str = str.substr(off+1);
+    }
+    off = str.find("/");
+  }
+  host = str.substr(0, off);
+  str = str.substr(off+1);
+  off = str.find("?");
+  if (off == string::npos)
+    db = str;
+  else {
+    db = str.substr(0, off);
+    str = str.substr(off+1);
+    while (!str.empty()) {
+      off = str.find("&");
+      opts.push_back(str.substr(0, off));
+      if (off == string::npos)
+        str.clear();
+      else
+        str = str.substr(off+1);
+    }
+  }
+  
+  if (driver == "postgres")
+    return get_project_names_postgres(user, pass, host, db, opts);
+  
+  std::cerr<<"Confusing db string.\n";
+  return set<string>();
+}
+
 int tosserr(int ret, std::string const & name)
 {
   if (ret == -1)
@@ -1370,19 +1455,11 @@
     }
   }
 
-  set<string> names;
-  pqxx::connection conn(dbstring);
-  pqxx::work w(conn, "trx");
-  pqxx::result r = w.exec("SELECT name FROM projects");
-  for(unsigned int i = 0; i < r.size(); ++i) {
-    string n = r[i][0].c_str();
-    if(n.empty())
-      continue;
-    make_server(n);
-    names.insert(n);
-    cerr<<"Server: "<<n<<"\n";
+  set<string> names = get_project_names();
+  for(set<string>::const_iterator i = names.begin(); i != names.end(); ++i) {
+    make_server(*i);
+    cerr<<"Server: "<<(*i)<<"\n";
   }
-  w.commit();
 
   for (map<string, shared_ptr<server> >::iterator
          i = server::servers_by_name.begin();
============================================================
--- www/admin-description_backend.php	35aaa14b1ed2fd7b061c029208d095f3ed520a58
+++ www/admin-description_backend.php	77be066f94469962dee95ebcbe852d3f7ef3bfc0
@@ -16,5 +16,5 @@
 					"longdescription" => file_get_contents($projwww . "/longdescription")));
 	}
 }
-pg_close($db);
+$db->Close();
 ?>
============================================================
--- www/admin-files_backend.php	ef16f5dbaffe7f400e6b75126f7707abb5d5f9af
+++ www/admin-files_backend.php	8109ee3be651cbd4d693b930060403c1a7149a46
@@ -47,5 +47,5 @@
 	file_put_contents($projwww . "/files-about/" . basename($args->file), $args->filedesc);
 	print $json->encode(array("ok" => "ok"));
 }
-pg_close($db);
+$db->Close();
 ?>
============================================================
--- www/admin-permissions_backend.php	9dfe7767585351057995a7131f324748ec3136d1
+++ www/admin-permissions_backend.php	fe7eeb8b0b6ad5f905dc314e51aee3e505852ed2
@@ -1,25 +1,23 @@
 <?
 include_once("common-ctrl.php");
 
 function maintlist() {
-	global $db, $safeproj;
+	global $db,$project;
 	$fields = "username, give, upload, homepage, access, server, description";
-	$query = sprintf("SELECT %s FROM permissions WHERE ", $fields);
-	$query = $query . "project = '%s'";
-	$result = pg_exec($db, sprintf($query, $safeproj));
+	$query = sprintf("SELECT %s FROM permissions WHERE project=?", $fields);
+	$result = $db->Execute($query, array($project));
 	$out = array();
 	if ($result) {
-		$rows = pg_numrows($result);
-		for($i = 0; $i < $rows; ++$i) {
-			$row = pg_fetch_row ($result,$i);
-			$perm['username']	= $row[0];
-			$perm['give']		= ($row[1] == 1);
-			$perm['upload']		= ($row[2] == 1);
-			$perm['homepage']	= ($row[3] == 1);
-			$perm['access']		= ($row[4] == 1);
-			$perm['server']		= ($row[5] == 1);
-			$perm['description']	= ($row[6] == 1);
+		while (!$result->EOF) {
+			$perm['username']	= $result->fields[0];
+			$perm['give']		= ($result->fields[1] == 1);
+			$perm['upload']		= ($result->fields[2] == 1);
+			$perm['homepage']	= ($result->fields[3] == 1);
+			$perm['access']		= ($result->fields[4] == 1);
+			$perm['server']		= ($result->fields[5] == 1);
+			$perm['description']	= ($result->fields[6] == 1);
 			$out[] = $perm;
+			$result->MoveNext();
 		}
 	}
 	return $out;
@@ -45,24 +43,28 @@
 				$res["error"] = "You're not allowed to revoke your own permissions to edit maintainers.";
 				break;
 			}
-			pg_exec($db, "BEGIN");
+			$db->BeginTrans();
 			$begun = true;
-			pg_exec($db, "LOCK TABLE permissions");
-			$query = sprintf("DELETE FROM permissions WHERE project = '%s'", $safeproj);
-			$result = pg_exec($db, $query);
+			#			pg_exec($db, "LOCK TABLE permissions");
+			$result = $db->Execute("DELETE FROM permissions WHERE project=?", array($project));
 			if (!$result) {
 				$res['error'] = 'Internal server error.';
 				$ok = false;
 				break;
 			}
 			$fields = "username, project, give, upload, homepage, access, server, description";
-			$query = sprintf("INSERT INTO permissions (%s) VALUES (%%s)", $fields);
+			$query = sprintf("INSERT INTO permissions (%s) VALUES (?,?,?,?,?,?,?,?)", $fields);
+			$istmt = $db->Prepare($query);
 			foreach ($args->newmaint as $i) {
-				$values = sprintf("'%s', '%s', %s, %s, %s, %s, %s, %s",
-						pg_escape_string($i->username), $safeproj,
-						$i->give?1:0, $i->upload?1:0, $i->homepage?1:0,
-						$i->access?1:0, $i->server?1:0, $i->description?1:0);
-				$result = pg_exec($db, sprintf($query, $values));
+				$result = $db->Execute($istmt, 
+						array($i->username, 
+							$project,
+							$i->give?1:0, 
+							$i->upload?1:0, 
+							$i->homepage?1:0,
+							$i->access?1:0, 
+							$i->server?1:0, 
+							$i->description?1:0));
 				if (!$result) {
 					$res['error'] = 'Internal server error.';
 					$ok = false;
@@ -73,10 +75,10 @@
 				$res["maintainers"] = maintlist();
 		} while(false);
 		if (!$ok && $begun)
-			pg_exec($db, "ROLLBACK");
+			$db->RollbackTrans();
 		print $json->encode($res);
-		pg_exec($db, "END");
+		$db->CommitTrans();
 	}
 }
-pg_close($db);
+$db->Close();
 ?>
============================================================
--- www/admin-resources_backend.php	d1f490cc113924a005b87acd0228eb369e29cea6
+++ www/admin-resources_backend.php	c25e06b302ff66e55ecee79a85765f2e90339d2e
@@ -10,17 +10,15 @@
 	$res = array();
 	$ok = true;
 	do {
-		pg_exec($db, "BEGIN");
-		pg_exec($db, "LOCK TABLE resources");
-		$query = sprintf("DELETE FROM resources WHERE project = '%s'", $safeproj);
-		$result = pg_exec($db, $query);
+		$db->BeginTrans();
+		#		pg_exec($db, "LOCK TABLE resources");
+		$result = $db->Execute("DELETE FROM resources WHERE project=?", array($project));
 		if (!$result) {
 			$res['error'] = 'Internal server error. (1)';
 			$ok = false;
 			break;
 		}
-		$fields = "project, name, type, data";
-		$query = sprintf("INSERT INTO resources (%s) VALUES (%%s)", $fields);
+		$istmt =  $db->Prepare("INSERT INTO resources(project,name,type,data) VALUES(?,?,?,?)");
 		foreach ($args->newresources as $i) {
 			if ($i->type == "link") {
 				$type = 0;
@@ -29,15 +27,14 @@
 			} else {
 				$type = -1;
 			}
-			$values = sprintf("'%s', '%s', %s, '%s'",
-					$safeproj,
-					pg_escape_string($i->name),
+			$values = array($project,
+					$i->name,
 					$type,
-					pg_escape_string($i->data));
-			$result = pg_exec($db, sprintf($query, $values));
+					$i->data);
+			$result = $db->Execute($istmt, $values);
 			if (!$result) {
 				$res['error'] = 'Internal server error. (2)';
-				$res['verboseError'] = sprintf($query, $values);
+				$res['verboseError'] = sprintf("inserting into resources: %s, %s, %s, %s", $project, $i->name,$type,$i->data);
 				$ok = false;
 				break;
 			}
@@ -46,9 +43,10 @@
 			$res["resources"] = resourcelist();
 	} while(false);
 	if (!$ok)
-		pg_exec($db, "ROLLBACK");
+		$db->RollbackTrans();
+	else
+		$db->CommitTrans();
 	print $json->encode($res);
-	pg_exec($db, "END");
 }
-pg_close($db);
+$db->Close();
 ?>
============================================================
--- www/admin-source_control_backend.php	bd5a63243bd701e1d25546eba8f7df5d4c809103
+++ www/admin-source_control_backend.php	bad920c2af82c62f49e8e8c8b1a2404aa635ee27
@@ -83,5 +83,5 @@
 		print $json->encode(array("result" => "ok"));
 	}
 }
-pg_close($db);
+$db->Close();
 ?>
============================================================
--- www/common-ctrl.php	3d09cb8656535448914e20f5507f887fad56d0ee
+++ www/common-ctrl.php	525cce75f5c6b70486c58ac270facaa835e247f1
@@ -5,7 +5,6 @@
 $action = $args->action; if($_REQUEST['action']) $action = $_REQUEST['action'];
 $project = $args->project; if($_REQUEST['project']) $project = $_REQUEST['project'];
 
-$safeproj = pg_escape_string($project);
 $projdir = $project_dir . "/" . basename($project);
 $projwww = $www_dir . "/projects/" . basename($project);
 $monotone = "$monotone --confdir '$projdir'";
@@ -18,16 +17,12 @@
 	else
 		return $args->$name;
 }
-function safearg($name) {
-	return pg_escape_string(getarg($name));
-}
 function dirsafe($name) {
 	return ($name == basename($name)) && ($name != '..');
 }
 
 if (!$project) {
 	$project = basename(dirname($_SERVER['PHP_SELF']));
-	$safeproj = pg_escape_string($project);
 }
 function allowed($what) {
 	global $json, $permissions, $validuser, $username;
@@ -52,15 +47,15 @@
 if ($validuser) {
 	$fields = "give, upload, homepage, access, server, description";
 	$query = sprintf("SELECT %s FROM permissions WHERE ", $fields);
-	$query = $query . "username = '%s' AND project = '%s'";
-	$result = pg_exec($db, sprintf($query, $safeuser, $safeproj));
+	$query = $query . "username=? AND project=?";
+	$result = $db->Execute($query, array($username, $project));
 	if ($result) {
-		$rows = pg_numrows($result);
+		$rows = $result->RecordCount();
 		$permissions['rows'] = $rows;
-		$permissions['safeuser'] = $safeuser;
-		$permissions['safeproj'] = $safeproj;
+		$permissions['username'] = $username;
+		$permissions['project'] = $project;
 		if ($rows == 1) {
-			$row = pg_fetch_row ($result, 0);
+			$row = $result->FetchRow();
 			$permissions['give']		= ($row[0] == 1);
 			$permissions['upload']		= ($row[1] == 1);
 			$permissions['homepage']		= ($row[2] == 1);
============================================================
--- www/common-resource.php	bb89b43d6a10482146c02944a319179a2e60a85e
+++ www/common-resource.php	fbb14c31a5b356f9199190f90cee387a3c9a247d
@@ -1,24 +1,23 @@
 <?
 include_once("common.php");
 function resourcelist() {
-	global $db, $safeproj;
-	$query = "SELECT name, type, data FROM resources WHERE project = '%s'";
-	$result = pg_exec($db, sprintf($query, $safeproj));
+	global $db, $project;
+	$query = "SELECT name, type, data FROM resources WHERE project=?";
+	$result = $db->Execute($query, array($project));
 	$out = array();
 	if ($result) {
-		$rows = pg_numrows($result);
-		for($i = 0; $i < $rows; ++$i) {
-			$row = pg_fetch_row ($result,$i);
-			$r['name'] = $row[0];
-			if ($row[1] == 0) {
+		while (!$result->EOF) {
+			$r['name'] = $result->fields[0];
+			if ($result->fields[1] == 0) {
 				$r['type'] = "link";
-			} elseif ($row[1] == 1) {
+			} elseif ($result->fields[1] == 1) {
 				$r['type'] = "irc";
 			} else {
 				$r['type'] = "unknown";
 			}
-			$r['data'] = $row[2];
+			$r['data'] = $result->fields[2];
 			$out[] = $r;
+			$result->MoveNext();
 		}
 	}
 	return $out;
============================================================
--- www/common.php	80a3b636f5be49cace64be55e4d2460717184eba
+++ www/common.php	d98b06834662916a0798150dcb656a36f0801149
@@ -1,5 +1,5 @@
 <?
-ini_set("display_errors", false);
+#ini_set("display_errors", false);
 
 $confdir = 'CONFDIR';
 $conffile = $confdir . "/hostconfig";
@@ -34,6 +34,8 @@
 		$hostname = nxt($splitconf);
 	} elseif($i == "project_dir") {
 		$project_dir = nxt($splitconf);
+	} elseif($i == "adodb_path") {
+		$adodb_path = nxt($splitconf);
 	} elseif($i == "graph_dir") {
 		$graph_dir = nxt($splitconf);
 	} elseif($i == "www_dir") {
@@ -57,6 +59,7 @@
 $json = new Services_JSON();
 
 function mktok($username, $shapass, $t) {
+	global $confdir;
 	$secfile = $confdir . "/secfile";
 	$sstr = "";
 	if (is_file($secfile)) {
@@ -88,17 +91,14 @@
 	$shapass = '';
 }
 
-$safeuser = pg_escape_string($username);
-
+include_once($adodb_path);
 $validuser = false;
-$db = pg_connect($dbstring);
-$query = sprintf("SELECT password FROM users WHERE username = '%s'", $safeuser);
-$result = pg_exec($db, $query);
+$db = &ADONewConnection( $dbstring );
+$result = $db->Execute("SELECT password FROM users WHERE username=?", array($username));
 if ($result) {
-	$rows = pg_numrows($result);
+	$rows = $result->RecordCount();
 	if ($rows == 1) {
-		$row = pg_fetch_row ($result, 0);
-		if ($row[0] == $shapass) {
+		if ($result->fields[0] == $shapass) {
 			$validuser = true;
 		}
 	}
============================================================
--- www/index.php	dbdcfb046def381d796adc242fc9044f45be52d8
+++ www/index.php	9c415a134ece496a7a2015c8fb3e2e6e7f9d58a9
@@ -38,31 +38,31 @@
 # First, display those maintained by the logged in user, if any
 if ($validuser) {
 #	$query = "SELECT name, directory FROM projects WHERE name IN (SELECT project FROM permissions WHERE username = '%s')";
-	$query = "SELECT name FROM projects WHERE name IN (SELECT project FROM permissions WHERE username = '%s')";
-	$result = pg_exec($db, sprintf($query,$safeuser));
+	$query= "SELECT name FROM projects WHERE name IN (SELECT project FROM permissions WHERE username=?)";
+	$result = $db->Execute($query, array($username));
 	if (!$result) {printf("ERROR"); }
-	$rows = pg_numrows($result);
+	$rows = $result->RecordCount();
 	if ($rows > 0) {
 		printf("<p><b>Projects you help maintain:</b></p>");
-		for($i = 0; $i < $rows; ++$i) {
-			$row = pg_fetch_row ($result,$i);
+		while (!$result->EOF) {
+			$row =  $result->FetchRow();
 			display_project_summary($row, 1);
 		}
 	}
 }
 #$query = "SELECT name, directory FROM projects WHERE name NOT IN (SELECT project FROM permissions WHERE username = '%s')";
-$query = "SELECT name FROM projects WHERE name NOT IN (SELECT project FROM permissions WHERE username = '%s')";
-$result = pg_exec($db, sprintf($query,$safeuser));
+$query = "SELECT name FROM projects WHERE name NOT IN (SELECT project FROM permissions WHERE username=?)";
+$result = $db->Execute($query, array($username));
 if (!$result) {printf("ERROR"); }
-$rows = pg_numrows($result);
+$rows = $result->RecordCount();
 if ($rows > 0) {
 	printf("<p><b>Projects you don't help maintain:</b></p>");
-	for($i = 0; $i < $rows; ++$i) {
-		$row = pg_fetch_row ($result,$i);
+	while (!$result->EOF) {
+		$row =  $result->FetchRow();
 		display_project_summary($row, 0);
 	}
 }
-pg_close();
+$db->Close();
 ?>
 
 </div>
============================================================
--- www/login.php	2411034b91d3b8441676c2ca0d559b32682027f5
+++ www/login.php	53f3fcfe78d47e975b16cc3237465f91688225fe
@@ -42,21 +42,26 @@
 	if ($username == "" || $shapass == "") {
 		$res = "Your username and password cannot be blank.<br/>\n";
 	} else {
-		pg_exec($db, "BEGIN");
-		pg_exec($db, "LOCK TABLE users");
-		$query = sprintf("SELECT * FROM users WHERE username = '%s'", $safeuser);
-		$result = pg_exec($db, $query);
+		$db->BeginTrans();
+		#		pg_exec($db, "LOCK TABLE users");
+		$result = $db->Execute("SELECT * FROM users WHERE username=?", array($username));
 		if (!$result) {
 			$res = "Internal server error.<br/>\n";
-		} else if (pg_numrows($result) == 0) {
+		} else if ($result->RecordCount() == 0) {
 			$query = "INSERT INTO users (username, password) VALUES ('%s', '%s')";
-			pg_exec($db, sprintf($query, $safeuser, $shapass));
-			$res = "Added user $username.<br/>\n";
-			$validuser = true;
+			$ires = $db->Execute("INSERT INTO users (username, password) VALUES(?,?)",
+				array($username, $shapass));
+			if (!$ires) {
+				$res = "That username is already taken.<br/>\n";
+				$db->RollbackTrans();
+			} else {
+				$res = "Added user $username.<br/>\n";
+				$validuser = true;
+			}
 		} else {
 			$res = "That username is already taken.<br/>\n";
 		}
-		pg_exec($db, "END");
+		$db->CommitTrans();
 	}
 	docookie($username, $shapass);
 	page_head();
@@ -69,8 +74,8 @@
 		if ($newpass == "") {
 			$res = "Your new password cannot be blank.";
 		} else {
-			$query = "UPDATE users SET password = '%s' WHERE username = '%s'";
-			$result = pg_exec($db, sprintf($query, sha1($newpass), $safeuser));
+			$query = "UPDATE users SET password=? WHERE username=?";
+			$result = $db->Execute($query, array(sha1($newpass), $username));
 			if(!result) {
 				$res = "Internal server error.";
 			} else {
============================================================
--- www/proj-ctrl.php	95c69963bab767abfea870515cf888496987000a
+++ www/proj-ctrl.php	4174270cbc77848dd88cd09efec5f3f010c46ea3
@@ -18,7 +18,7 @@
 		print "parent.status(\"Error: username or password is incorrect.\");\n";
 	}
 	print "</script></head><body>File uploaded</body></html>";
-	pg_close();
+	$db->Close();
 	exit;
 } else if ($action === "upload_files") {
 	header('Content-type: text/html');
@@ -53,7 +53,7 @@
 			print "parent.status(\"" . $st . "\");";
 	} while (false);
 	print "</script></head><body>File uploaded</body></html>";
-	pg_close();
+	$db->Close();
 	exit;
 }
 
@@ -75,24 +75,22 @@
 }
 
 function maintlist() {
-	global $db, $safeproj;
+	global $db, $project;
 	$fields = "username, give, upload, homepage, access, server, description";
-	$query = sprintf("SELECT %s FROM permissions WHERE ", $fields);
-	$query = $query . "project = '%s'";
-	$result = pg_exec($db, sprintf($query, $safeproj));
+	$query = sprintf("SELECT %s FROM permissions WHERE project=?", $fields);
+	$result = $db->Execute($query, array($project));
 	$out = array();
 	if ($result) {
-		$rows = pg_numrows($result);
-		for($i = 0; $i < $rows; ++$i) {
-			$row = pg_fetch_row ($result,$i);
-			$perm['username']	= $row[0];
-			$perm['give']		= ($row[1] == 1);
-			$perm['upload']		= ($row[2] == 1);
-			$perm['homepage']	= ($row[3] == 1);
-			$perm['access']		= ($row[4] == 1);
-			$perm['server']		= ($row[5] == 1);
-			$perm['description']	= ($row[6] == 1);
+		while (!$result->EOF) {
+			$perm['username']	= $result->fields[0];
+			$perm['give']		= ($result->fields[1] == 1);
+			$perm['upload']		= ($result->fields[2] == 1);
+			$perm['homepage']	= ($result->fields[3] == 1);
+			$perm['access']		= ($result->fields[4] == 1);
+			$perm['server']		= ($result->fields[5] == 1);
+			$perm['description']	= ($result->fields[6] == 1);
 			$out[] = $perm;
+			$result->MoveNext();
 		}
 	}
 	return $out;
@@ -102,12 +100,12 @@
 
 if ($action == "new_project") {
 	if ($validuser) {
-		pg_exec($db, "BEGIN");
-		pg_exec($db, "LOCK TABLE projects, permissions");
+		$db->BeginTrans();
+		#		pg_exec($db, "LOCK TABLE projects, permissions");
 		$err = false;
 
-		$query = "SELECT * FROM projects WHERE name = '%s'";
-		$result = pg_exec($db, sprintf($query, $safeproj));
+		$result = $db->Execute("SELECT * FROM projects WHERE name=?",
+			array($project));
 		do {
 			if(!preg_match('/^[a-zA-Z0-9-]*$/D', $project)) {
 				print $json->encode(array("error" => "Only letters, numbers, and dash are allowed in a project name."));
@@ -119,7 +117,7 @@
 				print $json->encode(array("error" => "Internal server error."));
 				break;
 			}
-			if(pg_numrows($result)) {
+			if ($result->RecordCount()) {
 				print $json->encode(array("error" => "That project name is already taken."));
 				$err = true;
 				break;
@@ -128,17 +126,15 @@
 			$projwww = $www_dir . '/projects/'. $project;
 #			$query = "INSERT INTO projects (name, directory) VALUES ('%s', '%s')";
 #			$result = pg_exec($db, sprintf($query, $safeproj, '/foobar'));
-			$query = "INSERT INTO projects (name) VALUES ('%s')";
-			$result = pg_exec($db, sprintf($query, $safeproj));
+			$result = $db->Execute("INSERT INTO projects (name) VALUES (?)", array($project));
 			if(!$result) {
 				$err = true; 
 				print $json->encode(array("error" => "Internal server error."));
 				break;
 			}
 			$fields = "username, project, give, upload, homepage, access, server, description";
-			$query = sprintf("INSERT INTO permissions (%s) VALUES (%%s)", $fields);
-			$values = sprintf("'%s', '%s', 1, 1, 1, 1, 1, 1", $username, $safeproj);
-			$result = pg_exec($db, sprintf($query, $values));
+			$query = sprintf("INSERT INTO permissions (%s) VALUES (?,?,1,1,1,1,1,1)", $fields);
+			$result = $db->Execute($query, array($username, $project));
 			if(!$result) {
 				$err = true; 
 				print $json->encode(array("error" => "Internal server error."));
@@ -165,14 +161,14 @@
 			usherctrl("ADD $project");
 		} while (false);
 		if ($err)
-			pg_exec($db, "ROLLBACK");
+			$db->RollbackTrans();
 		else
 			print $json->encode(array("name" => $project));
 
-		pg_exec($db, "END");
+		$db->CommitTrans();
 	} else
 		print $json->encode(array("error" => "username or password incorrect."));
 } else
 	print $json->encode(array("error" => sprintf("'%s' not implemented.", $action)));
-pg_close($db);
+$db->Close();
 ?>
============================================================
--- www/project.php	3260a28bfd208039e33b8637a1ec5a5c4ee85dba
+++ www/project.php	02a98d34f5ed4b461542afedd2e846f980fe1731
@@ -1,12 +1,11 @@
 <?
 include_once('common.php');
 $hostname = "localhost";
 $project = basename(dirname($_SERVER['PHP_SELF']));
-$safeproj = pg_escape_string($project);
 $level = 'project';
 
 function mkfilediv() {
-	global $safeproj;
+	global $project;
 	$files = scandir("files");
 	$filediv_header = "<hr/>\n<p>"
 	. "This project has released the following files:</p>\n\n"