Question regarding SQL injection

[eluser]Pascal Kriete[/eluser]
The function checks the type and surrounds strings with quotes. So it becomes:
system/database/DB_driver.php - line 679

Code:

UPDATE customers SET name='xyz', passwd='0;####' WHERE kid='abc';

Double and single quotes are escaped with backslashes by the native mysql_real_escape_string function (or the appropriate equivalent for your db type).

The bigger issue with your code is that you're storing passwords in plain text. So instead of the brute forcing of each user's account that you're anticipating, the hacker will do it exactly once - to get the database credentials. You should hash your passwords.