Hi. Nice job with this contribution. Thank you very much.
I have a couple of things to mencion:
1) In some files you don't use: TABLE_TABLENAME (example: admin/auctions.php line 166 among others). May be it work just like it's now, but I'm usinAgag a DBPREFIX contribution and I've noted the TABLE_TABLENAME missing issue (I think it's more clean if the table names are taken from database_tables.php files) (If you want, I can make a list with all cases)
2) In admin/include/database_tables.php: define('TABLE_AUCTIONS_ATTRIBUTES','auctions_attributes'); is missing.
3) In admin/auctions.php, in 'update' case the overbid mount remains (it's not update). It's that ok? I can't see the reason for this (yet).
Adding:
$overbid_amount = tep_db_prepare_input($HTTP_POST_VARS['overbid_amount']);
...
tep_db_query("update " ... overbid_amount = '" . tep_db_input($overbid_amount) . "' ....);
works fine
Again, thank you very much. Let me know if you want I detail the 1er point