Actually that's not it.... Here are the changes

Around line 829 find
Code:
mysql_real_escape_string($country_name));
change to
Code:
zen_db_input($country_name));
Then around line 856 find
Code:
mysql_real_escape_string($country_id),
mysql_real_escape_string($state_name));
Change to
Code:
zen_db_input($country_id),
zen_db_input($state_name));
~Melanie