I've reported this issue to stamps.com (and included the suggested correction). There are 3 areas to be changed:
Line 776:
Code:
                $comments = /*mysql_escape_string($_REQUEST['comments'])*/ $db->prepare_input ($_REQUEST['comments']);  //-20150917-lat9  *** 1 of 3 ***
Line 828
Code:
                                /*mysql_real_escape_string($country_name)*/ $db->prepare_input ($country_name));  //-20150917-lat9  *** 2 of 3 ***
Lines 854-856
Code:
                $qry = sprintf("select zone_code from ". TABLE_ZONES. " where zone_country_id = '%s' and zone_name = '%s'",
                                /*mysql_real_escape_string($country_id)*/ $db->prepare_input ($country_id),
                                /*mysql_real_escape_string($state_name)*/ $db->prepare_input ($state_name));  //-20150917-lat9  *** 3 of 3 ***