diff --git a/model/AliasHandler.php b/model/AliasHandler.php
index 5ca9c3b5..aaafd91e 100644
--- a/model/AliasHandler.php
+++ b/model/AliasHandler.php
@@ -7,16 +7,22 @@ class AliasHandler {
 
     private $username = null;
 
+
+# TODO: implement a "delete" method. Pseudocode:
+# - check if alias exists
+# - check if mailbox exists - if yes, error out (never delete the alias of a mailbox!)
+# - (if still here) delete alias
+
     /**
      * @param string $username
      */
     public function __construct($username) {
-        $this->username = $username;
+        $this->username = strtolower($username);
     }
 
     /**
      * @return array - list of email addresses the user's mail is forwarded to.
-     * (may be an empty list, especially if $CONF['alias_control'] is turned off...
+     * (may be an empty list, especially if $CONF['alias_control'] is turned off...)
      * @param boolean - by default we don't return special addresses (e.g. vacation and mailbox alias); pass in true here if you wish to.
      */
     public function get($all=false) {
@@ -25,41 +31,46 @@ class AliasHandler {
 
         $sql = "SELECT * FROM $table_alias WHERE address='$username'";
         $result = db_query($sql);
-        if($result['rows'] == 1) {
+        if($result['rows'] != 1) {
+            return false;
+        }
+
+# TODO: whitespace fix: move ~20 lines below one step left
             $row = db_array ($result['result']);
             // At the moment Postfixadmin stores aliases in it's database in a comma seperated list; this may change one day.
             $list = explode(',', $row['goto']);
             if($all) {
-                return $list;
+                $this->return = $list;
+                return true;
             }
 
-            $new_list = array();
+            $filtered_list = array();
             /* if !$all, remove vacation & mailbox aliases */
             foreach($list as $address) {
                 if($address != '' ) {
                     if($this->is_vacation_address($address) || $this->is_mailbox_alias($address)) {
+                        # TODO: store "vacation_active" and "mailbox" status - should be readable public
                     }
                     else {
-                        $new_list[] = $address;
+                        $filtered_list[] = $address;
                     }
                 }
             }
-            $list = $new_list;
-            $this->return = $list;
+            $this->return = $filtered_list;
             return true;
-        }
-        return false;
     }
 
    /** 
     * @param string $address
     * @param string $username
     * @return boolean true if the username is an alias for the mailbox AND we have alias_control turned off.
+    * TODO: comment for @return: does alias_control really matter here?
     */
     public function is_mailbox_alias($address) {
         global $CONF;
         $username = $this->username;
         if($address == $username) {
+            # TODO: check (via SQL query) if there is really a mailbox with this address
             return true;
         }
         return false;
@@ -72,7 +83,7 @@ class AliasHandler {
     public function is_vacation_address($address) {
         global $CONF;
         if($CONF['vacation'] == 'YES') {
-            if(stripos($address, '@' . $CONF['vacation_domain'])) {
+            if(stripos($address, '@' . $CONF['vacation_domain'])) { # TODO: check full vacation address user#domain.com@vacation_domain
                 return true;
             }
         }
@@ -84,24 +95,26 @@ class AliasHandler {
      * @param array $addresses - list of aliases to set for the user.
      * @param string flags - forward_and_store or remote_only or ''
      * @param boolean $vacation_persist - set to false to stop the vacation address persisting across updates
-     * Set the user's aliases to those provided. If $addresses ends up being empty the alias record is removed.
+     * Set the user's aliases to those provided. If $addresses ends up being empty the alias record is removed. # TODO: deleting that's buggy behaviour, error out instead
      */
     public function update($addresses, $flags = '', $vacation_persist=true) {
         // find out if the user is on vacation or not; if they are, 
         // then the vacation alias needs adding to the db (as we strip it out in the get method) 
         // likewise with the alias_control address.
 
+        # TODO: move all validation from edit-alias/create-alias and users/edit-alias here
+
         $valid_flags = array('', 'forward_and_store', 'remote_only');
         if(!in_array($flags, $valid_flags)) {
             die("Invalid flag passed into update()... : $flag - valid options are :" . implode(',', $valid_flags));
         } 
         $addresses = array_unique($addresses);
 
-        $original = $this->get(true);
-		$tmp = preg_split('/@/', $this->username);
-		$domain = $tmp[1];
+		list (/*NULL*/, $domain) = explode('@', $this->username);
+
+        if ( ! $this->get(true) ) die("Alias not existing?"); # TODO: better error behaviour
 
-        foreach($original as $address) {
+        foreach($this->return as $address) {
             if($vacation_persist) {
                 if($this->is_vacation_address($address)) {
                     $addresses[] = $address;
@@ -117,7 +130,7 @@ class AliasHandler {
 
         $new_list = array();
         if($flags == 'remote_only') {
-            foreach($addresses as $address) {
+            foreach($addresses as $address) { # TODO: write a remove_from_array function, see http://tech.petegraham.co.uk/2007/03/22/php-remove-values-from-array/
                 // strip out our username... if it's in the list given.
                 if($address != $this->username) {
                     $new_list[] = $address;            
@@ -134,29 +147,40 @@ class AliasHandler {
         $new_list = array();
         foreach($addresses as $address) {
             if($address != '') {
-                $new_list[] = $address;
+                $new_list[] = $address; # TODO use remove_from_array, see above
             }
         } 
         $addresses = array_unique($new_list);
-        $username = escape_string($this->username);
-        $goto = escape_string(implode(',', $addresses));
-        $table_alias = table_by_key('alias');
+        $E_username = escape_string($this->username);
+        $goto = implode(',', $addresses);
+#        $table_alias = table_by_key('alias');
         if(sizeof($addresses) == 0) {
-            $sql = "DELETE FROM $table_alias WHERE address = '$username'"; # TODO: should never happen
-            error_log("Alias set to empty / deleted: $username"); # TODO: more/better error handling - maybe just return false?
+            # $result = db_delete('alias', 'address', $this->username); # '"DELETE FROM $table_alias WHERE address = '$username'"; # TODO: should never happen and causes broken behaviour
+            error_log("Alias set to empty / Attemp to delete: " . $this->username); # TODO: more/better error handling - maybe just return false?
         }
-        if($this->hasAliasRecord() == false) {
+        if($this->hasAliasRecord() == false) { # TODO should never happen in update() - see also the comments on handling DELETE above
             $true = db_get_boolean(True);
-			$sql = "INSERT INTO $table_alias (address, goto, domain, created, modified, active) VALUES ('$username', '$goto', '$domain', NOW(), NOW(), '$true')";
+            $alias_data = array(
+                'address'   => $this->username,
+                'goto'      => $goto,
+                'domain'    => $domain,
+                'active'    => db_get_boolean(True),
+            );
+            $result = db_insert('alias', $alias_data);
+#			$sql = "INSERT INTO $table_alias (address, goto, domain, created, modified, active) VALUES ('$username', '$goto', '$domain', NOW(), NOW(), '$true')";
+#            $result = db_query($sql);
         }
         else {
-            $sql = "UPDATE $table_alias SET goto = '$goto', modified = NOW() WHERE address = '$username'";
+            $alias_data = array(
+                'goto' => $goto,
+            );
+            $result = db_update('alias', "address = '$E_username'", $alias_data);
+#            $sql = "UPDATE $table_alias SET goto = '$goto', modified = NOW() WHERE address = '$username'";
         }
-        $result = db_query($sql);
-        if($result['rows'] != 1) {
+        if($result != 1) {
             return false;
         }
-        db_log($username, $domain, 'edit_alias', "$username -> $goto");
+        db_log($this->username, $domain, 'edit_alias', "$E_username -> $goto");
         return true;
     }
 
@@ -166,8 +190,8 @@ class AliasHandler {
      * @return boolean true if local delivery is enabled
      */
     public function hasStoreAndForward() {
-        $aliases = $this->get(true);
-        if(in_array($this->username, $aliases)) {
+        $result = $this->get(true); # TODO: error checking?
+        if(in_array($this->username, $this->return)) {
             return true;
         }
         return false;