Hi Zinga
Thank you for the "review" and the help
It was silly of me not to do the db escape string - and I had seen it used in one of RateU's plugins as well (facepalm).
The aggregated download count is working correctly now, so thats a good thing too. I will go and do some research on adding up fields with php.
I will give it some thought on the method to select the attachments to use - its just a shame that I can't share it as it is, so I will have a go at the suggested alternative solution...one step at a time though.