Code Igniter SQL Injection and query structure (dynamic where clause with same column name)

Question

I'm trying to make sure that my code igniter query is safe from sql injection but I can't really find an example illustrating this or explaining if these parameters I'm using are escaped/bound.

$inputArray = [1,2,3,4,5];
$this->db_name->select('a_column');
$this->db_name->from('a_table');
foreach ($inputArray as $item) {
    $this->db_name->or_where('id',$item);
}

$query = $this->db_name->get();

Most importantly, are all the items that I'm checking for as a matching id from my input array bound/escaped to protect from SQL injection? If not, how should I structure it in a query like this?

I don't really care for how I've structured this query any guidance on this would be appreciated. In fact I don't really like it at all but I need to make sure I'm using query building with code igniter in such a way that it will be easily switchable to a different database system if for whatever reason I wasn't using the one I'm using now (eg. mysql to oracle) - I also realize that a where clause that simple would probably never differ and is universal if I were to just put it in with regular SQL but I'm trying to learn best practices for CI when other scenarios come up and things might be more complicated or differ between database systems and syntax.

Any help is much appreciated! Thanks.

Mark S. · Accepted Answer · 2017-06-08 18:10:27Z

1

Yes it's protected. From the CodeIgniter QueryBuilder documentation

Beyond simplicity, a major benefit to using the Query Builder features is that it allows you to create database independent applications, since the query syntax is generated by each database adapter. It also allows for safer queries, since the values are escaped automatically by the system.

edited Jun 8, 2017 at 18:10

answered Jun 8, 2017 at 18:02

Mark S.

4,0274 gold badges25 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Code Igniter SQL Injection and query structure (dynamic where clause with same column name)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related