How to automatically escape values used into CodeIgniter's query() method

Question

Before anything else, I know that Active Record automatically escapes all queries by it and that there is a method for manually escaping SQL.

$this->db->escape()

The problem is that I am using raw sql queries sometimes

$sql = "...."
$this->db->query($sql);

but I don't want to manually call the CI escape function each time I do it.

Is there a way to make CI automatically escape all queries passed to it? A config that can be set maybe?

Eric T · Accepted Answer · 2012-08-16 03:39:51Z

2

You may consider using the Query Bind which is at the bottom of the url. Try to practice binding queries it is faster and cleaner way of doing.

Bind Queries Example:

$sql = "SELECT * FROM some_table WHERE id = ? AND price = ?"; 

$this->db->query($sql, array(3, 100));

Note** with binding method it is always automatically escape.

answered Aug 16, 2012 at 3:39

Eric T

1,0264 gold badges20 silver badges42 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1