Welcome Guest, Not a member yet? Register   Sign In
CodeIgniter - escaping values before inserting in database - single quotes issue
#10

[eluser]Zigson[/eluser]
I have played a bit with queries which could perform SQL injection.

I would say that it is safe to code with query bindings or active record functions (not all of them, see the documentation) because they automatically escape values.

Nevertheless, my inserted value in database is:
Test ” ’ test

And the code:

Code:
$data = array(
    'some_value' => $this->input->post('some_value'),

$this->db->insert($this->db->table, $data);

I did not use htmlentities() or htmlspecialchars().


Messages In This Thread
CodeIgniter - escaping values before inserting in database - single quotes issue - by El Forum - 10-15-2014, 02:51 PM



Theme © iAndrew 2016 - Forum software by © MyBB