[eluser]Zigson[/eluser]
I have played a bit with queries which could perform SQL injection.
I would say that it is safe to code with query bindings or active record functions (not all of them, see the documentation) because they automatically escape values.
Nevertheless, my inserted value in database is:
Test ” ’ test
And the code:
Code:
$data = array(
'some_value' => $this->input->post('some_value'),
$this->db->insert($this->db->table, $data);
I did not use htmlentities() or htmlspecialchars().