Welcome Guest, Not a member yet? Register   Sign In
Escape string before inserting in a query
#1

(This post was last modified: 06-06-2018, 08:13 AM by glorsh66.)

I  know that when you are using CI query builder you don't need care about it, because CI automatically escapes strings for you.

But what if i need to use my own SQL query (which is not possible to build using query builder, or it's possible but only by taking really convoluted and strage ways)

for instance (it can be much more complicated, it is just an example) 

Code:
$query = $this->db->query("SELECT * FROM `PM_board` WHERE `lesser_id` ={$owner}
UNION
SELECT * FROM `PM_board` WHERE `greater_id` = {$owner}");
I am using this query for Index optimization, because a built in mysql operator OR don't properly use indexes.


How do I protect myself from MySQL injection in this case?
What function do I need to use on $owner to escape all dangerous symbols.
But I don't want to distort string representation. I don't want to change HTML entities, only to escape string.
Reply


Messages In This Thread
Escape string before inserting in a query - by glorsh66 - 06-06-2018, 08:11 AM



Theme © iAndrew 2016 - Forum software by © MyBB