prevent database update when no where statement found

[eluser]a&w[/eluser]
Ok, thanks. I appreciate your insight.

For me, I guess I'd like to error on the conservative side. I can still update without the where just by setting that property accordingly. Kind of like how you can switch protect identifiers on/off.

As it turns out just returning the empty string for sql works to kill that query, but doesn't work with transactions. An empty sql '' statement throws a debug message only, it won't set the transaction status to false, so the transaction still goes through.

That is unexpected or maybe a bug? I mean if it threw an error message with an invalid query I would think that would merit not committing the transaction, no?

circa line 244 of DB_driver.php

Code:

if ($sql == '')
        {
            if ($this->db_debug)
            {
                log_message('error', 'Invalid query: '.$sql);
                return $this->display_error('db_invalid_query');
            }
            return FALSE;
        }

....
        // Run the Query
        if (FALSE === ($this->result_id = $this->simple_query($sql)))
        {
            if ($this->save_queries == TRUE)
            {
                $this->query_times[] = 0;
            }
        
            // This will trigger a rollback if transactions are being used
            $this->_trans_status = FALSE;

I think that first if block should set the transaction status to false.