ActiveRecord set/update/select not escaping

[eluser]DODMax[/eluser]
It happens to me too (CI 1.7.2)
I did not tested more than that but it seems in some case CI is only escaping the identifiers during the first query. May come from the driver (MySQL in my case) as it seems the escape_str() function is loaded dynamically according to the driver.

My solution was to change the columns name, however this looks like a huge security risk.
Haven't found much more resources on that