Preventing SQL Injection Attacks using Active Record

[eluser]bedanand[/eluser]
Here is the simple rule to protect against sql inject. Never use direct queries like this, instead use binded variables on sql queries.

Never do:
$query= $this->db->query('select * from users where username="'.$username.'" and password="'.$password.'"');


Should do:
$query= $this->db->query("select * from users where username=? and password=?", array($username,$password));

Here is the nice article about this.
Protect against sql-injection