is it safe to use $this->db->query($sql);

Another solution too (automactically protected):

PHP Code:

$sql = "INSERT INTO tbl_employee (firstname, secondname, age) VALUES(?, ?,?)";
 $query = $this->db->query($sql, array('firstname' => $var1, 'secondname' => $var2, 'age' => $var3));