Security issue

[eluser]nebulom[/eluser]
I don't know. I tried typing "hello' world" and it still fires the error. Here's without the escape

UPDATE "EES_BPC_DISC" SET "LAST_UPDATE_DATE" = sysdate, "COMMENTS" = 'hello' world', "LAST_UPDATE_BY" = 'EES_ADMIN' WHERE "ID" = '1'

and with

Code:

$data = array(
            'COMMENTS' => $this->db->escape($this->input->post('comments')),
            'LAST_UPDATE_BY' => $this->session->userdata('username')
        );

UPDATE "EES_BPC_DISC" SET "LAST_UPDATE_DATE" = sysdate, "COMMENTS" = ''hello' world'', "LAST_UPDATE_BY" = 'EES_ADMIN' WHERE "ID" = '1'

I'm with oci8. Does that count? Thanks.