Model::update() is dangerous

There is no good solution for this for now. Any change would be a BC break.
Developers may use composite keys with the model.

PHP Code:

$model->where(['key1' => 'value1', 'key2' => 'value2'])->update(null, $data); 


I believe this was a design choice.

---

Whether we like the current model behavior or not, the code presented here and in the repo lacks any basic checks in update() / postUpdate() method:

• why is null/false acceptable as a value at all?
  
• I can perform an update query on every single row in the table without checking if row exists or not.
  

Meanwhile, the code responsible for showing the view: getEdit() has these checks. There should be no difference when validating the $id for getEdit() and postUpdate().

I get your reasoning with update(null, $data), but the real danger here is poorly-written code, not the framework. In this case, simple value validation for $id would solve all the problems.

michalsn.dev - mostly about CodeIgniter