phpcodeignitersql-injection

Does CodeIgniter's query() method have injection protection?

Does $this-db->query() have MySQL injection protection? I was wondering because I use this in instances and have not done anything to protect against SQL injection attacks.

Solution

  • The ActiveRecord style of querying with CodeIgniter escapes parameters, but not query().

    You can use active record in this manner:

    $someAge = 25;
$this->db->select('names, age');
$query = $this->db->get_where('people', array('age' => '>' . $someAge));

    Read more about it here: https://www.codeigniter.com/userguide2/database/active_record.html