phpcodeigniterescapinginsert-query

CodeIgniter INSERT query emits error despite calling calling escape() on one of the values

What is the best way to escape unwanted characters in order to avoid further database syntax errors when executing insert/update queries when submitting forms?

eg. $note = $this->db->escape( $data['note'] );

INSERT query renders a further syntax error.

ie.

$this->db->query("INSERT INTO notes (note_id, note) VALUES ('$note_id','$note')");

Solution

  • as it mentioned in Codeignitier documentation when using query builder class

    All values are escaped automatically producing safer queries.

    so its safer to use query builder class for both error handling and security