How to avoid SQL injection in CodeIgniter?

by

CodeIgniter’s Active Record methods automatically escape queries for you, to prevent sql injection.

$this->db->select('*')->from('tablename')->where('var', $val1);
$this->db->get();

or

$this->db->insert('tablename', array('var1'=>$val1, 'var2'=>$val2));

If you don’t want to use Active Records, you can use query bindings to prevent against injection.

$sql="SELECT * FROM tablename WHERE var = ?";
$this->db->query($sql, array($val1));

Or for inserting you can use the insert_string() method.

$sql = $this->db->insert_string('tablename', array('var1'=>$val1, 'var2'=>$val2));
$this->db->query($sql);

There is also the escape() method if you prefer to run your own queries.

$val1 = $this->db->escape($val1);
$this->db->query("SELECT * FROM tablename WHERE var=$val1");

More Related Contents:

  1. How to create a custom EL function to invoke a static method?
  2. “Parameter” vs “Argument” [duplicate]
  3. Passing external function of multiple variables as a function of one variable in Fortran
  4. Procedure with assumed-shape dummy argument must have an explicit interface [duplicate]
  5. Is there a way to use two ‘…’ statements in a function in R?
  6. Jump to function definition
  7. How to alias a function name in Fortran
  8. Parenthesis Powershell functions
  9. How to deal with name/value pairs of function arguments in MATLAB
  10. How to compose `not` with a function of arbitrary arity?
  11. Uses for Haskell id function
  12. Exporting a function in shell
  13. D3 Key Function
  14. Is there a way to get a vector with the name of all functions that one could use in R?
  15. F# generics / function overloading syntax
  16. How to correct “Function definitions are not permitted at the prompt or in scripts”
  17. What are the differences between functions and methods in Swift?
  18. Override a function that is imported in a namespace
  19. Haskell operator vs function precedence
  20. Scala Functional Literals with Implicits
  21. Does dart support operator overloading
  22. Eta-expansion between methods and functions with overloaded methods in Scala
  23. Return multiple values from a function in swift
  24. Why can’t ‘kotlin.Result’ be used as a return type?
  25. How many lines of code should a function/procedure/method have? [duplicate]
  26. How to evaluate functions in GDB?
  27. Proper use of modules in Fortran
  28. Matlab ode45. How to change a parameter inside it while calling it?
  29. How do you strip the unit from any number in SASS?
  30. In R, what exactly is the problem with having variables with the same name as base R functions?

Leave a Comment