How to avoid SQL injection in CodeIgniter?
CodeIgniter’s Active Record methods automatically escape queries for you, to prevent sql injection. $this->db->select(‘*’)->from(‘tablename’)->where(‘var’, $val1); $this->db->get(); or $this->db->insert(‘tablename’, array(‘var1’=>$val1, ‘var2’=>$val2)); If you don’t want to use Active Records, you can use query bindings to prevent against injection. $sql=”SELECT * FROM tablename WHERE var = ?”; $this->db->query($sql, array($val1)); Or for inserting you can use the insert_string() … Read more