Escaping SQL queries in Codeigniter
activerecord, codeigniter, mysql, php
Solution
Another way is to use Query Binding which automatically escapes all the values:
$sql = "INSERT IGNORE INTO my_table(lat, lng, date, type) VALUES (?,?,?,?);";
$this->db->query($sql, array($data['lat'], $data['lng'], $data['date'], $data['type']));
Problem
I am inserting some data into a MySQL table using CodeIgniter. Because I am using `INSERT IGNORE INTO` and do not want to edit the active records class to enable this feature, I am generating the SQL query manually. ``` $this->db->query("INSERT IGNORE INTO my_table(lat, lng, date, type) VALUES ('" . $data['lat'] . "', '" . $data['lng'] . "', '" . $data['date'] . "', '" . $data['type'] . "')"); ``` Problem: The query failed when the string in `$data['type']` contained a single quote. How can I make it such that these characters that need to be escaped gets escaped automatically, like when using Active records?