mpick/codeigniter_Bloggy — Issue #6: Database queries are not escaped
Author: dwightwatson
Created: 2011-11-12 04:37:14+00:00
State: open

For example, in blog_model.php:

```php
$query = $this->db->query("SELECT idblogentry,title,titleurl,subtitle,entrydate,active,note
FROM blogentry
WHERE active = 1 {$where}
ORDER BY entrydate DESC");
```

Should bind variables to the query or use Active Recaord.