EllisLab/CodeIgniter — Issue #1013: update_batch not escaping field and table names when using where()
Author: JonnoFTW
Created: 2012-02-04 09:37:56+00:00
State: open

When running this code:
```
var_dump($data);
$this->db->where('event_id',$data['event_id']);
$this->db->update_batch('results',$data['results'],'uid');
echo $this->db->last_query();
```

Output is:
```
array(2) {
["event_id"]=>
string(2) "11"
["results"]=>
array(2) {
[0]=>
array(2) {
["uid"]=>
string(36) "1beab26d-f705-11e0-a190-f46d048dfd25"
["res"]=>
string(1) "2"
}
[1]=>
array(2) {
["uid"]=>
string(36) "9dcc9e0a-bf24-11e0-838c-f46d048dfd25"
["res"]=>
string(1) "1"
}
}
}
UPDATE results SET res = CASE
WHEN uid = '1beab26d-f705-11e0-a190-f46d048dfd25' THEN '2'
WHEN uid = '9dcc9e0a-bf24-11e0-838c-f46d048dfd25' THEN '1'
ELSE res END WHERE `event_id` = '11' AND uid IN ('1beab26d-f705-11e0-a190-f46d048dfd25','9dcc9e0a-bf24-11e0-838c-f46d048dfd25')
```

The field and table names from the update_batch are not being escaped with back ticks.