EllisLab/CodeIgniter — pull request #1177 by Eclarian (2012-03-12 18:29:28+00:00)
Title: Adding Support to Properly Escape Objects that have __toString() magic method

If an object has a __toString() method when passed into the DB escape method it should treat that object as a string. Here is an example of a date object I use frequently that is just an extension of the DateTime object in PHP. (https://gist.github.com/2023695) I'd much rather just pass the object var directly to the method rather than having to call a method on the object that returns a string.

**I have not tested this on older versions of PHP** (5.1 or 5.2) or on drivers other than mysqli. I know it may be a problem in PHP 5.1 (but I think CodeIgniter is upgrading the requirement to 5.2 anyway, right?). If this is an issue, then it could probably be mitigated by typecasting the object to a string.

http://www.php.net/manual/en/language.oop5.magic.php#object.tostring
"It is worth noting that before PHP 5.2.0 the __toString() method was only called when it was directly combined with echo() or print(). Since PHP 5.2.0, it is called in any string context (e.g. in printf() with %s modifier) but not in other types contexts (e.g. with %d modifier). Since PHP 5.2.0, converting objects without __toString() method to string would cause E_RECOVERABLE_ERROR."