bcit-ci/CodeIgniter — pull request #3277 by clawoo (2014-10-18 11:58:25+00:00)
Title: Escape arrays sent as binding values for database queries.

Escape arrays sent as binding values for database queries.

Example: trying to select rows from a table where the id is in a given array. In plain SQL this would be:

SELECT * FROM builds WHERE id IN (1, 2, 3);

Trying to do this using binding values results into an error:

$ids = array(1, 2, 3);
$this->db->query("SELECT * FROM builds WHERE id IN ?", array($ids));

Result:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

SELECT * FROM builds WHERE id IN 1

My change will check in `DB_Driver::escape` whether the given parameter is an array. If it is, it will walk the array with `DB_Driver::escape` for each element, therefore escaping it. Finally, it will return the escaped value as "(escaped_id1, escaped_id2, escaped_id3)"

Result:

SELECT * FROM builds WHERE id IN (1,2,3)

This also works for string values:

$ids = array('1', '2', '3');
$this->db->query("SELECT * FROM builds WHERE id IN ?", array($ids));

Result:

SELECT * FROM builds WHERE id IN ('1','2','3')