Escape arrays sent as binding values for database queries.

1 files changed, 6 insertions, 1 deletions

diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php
index 62cea758e..094356965 100644
--- a/system/database/DB_driver.php
+++ b/system/database/DB_driver.php
@@ -992,7 +992,12 @@ abstract class CI_DB_driver {
 	 */
 	public function escape($str)
 	{
-		if (is_string($str) OR (is_object($str) && method_exists($str, '__toString')))
+		if (is_array($str))
+		{
+			$str = array_map(array(&$this, 'escape'), $str);
+			return '('.implode(',', $str).')';
+		}
+		elseif (is_string($str) OR (is_object($str) && method_exists($str, '__toString')))
 		{
 			return "'".$this->escape_str($str)."'";
 		}