Fixed a bug in which identifers were not being escaped properly when reserved characters were used

1 files changed, 12 insertions, 1 deletions

diff --git a/system/database/drivers/mysqli/mysqli_driver.php b/system/database/drivers/mysqli/mysqli_driver.php
index f72db64b6..1b3da7a6b 100644
--- a/system/database/drivers/mysqli/mysqli_driver.php
+++ b/system/database/drivers/mysqli/mysqli_driver.php
@@ -425,7 +425,18 @@ class CI_DB_mysqli_driver extends CI_DB {
 		{

 			return $item;

 		}

-	

+		

+		foreach ($this->_reserved_identifiers as $id)

+		{

+			if (strpos($item, '.'.$id) !== FALSE)

+			{

+				$str = $this->_escape_char. str_replace('.', $this->_escape_char.'.', $item);  

+				

+				// remove duplicates if the user already included the escape

+				return preg_replace('/['.$this->_escape_char.']+/', $this->_escape_char, $str);

+			}		

+		}

+		

 		if (strpos($item, '.') !== FALSE)

 		{

 			$str = $this->_escape_char.str_replace('.', $this->_escape_char.'.'.$this->_escape_char, $item).$this->_escape_char;